Privacy Policy — Edge / OpenStrap
- Last updated: July 27, 2026
+ Last updated: August 18, 2026
Edge ("the App") is an independent, open-source project. It is not affiliated
with, sponsored by, or endorsed by WHOOP, Inc.
@@ -66,6 +66,38 @@ Anonymous diagnostics
Google's Firebase privacy & security documentation:
firebase.google.com/support/privacy.
+ Barcode lookup for food logging
+ The food log can read a barcode with the camera and fill in the nutrition
+ figures for you. Doing that means asking a database, so it is off
+ until you turn it on, and the App asks you before the first
+ lookup ever happens — not after.
+
+ - What is sent is the barcode. It goes to
+ openfoodfacts.org, the free and open food database. Nothing about you,
+ your meals, your health or your device goes with it. Like any network
+ request it discloses your IP address to them.
+ - Only when you scan. There is no background lookup, no
+ batch and no pre-fetch.
+ - A barcode you have scanned before is answered from your own
+ phone. The App keeps a local copy of what it has fetched, so
+ re-scanning the same packet asks nobody anything.
+ - The camera reads digits and nothing else. No photo is
+ taken, stored or sent. Declining camera access leaves the rest of the
+ food log working.
+ - Everything still works with it off. Typing the
+ numbers off the pack was always the way in and still is.
+
+ You can turn it off at any time in Settings › Privacy ›
+ “Look barcodes up online”, and the App then makes no
+ food-related network request at all.
+ Their data is contributed by the public, is licensed under the
+ Open Database
+ License, and their own terms say it must not be used for medical
+ purposes. So a scanned figure is treated as something you typed rather
+ than something the App measured: anything that fails a basic plausibility
+ check is left blank instead of filled in, and every filled box is yours to
+ edit before you save.
+
Location and workout routes
If you record a run, ride or walk, the App uses your device's location to
draw that workout's route. This is the most sensitive permission the App
@@ -112,7 +144,13 @@
Optional, user-initiated integrations
your own API key.
Health app integration — if you enable it, the App can
write derived daily metrics to Apple Health or Google Health Connect, which
- are controlled by your device's own OS-level health app, not by us.
+ are controlled by your device's own OS-level health app, not by us. The App
+ can also read from that same health app when you tap an import —
+ your height, weight, date of birth and sex, your resting heart rate, blood
+ pressure, blood glucose and body temperature readings, and your workouts and
+ their routes. Every import is something you start by hand, never a background
+ sync, and what it reads stays on your device: reading from your health app
+ sends nothing anywhere.
What we don't do
@@ -126,7 +164,9 @@ Your controls
integration at any time in Settings if you'd previously turned them on. If
you explicitly installed a GitHub release and enabled health data
contribution, you can disable that feature at any time from the app's
- settings.
+ settings. Barcode lookup for the food log is off by default and can be
+ turned off again at any time in Settings › Privacy ›
+ “Look barcodes up online”.
Uninstalling the App deletes all of your locally stored data immediately.
That's the whole picture unless you had separately enabled one of
diff --git a/guides/TASKER_INTEGRATION.md b/guides/TASKER_INTEGRATION.md
index 71db8336..53e5dfa2 100644
--- a/guides/TASKER_INTEGRATION.md
+++ b/guides/TASKER_INTEGRATION.md
@@ -1,4 +1,4 @@
-# Tasker integration — buzz your strap
+# Tasker integration — buzz your strap, and hear back
OpenStrap Edge can vibrate your WHOOP strap in response to a Broadcast intent
from Tasker (or any automation app). Use it to buzz the strap for phone calls,
@@ -60,6 +60,43 @@ omitted. `pattern:1` buzzes until acked by tapping the strap, which makes it
ideal for phone-call notifications. See [BUZZ_MEANINGS.md](BUZZ_MEANINGS.md)
for the full list.
+## The other direction: OpenStrap tells Tasker
+
+**Android only.** iOS does not get this and is not going to: a Shortcuts
+personal automation can only trigger on a fixed system list of events, and
+there is no public mechanism for an app to add one. Donating an intent buys
+Siri suggestions and discoverability, not a trigger. So on iOS you get more
+things *you* can invoke; you do not get events that invoke *your* shortcut.
+
+One event ships today. When an offload from the strap finishes, the app sends
+a broadcast:
+
+| Field | Value |
+|---|---|
+| Action | `wtf.openstrap.openstrap_edge.SYNC_COMPLETE` |
+| Extra `records` | int — how many records that sync stored |
+| Extra `at` | int — unix seconds when it finished |
+
+Catch it with a Tasker Profile → **Event → System → Intent Received**, with
+Action set to the string above. Leave Package empty.
+
+Rate-limited to one outbound event a minute, so a reconnect storm cannot spam
+your profile.
+
+### What the extras deliberately do not contain
+
+No token. This is an implicit broadcast, so anything on your phone can read
+the extras — putting your buzz token in there would hand every installed app
+the ability to buzz your strap, which is the one thing that token exists to
+stop. There is nothing to protect in this direction: the worst a forged
+`SYNC_COMPLETE` can do is run your own profile early.
+
+No readiness, no recovery, no strain, no sleep. Those numbers are sometimes
+*absent* — not zero, absent, with a reason attached — and the app shows you
+which. Once a number leaves the app that context is gone, and a Shortcut that
+received `readiness=0` would have no way to tell "you scored zero" from "we
+did not measure it". Only facts about the sync itself go out.
+
## Troubleshooting
- Rapid repeat broadcasts are rate-limited (about 1.5 s between accepted
diff --git a/ios/OpenStrapIntents.swift b/ios/OpenStrapIntents.swift
index d4915e81..f742cfc7 100644
--- a/ios/OpenStrapIntents.swift
+++ b/ios/OpenStrapIntents.swift
@@ -14,40 +14,72 @@ import Foundation
enum OpenStrapShared {
static var appGroup: String {
Bundle.main.object(forInfoDictionaryKey: "OpenStrapAppGroupIdentifier") as? String
- ?? "group.wtf.openstrap"
+ // Same fallback as AppGroup.swift and WidgetService.fallbackAppGroupId:
+ // the build-configured default (ios/Config/Signing.defaults.xcconfig).
+ // Three different fallbacks for one group meant that if Info.plist ever
+ // went missing, Siri and the widget would read different suites.
+ ?? "group.com.example.openstrap"
}
static func defaults() -> UserDefaults? { UserDefaults(suiteName: appGroup) }
- static var hasData: Bool { defaults()?.bool(forKey: "has_data") ?? false }
+ /// `has_data` is the phone saying the snapshot is non-empty and describes a
+ /// recent day — but it is a bool frozen when the phone last pushed, so on a
+ /// phone that stopped syncing it stays true forever. Siri answers in the
+ /// present tense, so it ages `updated_at` here, at answer time.
+ ///
+ /// Same 26 h and same reasoning as `kStaleAfter` in
+ /// ios/OpenStrapWidget/OpenStrapWidget.swift and WatchMetrics.swift —
+ /// separate build targets, so it cannot be one declaration.
+ static let staleAfter: TimeInterval = 26 * 3600
+
+ static var hasData: Bool {
+ guard defaults()?.bool(forKey: "has_data") ?? false else { return false }
+ let at = defaults()?.object(forKey: "updated_at") as? Int ?? 0
+ // An unknown timestamp is not a claim of staleness.
+ return at <= 0 || Date().timeIntervalSince1970 - Double(at) <= staleAfter
+ }
static var readiness: Int { defaults()?.object(forKey: "readiness") as? Int ?? -1 }
+ /// The phone's own band label, published as `readiness_band` (thresholds:
+ /// `readinessBand` in lib/ui2/screens/home_screen.dart). Siri used to carry a
+ /// fourth private copy of the cut-offs, so it called 65 "moderate" while the
+ /// phone said "Steady" and the widget drew orange.
+ static var readinessBand: String { defaults()?.string(forKey: "readiness_band") ?? "" }
static var strain: Double { defaults()?.object(forKey: "strain") as? Double ?? -1 }
static var hrv: Int { defaults()?.object(forKey: "hrv") as? Int ?? -1 }
static var rhr: Int { defaults()?.object(forKey: "rhr") as? Int ?? -1 }
static var sleepMin: Int { defaults()?.object(forKey: "sleep_min") as? Int ?? -1 }
+ /// Spoken, so it is words rather than the phone's "7h 05m" — but a 45-minute
+ /// nap is not "0 hours 45 minutes".
static var sleepText: String {
guard sleepMin >= 0 else { return "no sleep data yet" }
- return "\(sleepMin / 60) hours \(sleepMin % 60) minutes"
+ let h = sleepMin / 60, m = sleepMin % 60
+ if h == 0 { return "\(m) minutes" }
+ if m == 0 { return h == 1 ? "1 hour" : "\(h) hours" }
+ return "\(h) \(h == 1 ? "hour" : "hours") \(m) minutes"
}
- static var noData: String { "I don't have today's numbers yet. Open OpenStrap and sync your strap." }
+ static var noData: String { "I don't have today's numbers yet. Open OpenStrap and sync your band." }
}
// MARK: - Intents
@available(iOS 16.0, *)
struct RecoveryIntent: AppIntent {
- static var title: LocalizedStringResource = "Check Recovery"
- static var description = IntentDescription("Ask OpenStrap for today's recovery.")
+ static var title: LocalizedStringResource = "Check Readiness"
+ static var description = IntentDescription("Ask OpenStrap for today's readiness.")
static var openAppWhenRun = false
func perform() async throws -> some IntentResult & ProvidesDialog {
guard OpenStrapShared.hasData, OpenStrapShared.readiness >= 0 else {
return .result(dialog: IntentDialog(stringLiteral: OpenStrapShared.noData))
}
- let r = OpenStrapShared.readiness
- let tier = r < 34 ? "Take it easy today." : (r < 67 ? "A moderate day looks good." : "You're primed to push.")
- return .result(dialog: "Your recovery is \(r) percent. \(tier)")
+ // "Readiness, out of 100" — the app's own name and unit. It is not a
+ // percentage and it is not called Recovery anywhere else in the product.
+ let band = OpenStrapShared.readinessBand
+ let line = "Your readiness is \(OpenStrapShared.readiness) out of 100."
+ return .result(dialog: IntentDialog(
+ stringLiteral: band.isEmpty ? line : "\(line) \(band)."))
}
}
@@ -111,11 +143,12 @@ struct OpenStrapShortcuts: AppShortcutsProvider {
AppShortcut(
intent: RecoveryIntent(),
phrases: [
+ "\(.applicationName) readiness",
+ "What's my readiness in \(.applicationName)",
"\(.applicationName) recovery",
- "What's my recovery in \(.applicationName)",
"How recovered am I in \(.applicationName)",
],
- shortTitle: "Recovery",
+ shortTitle: "Readiness",
systemImageName: "bolt.heart")
AppShortcut(
diff --git a/ios/OpenStrapWatch Watch App/OpenStrapWatchApp.swift b/ios/OpenStrapWatch Watch App/OpenStrapWatchApp.swift
index f34456e9..be7444b9 100644
--- a/ios/OpenStrapWatch Watch App/OpenStrapWatchApp.swift
+++ b/ios/OpenStrapWatch Watch App/OpenStrapWatchApp.swift
@@ -1,9 +1,9 @@
-// Edge Watch App — the on-wrist glance for today's recovery, strain and sleep.
+// OpenStrap Watch App — the on-wrist glance for today's readiness, strain and sleep.
//
// Read-only mirror of the phone's derived metrics (received over WCSession by
-// WatchStore). Styled to match the phone app: "Ember on Paper" (light) / "Char"
-// (dark), tracking the app's own theme via the `theme_dark` flag it syncs. No
-// compute, no BLE — the WHOOP band is the sensor and the phone does the analytics.
+// WatchStore). Styled to match the phone app: it spends lib/ui2/theme.dart's
+// tokens, tracking the app's own theme via the `theme_dark` flag it syncs. No
+// compute, no BLE — the band is the sensor and the phone does the analytics.
import SwiftUI
@@ -21,7 +21,7 @@ struct OpenStrapWatchApp: App {
}
}
-// MARK: - Palette (mirrors lib/theme/tokens.dart — Ember on Paper / Char)
+// MARK: - Palette (mirrors lib/ui2/theme.dart)
extension Color {
init(hex: UInt32) {
@@ -34,34 +34,61 @@ extension Color {
}
}
+/// ui2's raw pigment (`C` in lib/ui2/theme.dart). Arcs and fills only — an
+/// accent used as TEXT goes through the solved `on*` members of `Palette`,
+/// which are `P.on()`'s output for this brightness.
+enum C {
+ static let green = Color(hex: 0x22C55E)
+ static let orange = Color(hex: 0xF97316)
+ static let red = Color(hex: 0xEF4444)
+ static let blue = Color(hex: 0x3B82F6) // sleep
+ static let purple = Color(hex: 0x8B5CF6) // strain / movement
+ static let n400 = Color(hex: 0x94A3B8)
+}
+
struct Palette {
let bg, surface, surfaceAlt, divider: Color
let ink, inkSoft, inkMuted: Color
- let coral, coralSoft, coralInk: Color
- let good, warn, bad, cool: Color
-
- static let ember = Palette(
- bg: Color(hex: 0xF4F1EC), surface: Color(hex: 0xFFFFFF),
- surfaceAlt: Color(hex: 0xECE7DF), divider: Color(hex: 0xE6E0D6),
- ink: Color(hex: 0x16130F), inkSoft: Color(hex: 0x6B6157), inkMuted: Color(hex: 0xA59C90),
- coral: Color(hex: 0xFF5A36), coralSoft: Color(hex: 0xFFE7DF), coralInk: Color(hex: 0x7A2A16),
- good: Color(hex: 0x2BB673), warn: Color(hex: 0xF5A623), bad: Color(hex: 0xE5484D),
- cool: Color(hex: 0x7CA8F0))
-
- static let char = Palette(
- bg: Color(hex: 0x14110D), surface: Color(hex: 0x1E1A15),
- surfaceAlt: Color(hex: 0x2A251F), divider: Color(hex: 0x302A22),
- ink: Color(hex: 0xF1ECE3), inkSoft: Color(hex: 0xB6AB9C), inkMuted: Color(hex: 0x7E7466),
- coral: Color(hex: 0xFF6B47), coralSoft: Color(hex: 0x3A2018), coralInk: Color(hex: 0xFFB59E),
- good: Color(hex: 0x34C988), warn: Color(hex: 0xF7B53A), bad: Color(hex: 0xF26168),
- cool: Color(hex: 0x8FB4F2))
-
- func recovery(_ tier: Int) -> Color {
+ /// `P.on(C.green)` + `P.wash(C.green)` — the Home accent as text, and the
+ /// tinted card it sits on.
+ let onHome, homeWash: Color
+ /// Tier accents as TEXT (`P.on`).
+ let onGood, onWarn, onBad, onNone: Color
+
+ static let light = Palette(
+ bg: Color(hex: 0xF8FAFC), surface: Color(hex: 0xFFFFFF),
+ surfaceAlt: Color(hex: 0xF1F5F9), divider: Color(hex: 0xE2E8F0),
+ ink: Color(hex: 0x0F172A), inkSoft: Color(hex: 0x475569), inkMuted: Color(hex: 0x627188),
+ onHome: Color(hex: 0x1A7948), homeWash: Color(hex: 0xE7F9ED),
+ onGood: Color(hex: 0x1A7948), onWarn: Color(hex: 0xA5521D),
+ onBad: Color(hex: 0xB9393E), onNone: Color(hex: 0x606B80))
+
+ static let dark = Palette(
+ bg: Color(hex: 0x0B1017), surface: Color(hex: 0x151C26),
+ surfaceAlt: Color(hex: 0x1D2632), divider: Color(hex: 0x232D3B),
+ ink: Color(hex: 0xF1F5F9), inkSoft: Color(hex: 0x94A3B8), inkMuted: Color(hex: 0x7F8DA0),
+ onHome: Color(hex: 0x22C55E), homeWash: Color(hex: 0x173A30),
+ onGood: Color(hex: 0x22C55E), onWarn: Color(hex: 0xF87F2A),
+ onBad: Color(hex: 0xEF7373), onNone: Color(hex: 0x97A6BA))
+
+ /// Readiness tier → arc pigment. The tier is computed once, in Dart, and
+ /// shipped as `readiness_tier`; this only paints it.
+ func readinessArc(_ tier: Int) -> Color {
switch tier {
- case 2: return good
- case 1: return warn
- case 0: return bad
- default: return inkMuted
+ case 3, 2: return C.green
+ case 1: return C.orange
+ case 0: return C.red
+ default: return C.n400
+ }
+ }
+
+ /// The same tier, solved for TEXT.
+ func readiness(_ tier: Int) -> Color {
+ switch tier {
+ case 3, 2: return onGood
+ case 1: return onWarn
+ case 0: return onBad
+ default: return onNone
}
}
}
@@ -71,26 +98,23 @@ struct Palette {
struct WatchGlanceView: View {
@EnvironmentObject var store: WatchStore
private var m: WatchMetrics { store.metrics }
- private var p: Palette { m.themeDark ? .char : .ember }
+ private var p: Palette { m.themeDark ? .dark : .light }
var body: some View {
ZStack {
+ // Flat surface. ui2 has no glow: the phone is cards on a plain ground,
+ // and the wrist is one of its cards.
p.bg.ignoresSafeArea()
- // Signature coral ember glow, top-trailing (matches the app's GlowCard/recap).
- RadialGradient(
- colors: [p.coral.opacity(m.themeDark ? 0.20 : 0.16), .clear],
- center: .topTrailing, startRadius: 2, endRadius: 130)
- .ignoresSafeArea()
ScrollView {
VStack(spacing: 12) {
- if !m.hasData { empty } else {
- recoveryHero
+ if !m.fresh { empty } else {
+ readinessHero
HStack(spacing: 10) {
MetricCard(p: p, title: "STRAIN", value: m.strainText,
- fraction: m.strainFraction, accent: p.coral)
+ fraction: m.strainFraction, accent: C.purple)
MetricCard(p: p, title: "SLEEP", value: m.sleepText,
- fraction: m.sleepFraction, accent: p.cool)
+ fraction: m.sleepFraction, accent: C.blue)
}
HStack(spacing: 8) {
StatCell(p: p, label: "HRV", value: m.hrvText, unit: "ms")
@@ -106,15 +130,20 @@ struct WatchGlanceView: View {
.onAppear { store.requestRefresh() }
}
+ /// Nothing to show — either the phone has never pushed, or what it pushed is
+ /// old enough that it is no longer today's answer. The two say different
+ /// things: a snapshot going stale is not the same as never having one, and a
+ /// stale number rendered as current is exactly what this state exists to
+ /// prevent.
private var empty: some View {
VStack(spacing: 8) {
Image(systemName: "heart.text.square")
.font(.system(size: 32))
.foregroundStyle(p.inkMuted)
- Text("No data yet")
+ Text(m.hasData ? "No recent data" : "No data yet")
.font(.system(size: 16, weight: .semibold, design: .rounded))
.foregroundStyle(p.ink)
- Text("Open Edge on your iPhone and sync your strap.")
+ Text("Open OpenStrap on your iPhone and sync your band.")
.font(.system(size: 12))
.multilineTextAlignment(.center)
.foregroundStyle(p.inkSoft)
@@ -122,21 +151,35 @@ struct WatchGlanceView: View {
.padding(.top, 20)
}
- private var recoveryHero: some View {
- let tint = p.recovery(m.recoveryTier)
+ /// Readiness hero. Not "Recovery", and not a percentage — the phone scores
+ /// READINESS out of 100 and the wrist must not rename it. With no score there
+ /// is no arc: an arc trimmed to zero is a ring pinned at empty, which reads
+ /// as "your readiness is 0".
+ private var readinessHero: some View {
+ let arc = p.readinessArc(m.tier)
return ZStack {
- Circle().stroke(tint.opacity(0.18), lineWidth: 11)
- Circle()
- .trim(from: 0, to: m.readinessFraction)
- .stroke(tint, style: StrokeStyle(lineWidth: 11, lineCap: .round))
- .rotationEffect(.degrees(-90))
+ Circle().stroke(p.divider, lineWidth: 11)
+ if m.readinessFraction > 0 {
+ Circle()
+ .trim(from: 0, to: m.readinessFraction)
+ .stroke(arc, style: StrokeStyle(lineWidth: 11, lineCap: .round))
+ .rotationEffect(.degrees(-90))
+ }
VStack(spacing: -2) {
- Text(m.readiness >= 0 ? "\(m.readiness)" : "—")
- .font(.system(size: 40, weight: .bold, design: .rounded))
- .foregroundStyle(p.ink)
- Text("RECOVERY")
+ if m.readiness >= 0 {
+ Text("\(m.readiness)")
+ .font(.system(size: 40, weight: .bold, design: .rounded))
+ .foregroundStyle(p.ink)
+ } else {
+ Text("Not scored")
+ .font(.system(size: 13, weight: .semibold, design: .rounded))
+ .foregroundStyle(p.inkSoft)
+ }
+ Text(m.readiness >= 0 && !m.band.isEmpty ? m.band.uppercased() : "READINESS")
.font(.system(size: 9, weight: .semibold, design: .rounded))
.tracking(1.2)
+ .minimumScaleFactor(0.7)
+ .lineLimit(1)
.foregroundStyle(p.inkMuted)
}
}
@@ -148,36 +191,42 @@ struct WatchGlanceView: View {
HStack(alignment: .top, spacing: 6) {
Image(systemName: "sparkles")
.font(.system(size: 11))
- .foregroundStyle(p.coralInk)
+ .foregroundStyle(p.onHome)
Text(m.coachLine)
.font(.system(size: 12, weight: .medium))
- .foregroundStyle(p.coralInk)
+ .foregroundStyle(p.onHome)
Spacer(minLength: 0)
}
.padding(.horizontal, 10)
.padding(.vertical, 8)
.frame(maxWidth: .infinity, alignment: .leading)
- .background(p.coralSoft, in: RoundedRectangle(cornerRadius: 12))
+ .background(p.homeWash, in: RoundedRectangle(cornerRadius: 12))
}
}
// MARK: - Components
+/// An absent metric is an empty slot — no number, no arc, the card dimmed.
+/// A 54pt circle cannot carry the phone's what/why/fix, but a dash over a ring
+/// drawn at zero is a measurement we do not have, which is worse than silence.
private struct MetricCard: View {
let p: Palette
let title: String
let value: String
let fraction: Double
let accent: Color
+ private var absent: Bool { value.isEmpty }
var body: some View {
VStack(spacing: 6) {
ZStack {
Circle().stroke(accent.opacity(0.18), lineWidth: 6)
- Circle()
- .trim(from: 0, to: fraction)
- .stroke(accent, style: StrokeStyle(lineWidth: 6, lineCap: .round))
- .rotationEffect(.degrees(-90))
+ if fraction > 0 {
+ Circle()
+ .trim(from: 0, to: fraction)
+ .stroke(accent, style: StrokeStyle(lineWidth: 6, lineCap: .round))
+ .rotationEffect(.degrees(-90))
+ }
Text(value)
.font(.system(size: 15, weight: .bold, design: .rounded))
.foregroundStyle(p.ink)
@@ -195,6 +244,7 @@ private struct MetricCard: View {
.padding(.vertical, 10)
.background(p.surface, in: RoundedRectangle(cornerRadius: 14))
.overlay(RoundedRectangle(cornerRadius: 14).stroke(p.divider, lineWidth: 1))
+ .opacity(absent ? 0.4 : 1)
}
}
@@ -203,6 +253,7 @@ private struct StatCell: View {
let label: String
let value: String
let unit: String
+ private var absent: Bool { value.isEmpty }
var body: some View {
VStack(spacing: 1) {
@@ -210,13 +261,19 @@ private struct StatCell: View {
.font(.system(size: 9, weight: .semibold, design: .rounded))
.tracking(0.8)
.foregroundStyle(p.inkMuted)
- HStack(alignment: .firstTextBaseline, spacing: 2) {
- Text(value)
- .font(.system(size: 18, weight: .bold, design: .rounded))
- .foregroundStyle(p.ink)
- Text(unit)
- .font(.system(size: 9))
+ if absent {
+ Text("no reading")
+ .font(.system(size: 11))
.foregroundStyle(p.inkSoft)
+ } else {
+ HStack(alignment: .firstTextBaseline, spacing: 2) {
+ Text(value)
+ .font(.system(size: 18, weight: .bold, design: .rounded))
+ .foregroundStyle(p.ink)
+ Text(unit)
+ .font(.system(size: 9))
+ .foregroundStyle(p.inkSoft)
+ }
}
}
.frame(maxWidth: .infinity)
diff --git a/ios/OpenStrapWatch Watch App/WatchMetrics.swift b/ios/OpenStrapWatch Watch App/WatchMetrics.swift
index 60cccd63..ead2f025 100644
--- a/ios/OpenStrapWatch Watch App/WatchMetrics.swift
+++ b/ios/OpenStrapWatch Watch App/WatchMetrics.swift
@@ -1,22 +1,35 @@
// WatchMetrics — the today snapshot the watch renders.
//
-// Add this file to BOTH watch targets (the Watch App and the Watch Widget
-// Extension). The watch app's WatchStore receives the payload over WCSession and
-// writes it into the watch-side App Group; the complication widget reads the same
-// suite. (The watch app and its widget extension are separate processes, so they
-// share via a watch App Group — NOT the phone's App Group.)
+// Watch App target only. WatchStore receives the payload over WCSession and
+// caches it here; the glance reads it back. This used to be stored in an App
+// Group ("group.wtf.openstrap.watch") that the watch entitlement never declared
+// — a suite nobody else could open, kept alive for a complication extension
+// that was never in the Xcode project. One process writes and reads it, so
+// standard defaults are the whole requirement.
+//
+// HONESTY: the phone forbids a bare dash and a zero-filled ring for an absent
+// metric. Text helpers return "" and ring fractions return a negative sentinel
+// so the views can leave the slot empty instead of drawing "0". And `hasData`
+// is not enough on its own — it is a bool frozen when the phone pushed, so the
+// wrist gates on `fresh`, which ages `updatedAt` at render time.
import Foundation
-enum WatchConfig {
- /// Watch-side App Group, shared between the Watch App and Watch Widget targets.
- /// Create this group and enable it on BOTH watch targets in Xcode.
- static let appGroup = "group.wtf.openstrap.watch"
-}
+/// How old a snapshot may be before the wrist stops presenting it as today's
+/// answer: one whole missed wake cycle plus a little grace. Same value and same
+/// reasoning as `kStaleAfter` in ios/OpenStrapWidget/OpenStrapWidget.swift —
+/// separate build targets, so it cannot be one declaration.
+let kStaleAfter: TimeInterval = 26 * 3600
struct WatchMetrics {
var hasData: Bool
var readiness: Int // 0–100, -1 = none
+ /// Readiness tier, straight from Dart. The thresholds live in exactly one
+ /// place — `readinessBand` in lib/ui2/screens/home_screen.dart, published as
+ /// `readiness_tier`. Never re-derive a band from `readiness` here: the watch
+ /// used to call 38 "yellow" while the phone called the same score red.
+ var tier: Int // -1 not scored · 0 rest · 1 easy · 2 steady · 3 good
+ var band: String // the phone's own label for `tier`
var strain: Double // 0–21, -1 = none
var sleepMin: Int // minutes asleep, -1 = none
var needMin: Int // sleep need (min); -1 = none — never fabricate 8h
@@ -29,47 +42,60 @@ struct WatchMetrics {
var themeDark: Bool // mirror the app's Ember-on-Paper (false) / Char (true)
static let empty = WatchMetrics(
- hasData: false, readiness: -1, strain: -1, sleepMin: -1, needMin: -1,
- hrv: -1, hrvBaseline: -1, rhr: -1, coachLine: "", battPct: -1, updatedAt: 0,
- themeDark: true)
+ hasData: false, readiness: -1, tier: -1, band: "", strain: -1, sleepMin: -1,
+ needMin: -1, hrv: -1, hrvBaseline: -1, rhr: -1, coachLine: "", battPct: -1,
+ updatedAt: 0, themeDark: true)
static func load() -> WatchMetrics {
- let d = UserDefaults(suiteName: WatchConfig.appGroup)
+ let d = UserDefaults.standard
return WatchMetrics(
- hasData: d?.bool(forKey: "has_data") ?? false,
- readiness: d?.object(forKey: "readiness") as? Int ?? -1,
- strain: d?.object(forKey: "strain") as? Double ?? -1,
- sleepMin: d?.object(forKey: "sleep_min") as? Int ?? -1,
- needMin: d?.object(forKey: "sleep_need_min") as? Int ?? -1,
- hrv: d?.object(forKey: "hrv") as? Int ?? -1,
- hrvBaseline: d?.object(forKey: "hrv_baseline") as? Int ?? -1,
- rhr: d?.object(forKey: "rhr") as? Int ?? -1,
- coachLine: d?.string(forKey: "coach_line") ?? "",
- battPct: d?.object(forKey: "batt_pct") as? Int ?? -1,
- updatedAt: d?.object(forKey: "updated_at") as? Int ?? 0,
- themeDark: d?.object(forKey: "theme_dark") as? Bool ?? true)
+ hasData: d.bool(forKey: "has_data"),
+ readiness: d.object(forKey: "readiness") as? Int ?? -1,
+ tier: d.object(forKey: "readiness_tier") as? Int ?? -1,
+ band: d.string(forKey: "readiness_band") ?? "",
+ strain: d.object(forKey: "strain") as? Double ?? -1,
+ sleepMin: d.object(forKey: "sleep_min") as? Int ?? -1,
+ needMin: d.object(forKey: "sleep_need_min") as? Int ?? -1,
+ hrv: d.object(forKey: "hrv") as? Int ?? -1,
+ hrvBaseline: d.object(forKey: "hrv_baseline") as? Int ?? -1,
+ rhr: d.object(forKey: "rhr") as? Int ?? -1,
+ coachLine: d.string(forKey: "coach_line") ?? "",
+ battPct: d.object(forKey: "batt_pct") as? Int ?? -1,
+ updatedAt: d.object(forKey: "updated_at") as? Int ?? 0,
+ themeDark: d.object(forKey: "theme_dark") as? Bool ?? true)
+ }
+
+ /// Is this still today's answer? An unknown timestamp is not a claim of
+ /// staleness (a snapshot that never got a push has `hasData` false anyway).
+ var fresh: Bool {
+ guard hasData else { return false }
+ guard updatedAt > 0 else { return true }
+ return Date().timeIntervalSince1970 - Double(updatedAt) <= kStaleAfter
}
// MARK: Display helpers
+ // "" = no measurement. The score the phone calls READINESS out of 100 is not
+ // a percentage and is not called Recovery — one number, one name, one unit.
- var readinessText: String { readiness >= 0 ? "\(readiness)%" : "—" }
- var strainText: String { strain >= 0 ? String(format: "%.1f", strain) : "—" }
- var hrvText: String { hrv >= 0 ? "\(hrv)" : "—" }
- var rhrText: String { rhr >= 0 ? "\(rhr)" : "—" }
+ var readinessText: String { readiness >= 0 ? "\(readiness)" : "" }
+ var strainText: String { strain >= 0 ? String(format: "%.1f", strain) : "" }
+ var hrvText: String { hrv >= 0 ? "\(hrv)" : "" }
+ var rhrText: String { rhr >= 0 ? "\(rhr)" : "" }
+ /// "45m" / "7h 05m" — the phone's `hm()` (lib/ui2/screens/home_screen.dart).
var sleepText: String {
- guard sleepMin >= 0 else { return "—" }
- return "\(sleepMin / 60)h \(sleepMin % 60)m"
+ guard sleepMin >= 0 else { return "" }
+ if sleepMin < 60 { return "\(sleepMin)m" }
+ return String(format: "%dh %02dm", sleepMin / 60, sleepMin % 60)
}
- /// Recovery ring fraction 0–1.
- var readinessFraction: Double { readiness >= 0 ? Double(readiness) / 100.0 : 0 }
- /// Strain ring fraction 0–1 (0–21 scale).
- var strainFraction: Double { strain >= 0 ? min(strain / 21.0, 1) : 0 }
+
+ // Ring fractions; negative = nothing measured, so draw the track only.
+ var readinessFraction: Double { readiness >= 0 ? Double(readiness) / 100.0 : -1 }
+ /// Strain ring fraction 0–1. 0–21 is the headline scale `strainScore` maps
+ /// TRIMP onto (analytics/lib/src/onehz/clinical/load_trimp.dart:104-122).
+ var strainFraction: Double { strain >= 0 ? min(strain / 21.0, 1) : -1 }
/// Sleep-vs-need fraction 0–1.
var sleepFraction: Double {
- guard sleepMin >= 0, needMin > 0 else { return 0 }
+ guard sleepMin >= 0, needMin > 0 else { return -1 }
return min(Double(sleepMin) / Double(needMin), 1)
}
-
- /// WHOOP-style recovery color: red < 34, yellow 34–66, green ≥ 67.
- var recoveryTier: Int { readiness < 0 ? -1 : (readiness < 34 ? 0 : (readiness < 67 ? 1 : 2)) }
}
diff --git a/ios/OpenStrapWatch Watch App/WatchStore.swift b/ios/OpenStrapWatch Watch App/WatchStore.swift
index 4f074e8e..8a08b4dc 100644
--- a/ios/OpenStrapWatch Watch App/WatchStore.swift
+++ b/ios/OpenStrapWatch Watch App/WatchStore.swift
@@ -1,14 +1,18 @@
// WatchStore — receives today's metrics from the iPhone and caches them.
//
// Add to the Watch App target only. On activation it pulls the latest snapshot;
-// thereafter it receives coalesced `applicationContext` pushes (and complication
-// user-info) from WatchBridge on the phone. Every ingest writes the watch-side
-// App Group and reloads complication timelines so the face stays in sync.
+// thereafter it receives coalesced `applicationContext` pushes from WatchBridge
+// on the phone. Every ingest caches the payload so the glance stays in sync.
+//
+// There are no complications: the OpenStrapWatchWidget sources were never in
+// the Xcode project, so nothing compiled them and there was no timeline to
+// reload. Re-adding them means an Xcode-created watchOS widget extension target
+// embedded in this app (plus its own bundle id and a watch App Group), not a
+// loose folder.
import Combine
import Foundation
import WatchConnectivity
-import WidgetKit
final class WatchStore: NSObject, ObservableObject, WCSessionDelegate {
static let shared = WatchStore()
@@ -34,14 +38,10 @@ final class WatchStore: NSObject, ObservableObject, WCSessionDelegate {
}
private func ingest(_ payload: [String: Any]) {
- NSLog("[WatchStore] ingest keys=%@ suiteNil=%d", payload.keys.sorted().joined(separator: ","),
- (UserDefaults(suiteName: WatchConfig.appGroup) == nil) ? 1 : 0)
- guard !payload.isEmpty, let d = UserDefaults(suiteName: WatchConfig.appGroup) else { return }
+ guard !payload.isEmpty else { return }
+ let d = UserDefaults.standard
for (k, v) in payload { d.set(v, forKey: k) }
- DispatchQueue.main.async {
- self.metrics = .load()
- WidgetCenter.shared.reloadAllTimelines()
- }
+ DispatchQueue.main.async { self.metrics = .load() }
}
// MARK: - WCSessionDelegate
diff --git a/ios/OpenStrapWatchWidget/OpenStrapWatchWidgetBundle.swift b/ios/OpenStrapWatchWidget/OpenStrapWatchWidgetBundle.swift
deleted file mode 100644
index f5a26d27..00000000
--- a/ios/OpenStrapWatchWidget/OpenStrapWatchWidgetBundle.swift
+++ /dev/null
@@ -1,146 +0,0 @@
-// OpenStrap Watch complications — WidgetKit widgets for the Apple Watch face.
-//
-// Add these to a "Watch Widget Extension" target embedded in the Watch App.
-// They read the watch-side App Group (written by WatchStore when the phone
-// pushes fresh metrics) and render as accessory-family complications. Add
-// WatchMetrics.swift to this target too (shared model + WatchConfig.appGroup).
-
-import SwiftUI
-import WidgetKit
-
-// MARK: - Timeline
-
-struct RecoveryEntry: TimelineEntry {
- let date: Date
- let metrics: WatchMetrics
-}
-
-struct RecoveryProvider: TimelineProvider {
- func placeholder(in context: Context) -> RecoveryEntry {
- RecoveryEntry(date: Date(), metrics: .empty)
- }
-
- func getSnapshot(in context: Context, completion: @escaping (RecoveryEntry) -> Void) {
- completion(RecoveryEntry(date: Date(), metrics: .load()))
- }
-
- func getTimeline(in context: Context, completion: @escaping (Timeline) -> Void) {
- // Data is push-driven (WatchStore reloads timelines on new WCSession data),
- // so a single current entry with a periodic safety refresh is enough.
- let entry = RecoveryEntry(date: Date(), metrics: .load())
- let next = Calendar.current.date(byAdding: .minute, value: 30, to: Date()) ?? Date()
- completion(Timeline(entries: [entry], policy: .after(next)))
- }
-}
-
-private func recoveryColor(_ tier: Int) -> Color {
- // Matches lib/theme/tokens.dart good/warn/bad (Char variant, for the dark face).
- switch tier {
- case 2: return Color(red: 0x34 / 255, green: 0xC9 / 255, blue: 0x88 / 255) // good
- case 1: return Color(red: 0xF7 / 255, green: 0xB5 / 255, blue: 0x3A / 255) // warn
- case 0: return Color(red: 0xF2 / 255, green: 0x61 / 255, blue: 0x68 / 255) // bad
- default: return .gray
- }
-}
-
-// MARK: - Recovery complication (circular / corner / inline)
-
-struct RecoveryComplication: Widget {
- let kind = "OpenStrapRecovery"
-
- var body: some WidgetConfiguration {
- StaticConfiguration(kind: kind, provider: RecoveryProvider()) { entry in
- RecoveryComplicationView(m: entry.metrics)
- .containerBackground(.clear, for: .widget)
- }
- .configurationDisplayName("Recovery")
- .description("Today's recovery from OpenStrap.")
- .supportedFamilies([.accessoryCircular, .accessoryCorner, .accessoryInline])
- }
-}
-
-struct RecoveryComplicationView: View {
- @Environment(\.widgetFamily) private var family
- let m: WatchMetrics
-
- var body: some View {
- switch family {
- case .accessoryInline:
- Label("Recovery \(m.readinessText)", systemImage: "bolt.heart")
- case .accessoryCorner:
- Text(m.readinessText)
- .font(.system(size: 18, weight: .bold, design: .rounded))
- .widgetLabel {
- Gauge(value: m.readinessFraction) { EmptyView() }
- .tint(recoveryColor(m.recoveryTier))
- }
- default: // accessoryCircular
- Gauge(value: m.readinessFraction) {
- Image(systemName: "bolt.heart")
- } currentValueLabel: {
- Text(m.readiness >= 0 ? "\(m.readiness)" : "—")
- .font(.system(size: 15, weight: .bold, design: .rounded))
- }
- .gaugeStyle(.accessoryCircular)
- .tint(recoveryColor(m.recoveryTier))
- }
- }
-}
-
-// MARK: - Combined rectangular (recovery · strain · sleep)
-
-struct TodayComplication: Widget {
- let kind = "OpenStrapToday"
-
- var body: some WidgetConfiguration {
- StaticConfiguration(kind: kind, provider: RecoveryProvider()) { entry in
- TodayComplicationView(m: entry.metrics)
- .containerBackground(.clear, for: .widget)
- }
- .configurationDisplayName("Today")
- .description("Recovery, strain and sleep at a glance.")
- .supportedFamilies([.accessoryRectangular])
- }
-}
-
-struct TodayComplicationView: View {
- let m: WatchMetrics
-
- var body: some View {
- HStack(spacing: 8) {
- Gauge(value: m.readinessFraction) {
- EmptyView()
- } currentValueLabel: {
- Text(m.readiness >= 0 ? "\(m.readiness)" : "—")
- .font(.system(size: 13, weight: .bold, design: .rounded))
- }
- .gaugeStyle(.accessoryCircular)
- .tint(recoveryColor(m.recoveryTier))
-
- VStack(alignment: .leading, spacing: 1) {
- Text("Recovery")
- .font(.system(size: 12, weight: .semibold))
- Text("Strain \(m.strainText) · \(m.sleepText)")
- .font(.system(size: 12))
- .foregroundStyle(.secondary)
- if !m.coachLine.isEmpty {
- Text(m.coachLine)
- .font(.system(size: 11))
- .foregroundStyle(.secondary)
- .lineLimit(1)
- }
- }
- Spacer(minLength: 0)
- }
- }
-}
-
-// MARK: - Bundle
-
-@main
-struct OpenStrapWatchWidgetBundle: WidgetBundle {
- var body: some Widget {
- RecoveryComplication()
- TodayComplication()
- }
-}
diff --git a/ios/OpenStrapWidget/OpenStrapBatteryWidget.swift b/ios/OpenStrapWidget/OpenStrapBatteryWidget.swift
index 865b642a..f99d0dd4 100644
--- a/ios/OpenStrapWidget/OpenStrapBatteryWidget.swift
+++ b/ios/OpenStrapWidget/OpenStrapBatteryWidget.swift
@@ -8,7 +8,8 @@
// it is NOT part of /today — so unlike OpenStrapWidget this one does NOT
// self-refresh over the network. It renders the last snapshot the app wrote
// into the shared App Group (keys batt_pct / batt_charging / batt_at) the last
-// time the band was connected. "—" until we've ever seen the band.
+// time the band was connected. Until we have ever seen the band it says so in
+// words — it never draws a bar at empty, which reads as "0%".
//
// Primary surface is the lock screen (accessory* families); a systemSmall
// variant is included so it can also live on the home screen.
@@ -19,7 +20,7 @@ import SwiftUI
private let kAppGroup = AppGroup.identifier
-// MARK: - Theme (mirrors OpenStrapWidget's Ember-on-Paper / Char)
+// MARK: - Theme (lib/ui2/theme.dart; mirrors OpenStrapWidget's)
private extension Color {
init(_ r: Int, _ g: Int, _ b: Int) {
@@ -29,10 +30,10 @@ private extension Color {
private struct BattPal {
let bg: Color, ink: Color, inkMuted: Color, track: Color
- static let light = BattPal(bg: Color(244, 241, 236), ink: Color(26, 23, 20),
- inkMuted: Color(165, 156, 144), track: Color(236, 231, 223))
- static let dark = BattPal(bg: Color(30, 26, 21), ink: Color(241, 236, 227),
- inkMuted: Color(126, 116, 102), track: Color(42, 37, 31))
+ static let light = BattPal(bg: Color(0xFF, 0xFF, 0xFF), ink: Color(0x0F, 0x17, 0x2A),
+ inkMuted: Color(0x62, 0x71, 0x88), track: Color(0xE2, 0xE8, 0xF0))
+ static let dark = BattPal(bg: Color(0x15, 0x1C, 0x26), ink: Color(0xF1, 0xF5, 0xF9),
+ inkMuted: Color(0x7F, 0x8D, 0xA0), track: Color(0x23, 0x2D, 0x3B))
static var current: BattPal {
let isDark = UserDefaults(suiteName: kAppGroup)?.object(forKey: "theme_dark") as? Bool ?? false
return isDark ? .dark : .light
@@ -44,43 +45,74 @@ private extension Color {
static var battInk: Color { BattPal.current.ink }
static var battInkMuted: Color { BattPal.current.inkMuted }
static var battTrack: Color { BattPal.current.track }
- static let battCoral = Color(255, 90, 54)
- static let battCoralDeep = Color(232, 67, 31)
- static let battGood = Color(43, 182, 115)
- static let battCharge = Color(124, 168, 240)
+ // Raw ui2 pigment: a battery bar is non-text UI, so it spends `C.*` directly.
+ static let battLow = Color(0xF9, 0x73, 0x16) // C.orange
+ static let battCritical = Color(0xEF, 0x44, 0x44) // C.red
+ static let battGood = Color(0x22, 0xC5, 0x5E) // C.green
+ static let battCharge = Color(0x3B, 0x82, 0xF6) // C.blue
}
// MARK: - Model
+/// A battery reading older than this is not the band's current level — we
+/// simply have not talked to it. Shorter than the metrics widget's 26 h
+/// (OpenStrapWidget.swift) on purpose: readiness describes a night that stays
+/// true all day, a battery percentage describes right now.
+private let kBattStaleAfter: TimeInterval = 86_400
+
struct BatteryEntry: TimelineEntry {
- let date: Date
- let name: String // strap advertising name (falls back to "Strap")
+ var date: Date
+ let name: String // the band's advertising name (falls back to "Band")
let pct: Int // -1 = never seen the band
let charging: Bool
let updatedAt: Int // epoch seconds, 0 = unknown
- let stale: Bool // last reading is old enough that we mute it
static let placeholder = BatteryEntry(
- date: Date(), name: "WHOOP 4.0", pct: 68, charging: false,
- updatedAt: Int(Date().timeIntervalSince1970), stale: false)
+ date: Date(), name: "Band", pct: 68, charging: false,
+ updatedAt: Int(Date().timeIntervalSince1970))
var hasData: Bool { pct >= 0 }
+
+ /// Computed from THIS ENTRY'S date, not from `Date()` at read time — the same
+ /// reason the metrics widget does it: a flag frozen when the timeline was
+ /// built can never go stale on its own, so WidgetKit renders the flip from an
+ /// entry it already holds (see getTimeline).
+ var stale: Bool {
+ guard hasData, updatedAt > 0 else { return false }
+ return date.timeIntervalSince1970 - Double(updatedAt) > kBattStaleAfter
+ }
+
+ /// The instant this reading stops being the band's current level.
+ var stalenessDeadline: Date? {
+ guard hasData, updatedAt > 0 else { return nil }
+ let at = Date(timeIntervalSince1970: Double(updatedAt) + kBattStaleAfter)
+ return at > date ? at : nil
+ }
+
+ func at(_ d: Date) -> BatteryEntry { var c = self; c.date = d; return c }
var t: Double { pct >= 0 ? min(max(Double(pct) / 100.0, 0), 1) : 0 }
+ /// `charging` is a fact about the moment the app last wrote, so it goes stale
+ /// with the level it came with. Without this the widget said "Charging" in
+ /// blue, with a bolt, about a band that came off the puck four days ago —
+ /// the charge branch was tested before the staleness branch everywhere.
+ /// Mirrored in OpenStrapBatteryWidgetProvider.kt — keep the two in step.
+ var chargingNow: Bool { charging && !stale }
+
/// Coral when low, deep-coral when critical, blue while charging, otherwise ink.
var color: Color {
if !hasData { return .battInkMuted }
- if charging { return .battCharge }
- if pct <= 10 { return .battCoralDeep }
- if pct <= 25 { return .battCoral }
+ if chargingNow { return .battCharge }
+ if pct <= 10 { return .battCritical }
+ if pct <= 25 { return .battLow }
return .battGood
}
- var valueText: String { pct >= 0 ? "\(pct)%" : "—" }
+ var valueText: String { pct >= 0 ? "\(pct)%" : "" }
- /// Icon: a charging bolt while plugged in, otherwise the strap glyph
+ /// Icon: a charging bolt while plugged in, otherwise the band glyph
/// (mirrors the app's device icon, HugeIcons SmartWatch01).
- var symbol: String { charging ? "bolt.fill" : "applewatch" }
+ var symbol: String { chargingNow ? "bolt.fill" : "applewatch" }
}
// MARK: - Shared store (App Group, read-only here)
@@ -92,12 +124,9 @@ private enum BatteryStore {
let charging = d?.object(forKey: "batt_charging") as? Bool ?? false
let at = d?.object(forKey: "batt_at") as? Int ?? 0
let raw = (d?.string(forKey: "batt_name") ?? "").trimmingCharacters(in: .whitespaces)
- let name = raw.isEmpty ? "Strap" : raw
- // Mute (still show the number, but greyed) once the reading is > 24h old —
- // we genuinely don't know the current level if we haven't talked to the band.
- let stale = at > 0 && (Int(Date().timeIntervalSince1970) - at) > 86_400
+ let name = raw.isEmpty ? "Band" : raw
return BatteryEntry(date: Date(), name: name, pct: pct, charging: charging,
- updatedAt: at, stale: stale)
+ updatedAt: at)
}
}
@@ -113,10 +142,16 @@ struct BatteryProvider: TimelineProvider {
}
func getTimeline(in context: Context, completion: @escaping (Timeline) -> Void) {
- let entry = BatteryStore.read()
- let next = Calendar.current.date(byAdding: .minute, value: 30, to: Date())
- ?? Date().addingTimeInterval(1800)
- completion(Timeline(entries: [entry], policy: .after(next)))
+ // Second entry at the staleness deadline: the reading labels itself "last
+ // known" at exactly that moment with no process wake. The 30-min `.after`
+ // only picks up a newer snapshot.
+ let now = Date()
+ let entry = BatteryStore.read().at(now)
+ var entries = [entry]
+ if let deadline = entry.stalenessDeadline { entries.append(entry.at(deadline)) }
+ let next = Calendar.current.date(byAdding: .minute, value: 30, to: now)
+ ?? now.addingTimeInterval(1800)
+ completion(Timeline(entries: entries, policy: .after(next)))
}
}
@@ -143,7 +178,7 @@ private struct BattBar: View {
}
}
-/// Home-screen small: strap name + level + linear bar.
+/// Home-screen small: band name + level + linear bar.
private struct BatterySmallView: View {
let e: BatteryEntry
var body: some View {
@@ -157,32 +192,39 @@ private struct BatterySmallView: View {
Text(e.valueText).font(battNumFont(30)).foregroundColor(.battInk)
.minimumScaleFactor(0.6).lineLimit(1)
Spacer(minLength: 8)
- BattBar(t: e.t, color: e.color, height: 9)
- Text(e.charging ? "Charging" : (e.hasData ? "Battery" : "Not connected"))
+ if e.hasData { BattBar(t: e.t, color: e.color, height: 9) }
+ // Dimming alone does not SAY anything. A reading we can no longer vouch
+ // for names itself, on every family.
+ Text(!e.hasData ? "Not connected yet"
+ : (e.stale ? "Last known level" : (e.charging ? "Charging" : "Battery")))
.font(.system(size: 10, weight: .medium)).foregroundColor(.battInkMuted)
.padding(.top, 5)
}
.frame(maxWidth: .infinity, maxHeight: .infinity, alignment: .leading)
- .opacity(e.stale ? 0.5 : 1)
.padding(14)
}
}
-@available(iOSApplicationExtension 16.0, *)
+// A Gauge with no reading is a bar drawn at empty, which reads as "0% battery"
+// rather than "we haven't heard from the band" — so an unknown level gets the
+// glyph and a word, never a gauge.
private struct BatteryCircularView: View {
let e: BatteryEntry
var body: some View {
- Gauge(value: e.t) {
- Image(systemName: e.symbol)
- } currentValueLabel: {
- Text(e.valueText)
+ if e.hasData {
+ Gauge(value: e.t) {
+ Image(systemName: e.symbol)
+ } currentValueLabel: {
+ Text(e.valueText)
+ }
+ .gaugeStyle(.accessoryCircularCapacity)
+ .widgetAccentable()
+ } else {
+ Image(systemName: "applewatch.slash").font(.system(size: 18)).widgetAccentable()
}
- .gaugeStyle(.accessoryCircularCapacity)
- .widgetAccentable()
}
}
-@available(iOSApplicationExtension 16.0, *)
private struct BatteryRectangularView: View {
let e: BatteryEntry
var body: some View {
@@ -195,24 +237,27 @@ private struct BatteryRectangularView: View {
.font(.system(size: 13, weight: .semibold))
.widgetAccentable()
- // Linear lock-screen battery bar with the level inline.
- Gauge(value: e.t) {
- Text("")
- } currentValueLabel: {
- Text(e.hasData ? "\(e.pct)%" : "—")
+ if e.hasData {
+ // Linear lock-screen battery bar with the level inline.
+ Gauge(value: e.t) {
+ Text("")
+ } currentValueLabel: {
+ Text("\(e.pct)%")
+ }
+ .gaugeStyle(.accessoryLinearCapacity)
+ } else {
+ Text("Not connected yet").font(.system(size: 12)).foregroundStyle(.secondary)
+ }
+ if e.stale {
+ Text("Last known").font(.system(size: 11)).foregroundStyle(.secondary)
}
- .gaugeStyle(.accessoryLinearCapacity)
}
}
}
private extension View {
@ViewBuilder func battWidgetBackground(_ color: Color) -> some View {
- if #available(iOSApplicationExtension 17.0, *) {
- containerBackground(color, for: .widget)
- } else {
- background(color)
- }
+ containerBackground(color, for: .widget)
}
}
@@ -221,26 +266,26 @@ struct OpenStrapBatteryEntryView: View {
var entry: BatteryEntry
var body: some View {
- content.battWidgetBackground(family == .systemSmall ? Color.battPaper : Color.clear)
+ // The staleness mute used to be applied only inside BatterySmallView, so a
+ // lock-screen complication showed a week-old percentage at full strength.
+ // It belongs here, above every family.
+ content
+ .opacity(entry.stale ? 0.5 : 1)
+ .battWidgetBackground(family == .systemSmall ? Color.battPaper : Color.clear)
}
@ViewBuilder private var content: some View {
switch family {
- case .systemSmall: BatterySmallView(e: entry)
- default:
- if #available(iOSApplicationExtension 16.0, *) {
- switch family {
- case .accessoryCircular: BatteryCircularView(e: entry)
- case .accessoryRectangular: BatteryRectangularView(e: entry)
- case .accessoryInline:
- Label(
- entry.hasData ? "\(entry.name) \(entry.pct)%" : "\(entry.name) —",
- systemImage: entry.symbol)
- default: BatterySmallView(e: entry)
- }
- } else {
- BatterySmallView(e: entry)
- }
+ case .systemSmall: BatterySmallView(e: entry)
+ case .accessoryCircular: BatteryCircularView(e: entry)
+ case .accessoryRectangular: BatteryRectangularView(e: entry)
+ case .accessoryInline:
+ Label(
+ entry.hasData
+ ? "\(entry.name) \(entry.pct)%\(entry.stale ? " · last known" : "")"
+ : "\(entry.name) not connected",
+ systemImage: entry.symbol)
+ default: BatterySmallView(e: entry)
}
}
}
@@ -254,13 +299,7 @@ struct OpenStrapBatteryWidget: Widget {
}
.configurationDisplayName("Band Battery")
.description("Your band's battery level at a glance.")
- .supportedFamilies(supportedFamilies)
- }
-
- private var supportedFamilies: [WidgetFamily] {
- if #available(iOSApplicationExtension 16.0, *) {
- return [.systemSmall, .accessoryCircular, .accessoryRectangular, .accessoryInline]
- }
- return [.systemSmall]
+ .supportedFamilies([.systemSmall, .accessoryCircular,
+ .accessoryRectangular, .accessoryInline])
}
}
diff --git a/ios/OpenStrapWidget/OpenStrapBreathingLiveActivity.swift b/ios/OpenStrapWidget/OpenStrapBreathingLiveActivity.swift
index a29fa44f..346ded86 100644
--- a/ios/OpenStrapWidget/OpenStrapBreathingLiveActivity.swift
+++ b/ios/OpenStrapWidget/OpenStrapBreathingLiveActivity.swift
@@ -32,7 +32,7 @@ struct OpenStrapBreathingAttributes: ActivityAttributes {
var startedAt: Date
}
-// MARK: - Palette (mirrors OpenStrapWidgetLiveActivity's, kept local —
+// MARK: - Palette (lib/ui2/theme.dart; mirrors OpenStrapWidgetLiveActivity's, kept local —
// that file's helpers are `private` to it, so a small deliberate duplication
// here is safer than widening that file's access just to share four colors)
@@ -46,11 +46,15 @@ private extension Color {
private struct BreathingPal {
let clayPaper: Color, ink: Color, inkMuted: Color
+ /// `P.on(C.teal)` — the Mind accent as TEXT on this surface.
+ let onMind: Color
let isDark: Bool
- static let light = BreathingPal(clayPaper: Color(246, 242, 236), ink: Color(26, 23, 20),
- inkMuted: Color(150, 142, 131), isDark: false)
- static let dark = BreathingPal(clayPaper: Color(32, 28, 23), ink: Color(241, 236, 227),
- inkMuted: Color(126, 116, 102), isDark: true)
+ static let light = BreathingPal(clayPaper: Color(0xFF, 0xFF, 0xFF), ink: Color(0x0F, 0x17, 0x2A),
+ inkMuted: Color(0x62, 0x71, 0x88),
+ onMind: Color(0x12, 0x76, 0x74), isDark: false)
+ static let dark = BreathingPal(clayPaper: Color(0x15, 0x1C, 0x26), ink: Color(0xF1, 0xF5, 0xF9),
+ inkMuted: Color(0x7F, 0x8D, 0xA0),
+ onMind: Color(0x14, 0xB8, 0xA6), isDark: true)
static var current: BreathingPal {
(UserDefaults(suiteName: kAppGroup)?.object(forKey: "theme_dark") as? Bool ?? false)
? .dark : .light
@@ -61,7 +65,13 @@ private extension Color {
static var bClayPaper: Color { BreathingPal.current.clayPaper }
static var bInk: Color { BreathingPal.current.ink }
static var bInkMuted: Color { BreathingPal.current.inkMuted }
- static let bRecovery = Color(43, 182, 115) // matches DomainAccent.recovery
+ /// Breathing is the Mind domain — `C.teal` in lib/ui2/theme.dart, the fifth
+ /// tab's accent. Raw pigment for glyphs and keylines…
+ static let bMind = Color(0x14, 0xB8, 0xA6)
+ /// …`P.fill(C.teal)` for anything white sits on (buttons, tints)…
+ static let bMindFill = Color(0x0F, 0x85, 0x78)
+ /// …and `P.on(C.teal)` for accent TEXT.
+ static var bOnMind: Color { BreathingPal.current.onMind }
}
private func coherenceText(_ v: Double) -> String { v >= 0 ? "\(Int(v.rounded()))%" : "Calibrating…" }
@@ -90,9 +100,9 @@ private struct BreathingLockScreenView: View {
HStack(spacing: 14) {
if #available(iOSApplicationExtension 17.0, *) {
Image(systemName: "wind").font(.system(size: 26))
- .foregroundStyle(Color.bRecovery).symbolEffect(.pulse, options: .repeating)
+ .foregroundStyle(Color.bMind).symbolEffect(.pulse, options: .repeating)
} else {
- Image(systemName: "wind").font(.system(size: 26)).foregroundStyle(Color.bRecovery)
+ Image(systemName: "wind").font(.system(size: 26)).foregroundStyle(Color.bMind)
}
VStack(alignment: .leading, spacing: 2) {
Text(coherenceText(score))
@@ -109,7 +119,7 @@ private struct BreathingLockScreenView: View {
Button(intent: EndBreathingIntent()) {
Image(systemName: "stop.fill").font(.system(size: 12, weight: .bold))
}
- .tint(Color.bRecovery).buttonBorderShape(.capsule)
+ .tint(Color.bMindFill).buttonBorderShape(.capsule)
}
}
.padding(16)
@@ -126,18 +136,18 @@ struct OpenStrapBreathingLiveActivity: Widget {
var body: some WidgetConfiguration {
ActivityConfiguration(for: OpenStrapBreathingAttributes.self) { context in
BreathingLockScreenView(context: context)
- .activitySystemActionForegroundColor(Color.bRecovery)
+ .activitySystemActionForegroundColor(Color.bMindFill)
} dynamicIsland: { context in
let score = context.state.coherenceScore
return DynamicIsland {
DynamicIslandExpandedRegion(.leading) {
- Image(systemName: "wind").font(.system(size: 18)).foregroundStyle(Color.bRecovery)
+ Image(systemName: "wind").font(.system(size: 18)).foregroundStyle(Color.bMind)
}
DynamicIslandExpandedRegion(.trailing) {
VStack(alignment: .trailing, spacing: 0) {
Text(coherenceText(score))
.font(.system(size: 18, weight: .bold, design: .rounded))
- .foregroundStyle(Color.bRecovery).contentTransition(.numericText())
+ .foregroundStyle(Color.bOnMind).contentTransition(.numericText())
Text("COHERENCE").font(.system(size: 8, weight: .semibold)).tracking(1).foregroundStyle(.secondary)
}
}
@@ -151,18 +161,18 @@ struct OpenStrapBreathingLiveActivity: Widget {
Button(intent: EndBreathingIntent()) {
Label("End session", systemImage: "stop.fill").font(.system(size: 12, weight: .bold))
}
- .tint(Color.bRecovery).buttonBorderShape(.capsule)
+ .tint(Color.bMindFill).buttonBorderShape(.capsule)
}
}
} compactLeading: {
- Image(systemName: "wind").font(.system(size: 14)).foregroundStyle(Color.bRecovery)
+ Image(systemName: "wind").font(.system(size: 14)).foregroundStyle(Color.bMind)
} compactTrailing: {
Text(score >= 0 ? "\(Int(score.rounded()))%" : "·")
- .font(.system(size: 13, weight: .bold, design: .rounded)).foregroundStyle(Color.bRecovery)
+ .font(.system(size: 13, weight: .bold, design: .rounded)).foregroundStyle(Color.bOnMind)
} minimal: {
- Image(systemName: "wind").font(.system(size: 12)).foregroundStyle(Color.bRecovery)
+ Image(systemName: "wind").font(.system(size: 12)).foregroundStyle(Color.bMind)
}
- .keylineTint(Color.bRecovery)
+ .keylineTint(Color.bMind)
}
}
}
diff --git a/ios/OpenStrapWidget/OpenStrapWidget.entitlements b/ios/OpenStrapWidget/OpenStrapWidget.entitlements
deleted file mode 100644
index d9849a81..00000000
--- a/ios/OpenStrapWidget/OpenStrapWidget.entitlements
+++ /dev/null
@@ -1,10 +0,0 @@
-
-
-
-
- com.apple.security.application-groups
-
- $(APP_GROUP_IDENTIFIER)
-
-
-
diff --git a/ios/OpenStrapWidget/OpenStrapWidget.swift b/ios/OpenStrapWidget/OpenStrapWidget.swift
index 99b57963..8dfe7319 100644
--- a/ios/OpenStrapWidget/OpenStrapWidget.swift
+++ b/ios/OpenStrapWidget/OpenStrapWidget.swift
@@ -2,24 +2,48 @@
// OpenStrapWidget.swift
// OpenStrapWidget
//
-// Home/lock-screen widget — "Ember on Paper". Renders the snapshot the app
-// writes into the shared App Group; ALSO self-refreshes ~hourly by fetching
-// /today directly (using the JWT + backend URL the app stores in the group), so
-// it stays current even when the app is fully closed. No @main here — the bundle
-// (OpenStrapWidgetBundle.swift) owns it.
+// Home/lock-screen widget — renders the snapshot the app writes into the shared
+// App Group. Nothing else: this is a local-first app with no backend and no
+// account, so there is nothing for the widget to fetch. (It used to carry a
+// "self-refreshes hourly by fetching /today" path guarded on a JWT that no code
+// ever wrote — dead on every install, and its parser hard-wrote has_data = true,
+// which would have clobbered the app's staleness gate the moment anyone wired it
+// up.) The app calls WidgetService.refresh() after every derive; that is the
+// only refresh there is.
//
// Shows three rings: Strain · Sleep · HRV. (Recovery was retired — the app no
// longer surfaces a recovery score; HRV is the real measured autonomic signal.)
+//
+// HONESTY: nothing here is allowed to look current when it isn't. `has_data`
+// is the Dart side saying "this snapshot is empty or describes a day more than
+// one behind" — but it is a bool frozen at push time, so on a phone that stops
+// syncing it stays true forever. Freshness is therefore computed HERE, at
+// render time, from `updated_at` (see `OpenStrapEntry.fresh`), and every family
+// gates on that. An absent metric is drawn as an empty slot, never as a dash
+// over a ring pinned at zero. The readiness BANDING is not computed here: Dart
+// publishes `readiness_tier` so the phone, the widget, the watch and Siri
+// cannot disagree about what 65 means.
import WidgetKit
import SwiftUI
private let kAppGroup = AppGroup.identifier
-// MARK: - Theme (Ember on Paper / Char)
+// MARK: - Theme (lib/ui2/theme.dart)
// The app writes "theme_dark" into the App Group to mirror its in-app appearance
-// (which already resolves "System" to the actual OS brightness). Surfaces + ink
-// flip between paper and char; the ember coral + ring accents stay constant.
+// (which already resolves "System" to the actual OS brightness).
+//
+// These are ui2's tokens, not the retired lib/theme/tokens.dart ones — the
+// widget sits on the same home screen as the app and had been painting the
+// previous design system's palette. Surfaces are `P.card` (a widget IS a card),
+// the track is `P.track`, muted ink is `P.ink3`.
+//
+// Accents come in two forms, and the distinction is the whole point of ui2's
+// palette: RAW pigment (`C.*`) is for arcs and fills — non-text UI — while an
+// accent used as TEXT is run through `P.on()`, which nudges it toward the page
+// ink until it clears WCAG AA 4.5:1 on the worst surface it can land on. Those
+// solved values are precomputed here (`onGood`/`onWarn`/`onBad`/`onNone`);
+// re-deriving them means running P.on's binary search, not eyeballing a hex.
private extension Color {
init(_ r: Int, _ g: Int, _ b: Int) {
@@ -27,12 +51,29 @@ private extension Color {
}
}
+/// Raw pigment — arcs and fills only. Identical in both themes, like `C` in
+/// lib/ui2/theme.dart.
+enum C {
+ static let green = Color(0x22, 0xC5, 0x5E)
+ static let orange = Color(0xF9, 0x73, 0x16)
+ static let red = Color(0xEF, 0x44, 0x44)
+ static let blue = Color(0x3B, 0x82, 0xF6) // sleep
+ static let purple = Color(0x8B, 0x5C, 0xF6) // strain / movement
+ static let n400 = Color(0x94, 0xA3, 0xB8)
+}
+
private struct Pal {
let bg: Color, ink: Color, inkMuted: Color, track: Color
- static let light = Pal(bg: Color(244, 241, 236), ink: Color(26, 23, 20),
- inkMuted: Color(165, 156, 144), track: Color(236, 231, 223))
- static let dark = Pal(bg: Color(30, 26, 21), ink: Color(241, 236, 227),
- inkMuted: Color(126, 116, 102), track: Color(42, 37, 31))
+ /// Tier accents solved for TEXT (`P.on`), per brightness.
+ let onGood: Color, onWarn: Color, onBad: Color, onNone: Color
+ static let light = Pal(bg: Color(0xFF, 0xFF, 0xFF), ink: Color(0x0F, 0x17, 0x2A),
+ inkMuted: Color(0x62, 0x71, 0x88), track: Color(0xE2, 0xE8, 0xF0),
+ onGood: Color(0x1A, 0x79, 0x48), onWarn: Color(0xA5, 0x52, 0x1D),
+ onBad: Color(0xB9, 0x39, 0x3E), onNone: Color(0x60, 0x6B, 0x80))
+ static let dark = Pal(bg: Color(0x15, 0x1C, 0x26), ink: Color(0xF1, 0xF5, 0xF9),
+ inkMuted: Color(0x7F, 0x8D, 0xA0), track: Color(0x23, 0x2D, 0x3B),
+ onGood: Color(0x22, 0xC5, 0x5E), onWarn: Color(0xF8, 0x7F, 0x2A),
+ onBad: Color(0xEF, 0x73, 0x73), onNone: Color(0x97, 0xA6, 0xBA))
static var isDark: Bool {
UserDefaults(suiteName: kAppGroup)?.object(forKey: "theme_dark") as? Bool ?? false
}
@@ -44,18 +85,30 @@ private extension Color {
static var ink: Color { Pal.current.ink }
static var inkMuted: Color { Pal.current.inkMuted }
static var surfaceAlt: Color { Pal.current.track }
- static let coral = Color(255, 90, 54)
- static let coralDeep = Color(232, 67, 31)
- static let good = Color(43, 182, 115)
- static let sleepBlue = Color(124, 168, 240)
}
// MARK: - Model
+/// How old the snapshot may be before the widget stops presenting it as today's
+/// answer. The app pushes on every completed derivation and on every finished
+/// sync, so under normal use this is refreshed each morning; 26 h is one whole
+/// missed wake cycle plus a couple of hours of grace for a wandering wake time.
+/// Past it, the readiness on the home screen is at best the morning before
+/// last's, and the honest render is the no-data state, not a stale number with
+/// nothing on it to say so.
+///
+/// Kept in step with the same constant on the Watch (WatchMetrics.swift), in
+/// Siri (OpenStrapIntents.swift) and on Android (StrapWidgets.kt) — three
+/// separate build targets, so it cannot be one declaration.
+let kStaleAfter: TimeInterval = 26 * 3600
+
struct OpenStrapEntry: TimelineEntry {
- let date: Date
+ var date: Date
let hasData: Bool
+ let updatedAt: Int // epoch sec of the last push, 0 = unknown
let readiness: Int // -1 = none (composite 0..100) — the headline
+ let tier: Int // -1 = not scored · 0 rest · 1 easy · 2 steady · 3 good
+ let band: String // the phone's own label for `tier` ("Steady", …)
let strain: Double // -1 = none
let sleepMin: Int // -1 = none
let needMin: Int // -1 = none (sleep need, min) — never fabricate 8h
@@ -65,35 +118,84 @@ struct OpenStrapEntry: TimelineEntry {
let coachLine: String
static let placeholder = OpenStrapEntry(
- date: Date(), hasData: true, readiness: 72, strain: 12.4,
- sleepMin: 437, needMin: 480, hrv: 62, hrvBaseline: 58, rhr: 54,
+ date: Date(), hasData: true, updatedAt: Int(Date().timeIntervalSince1970),
+ readiness: 72, tier: 2, band: "Steady",
+ strain: 12.4, sleepMin: 437, needMin: 480, hrv: 62, hrvBaseline: 58, rhr: 54,
coachLine: "Room to push today")
- // Ring fractions (0…1).
- var readinessT: Double { readiness >= 0 ? Double(readiness) / 100.0 : 0 }
+ /// Is this snapshot still today's answer, AS OF THIS ENTRY'S DATE?
+ ///
+ /// `hasData` alone is not enough and never was: it is frozen the moment Dart
+ /// writes it, so a phone that has not synced for a week keeps a week-old
+ /// readiness on the home screen looking exactly like this morning's. The age
+ /// is measured against `date` rather than `Date()` so that WidgetKit can
+ /// render the flip from a timeline entry it already holds — see getTimeline.
+ ///
+ /// An unknown timestamp (0) is not a claim of staleness, matching
+ /// `WidgetService.isStale`; a snapshot that never got a push has `has_data`
+ /// false anyway.
+ var fresh: Bool {
+ guard hasData else { return false }
+ guard updatedAt > 0 else { return true }
+ return date.timeIntervalSince1970 - Double(updatedAt) <= kStaleAfter
+ }
+
+ /// The instant this entry stops being today's answer, or nil if it already is
+ /// not (or never had a timestamp to age).
+ var stalenessDeadline: Date? {
+ guard hasData, updatedAt > 0 else { return nil }
+ let at = Date(timeIntervalSince1970: Double(updatedAt) + kStaleAfter)
+ return at > date ? at : nil
+ }
+
+ func at(_ d: Date) -> OpenStrapEntry { var c = self; c.date = d; return c }
+
+ // Ring fractions (0…1). A negative fraction means "no measurement" — Ring
+ // draws the track only, and no view fills an arc against a value we don't have.
+ var readinessT: Double { readiness >= 0 ? Double(readiness) / 100.0 : -1 }
+ /// Tier → colour. The THRESHOLDS live in Dart (`readinessBand` in
+ /// lib/ui2/screens/home_screen.dart) and arrive as `readiness_tier`; this maps
+ /// the tier onto the widget's own surface palette and nothing more. Do not
+ /// re-derive a band from `readiness` here — that is how the phone, the widget
+ /// and the watch ended up disagreeing about the same score.
+ /// Arc pigment (raw `C`) and text pigment (`P.on`-solved) for the tier.
+ var readinessArc: Color {
+ switch tier {
+ case 3, 2: return C.green
+ case 1: return C.orange
+ case 0: return C.red
+ default: return C.n400
+ }
+ }
var readinessColor: Color {
- if readiness < 0 { return .inkMuted }
- if readiness >= 66 { return .good }
- if readiness >= 40 { return .coral }
- return .coralDeep
+ let p = Pal.current
+ switch tier {
+ case 3, 2: return p.onGood
+ case 1: return p.onWarn
+ case 0: return p.onBad
+ default: return p.onNone
+ }
}
- var strainT: Double { strain >= 0 ? min(strain / 21.0, 1) : 0 }
- var sleepT: Double { (sleepMin >= 0 && needMin > 0) ? min(Double(sleepMin) / Double(needMin), 1) : 0 }
+ /// 0–21 is the real headline scale (`strainScore` log-maps TRIMP onto it —
+ /// analytics/lib/src/onehz/clinical/load_trimp.dart:104-122), not a widget
+ /// invention. Siri says "out of twenty-one" for the same reason.
+ var strainT: Double { strain >= 0 ? min(strain / 21.0, 1) : -1 }
+ var sleepT: Double { (sleepMin >= 0 && needMin > 0) ? min(Double(sleepMin) / Double(needMin), 1) : -1 }
+ /// HRV against YOUR OWN baseline: a full ring is at or above it. There is no
+ /// population scale for RMSSD, so with no baseline there is no denominator
+ /// and the arc is simply not drawn — this used to divide by a hard-coded 100
+ /// (and by 1.5 × baseline), neither of which exists anywhere in the pipeline.
var hrvT: Double {
- guard hrv >= 0 else { return 0 }
- if hrvBaseline > 0 { return min(Double(hrv) / (1.5 * Double(hrvBaseline)), 1) }
- return min(Double(hrv) / 100.0, 1)
- }
- // HRV reads green at/above your baseline, warmer as it drops below it.
- var hrvColor: Color {
- guard hrv >= 0, hrvBaseline > 0 else { return .good }
- if hrv >= hrvBaseline { return .good }
- if hrv >= Int(0.8 * Double(hrvBaseline)) { return .coral }
- return .coralDeep
+ guard hrv >= 0, hrvBaseline > 0 else { return -1 }
+ return min(Double(hrv) / Double(hrvBaseline), 1)
}
+ /// HRV carries its domain accent (`C.green`, as on the phone's Health trend)
+ /// and no colour judgement: a "0.8 × baseline is amber" cut-off was invented
+ /// here and appears in no analytics output.
+ var hrvColor: Color { hrv >= 0 ? C.green : C.n400 }
}
-// MARK: - Shared store (App Group)
+// MARK: - Shared store (App Group, read-only)
private enum Store {
static var defaults: UserDefaults? { UserDefaults(suiteName: kAppGroup) }
@@ -103,7 +205,10 @@ private enum Store {
return OpenStrapEntry(
date: Date(),
hasData: d?.bool(forKey: "has_data") ?? false,
+ updatedAt: d?.object(forKey: "updated_at") as? Int ?? 0,
readiness: d?.object(forKey: "readiness") as? Int ?? -1,
+ tier: d?.object(forKey: "readiness_tier") as? Int ?? -1,
+ band: d?.string(forKey: "readiness_band") ?? "",
strain: d?.object(forKey: "strain") as? Double ?? -1,
sleepMin: d?.object(forKey: "sleep_min") as? Int ?? -1,
needMin: (d?.object(forKey: "sleep_need_min") as? Int) ?? -1,
@@ -112,80 +217,6 @@ private enum Store {
rhr: d?.object(forKey: "rhr") as? Int ?? -1,
coachLine: d?.string(forKey: "coach_line") ?? "")
}
-
- static func write(_ e: OpenStrapEntry) {
- let d = defaults
- d?.set(true, forKey: "has_data")
- d?.set(e.readiness, forKey: "readiness")
- d?.set(e.strain, forKey: "strain")
- d?.set(e.sleepMin, forKey: "sleep_min")
- d?.set(e.needMin, forKey: "sleep_need_min")
- d?.set(e.hrv, forKey: "hrv")
- d?.set(e.hrvBaseline, forKey: "hrv_baseline")
- d?.set(e.rhr, forKey: "rhr")
- d?.set(e.coachLine, forKey: "coach_line")
- d?.set(Int(Date().timeIntervalSince1970), forKey: "updated_at")
- }
-
- static var backendURL: String { defaults?.string(forKey: "backend_url") ?? "" }
- static var jwt: String { defaults?.string(forKey: "access_jwt") ?? "" }
-}
-
-// MARK: - Self-refresh: fetch /today directly
-
-private enum TodayAPI {
- /// GET {url}/today with the stored JWT, parse into an entry. Falls back to the
- /// cached entry on any failure (offline / expired token / parse error).
- static func fetch(fallback: OpenStrapEntry, completion: @escaping (OpenStrapEntry) -> Void) {
- let base = Store.backendURL
- let token = Store.jwt
- guard !base.isEmpty, !token.isEmpty, let url = URL(string: base + "/today") else {
- completion(fallback); return
- }
- var req = URLRequest(url: url)
- req.httpMethod = "GET"
- req.timeoutInterval = 12
- req.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
- URLSession.shared.dataTask(with: req) { data, resp, _ in
- guard
- let http = resp as? HTTPURLResponse, http.statusCode == 200,
- let data = data,
- let json = (try? JSONSerialization.jsonObject(with: data)) as? [String: Any]
- else { completion(fallback); return }
- let entry = parse(json) ?? fallback
- Store.write(entry) // keep the cache fresh for the next instant render
- completion(entry)
- }.resume()
- }
-
- private static func parse(_ j: [String: Any]) -> OpenStrapEntry? {
- func obj(_ m: Any?) -> [String: Any]? { m as? [String: Any] }
- func val(_ parent: [String: Any]?, _ key: String) -> Double? {
- guard let leaf = obj(parent?[key]), let v = leaf["value"] as? NSNumber else { return nil }
- return v.doubleValue
- }
- let daily = obj(j["daily"]); let sleep = obj(j["sleep"]); let coach = obj(j["coach"])
- let hrvObj = obj(j["hrv"]) // top-level { rmssd, baseline, ... }
-
- let readiness = val(daily, "readiness").map { Int($0.rounded()) } ?? -1
- let strain = val(daily, "strain") ?? -1
- let rhr = val(daily, "resting_hr").map { Int($0.rounded()) } ?? -1
- let sleepMin = val(sleep, "duration_min").map { Int($0.rounded()) } ?? -1
- let needMin = val(sleep, "need_min").map { Int($0.rounded()) } ?? -1
- let hrv = (hrvObj?["rmssd"] as? NSNumber).map { Int($0.doubleValue.rounded()) } ?? -1
- let hrvBase = (hrvObj?["baseline"] as? NSNumber).map { Int($0.doubleValue.rounded()) } ?? -1
-
- var coachLine = ""
- if let plan = coach?["plan"] as? [[String: Any]], let first = plan.first,
- let title = first["title"] as? String { coachLine = title }
- else if let tgt = obj(coach?["strain_target"]), let v = tgt["value"] as? NSNumber {
- coachLine = "Aim for strain \(Int(v.doubleValue.rounded()))"
- }
- let hasData = daily != nil || sleep != nil
- return OpenStrapEntry(date: Date(), hasData: hasData, readiness: readiness, strain: strain,
- sleepMin: sleepMin, needMin: needMin, hrv: hrv,
- hrvBaseline: hrvBase, rhr: rhr, coachLine: coachLine)
- }
}
// MARK: - Provider
@@ -198,13 +229,26 @@ struct Provider: TimelineProvider {
}
func getTimeline(in context: Context, completion: @escaping (Timeline) -> Void) {
- let cached = Store.read()
- // Refresh from the network (best-effort); fall back to cache. Re-render hourly.
- TodayAPI.fetch(fallback: cached) { entry in
- let next = Calendar.current.date(byAdding: .hour, value: 1, to: Date())
- ?? Date().addingTimeInterval(3600)
- completion(Timeline(entries: [entry], policy: .after(next)))
- }
+ // Push-driven: the app reloads timelines after every derive. Two things
+ // keep it honest when it doesn't.
+ //
+ // The SECOND ENTRY is the load-bearing one. `fresh` is a function of the
+ // entry's own date, so an entry scheduled at the staleness deadline renders
+ // the no-data state at exactly that moment — WidgetKit switches to it with
+ // no process wake, no budget spend and nothing for the app to do. A widget
+ // that only ever re-read a bool at push time is how a week-old readiness
+ // sat on the home screen looking like this morning's.
+ //
+ // The hourly `.after` is the cheap belt-and-braces: it picks up a new
+ // snapshot the app wrote while we were not reloaded, and re-arms the
+ // deadline entry.
+ let now = Date()
+ let entry = Store.read().at(now)
+ var entries = [entry]
+ if let deadline = entry.stalenessDeadline { entries.append(entry.at(deadline)) }
+ let next = Calendar.current.date(byAdding: .hour, value: 1, to: now)
+ ?? now.addingTimeInterval(3600)
+ completion(Timeline(entries: entries, policy: .after(next)))
}
}
@@ -227,17 +271,22 @@ private struct Ring: View {
}
}
+/// Minutes → "45m" / "7h 05m". Byte-for-byte the phone's `hm()`
+/// (lib/ui2/screens/home_screen.dart) so the same night reads the same on both.
private func hm(_ min: Int) -> String {
- if min < 0 { return "—" }
- let h = min / 60, m = min % 60
- if h == 0 { return "\(m)m" }
- if m == 0 { return "\(h)h" }
- return "\(h)h \(m)m"
+ if min < 0 { return "" }
+ if min < 60 { return "\(min)m" }
+ return String(format: "%dh %02dm", min / 60, min % 60)
}
private func numFont(_ size: CGFloat) -> Font { .system(size: size, weight: .bold, design: .rounded) }
/// One labelled metric ring (used for all three: Strain / Sleep / HRV).
+///
+/// An absent metric is an EMPTY slot: no number, no arc, the whole cell dimmed.
+/// The phone's contract (grammar.dart) is what/why/fix, which does not fit in a
+/// 44pt circle — but a bare "—" over a ring drawn at zero reads as "your HRV is
+/// zero", which is worse than saying nothing. The reason is one tap away.
private struct MetricRing: View {
let label: String
let value: String
@@ -246,6 +295,7 @@ private struct MetricRing: View {
var size: CGFloat = 58
var line: CGFloat = 7
var valueSize: CGFloat = 16
+ private var absent: Bool { value.isEmpty }
var body: some View {
VStack(spacing: 5) {
ZStack {
@@ -255,6 +305,7 @@ private struct MetricRing: View {
.frame(width: size, height: size)
Text(label).font(.system(size: 9, weight: .semibold)).tracking(0.8).foregroundColor(.inkMuted)
}
+ .opacity(absent ? 0.4 : 1)
}
}
@@ -268,13 +319,13 @@ private struct TripleRings: View {
var body: some View {
HStack(spacing: 0) {
MetricRing(label: "STRAIN",
- value: e.strain >= 0 ? String(format: "%.1f", e.strain) : "—",
- t: e.strainT, color: .coral, size: size, line: line, valueSize: valueSize)
+ value: e.strain >= 0 ? String(format: "%.1f", e.strain) : "",
+ t: e.strainT, color: C.purple, size: size, line: line, valueSize: valueSize)
.frame(maxWidth: .infinity)
MetricRing(label: "SLEEP", value: hm(e.sleepMin),
- t: e.sleepT, color: .sleepBlue, size: size, line: line, valueSize: valueSize - 1)
+ t: e.sleepT, color: C.blue, size: size, line: line, valueSize: valueSize - 1)
.frame(maxWidth: .infinity)
- MetricRing(label: "HRV", value: e.hrv >= 0 ? "\(e.hrv)" : "—",
+ MetricRing(label: "HRV", value: e.hrv >= 0 ? "\(e.hrv)" : "",
t: e.hrvT, color: e.hrvColor, size: size, line: line, valueSize: valueSize)
.frame(maxWidth: .infinity)
}
@@ -282,24 +333,35 @@ private struct TripleRings: View {
}
}
-/// Readiness headline row — big ring + score + what it blends.
+/// Readiness headline row — big ring + score + the phone's own band label.
private struct ReadinessRow: View {
let e: OpenStrapEntry
var ring: CGFloat = 64
var body: some View {
HStack(spacing: 12) {
ZStack {
- Ring(t: e.readinessT, color: e.readinessColor, lineWidth: 9)
- Text(e.readiness >= 0 ? "\(e.readiness)" : "—").font(numFont(22)).foregroundColor(e.readinessColor)
+ Ring(t: e.readinessT, color: e.readinessArc, lineWidth: 9)
+ if e.readiness >= 0 {
+ Text("\(e.readiness)").font(numFont(22)).foregroundColor(e.readinessColor)
+ }
}
.frame(width: ring, height: ring)
VStack(alignment: .leading, spacing: 2) {
Text("READINESS").font(.system(size: 10, weight: .semibold)).tracking(1.1).foregroundColor(.inkMuted)
- Text(e.readiness >= 0 ? "HRV recovery + sleep" : "Building baseline")
+ // "Readiness not scored" and nothing more, the same neutral line
+ // `accessoryInline` uses. This said "Still building your baseline",
+ // which is ONE of the reasons and not the common one: with the band
+ // worn by day and off at night there is no measured night at all, and
+ // no reason key crosses the App Group for this side to tell the two
+ // apart. Naming the wrong one is a false claim about the user's state.
+ Text(e.readiness >= 0
+ ? (e.band.isEmpty ? "HRV recovery + sleep" : e.band)
+ : "Readiness not scored")
.font(.system(size: 12)).foregroundColor(.ink)
}
Spacer(minLength: 0)
}
+ .opacity(e.readiness >= 0 ? 1 : 0.55)
}
}
@@ -309,14 +371,14 @@ private struct SmallView: View {
// 2×2: Readiness · Strain / Sleep · HRV.
VStack(spacing: 10) {
HStack(spacing: 0) {
- MetricRing(label: "READY", value: e.readiness >= 0 ? "\(e.readiness)" : "—",
- t: e.readinessT, color: e.readinessColor, size: 44, line: 6, valueSize: 13).frame(maxWidth: .infinity)
- MetricRing(label: "STRAIN", value: e.strain >= 0 ? String(format: "%.1f", e.strain) : "—",
- t: e.strainT, color: .coral, size: 44, line: 6, valueSize: 13).frame(maxWidth: .infinity)
+ MetricRing(label: "READY", value: e.readiness >= 0 ? "\(e.readiness)" : "",
+ t: e.readinessT, color: e.readinessArc, size: 44, line: 6, valueSize: 13).frame(maxWidth: .infinity)
+ MetricRing(label: "STRAIN", value: e.strain >= 0 ? String(format: "%.1f", e.strain) : "",
+ t: e.strainT, color: C.purple, size: 44, line: 6, valueSize: 13).frame(maxWidth: .infinity)
}
HStack(spacing: 0) {
- MetricRing(label: "SLEEP", value: hm(e.sleepMin), t: e.sleepT, color: .sleepBlue, size: 44, line: 6, valueSize: 12).frame(maxWidth: .infinity)
- MetricRing(label: "HRV", value: e.hrv >= 0 ? "\(e.hrv)" : "—", t: e.hrvT, color: e.hrvColor, size: 44, line: 6, valueSize: 13).frame(maxWidth: .infinity)
+ MetricRing(label: "SLEEP", value: hm(e.sleepMin), t: e.sleepT, color: C.blue, size: 44, line: 6, valueSize: 12).frame(maxWidth: .infinity)
+ MetricRing(label: "HRV", value: e.hrv >= 0 ? "\(e.hrv)" : "", t: e.hrvT, color: e.hrvColor, size: 44, line: 6, valueSize: 13).frame(maxWidth: .infinity)
}
}
.padding(12)
@@ -335,41 +397,84 @@ private struct MediumView: View {
}
}
-@available(iOSApplicationExtension 16.0, *)
+/// `has_data == false` — the app is telling us the snapshot is empty or is
+/// describing a day more than one behind. Say that; do not render last week's
+/// readiness at full confidence.
+private struct NoDataView: View {
+ @Environment(\.widgetFamily) var family
+ var body: some View {
+ switch family {
+ case .accessoryCircular:
+ Image(systemName: "bolt.heart").font(.system(size: 18)).widgetAccentable()
+ case .accessoryRectangular:
+ VStack(alignment: .leading, spacing: 2) {
+ Text("No recent data").font(.system(size: 13, weight: .bold)).widgetAccentable()
+ Text("Open OpenStrap and sync your band.")
+ .font(.system(size: 12)).foregroundStyle(.secondary).lineLimit(2)
+ }
+ case .accessoryInline:
+ Text("OpenStrap · no recent data")
+ default:
+ VStack(spacing: 6) {
+ Image(systemName: "bolt.heart").font(.system(size: 22)).foregroundColor(.inkMuted)
+ Text("No recent data")
+ .font(.system(size: 14, weight: .semibold, design: .rounded)).foregroundColor(.ink)
+ Text("Open OpenStrap and sync your band.")
+ .font(.system(size: 11)).multilineTextAlignment(.center).foregroundColor(.inkMuted)
+ }
+ .padding(12)
+ }
+ }
+}
+
private struct AccessoryCircularView: View {
let e: OpenStrapEntry
var body: some View {
- Gauge(value: e.readinessT) {
- Text("RDY")
- } currentValueLabel: {
- Text(e.readiness >= 0 ? "\(e.readiness)" : "—")
+ // No Gauge when there is no score: `Gauge(value: 0)` draws a ring pinned at
+ // empty, which is indistinguishable from "your readiness is 0".
+ if e.readiness >= 0 {
+ Gauge(value: e.readinessT) {
+ Text("RDY")
+ } currentValueLabel: {
+ Text("\(e.readiness)")
+ }
+ .gaugeStyle(.accessoryCircular)
+ .widgetAccentable()
+ } else {
+ VStack(spacing: 0) {
+ Image(systemName: "bolt.heart").font(.system(size: 15)).widgetAccentable()
+ Text("RDY").font(.system(size: 9, weight: .semibold))
+ }
}
- .gaugeStyle(.accessoryCircular)
- .widgetAccentable()
}
}
-@available(iOSApplicationExtension 16.0, *)
private struct AccessoryRectangularView: View {
let e: OpenStrapEntry
var body: some View {
VStack(alignment: .leading, spacing: 2) {
- Text("Readiness \(e.readiness >= 0 ? "\(e.readiness)" : "—")").font(.system(size: 13, weight: .bold)).widgetAccentable()
- Text("Strain \(e.strain >= 0 ? String(format: "%.1f", e.strain) : "—") HRV \(e.hrv >= 0 ? "\(e.hrv)" : "—")")
+ Text(e.readiness >= 0 ? "Readiness \(e.readiness)" : "Readiness not scored")
+ .font(.system(size: 13, weight: .bold)).widgetAccentable()
+ Text(pair("Strain", e.strain >= 0 ? String(format: "%.1f", e.strain) : nil,
+ "HRV", e.hrv >= 0 ? "\(e.hrv)" : nil))
.font(.system(size: 13, weight: .semibold))
- Text("Sleep \(hm(e.sleepMin))" + (e.rhr >= 0 ? " RHR \(e.rhr)" : ""))
+ Text(pair("Sleep", hm(e.sleepMin).isEmpty ? nil : hm(e.sleepMin),
+ "RHR", e.rhr >= 0 ? "\(e.rhr)" : nil))
.font(.system(size: 12)).foregroundStyle(.secondary)
}
}
+
+ /// Two "Label value" pairs, dropping whichever side has no measurement — an
+ /// absent metric is left out of the line rather than printed as a dash.
+ private func pair(_ aLabel: String, _ a: String?, _ bLabel: String, _ b: String?) -> String {
+ [a.map { "\(aLabel) \($0)" }, b.map { "\(bLabel) \($0)" }]
+ .compactMap { $0 }.joined(separator: " ")
+ }
}
private extension View {
@ViewBuilder func widgetBackground(_ color: Color) -> some View {
- if #available(iOSApplicationExtension 17.0, *) {
- containerBackground(color, for: .widget)
- } else {
- background(color)
- }
+ containerBackground(color, for: .widget)
}
}
@@ -384,20 +489,17 @@ struct OpenStrapWidgetEntryView: View {
private var isSystem: Bool { family == .systemSmall || family == .systemMedium }
@ViewBuilder private var content: some View {
- switch family {
- case .systemSmall: SmallView(e: entry)
- case .systemMedium: MediumView(e: entry)
- default:
- if #available(iOSApplicationExtension 16.0, *) {
- switch family {
- case .accessoryCircular: AccessoryCircularView(e: entry)
- case .accessoryRectangular: AccessoryRectangularView(e: entry)
- case .accessoryInline:
- Text("Ready \(entry.readiness >= 0 ? "\(entry.readiness)" : "—") · Strain \(entry.strain >= 0 ? String(format: "%.1f", entry.strain) : "—")")
- default: SmallView(e: entry)
- }
- } else {
- SmallView(e: entry)
+ if !entry.fresh {
+ NoDataView()
+ } else {
+ switch family {
+ case .systemSmall: SmallView(e: entry)
+ case .systemMedium: MediumView(e: entry)
+ case .accessoryCircular: AccessoryCircularView(e: entry)
+ case .accessoryRectangular: AccessoryRectangularView(e: entry)
+ case .accessoryInline:
+ Text(entry.readiness >= 0 ? "Ready \(entry.readiness)" : "Readiness not scored")
+ default: SmallView(e: entry)
}
}
}
@@ -412,13 +514,7 @@ struct OpenStrapWidget: Widget {
}
.configurationDisplayName("OpenStrap")
.description("Readiness, strain, sleep and HRV at a glance.")
- .supportedFamilies(supportedFamilies)
- }
-
- private var supportedFamilies: [WidgetFamily] {
- if #available(iOSApplicationExtension 16.0, *) {
- return [.systemSmall, .systemMedium, .accessoryCircular, .accessoryRectangular, .accessoryInline]
- }
- return [.systemSmall, .systemMedium]
+ .supportedFamilies([.systemSmall, .systemMedium,
+ .accessoryCircular, .accessoryRectangular, .accessoryInline])
}
}
diff --git a/ios/OpenStrapWidget/OpenStrapWidgetBundle.swift b/ios/OpenStrapWidget/OpenStrapWidgetBundle.swift
index 968ac51e..3f83a519 100644
--- a/ios/OpenStrapWidget/OpenStrapWidgetBundle.swift
+++ b/ios/OpenStrapWidget/OpenStrapWidgetBundle.swift
@@ -13,7 +13,6 @@ struct OpenStrapWidgetBundle: WidgetBundle {
var body: some Widget {
OpenStrapWidget()
OpenStrapBatteryWidget()
- OpenStrapWidgetControl()
OpenStrapWidgetLiveActivity()
OpenStrapBreathingLiveActivity()
}
diff --git a/ios/OpenStrapWidget/OpenStrapWidgetControl.swift b/ios/OpenStrapWidget/OpenStrapWidgetControl.swift
deleted file mode 100644
index 3f086fef..00000000
--- a/ios/OpenStrapWidget/OpenStrapWidgetControl.swift
+++ /dev/null
@@ -1,54 +0,0 @@
-//
-// OpenStrapWidgetControl.swift
-// OpenStrapWidget
-//
-// Created by Abdul Sahil - garden on 12/06/26.
-//
-
-import AppIntents
-import SwiftUI
-import WidgetKit
-
-struct OpenStrapWidgetControl: ControlWidget {
- var body: some ControlWidgetConfiguration {
- StaticControlConfiguration(
- kind: Bundle.main.bundleIdentifier ?? "OpenStrapWidget",
- provider: Provider()
- ) { value in
- ControlWidgetToggle(
- "Start Timer",
- isOn: value,
- action: StartTimerIntent()
- ) { isRunning in
- Label(isRunning ? "On" : "Off", systemImage: "timer")
- }
- }
- .displayName("Timer")
- .description("A an example control that runs a timer.")
- }
-}
-
-extension OpenStrapWidgetControl {
- struct Provider: ControlValueProvider {
- var previewValue: Bool {
- false
- }
-
- func currentValue() async throws -> Bool {
- let isRunning = true // Check if the timer is running
- return isRunning
- }
- }
-}
-
-struct StartTimerIntent: SetValueIntent {
- static let title: LocalizedStringResource = "Start a timer"
-
- @Parameter(title: "Timer is running")
- var value: Bool
-
- func perform() async throws -> some IntentResult {
- // Start / stop the timer based on `value`.
- return .result()
- }
-}
diff --git a/ios/OpenStrapWidget/OpenStrapWidgetLiveActivity.swift b/ios/OpenStrapWidget/OpenStrapWidgetLiveActivity.swift
index 5b54a7cd..f14cad05 100644
--- a/ios/OpenStrapWidget/OpenStrapWidgetLiveActivity.swift
+++ b/ios/OpenStrapWidget/OpenStrapWidgetLiveActivity.swift
@@ -37,10 +37,16 @@ struct OpenStrapWidgetAttributes: ActivityAttributes {
var targetKcal: Int
}
-// MARK: - Palette (Ember on Paper / Char, clay)
+// MARK: - Palette (lib/ui2/theme.dart, clay)
// Mirrors the app's in-app appearance via the shared App Group flag "theme_dark"
// (which already accounts for an OS-overriding choice). The clay surface + ink
-// flip; the ember coral + zone accents stay constant in both modes.
+// flip; the accents stay constant in both modes.
+//
+// ui2 tokens, not the retired lib/theme/tokens.dart ones. The clay surface is
+// `P.card` over a `P.card2` sunk well; live HR carries the Heart domain accent
+// (`C.red`, as on the phone's Heart-rate card) and strain the Movement one
+// (`C.purple`). Accent TEXT uses the `P.on()`-solved variant, accent FILL the
+// `P.fill()` one — see the note at the top of OpenStrapWidget.swift.
private let kAppGroup = AppGroup.identifier
@@ -52,11 +58,27 @@ private extension Color {
private struct Pal {
let clayPaper: Color, claySunk: Color, ink: Color, inkMuted: Color
+ /// `P.on(C.red)` / `P.on(C.purple)` — the accents as TEXT on this surface.
+ let onHeart: Color, onMove: Color
+ /// The five HR-zone bands as ui2 draws them: `ZoneBar.pigment` run through
+ /// `P.on` (lib/ui2/charts.dart:729-733), because raw zone 1 measured 1.80:1
+ /// on a light card and read as a pale smear.
+ let zones: [Color]
let isDark: Bool
- static let light = Pal(clayPaper: Color(246, 242, 236), claySunk: Color(232, 226, 217),
- ink: Color(26, 23, 20), inkMuted: Color(150, 142, 131), isDark: false)
- static let dark = Pal(clayPaper: Color(32, 28, 23), claySunk: Color(46, 40, 32),
- ink: Color(241, 236, 227), inkMuted: Color(126, 116, 102), isDark: true)
+ static let light = Pal(clayPaper: Color(0xFF, 0xFF, 0xFF), claySunk: Color(0xF1, 0xF5, 0xF9),
+ ink: Color(0x0F, 0x17, 0x2A), inkMuted: Color(0x62, 0x71, 0x88),
+ onHeart: Color(0xB9, 0x39, 0x3E), onMove: Color(0x74, 0x4E, 0xCF),
+ zones: [Color(0x51, 0x6E, 0x95), Color(0x30, 0x65, 0xC1),
+ Color(0x1A, 0x79, 0x48), Color(0xA5, 0x52, 0x1D),
+ Color(0xB9, 0x39, 0x3E)],
+ isDark: false)
+ static let dark = Pal(clayPaper: Color(0x15, 0x1C, 0x26), claySunk: Color(0x1D, 0x26, 0x32),
+ ink: Color(0xF1, 0xF5, 0xF9), inkMuted: Color(0x7F, 0x8D, 0xA0),
+ onHeart: Color(0xEF, 0x73, 0x73), onMove: Color(0xA9, 0x89, 0xF6),
+ zones: [Color(0x93, 0xC5, 0xFD), Color(0x68, 0x9F, 0xF7),
+ Color(0x22, 0xC5, 0x5E), Color(0xF8, 0x7F, 0x2A),
+ Color(0xEF, 0x73, 0x73)],
+ isDark: true)
static var current: Pal {
(UserDefaults(suiteName: kAppGroup)?.object(forKey: "theme_dark") as? Bool ?? false)
? .dark : .light
@@ -68,18 +90,17 @@ private extension Color {
static var claySunk: Color { Pal.current.claySunk }
static var ink: Color { Pal.current.ink }
static var inkMuted: Color { Pal.current.inkMuted }
- static let coral = Color(255, 90, 54)
- static let coralDeep = Color(232, 67, 31)
+ /// The raw Heart pigment, for glyphs and arcs (non-text UI).
+ static let heart = Color(0xEF, 0x44, 0x44)
+ /// `P.fill(C.red)` — darkened until white on it clears AA. Buttons, tints.
+ static let heartFill = Color(0xD8, 0x3D, 0x3D)
+ static var onHeart: Color { Pal.current.onHeart }
+ static var onMove: Color { Pal.current.onMove }
}
-private let zonePalette: [Color] = [
- Color(124, 168, 240), // Z1 blue
- Color(43, 182, 115), // Z2 green
- Color(255, 90, 54), // Z3 coral
- Color(232, 67, 31), // Z4 deep
- Color(229, 72, 77), // Z5 red
-]
-private func zoneColor(_ z: Int) -> Color { (z >= 1 && z <= 5) ? zonePalette[z - 1] : .inkMuted }
+private func zoneColor(_ z: Int) -> Color {
+ (z >= 1 && z <= 5) ? Pal.current.zones[z - 1] : .inkMuted
+}
// MARK: - Claymorphic surface
@@ -110,9 +131,9 @@ private struct PulseHeart: View {
var body: some View {
if #available(iOSApplicationExtension 17.0, *) {
Image(systemName: "heart.fill").font(.system(size: size))
- .foregroundStyle(Color.coral).symbolEffect(.pulse, options: .repeating)
+ .foregroundStyle(Color.heart).symbolEffect(.pulse, options: .repeating)
} else {
- Image(systemName: "heart.fill").font(.system(size: size)).foregroundStyle(Color.coral)
+ Image(systemName: "heart.fill").font(.system(size: size)).foregroundStyle(Color.heart)
}
}
}
@@ -132,10 +153,13 @@ private struct ZoneBar: View {
}
}
-private func hrText(_ v: Int) -> String { v > 0 ? "\(v)" : "—" }
-// Unscored sessions push null rather than 0 — render the absence.
-private func strainText(_ v: Double?) -> String { v.map { String(format: "%.1f", $0) } ?? "—" }
-private func kcalText(_ v: Int?) -> String { v.map { "\($0)" } ?? "—" }
+// "" = nothing measured. A bare em-dash is the one rendering the phone's
+// grammar forbids outright (lib/ui2/grammar.dart:566-568), and it forbids it
+// here too: the lock screen dims the slot instead. Unscored sessions push null
+// rather than 0, so absence arrives as absence and stays that way.
+private func hrText(_ v: Int) -> String { v > 0 ? "\(v)" : "" }
+private func strainText(_ v: Double?) -> String { v.map { String(format: "%.1f", $0) } ?? "" }
+private func kcalText(_ v: Int?) -> String { v.map { "\($0)" } ?? "" }
// MARK: - Finish (interactive, iOS 17+)
@@ -169,8 +193,8 @@ private struct LockScreenView: View {
}
Spacer()
HStack(spacing: 14) {
- stat("STRAIN", strainText(s.strain), .coralDeep)
- stat("KCAL", kcalText(s.calories), .coral)
+ stat("STRAIN", strainText(s.strain), .onMove)
+ stat("KCAL", kcalText(s.calories), .onHeart)
}
}
VStack(alignment: .leading, spacing: 5) {
@@ -191,6 +215,7 @@ private struct LockScreenView: View {
VStack(spacing: 1) {
Text(value).font(.system(size: 18, weight: .bold, design: .rounded)).foregroundStyle(c)
.contentTransition(.numericText())
+ .opacity(value.isEmpty ? 0.4 : 1)
Text(label).font(.system(size: 8, weight: .semibold)).tracking(1).foregroundStyle(Color.inkMuted)
}
}
@@ -202,7 +227,7 @@ struct OpenStrapWidgetLiveActivity: Widget {
var body: some WidgetConfiguration {
ActivityConfiguration(for: OpenStrapWidgetAttributes.self) { context in
LockScreenView(context: context)
- .activitySystemActionForegroundColor(Color.coralDeep)
+ .activitySystemActionForegroundColor(Color.heartFill)
} dynamicIsland: { context in
let s = context.state
return DynamicIsland {
@@ -217,7 +242,7 @@ struct OpenStrapWidgetLiveActivity: Widget {
VStack(alignment: .trailing, spacing: 0) {
Text(strainText(s.strain))
.font(.system(size: 20, weight: .bold, design: .rounded))
- .foregroundStyle(Color.coral).contentTransition(.numericText())
+ .foregroundStyle(Color.onMove).contentTransition(.numericText())
Text("STRAIN").font(.system(size: 8, weight: .semibold)).tracking(1).foregroundStyle(.secondary)
}
}
@@ -229,12 +254,15 @@ struct OpenStrapWidgetLiveActivity: Widget {
DynamicIslandExpandedRegion(.bottom) {
HStack(spacing: 10) {
ZoneBar(zone: s.zone)
- Text("\(kcalText(s.calories)) kcal").font(.system(size: 12, weight: .semibold)).foregroundStyle(.secondary)
+ // Absent stays absent: a bare " kcal" with nothing in front of it
+ // is the unit claiming a measurement we don't have. The lock
+ // screen dims the empty slot; here the whole label goes.
+ Text(s.calories.map { "\($0) kcal" } ?? "").font(.system(size: 12, weight: .semibold)).foregroundStyle(.secondary)
if #available(iOSApplicationExtension 17.0, *) {
Button(intent: EndSessionIntent()) {
Image(systemName: "stop.fill").font(.system(size: 12, weight: .bold))
}
- .tint(Color.coralDeep).buttonBorderShape(.capsule)
+ .tint(Color.heartFill).buttonBorderShape(.capsule)
}
}.padding(.top, 2)
}
@@ -247,9 +275,9 @@ struct OpenStrapWidgetLiveActivity: Widget {
Text(s.zone >= 1 ? "Z\(s.zone)" : "·")
.font(.system(size: 13, weight: .bold, design: .rounded)).foregroundStyle(zoneColor(s.zone))
} minimal: {
- Text(hrText(s.hr)).font(.system(size: 13, weight: .bold, design: .rounded)).foregroundStyle(Color.coral)
+ Text(hrText(s.hr)).font(.system(size: 13, weight: .bold, design: .rounded)).foregroundStyle(Color.heart)
}
- .keylineTint(Color.coral)
+ .keylineTint(Color.heart)
}
}
}
diff --git a/ios/Podfile.lock b/ios/Podfile.lock
index 74afa0cd..aeb7a31f 100644
--- a/ios/Podfile.lock
+++ b/ios/Podfile.lock
@@ -174,7 +174,7 @@ PODS:
- GoogleUtilities/Network (~> 8.1)
- "GoogleUtilities/NSData+zlib (~> 8.1)"
- nanopb (~> 3.30910.0)
- - GoogleDataTransport (10.1.0):
+ - GoogleDataTransport (10.1.1):
- nanopb (~> 3.30910.0)
- PromisesObjC (~> 2.4)
- GoogleUtilities/AppDelegateSwizzler (8.1.2):
@@ -370,7 +370,7 @@ SPEC CHECKSUMS:
geolocator_apple: ab36aa0e8b7d7a2d7639b3b4e48308394e8cef5e
GoogleAdsOnDeviceConversion: e3b71da24ff4cf01cf520756ac1c2b93c07b86ff
GoogleAppMeasurement: a6d37949071d456e9147dac6789c4342e0e7a8c5
- GoogleDataTransport: aae35b7ea0c09004c3797d53c8c41f66f219d6a7
+ GoogleDataTransport: a24e58982ab3ba2f64d79613e027fe7f57e88539
GoogleUtilities: 766ace00c6b10d8148408f329d10c4f051931850
health: a4ddeac72091000e94776864d0028f6be31ec7a5
home_widget: f169fc41fd807b4d46ab6615dc44d62adbf9f64f
@@ -389,4 +389,4 @@ SPEC CHECKSUMS:
PODFILE CHECKSUM: b50997058227f33b81189532a9f3fc5007ec070b
-COCOAPODS: 1.16.2
+COCOAPODS: 1.17.0
diff --git a/ios/Runner.xcodeproj/project.pbxproj b/ios/Runner.xcodeproj/project.pbxproj
index b32e7afd..4b86b7f2 100644
--- a/ios/Runner.xcodeproj/project.pbxproj
+++ b/ios/Runner.xcodeproj/project.pbxproj
@@ -20,9 +20,11 @@
534897A72FDC2B310033A4D9 /* LiveActivityBridge.swift in Sources */ = {isa = PBXBuildFile; fileRef = 534897A62FDC2B310033A4D9 /* LiveActivityBridge.swift */; };
53962E962FF6EE120061A61B /* WatchBridge.swift in Sources */ = {isa = PBXBuildFile; fileRef = 53962E952FF6EE120061A61B /* WatchBridge.swift */; };
53962E972FF6EE120061A61B /* OpenStrapIntents.swift in Sources */ = {isa = PBXBuildFile; fileRef = 53962E942FF6EE120061A61B /* OpenStrapIntents.swift */; };
+ 60DE9D949573401269D6DF2E /* HealthRoutes.swift in Sources */ = {isa = PBXBuildFile; fileRef = 46A2B400A52A2CA90242C195 /* HealthRoutes.swift */; };
630172CC9317145AD5F8F3B7 /* Pods_RunnerTests.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 2C721EA0C8D31A3834E66203 /* Pods_RunnerTests.framework */; };
74858FAF1ED2DC5600515810 /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 74858FAE1ED2DC5600515810 /* AppDelegate.swift */; };
7884E8682EC3CC0700C636F2 /* SceneDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7884E8672EC3CC0400C636F2 /* SceneDelegate.swift */; };
+ 78A318202AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage in Frameworks */ = {isa = PBXBuildFile; productRef = 78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */; };
97C146FC1CF9000F007C117D /* Main.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FA1CF9000F007C117D /* Main.storyboard */; };
97C146FE1CF9000F007C117D /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FD1CF9000F007C117D /* Assets.xcassets */; };
97C147011CF9000F007C117D /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FF1CF9000F007C117D /* LaunchScreen.storyboard */; };
@@ -99,6 +101,7 @@
331C807B294A618700263BE5 /* RunnerTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = RunnerTests.swift; sourceTree = ""; };
331C8081294A63A400263BE5 /* RunnerTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = RunnerTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
3B3967151E833CAA004F5970 /* AppFrameworkInfo.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; name = AppFrameworkInfo.plist; path = Flutter/AppFrameworkInfo.plist; sourceTree = ""; };
+ 46A2B400A52A2CA90242C195 /* HealthRoutes.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = HealthRoutes.swift; sourceTree = ""; };
5348973B2FDC19C80033A4D9 /* OpenStrapWidgetExtension.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = OpenStrapWidgetExtension.appex; sourceTree = BUILT_PRODUCTS_DIR; };
5348973C2FDC19C80033A4D9 /* WidgetKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = WidgetKit.framework; path = System/Library/Frameworks/WidgetKit.framework; sourceTree = SDKROOT; };
5348973E2FDC19C80033A4D9 /* SwiftUI.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = SwiftUI.framework; path = System/Library/Frameworks/SwiftUI.framework; sourceTree = SDKROOT; };
@@ -116,6 +119,7 @@
74858FAD1ED2DC5600515810 /* Runner-Bridging-Header.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = "Runner-Bridging-Header.h"; sourceTree = ""; };
74858FAE1ED2DC5600515810 /* AppDelegate.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = ""; };
7884E8672EC3CC0400C636F2 /* SceneDelegate.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SceneDelegate.swift; sourceTree = ""; };
+ 78E0A7A72DC9AD7400C4905E /* FlutterGeneratedPluginSwiftPackage */ = {isa = PBXFileReference; lastKnownFileType = wrapper; name = FlutterGeneratedPluginSwiftPackage; path = Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage; sourceTree = ""; };
7AFA3C8E1D35360C0083082E /* Release.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = Release.xcconfig; path = Flutter/Release.xcconfig; sourceTree = ""; };
958D0478FBC7185E997FABAA /* Pods-Runner.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.release.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.release.xcconfig"; sourceTree = ""; };
9740EEB21CF90195004384FC /* Debug.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; name = Debug.xcconfig; path = Flutter/Debug.xcconfig; sourceTree = ""; };
@@ -198,6 +202,7 @@
isa = PBXFrameworksBuildPhase;
buildActionMask = 2147483647;
files = (
+ 78A318202AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage in Frameworks */,
0DCDABAA1F7E5CB91B882313 /* Pods_Runner.framework in Frameworks */,
);
runOnlyForDeploymentPostprocessing = 0;
@@ -236,6 +241,7 @@
9740EEB11CF90186004384FC /* Flutter */ = {
isa = PBXGroup;
children = (
+ 78E0A7A72DC9AD7400C4905E /* FlutterGeneratedPluginSwiftPackage */,
3B3967151E833CAA004F5970 /* AppFrameworkInfo.plist */,
9740EEB21CF90195004384FC /* Debug.xcconfig */,
7AFA3C8E1D35360C0083082E /* Release.xcconfig */,
@@ -292,6 +298,7 @@
606824C7302BC5108CEC40DF /* BleRestoreManager.swift */,
ACCE55E7000000000000F11E /* AccessorySetup.swift */,
0BGTASK00000000000000002 /* BgSyncScheduler.swift */,
+ 46A2B400A52A2CA90242C195 /* HealthRoutes.swift */,
);
path = Runner;
sourceTree = "";
@@ -396,6 +403,9 @@
FADE0004FADE0004FADE0004 /* PBXTargetDependency */,
);
name = Runner;
+ packageProductDependencies = (
+ 78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */,
+ );
productName = Runner;
productReference = 97C146EE1CF9000F007C117D /* Runner.app */;
productType = "com.apple.product-type.application";
@@ -437,6 +447,9 @@
Base,
);
mainGroup = 97C146E51CF9000F007C117D;
+ packageReferences = (
+ 781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "FlutterGeneratedPluginSwiftPackage" */,
+ );
productRefGroup = 97C146EF1CF9000F007C117D /* Products */;
projectDirPath = "";
projectRoot = "";
@@ -541,6 +554,21 @@
shellScript = "diff \"${PODS_PODFILE_DIR_PATH}/Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [ $? != 0 ] ; then\n # print error to STDERR\n echo \"error: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\" >&2\n exit 1\nfi\n# This output is used by Xcode 'outputs' to avoid re-running this script phase.\necho \"SUCCESS\" > \"${SCRIPT_OUTPUT_FILE_0}\"\n";
showEnvVarsInLog = 0;
};
+ 47E3AF2498550A854A4821B6 /* Ensure GoogleService-Info.plist */ = {
+ isa = PBXShellScriptBuildPhase;
+ buildActionMask = 2147483647;
+ files = (
+ );
+ inputPaths = (
+ );
+ name = "Ensure GoogleService-Info.plist";
+ outputPaths = (
+ "$(SRCROOT)/Runner/GoogleService-Info.plist",
+ );
+ runOnlyForDeploymentPostprocessing = 0;
+ shellPath = /bin/sh;
+ shellScript = "# GoogleService-Info.plist is gitignored (no committed credentials, real or\n# placeholder). The Resources phase below still statically references it, so\n# a fresh clone with no Firebase project configured needs SOMETHING on disk\n# at this path or the build fails outright. Generate a format-valid, inert\n# placeholder here (never committed, never overwrites a real file a\n# contributor has placed for their own local Firebase project) so Firebase\n# telemetry stays fully optional at build time, matching the Android side.\n# `-s` (exists AND non-empty), not `-f`: CI writes this file unconditionally\n# from a secret (base64 -d > ...), so an unset/blank secret leaves a 0-byte\n# file that `-f` would treat as \\\"already present\\\" and skip regenerating.\nPLIST=\"$SRCROOT/Runner/GoogleService-Info.plist\"\nif [ ! -s \"$PLIST\" ]; then\n cat > \"$PLIST\" <<'EOF'\n\n\n\n\n\tAPI_KEY\n\tAIzaSyDummyDummyDummyDummyDummyDummyDum\n\tGCM_SENDER_ID\n\t000000000000\n\tPLIST_VERSION\n\t1\n\tBUNDLE_ID\n\twtf.openstrap.dummy\n\tPROJECT_ID\n\tdummy-project\n\tSTORAGE_BUCKET\n\tdummy-project.appspot.com\n\tIS_ADS_ENABLED\n\t\n\tIS_ANALYTICS_ENABLED\n\t\n\tIS_APPINVITE_ENABLED\n\t\n\tIS_GCM_ENABLED\n\t\n\tIS_SIGNIN_ENABLED\n\t\n\tGOOGLE_APP_ID\n\t1:000000000000:ios:0000000000000000000000\n\n\nEOF\nfi\n";
+ };
937F4BC2D23308952D408C29 /* [CP] Check Pods Manifest.lock */ = {
isa = PBXShellScriptBuildPhase;
buildActionMask = 2147483647;
@@ -578,21 +606,6 @@
shellPath = /bin/sh;
shellScript = "/bin/sh \"$FLUTTER_ROOT/packages/flutter_tools/bin/xcode_backend.sh\" build";
};
- 47E3AF2498550A854A4821B6 /* Ensure GoogleService-Info.plist */ = {
- isa = PBXShellScriptBuildPhase;
- buildActionMask = 2147483647;
- files = (
- );
- inputPaths = (
- );
- name = "Ensure GoogleService-Info.plist";
- outputPaths = (
- "$(SRCROOT)/Runner/GoogleService-Info.plist",
- );
- runOnlyForDeploymentPostprocessing = 0;
- shellPath = /bin/sh;
- shellScript = "# GoogleService-Info.plist is gitignored (no committed credentials, real or\n# placeholder). The Resources phase below still statically references it, so\n# a fresh clone with no Firebase project configured needs SOMETHING on disk\n# at this path or the build fails outright. Generate a format-valid, inert\n# placeholder here (never committed, never overwrites a real file a\n# contributor has placed for their own local Firebase project) so Firebase\n# telemetry stays fully optional at build time, matching the Android side.\n# `-s` (exists AND non-empty), not `-f`: CI writes this file unconditionally\n# from a secret (base64 -d > ...), so an unset/blank secret leaves a 0-byte\n# file that `-f` would treat as \\\"already present\\\" and skip regenerating.\nPLIST=\"$SRCROOT/Runner/GoogleService-Info.plist\"\nif [ ! -s \"$PLIST\" ]; then\n cat > \"$PLIST\" <<'EOF'\n\n\n\n\n\tAPI_KEY\n\tAIzaSyDummyDummyDummyDummyDummyDummyDum\n\tGCM_SENDER_ID\n\t000000000000\n\tPLIST_VERSION\n\t1\n\tBUNDLE_ID\n\twtf.openstrap.dummy\n\tPROJECT_ID\n\tdummy-project\n\tSTORAGE_BUCKET\n\tdummy-project.appspot.com\n\tIS_ADS_ENABLED\n\t\n\tIS_ANALYTICS_ENABLED\n\t\n\tIS_APPINVITE_ENABLED\n\t\n\tIS_GCM_ENABLED\n\t\n\tIS_SIGNIN_ENABLED\n\t\n\tGOOGLE_APP_ID\n\t1:000000000000:ios:0000000000000000000000\n\n\nEOF\nfi\n";
- };
AEFDDC7BFE6597FE6A6F1BB9 /* FlutterFire: "flutterfire upload-crashlytics-symbols" */ = {
isa = PBXShellScriptBuildPhase;
buildActionMask = 2147483647;
@@ -666,6 +679,7 @@
46AF580757DC25648B6B0C95 /* BleRestoreManager.swift in Sources */,
ACCE55E7000000000000B11D /* AccessorySetup.swift in Sources */,
0BGTASK00000000000000001 /* BgSyncScheduler.swift in Sources */,
+ 60DE9D949573401269D6DF2E /* HealthRoutes.swift in Sources */,
);
runOnlyForDeploymentPostprocessing = 0;
};
@@ -767,6 +781,8 @@
baseConfigurationReference = 7AFA3C8E1D35360C0083082E /* Release.xcconfig */;
buildSettings = {
ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+ ASSETCATALOG_COMPILER_ALTERNATE_APPICON_NAMES = AppIconBW;
+ ASSETCATALOG_COMPILER_INCLUDE_ALL_APPICON_ASSETS = YES;
CLANG_ENABLE_MODULES = YES;
CODE_SIGN_ENTITLEMENTS = Runner/Runner.entitlements;
CURRENT_PROJECT_VERSION = "$(FLUTTER_BUILD_NUMBER)";
@@ -858,7 +874,7 @@
INFOPLIST_KEY_CFBundleDisplayName = OpenStrapWidget;
INFOPLIST_KEY_NSHumanReadableCopyright = "";
INFOPLIST_KEY_OpenStrapAppGroupIdentifier = "$(APP_GROUP_IDENTIFIER)";
- IPHONEOS_DEPLOYMENT_TARGET = 26.5;
+ IPHONEOS_DEPLOYMENT_TARGET = 17.0;
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
"@executable_path/Frameworks",
@@ -905,7 +921,7 @@
INFOPLIST_KEY_CFBundleDisplayName = OpenStrapWidget;
INFOPLIST_KEY_NSHumanReadableCopyright = "";
INFOPLIST_KEY_OpenStrapAppGroupIdentifier = "$(APP_GROUP_IDENTIFIER)";
- IPHONEOS_DEPLOYMENT_TARGET = 26.5;
+ IPHONEOS_DEPLOYMENT_TARGET = 17.0;
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
"@executable_path/Frameworks",
@@ -949,7 +965,7 @@
INFOPLIST_KEY_CFBundleDisplayName = OpenStrapWidget;
INFOPLIST_KEY_NSHumanReadableCopyright = "";
INFOPLIST_KEY_OpenStrapAppGroupIdentifier = "$(APP_GROUP_IDENTIFIER)";
- IPHONEOS_DEPLOYMENT_TARGET = 26.5;
+ IPHONEOS_DEPLOYMENT_TARGET = 17.0;
LD_RUNPATH_SEARCH_PATHS = (
"$(inherited)",
"@executable_path/Frameworks",
@@ -1246,6 +1262,8 @@
baseConfigurationReference = 9740EEB21CF90195004384FC /* Debug.xcconfig */;
buildSettings = {
ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+ ASSETCATALOG_COMPILER_ALTERNATE_APPICON_NAMES = AppIconBW;
+ ASSETCATALOG_COMPILER_INCLUDE_ALL_APPICON_ASSETS = YES;
CLANG_ENABLE_MODULES = YES;
CODE_SIGN_ENTITLEMENTS = Runner/Runner.entitlements;
CURRENT_PROJECT_VERSION = "$(FLUTTER_BUILD_NUMBER)";
@@ -1270,6 +1288,8 @@
baseConfigurationReference = 7AFA3C8E1D35360C0083082E /* Release.xcconfig */;
buildSettings = {
ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+ ASSETCATALOG_COMPILER_ALTERNATE_APPICON_NAMES = AppIconBW;
+ ASSETCATALOG_COMPILER_INCLUDE_ALL_APPICON_ASSETS = YES;
CLANG_ENABLE_MODULES = YES;
CODE_SIGN_ENTITLEMENTS = Runner/Runner.entitlements;
CURRENT_PROJECT_VERSION = "$(FLUTTER_BUILD_NUMBER)";
@@ -1342,6 +1362,20 @@
defaultConfigurationName = Release;
};
/* End XCConfigurationList section */
+
+/* Begin XCLocalSwiftPackageReference section */
+ 781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "FlutterGeneratedPluginSwiftPackage" */ = {
+ isa = XCLocalSwiftPackageReference;
+ relativePath = Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage;
+ };
+/* End XCLocalSwiftPackageReference section */
+
+/* Begin XCSwiftPackageProductDependency section */
+ 78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */ = {
+ isa = XCSwiftPackageProductDependency;
+ productName = FlutterGeneratedPluginSwiftPackage;
+ };
+/* End XCSwiftPackageProductDependency section */
};
rootObject = 97C146E61CF9000F007C117D /* Project object */;
}
diff --git a/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme b/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme
index e3773d42..c3fedb29 100644
--- a/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme
+++ b/ios/Runner.xcodeproj/xcshareddata/xcschemes/Runner.xcscheme
@@ -5,6 +5,24 @@
+
+
+
+
+
+
+
+
+
+
from else {
+ result(0)
+ return
+ }
+ guard from >= Date().addingTimeInterval(-cacheWindow) else {
+ result(notCovered)
+ return
+ }
+ pedometer.queryPedometerData(from: from, to: to) { data, error in
+ DispatchQueue.main.async {
+ guard let data = data, error == nil else {
+ result(nil)
+ return
+ }
+ result(data.numberOfSteps.intValue)
+ }
+ }
+
+ default:
+ result(FlutterMethodNotImplemented)
+ }
+ }
+ }
+}
+
// Band-gesture actions on iOS. Media control is deliberately NOT offered: iOS has no
// public API to control a third-party player (Spotify et al.) — only Apple Music via
// systemMusicPlayer — so advertising it would be misleading. The only sanctioned
@@ -175,3 +293,47 @@ enum ActionBridge {
}
}
}
+
+/// Switching the home-screen icon.
+///
+/// `setAlternateIconName` is the only public way to do this, and it comes with
+/// a cost the UI has to be honest about: iOS puts up its own "You have changed
+/// the icon for OpenStrap" alert on every change, and there is no way to
+/// suppress it. The icons themselves are compiled into the asset catalog
+/// (AppIcon / AppIconBW) and named by ASSETCATALOG_COMPILER_ALTERNATE_APPICON_NAMES
+/// in the Runner target — nothing here can invent one that was not built in.
+///
+/// `available` is asked rather than assumed: alternate icons are refused on some
+/// managed/enterprise configurations, and a settings row that cannot work should
+/// not be drawn.
+enum AppIconBridge {
+ private static let channelName = "openstrap/app_icon"
+
+ static func register(messenger: FlutterBinaryMessenger) {
+ let channel = FlutterMethodChannel(name: channelName, binaryMessenger: messenger)
+ channel.setMethodCallHandler { call, result in
+ switch call.method {
+ case "available":
+ result(UIApplication.shared.supportsAlternateIcons)
+ case "current":
+ // nil means the primary icon. iOS owns this state — nothing is mirrored
+ // into prefs, so the app can never disagree with the home screen.
+ result(UIApplication.shared.alternateIconName)
+ case "set":
+ guard UIApplication.shared.supportsAlternateIcons else {
+ result(false)
+ return
+ }
+ let name = (call.arguments as? [String: Any])?["name"] as? String
+ UIApplication.shared.setAlternateIconName(name) { error in
+ if let error = error {
+ NSLog("[app_icon] setAlternateIconName(\(name ?? "nil")) failed: \(error)")
+ }
+ result(error == nil)
+ }
+ default:
+ result(FlutterMethodNotImplemented)
+ }
+ }
+ }
+}
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-1024x1024@1x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-1024x1024@1x.png
index d5e1e7b8..cba651ab 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-1024x1024@1x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-1024x1024@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@1x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@1x.png
index 59a05975..f7ed7c5a 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@1x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@2x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@2x.png
index 03388cb5..43910ade 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@2x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@3x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@3x.png
index 0d285034..ddffdb30 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@3x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@3x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@1x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@1x.png
index 835273fe..9fcaf9e4 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@1x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@2x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@2x.png
index 90c20740..31d05139 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@2x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@3x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@3x.png
index 5731414c..37767b3e 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@3x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-29x29@3x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@1x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@1x.png
index 03388cb5..43910ade 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@1x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@2x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@2x.png
index 6a05fa22..77c9e19a 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@2x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@3x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@3x.png
index 0354f826..deedab73 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@3x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-40x40@3x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-50x50@1x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-50x50@1x.png
index 5e39c02d..8394f961 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-50x50@1x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-50x50@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-50x50@2x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-50x50@2x.png
index e4ecfad3..065dc987 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-50x50@2x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-50x50@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-57x57@1x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-57x57@1x.png
index 2e701207..ae81588d 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-57x57@1x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-57x57@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-57x57@2x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-57x57@2x.png
index 410b5ce3..df8c3e54 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-57x57@2x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-57x57@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-60x60@2x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-60x60@2x.png
index 0354f826..deedab73 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-60x60@2x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-60x60@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-60x60@3x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-60x60@3x.png
index a9c0089d..1f989cf5 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-60x60@3x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-60x60@3x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-72x72@1x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-72x72@1x.png
index 2fc52a5b..804ea9cb 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-72x72@1x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-72x72@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-72x72@2x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-72x72@2x.png
index e2a9f247..48b87c6f 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-72x72@2x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-72x72@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-76x76@1x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-76x76@1x.png
index 7aad4884..dde0d505 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-76x76@1x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-76x76@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-76x76@2x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-76x76@2x.png
index 43146a01..7149b95f 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-76x76@2x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-76x76@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-83.5x83.5@2x.png b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-83.5x83.5@2x.png
index 00d64ace..073d8859 100644
Binary files a/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-83.5x83.5@2x.png and b/ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-83.5x83.5@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Contents.json b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Contents.json
new file mode 100644
index 00000000..75c10194
--- /dev/null
+++ b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Contents.json
@@ -0,0 +1,116 @@
+{
+ "images": [
+ {
+ "size": "20x20",
+ "idiom": "iphone",
+ "filename": "Icon-BW-20x20@2x.png",
+ "scale": "2x"
+ },
+ {
+ "size": "20x20",
+ "idiom": "iphone",
+ "filename": "Icon-BW-20x20@3x.png",
+ "scale": "3x"
+ },
+ {
+ "size": "29x29",
+ "idiom": "iphone",
+ "filename": "Icon-BW-29x29@1x.png",
+ "scale": "1x"
+ },
+ {
+ "size": "29x29",
+ "idiom": "iphone",
+ "filename": "Icon-BW-29x29@2x.png",
+ "scale": "2x"
+ },
+ {
+ "size": "29x29",
+ "idiom": "iphone",
+ "filename": "Icon-BW-29x29@3x.png",
+ "scale": "3x"
+ },
+ {
+ "size": "40x40",
+ "idiom": "iphone",
+ "filename": "Icon-BW-40x40@2x.png",
+ "scale": "2x"
+ },
+ {
+ "size": "40x40",
+ "idiom": "iphone",
+ "filename": "Icon-BW-40x40@3x.png",
+ "scale": "3x"
+ },
+ {
+ "size": "60x60",
+ "idiom": "iphone",
+ "filename": "Icon-BW-60x60@2x.png",
+ "scale": "2x"
+ },
+ {
+ "size": "60x60",
+ "idiom": "iphone",
+ "filename": "Icon-BW-60x60@3x.png",
+ "scale": "3x"
+ },
+ {
+ "size": "20x20",
+ "idiom": "ipad",
+ "filename": "Icon-BW-20x20@1x.png",
+ "scale": "1x"
+ },
+ {
+ "size": "20x20",
+ "idiom": "ipad",
+ "filename": "Icon-BW-20x20@2x.png",
+ "scale": "2x"
+ },
+ {
+ "size": "29x29",
+ "idiom": "ipad",
+ "filename": "Icon-BW-29x29@1x.png",
+ "scale": "1x"
+ },
+ {
+ "size": "29x29",
+ "idiom": "ipad",
+ "filename": "Icon-BW-29x29@2x.png",
+ "scale": "2x"
+ },
+ {
+ "size": "40x40",
+ "idiom": "ipad",
+ "filename": "Icon-BW-40x40@1x.png",
+ "scale": "1x"
+ },
+ {
+ "size": "40x40",
+ "idiom": "ipad",
+ "filename": "Icon-BW-40x40@2x.png",
+ "scale": "2x"
+ },
+ {
+ "size": "76x76",
+ "idiom": "ipad",
+ "filename": "Icon-BW-76x76@1x.png",
+ "scale": "1x"
+ },
+ {
+ "size": "76x76",
+ "idiom": "ipad",
+ "filename": "Icon-BW-76x76@2x.png",
+ "scale": "2x"
+ },
+ {
+ "size": "83.5x83.5",
+ "idiom": "ipad",
+ "filename": "Icon-BW-83.5x83.5@2x.png",
+ "scale": "2x"
+ }
+ ],
+ "info": {
+ "version": 1,
+ "author": "xcode"
+ }
+}
\ No newline at end of file
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-20x20@1x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-20x20@1x.png
new file mode 100644
index 00000000..ed43ffaa
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-20x20@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-20x20@2x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-20x20@2x.png
new file mode 100644
index 00000000..923b33ec
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-20x20@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-20x20@3x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-20x20@3x.png
new file mode 100644
index 00000000..6270e041
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-20x20@3x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-29x29@1x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-29x29@1x.png
new file mode 100644
index 00000000..eb7965ed
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-29x29@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-29x29@2x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-29x29@2x.png
new file mode 100644
index 00000000..f09f53d4
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-29x29@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-29x29@3x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-29x29@3x.png
new file mode 100644
index 00000000..ab86af1f
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-29x29@3x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-40x40@1x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-40x40@1x.png
new file mode 100644
index 00000000..923b33ec
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-40x40@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-40x40@2x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-40x40@2x.png
new file mode 100644
index 00000000..2ac05090
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-40x40@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-40x40@3x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-40x40@3x.png
new file mode 100644
index 00000000..4cf27dd4
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-40x40@3x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-60x60@2x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-60x60@2x.png
new file mode 100644
index 00000000..4cf27dd4
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-60x60@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-60x60@3x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-60x60@3x.png
new file mode 100644
index 00000000..64789f64
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-60x60@3x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-76x76@1x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-76x76@1x.png
new file mode 100644
index 00000000..d70633c2
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-76x76@1x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-76x76@2x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-76x76@2x.png
new file mode 100644
index 00000000..588e6c5b
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-76x76@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-83.5x83.5@2x.png b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-83.5x83.5@2x.png
new file mode 100644
index 00000000..babb7e78
Binary files /dev/null and b/ios/Runner/Assets.xcassets/AppIconBW.appiconset/Icon-BW-83.5x83.5@2x.png differ
diff --git a/ios/Runner/Assets.xcassets/LaunchBackground.colorset/Contents.json b/ios/Runner/Assets.xcassets/LaunchBackground.colorset/Contents.json
index 19292716..0139c048 100644
--- a/ios/Runner/Assets.xcassets/LaunchBackground.colorset/Contents.json
+++ b/ios/Runner/Assets.xcassets/LaunchBackground.colorset/Contents.json
@@ -5,9 +5,9 @@
"color-space" : "srgb",
"components" : {
"alpha" : "1.000",
- "blue" : "0xEC",
- "green" : "0xF1",
- "red" : "0xF4"
+ "blue" : "0xFC",
+ "green" : "0xFA",
+ "red" : "0xF8"
}
},
"idiom" : "universal"
@@ -23,9 +23,9 @@
"color-space" : "srgb",
"components" : {
"alpha" : "1.000",
- "blue" : "0x0D",
- "green" : "0x11",
- "red" : "0x14"
+ "blue" : "0x17",
+ "green" : "0x10",
+ "red" : "0x0B"
}
},
"idiom" : "universal"
diff --git a/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json b/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json
deleted file mode 100644
index 0bedcf2f..00000000
--- a/ios/Runner/Assets.xcassets/LaunchImage.imageset/Contents.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
- "images" : [
- {
- "idiom" : "universal",
- "filename" : "LaunchImage.png",
- "scale" : "1x"
- },
- {
- "idiom" : "universal",
- "filename" : "LaunchImage@2x.png",
- "scale" : "2x"
- },
- {
- "idiom" : "universal",
- "filename" : "LaunchImage@3x.png",
- "scale" : "3x"
- }
- ],
- "info" : {
- "version" : 1,
- "author" : "xcode"
- }
-}
diff --git a/ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage.png b/ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage.png
deleted file mode 100644
index bf1b93a1..00000000
Binary files a/ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage.png and /dev/null differ
diff --git a/ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage@2x.png b/ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage@2x.png
deleted file mode 100644
index 664f151c..00000000
Binary files a/ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage@2x.png and /dev/null differ
diff --git a/ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage@3x.png b/ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage@3x.png
deleted file mode 100644
index 89f9b6b7..00000000
Binary files a/ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage@3x.png and /dev/null differ
diff --git a/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md b/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md
deleted file mode 100644
index 89c2725b..00000000
--- a/ios/Runner/Assets.xcassets/LaunchImage.imageset/README.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# Launch Screen Assets
-
-You can customize the launch screen with your own desired assets by replacing the image files in this directory.
-
-You can also do it by opening your Flutter project's Xcode project with `open ios/Runner.xcworkspace`, selecting `Runner/Assets.xcassets` in the Project Navigator and dropping in the desired images.
\ No newline at end of file
diff --git a/ios/Runner/Base.lproj/LaunchScreen.storyboard b/ios/Runner/Base.lproj/LaunchScreen.storyboard
index ad5c6556..fa344125 100644
--- a/ios/Runner/Base.lproj/LaunchScreen.storyboard
+++ b/ios/Runner/Base.lproj/LaunchScreen.storyboard
@@ -1,4 +1,18 @@
+
@@ -15,15 +29,7 @@
-
-
-
-
-
-
-
-
@@ -31,7 +37,4 @@
-
-
-
diff --git a/ios/Runner/HealthRoutes.swift b/ios/Runner/HealthRoutes.swift
new file mode 100644
index 00000000..6678388a
--- /dev/null
+++ b/ios/Runner/HealthRoutes.swift
@@ -0,0 +1,173 @@
+import CoreLocation
+import Flutter
+import HealthKit
+
+// HKWorkoutRoute → Dart. The `health` plugin this app already depends on reads
+// workouts but has no route API whatsoever (the string "route" does not appear
+// anywhere in health 11.1.1's lib/, ios/ or android/ sources), and a route is
+// the one thing in an imported workout that cannot be reconstructed from the
+// summary. So: the smallest possible channel — one method, coordinates only.
+//
+// Workouts themselves are deliberately NOT read here. The plugin already does
+// that correctly on both platforms, and duplicating it natively would mean two
+// definitions of "a workout" that could drift. This returns coordinates keyed
+// by the workout's uuid, and Dart joins them to the workouts it already has.
+//
+// The uuid string is `workout.uuid.uuidString`, which is byte-identical to what
+// the plugin emits for the same sample ("\(sample.uuid)"), so the join is exact
+// rather than a start-time match with a tolerance.
+enum HealthRouteBridge {
+ private static let channelName = "openstrap/health_routes"
+ private static let store = HKHealthStore()
+
+ /// One point per this many seconds. HKWorkoutRoute delivers roughly 1 Hz, so
+ /// an hour's run is ~3600 locations and a 90-day import is easily a million
+ /// rows — for a line on a map that is a few hundred pixels wide.
+ ///
+ /// ponytail: fixed 5 s decimation. If a route ever needs real per-point
+ /// analysis (grade, live pace) rather than drawing, take the raw cadence and
+ /// decimate at read time instead.
+ private static let minPointInterval: TimeInterval = 5
+
+ static func register(messenger: FlutterBinaryMessenger) {
+ let channel = FlutterMethodChannel(name: channelName, binaryMessenger: messenger)
+ channel.setMethodCallHandler { call, result in
+ switch call.method {
+ case "routes":
+ guard HKHealthStore.isHealthDataAvailable() else {
+ result([]) // iPad and the simulator. Not an error, just no store.
+ return
+ }
+ let args = call.arguments as? [String: Any] ?? [:]
+ guard let fromMs = args["fromMs"] as? Int, let toMs = args["toMs"] as? Int else {
+ result([])
+ return
+ }
+ let from = Date(timeIntervalSince1970: Double(fromMs) / 1000)
+ let to = Date(timeIntervalSince1970: Double(toMs) / 1000)
+ // `HKSeriesType.workoutRoute()` is a SEPARATE read authorization from
+ // the workout type, and the `health` plugin requests only the latter —
+ // so without this the route query returns nothing on a store the user
+ // has already granted workouts for, which is indistinguishable from
+ // owning no routes. Idempotent: HealthKit re-prompts only for types the
+ // user has not yet decided on.
+ //
+ // The grant is deliberately not checked. Apple does not report READ
+ // denial (`authorizationStatus` answers for writes only, by design, so
+ // an app cannot detect what it is being refused) — an empty result is
+ // the only honest answer to both "denied" and "none recorded".
+ store.requestAuthorization(
+ toShare: [], read: [HKSeriesType.workoutRoute(), HKObjectType.workoutType()]
+ ) { _, _ in
+ routes(
+ from: from, to: to,
+ completion: { payload in
+ DispatchQueue.main.async { result(payload) }
+ })
+ }
+
+ default:
+ result(FlutterMethodNotImplemented)
+ }
+ }
+ }
+
+ /// Every workout in the window that HAS a route, as
+ /// `[{uuid, points: [[lat, lng, alt, tsMs], …]}]`.
+ ///
+ /// Workouts without a route are omitted entirely rather than returned with an
+ /// empty list: Dart stores the workouts from the plugin regardless, and an
+ /// empty entry here would only be a second way of saying nothing.
+ private static func routes(
+ from: Date, to: Date, completion: @escaping ([[String: Any]]) -> Void
+ ) {
+ let predicate = HKQuery.predicateForSamples(withStart: from, end: to, options: [])
+ let query = HKSampleQuery(
+ sampleType: HKObjectType.workoutType(), predicate: predicate,
+ limit: HKObjectQueryNoLimit, sortDescriptors: nil
+ ) { _, samples, error in
+ guard let workouts = samples as? [HKWorkout], error == nil, !workouts.isEmpty else {
+ completion([])
+ return
+ }
+ // Each workout's route is its own async query, so collect under a group
+ // and answer once. Serialised through a queue rather than a lock: the
+ // HealthKit callbacks arrive on arbitrary threads and `out` is a value
+ // type, so appending from several of them at once is a data race.
+ let group = DispatchGroup()
+ let queue = DispatchQueue(label: "openstrap.health.routes")
+ var out: [[String: Any]] = []
+ for workout in workouts {
+ group.enter()
+ points(for: workout) { pts in
+ if !pts.isEmpty {
+ queue.async {
+ out.append(["uuid": workout.uuid.uuidString, "points": pts])
+ group.leave()
+ }
+ } else {
+ group.leave()
+ }
+ }
+ }
+ group.notify(queue: queue) { completion(out) }
+ }
+ store.execute(query)
+ }
+
+ /// The decimated coordinate list for one workout, or empty if it has none.
+ private static func points(
+ for workout: HKWorkout, completion: @escaping ([[Any]]) -> Void
+ ) {
+ let routeQuery = HKSampleQuery(
+ sampleType: HKSeriesType.workoutRoute(),
+ predicate: HKQuery.predicateForObjects(from: workout),
+ limit: HKObjectQueryNoLimit, sortDescriptors: nil
+ ) { _, samples, error in
+ guard let routes = samples as? [HKWorkoutRoute], error == nil, !routes.isEmpty else {
+ completion([]) // No route, or the user withheld it. Both mean no line.
+ return
+ }
+ let group = DispatchGroup()
+ let queue = DispatchQueue(label: "openstrap.health.route.points")
+ var all: [CLLocation] = []
+ for route in routes {
+ group.enter()
+ // HKWorkoutRouteQuery streams in batches and calls back repeatedly
+ // until `done`. Leaving the group on anything else double-counts the
+ // route and the completion fires while points are still arriving.
+ let q = HKWorkoutRouteQuery(route: route) { _, locations, done, _ in
+ if let locations = locations {
+ queue.async { all.append(contentsOf: locations) }
+ }
+ if done { queue.async { group.leave() } }
+ }
+ store.execute(q)
+ }
+ group.notify(queue: queue) {
+ let sorted = all.sorted { $0.timestamp < $1.timestamp }
+ var out: [[Any]] = []
+ var lastKept: Date?
+ for loc in sorted {
+ // A negative horizontal accuracy means the fix is invalid — Apple's
+ // own sentinel. Drawing it puts a spike through the middle of the map.
+ guard loc.horizontalAccuracy >= 0 else { continue }
+ if let last = lastKept,
+ loc.timestamp.timeIntervalSince(last) < minPointInterval
+ {
+ continue
+ }
+ lastKept = loc.timestamp
+ out.append([
+ loc.coordinate.latitude,
+ loc.coordinate.longitude,
+ loc.altitude,
+ Int(loc.timestamp.timeIntervalSince1970 * 1000),
+ ])
+ }
+ completion(out)
+ }
+ }
+ store.execute(routeQuery)
+ }
+}
diff --git a/ios/Runner/Info.plist b/ios/Runner/Info.plist
index 45d903a2..338d3723 100644
--- a/ios/Runner/Info.plist
+++ b/ios/Runner/Info.plist
@@ -71,8 +71,21 @@
LSSupportsOpeningDocumentsInPlace
+
NSHealthShareUsageDescription
- OpenStrap reads your step count from Apple Health to show your daily steps, and reads back its own recent samples so it never writes duplicates.
+ OpenStrap reads your height, weight, date of birth and sex to set up your profile; your resting heart rate so it has a starting baseline; any blood pressure, blood glucose or body temperature readings, so a device that is cleared to measure those can sit beside your own data with that device's name on it — never blended into an OpenStrap number; and your workouts and their routes, so a run recorded by another app can be listed and drawn on a map here, named with the app that recorded it and never counted as one OpenStrap measured. It also reads back its own recent samples so it never writes duplicates.
+
+ NSMotionUsageDescription
+ OpenStrap counts your daily steps from this iPhone's own motion chip, because a band on your wrist cannot tell walking from stirring a pot, and the phone in your pocket can. It reads step counts only — never your location or anything else the motion chip records — and only the last few days of them. Your steps stay on this device and are never uploaded.
+ NSCameraUsageDescription
+ OpenStrap uses the camera to read the barcode on a food packet, so logging a meal does not mean typing its nutrition panel out by hand. It reads the barcode digits and nothing else — no photo is taken, kept, or sent anywhere.
NSHealthUpdateUsageDescription
OpenStrap writes your sleep, resting heart rate, HRV, respiratory rate, energy and workouts into Apple Health.
NSBluetoothPeripheralUsageDescription
diff --git a/ios/WatchBridge.swift b/ios/WatchBridge.swift
index e298d771..5e0bd21b 100644
--- a/ios/WatchBridge.swift
+++ b/ios/WatchBridge.swift
@@ -1,11 +1,11 @@
// WatchBridge — phone → Apple Watch data ferry (WatchConnectivity).
//
// iPhone and Apple Watch do NOT share an App Group container (they're separate
-// devices), so the watch cannot read `group.wtf.openstrap` directly. This bridge
+// devices), so the watch cannot read the phone's App Group directly. This bridge
// takes the exact snapshot the app already writes for the home-screen widget
// (WidgetService → home_widget → App Group UserDefaults) and pushes it to the
-// watch over WCSession. The watch caches it locally and its glance + complications
-// render from that. One source of truth: we never recompute here, we mirror.
+// watch over WCSession. The watch caches it locally and its glance renders from
+// that (there are no complications — see WatchStore.swift). One source of truth: we never recompute here, we mirror.
//
// Trigger: Dart calls the `syncWatch` method on the existing `openstrap/ios_config`
// channel right after it updates the widget (see WidgetService). We also push on
@@ -20,16 +20,18 @@ final class WatchBridge: NSObject, WCSessionDelegate {
// The keys mirrored from WidgetService.push()/pushBattery(). Kept in lockstep
// with lib/widget/widget_service.dart and OpenStrapWidget.swift.
private static let intKeys = [
- "readiness", "hrv", "hrv_baseline", "sleep_min", "sleep_need_min", "rhr",
- "updated_at", "batt_pct", "batt_at",
+ "readiness", "readiness_tier", "hrv", "hrv_baseline", "sleep_min",
+ "sleep_need_min", "rhr", "updated_at", "batt_pct", "batt_at",
]
private static let doubleKeys = ["strain"]
- private static let stringKeys = ["coach_line", "stress_band", "batt_name"]
+ private static let stringKeys = ["readiness_band", "coach_line", "batt_name"]
private static let boolKeys = ["has_data", "batt_charging", "theme_dark"]
private var appGroupId: String {
Bundle.main.object(forInfoDictionaryKey: "OpenStrapAppGroupIdentifier") as? String
- ?? "group.wtf.openstrap"
+ // Same fallback as AppGroup.swift and WidgetService.fallbackAppGroupId —
+ // see the note there.
+ ?? "group.com.example.openstrap"
}
/// Activate the WCSession. Safe to call once at launch; no-op if unsupported
@@ -53,9 +55,12 @@ final class WatchBridge: NSObject, WCSessionDelegate {
}
/// Push the latest snapshot to the watch. `updateApplicationContext` delivers a
- /// single coalesced latest-state in the background (perfect for "today's numbers");
- /// the complication transfer keeps the watch face reasonably fresh within its
- /// daily budget. Both are best-effort.
+ /// single coalesced latest-state in the background — exactly right for "today's
+ /// numbers". Best-effort.
+ ///
+ /// No complication transfer: the watch ships no complications (their sources
+ /// were never in the Xcode project), so `transferCurrentComplicationUserInfo`
+ /// was spending a scarce daily budget on a face that cannot show it.
func pushCurrentState() {
guard WCSession.isSupported() else { return }
let s = WCSession.default
@@ -63,11 +68,6 @@ final class WatchBridge: NSObject, WCSessionDelegate {
let payload = snapshot()
guard !payload.isEmpty else { return }
do { try s.updateApplicationContext(payload) } catch { /* transient — next push retries */ }
- #if os(iOS)
- if s.isComplicationEnabled {
- s.transferCurrentComplicationUserInfo(payload)
- }
- #endif
}
// MARK: - WCSessionDelegate
diff --git a/lib/ai/ai_prefs.dart b/lib/ai/ai_prefs.dart
index 61f5ccb3..e840146a 100644
--- a/lib/ai/ai_prefs.dart
+++ b/lib/ai/ai_prefs.dart
@@ -14,6 +14,10 @@ class AiPrefs {
final bool journalEnabled;
/// Fire times as minutes-from-midnight (local wall clock).
+ ///
+ /// [eveningMin] is a FALLBACK, not the time: the nightly sweep fires relative
+ /// to the user's own bedtime when the sleep coach has learned one — see
+ /// [resolvedEveningMin]. A fixed 20:00 is somebody else's evening.
final int morningMin;
final int eveningMin;
@@ -80,6 +84,24 @@ class AiPrefs {
journalMin: journalMin ?? this.journalMin,
);
+ /// An hour before bed. Long enough that "get to bed by 22:45" is still
+ /// actionable tonight; late enough that the day it sweeps is over.
+ static const int eveningBedtimeLeadMin = 60;
+
+ /// Resolved nightly-sweep time (minutes-from-midnight): an hour before the
+ /// sleep coach's recommended bedtime when it has one, else [eveningMin].
+ ///
+ /// The coach needs a couple of free-day nights before it recommends anything,
+ /// so a new install genuinely has no bedtime and gets the fallback — that is
+ /// the case the fallback exists for, not a fixed default with a bedtime
+ /// override bolted on.
+ int resolvedEveningMin({double? bedtimeMinOfDay}) {
+ if (bedtimeMinOfDay != null && bedtimeMinOfDay >= 0) {
+ return (bedtimeMinOfDay.round() - eveningBedtimeLeadMin) % 1440;
+ }
+ return eveningMin % 1440;
+ }
+
/// Resolved journal-prompt time (minutes-from-midnight): explicit user time,
/// else ~30 min before the recommended bedtime, else the 22:30 fallback.
int resolvedJournalMin({double? bedtimeMinOfDay}) {
diff --git a/lib/ai/briefing.dart b/lib/ai/briefing.dart
index be194ecd..332fb5da 100644
--- a/lib/ai/briefing.dart
+++ b/lib/ai/briefing.dart
@@ -1,7 +1,8 @@
// briefing.dart — the daily AI briefing value type + its on-device cache.
//
-// A Briefing is one generated summary for one local day + period (morning =
-// last night's sleep/recovery; evening = today's strain/activity). It carries
+// A Briefing is one generated note for one local day + period (morning = last
+// night's sleep/recovery; evening = the nightly sweep, which is findings about
+// today or nothing at all — see nightly_sweep.dart). It carries
// BOTH the notification-length one-liner and the short structured breakdown,
// plus the exact inputs snapshot it was generated from (so the breakdown screen
// can show "based on" metrics without re-querying, and regeneration is honest
@@ -22,7 +23,7 @@ enum BriefingPeriod { morning, evening }
extension BriefingPeriodLabel on BriefingPeriod {
String get id => this == BriefingPeriod.morning ? 'morning' : 'evening';
String get title =>
- this == BriefingPeriod.morning ? 'Morning briefing' : 'Evening recap';
+ this == BriefingPeriod.morning ? 'Morning briefing' : 'Nightly sweep';
}
/// Which period the Today card should surface right now. Mornings through the
@@ -57,6 +58,16 @@ class Briefing {
required this.inputs,
});
+ /// Whether producing this note involved a model at all.
+ ///
+ /// The nightly sweep with no findings is written on-device and asks nobody:
+ /// no request, no payload, nothing to disclose. THE one place that rule is
+ /// stated — the "what was sent" screen reads it rather than re-deriving it,
+ /// because a screen that guesses wrong about this is the worst bug this app
+ /// can ship.
+ bool get calledModel =>
+ period != BriefingPeriod.evening || inputs.isNotEmpty;
+
Map toJson() => {
'day': day,
'period': period.id,
diff --git a/lib/ai/briefing_engine.dart b/lib/ai/briefing_engine.dart
index 3c5a63ca..823edb87 100644
--- a/lib/ai/briefing_engine.dart
+++ b/lib/ai/briefing_engine.dart
@@ -17,6 +17,7 @@ import '../coach/coach_engine.dart';
import '../data/day_label.dart';
import '../data/local_repository.dart';
import 'briefing.dart';
+import 'nightly_sweep.dart';
/// Injectable one-shot completion (tests pass a fake; production defaults to
/// [CoachEngine.completeText] — the shared BYOK plumbing).
@@ -97,41 +98,111 @@ Future> collectBriefingInputs(
}
} catch (_) {/* sleep detail absent → morning runs on the daily scalars */}
} else {
- _put(out, 'strain_0_21', _metricNum(daily['strain']), round: 1);
- _put(out, 'steps', _metricNum(daily['steps']), round: 0);
- _put(out, 'step_goal', _num(t['step_goal']), round: 0);
- _put(out, 'calories_total_kcal', _metricNum(daily['calories_total']),
- round: 0);
- _put(out, 'wear_min', _metricNum(daily['wear_min']), round: 0);
- final stress = _map(t['stress']);
- _put(out, 'stress_0_100', _metricNum(stress?['score'] ?? stress?['value']),
- round: 0);
+ // The evening pass is the nightly SWEEP, not a recap. It used to hand over
+ // strain, steps, calories, stress and the day's workouts, which produced
+ // exactly what you would expect: the day's numbers read back to someone who
+ // had just looked at them. Nothing but findings goes now — see
+ // nightly_sweep.dart for the bar one has to clear, and note that an empty
+ // map here is the normal, correct answer on most days.
+ return sweepInputs(
+ sweepFindings(await collectSweepSeries(repo, now ?? DateTime.now())),
+ recommendedBedtime: await _recommendedBedtime(repo),
+ );
+ }
+ return out;
+}
- // Today's workouts (manual + auto-detected, manual wins) — compact lines.
+/// The metrics the sweep looks at, keyed by the name [LocalRepository.getChart]
+/// speaks (it maps those onto series keys itself). Deliberately short: every
+/// one of these is a number the user already has a screen for, so a finding
+/// about it can be checked.
+const Map
+ kSweepMetrics = {
+ 'recovery': (key: 'readiness', label: 'readiness', unit: '', dp: 0),
+ 'resting_hr': (key: 'rhr', label: 'resting heart rate', unit: 'bpm', dp: 0),
+ 'hrv': (key: 'rmssd', label: 'HRV', unit: 'ms', dp: 0),
+ 'strain': (key: 'strain', label: 'strain', unit: '', dp: 1),
+ 'steps': (key: 'steps', label: 'steps', unit: '', dp: 0),
+ 'sleep': (key: 'tst_min', label: 'time asleep', unit: 'min', dp: 0),
+ 'efficiency': (
+ key: 'efficiency',
+ label: 'sleep efficiency',
+ unit: '%',
+ dp: 0
+ ),
+};
+
+/// Today's value plus its own trailing history, per metric, read from the same
+/// derived store the trend screens draw. A metric with no value TODAY is left
+/// out entirely — there is nothing to have a finding about.
+///
+/// The window stops at the most recent algo-version break. Values either side
+/// of one are not comparable, and a version bump reported as "the lowest in 60
+/// days" would be a finding about us, not about the user.
+Future> collectSweepSeries(
+ LocalRepository repo,
+ DateTime now,
+) async {
+ final today = todayLabel(now);
+ final out = [];
+ for (final e in kSweepMetrics.entries) {
try {
- final dayStart = now ?? DateTime.now();
- final startSec = DateTime(dayStart.year, dayStart.month, dayStart.day)
- .millisecondsSinceEpoch ~/
- 1000;
- final sessions = await repo.getSessions(from: startSec);
- final w = [];
- for (final s in sessions) {
- final st = _num(s['start_ts'])?.toInt();
- if (st == null || st < startSec) continue;
- final en = _num(s['end_ts'])?.toInt();
- final durMin = _num(s['duration_min'])?.round() ??
- (en != null ? ((en - st) / 60).round() : null);
- final type = (s['type'] ?? s['sport'] ?? s['label'] ?? 'workout')
- .toString();
- w.add(durMin == null ? type : '$type ${durMin}min');
- if (w.length >= 5) break;
+ final chart = await repo.getChart(e.key);
+ final points = chart['points'];
+ if (points is! List) continue;
+ var cutoff = 0;
+ final breaks = chart['algo_breaks'];
+ if (breaks is List) {
+ for (final b in breaks) {
+ final t = b is Map ? _num(b['t'])?.toInt() : null;
+ if (t != null && t > cutoff) cutoff = t;
+ }
}
- if (w.isNotEmpty) out['workouts'] = w;
- } catch (_) {/* sessions unavailable → recap runs on the daily scalars */}
+ double? todayValue;
+ final history = [];
+ for (final p in points) {
+ if (p is! Map) continue;
+ final t = _num(p['t'])?.toInt();
+ final v = _num(p['v'])?.toDouble();
+ if (t == null || v == null || !v.isFinite) continue;
+ final day = todayLabel(DateTime.fromMillisecondsSinceEpoch(t * 1000));
+ if (day == today) {
+ todayValue = v;
+ } else if (day.compareTo(today) < 0 && t >= cutoff) {
+ history.add(v);
+ }
+ }
+ if (todayValue == null) continue;
+ final m = e.value;
+ out.add(SweepSeries(
+ key: m.key,
+ label: m.label,
+ unit: m.unit,
+ decimals: m.dp,
+ today: todayValue,
+ history: history,
+ ));
+ } catch (_) {/* a series we cannot read is a series with no finding */}
}
return out;
}
+/// The sleep coach's recommended bedtime as `HH:MM`, or null when it has not
+/// earned one yet (it needs free-day nights before it says anything).
+Future _recommendedBedtime(LocalRepository repo) async {
+ try {
+ final coach = _map((await repo.getInsights())['sleep_coach']);
+ final v = _map(_map(coach?['bedtime'])?['value']);
+ final min = _num(v?['bedtime_min_of_day'])?.round();
+ if (min == null || min < 0) return null;
+ final m = min % 1440;
+ return '${(m ~/ 60).toString().padLeft(2, '0')}:'
+ '${(m % 60).toString().padLeft(2, '0')}';
+ } catch (_) {
+ return null;
+ }
+}
+
// ── prompt building (PURE — unit-tested on sample data) ───────────────────────
/// The reader's local time of day at GENERATION time — passed into the prompt
@@ -166,10 +237,44 @@ String readinessBand(num v) {
return 'good';
}
+/// The nightly sweep's rules.
+///
+/// Written against the failure it exists to prevent: a note that restates the
+/// day back, wrapped in hedges, ending in nothing to do. The model is given
+/// ONLY findings — every number in the payload is already unusual for this
+/// user — so there is no ordinary number for it to pad with, and these rules
+/// close the remaining ways to say nothing at length.
+String _sweepSystemPrompt() =>
+ 'You write one short note at the end of the day for a local-first fitness '
+ 'band app.\n'
+ 'You are given only FINDINGS: things measured as unusual for THIS '
+ 'user, against their own history. You were not given the ordinary '
+ 'numbers of their day, and there is nothing wrong with that.\n'
+ 'HARD RULES:\n'
+ '- Do not summarise the day. Do not restate a number as news. Every '
+ 'number you write must be one you were given.\n'
+ '- No diagnosis, no severity, no "consult a professional", and no '
+ 'disclaimer of any kind. A hedge is filler; it is not caution.\n'
+ '- No praise, no encouragement, no streaks, no score, no grade.\n'
+ '- Never assert a cause. Two findings on the same day are two '
+ 'findings; say they coincided, never that one caused the other.\n'
+ '- Give ONE concrete thing to do tomorrow, and attach the finding it '
+ 'follows from. If the findings do not support an action, say what '
+ 'stood out and stop — that is a complete note.\n'
+ '- Do not open with a greeting or any reference to the time of day — '
+ 'this text can be read hours after it was written. Direct, second '
+ 'person, plain. No emojis, no headers.\n'
+ 'OUTPUT FORMAT (exactly):\n'
+ 'Line 1: one plain-text sentence, max 140 characters — the finding '
+ 'that matters most. No markdown.\n'
+ 'Line 2: ---\n'
+ 'Then 2-3 markdown bullet points (each starting with "- "), max 14 '
+ 'words each. One fact or one action per bullet, nothing else.';
+
String briefingSystemPrompt(BriefingPeriod period) {
- final scope = period == BriefingPeriod.morning
- ? 'last night\'s sleep and recovery, and what they mean for the day ahead'
- : 'today\'s activity, strain and stress, and how the day landed';
+ if (period == BriefingPeriod.evening) return _sweepSystemPrompt();
+ const scope =
+ 'last night\'s sleep and recovery, and what they mean for the day ahead';
return 'You write a health briefing for a local-first fitness band app. '
'Summarize $scope.\n'
'HARD RULES:\n'
@@ -203,8 +308,8 @@ String buildBriefingUserPrompt(
..writeln(period == BriefingPeriod.morning
? 'Overnight briefing for $day (reader\'s local time: $timeOfDay). '
'Overnight data:'
- : 'Evening recap for $day (reader\'s local time: $timeOfDay). '
- 'Today\'s data so far:');
+ : 'Nightly sweep for $day (reader\'s local time: $timeOfDay). What '
+ 'came back as unusual for this person, and nothing else:');
if (inputs.isEmpty) {
b.writeln('(no metrics available yet)');
} else {
@@ -286,6 +391,23 @@ class BriefingEngine {
final day = todayLabel(effectiveNow);
final tod = partOfDay(effectiveNow);
final inputs = await collectBriefingInputs(repo, period, now: effectiveNow);
+ // NOTHING TO SAY IS AN ANSWER. The evening sweep hands back an empty map on
+ // any day where nothing was unusual for this user, which is most days. No
+ // model is called — there is no question to ask — so nothing leaves the
+ // device, and the "what was sent" screen has an empty payload to show
+ // because the payload really was empty.
+ if (period == BriefingPeriod.evening && inputs.isEmpty) {
+ final b = Briefing(
+ day: day,
+ period: period,
+ oneLiner: kNothingStoodOut,
+ breakdownMd: '',
+ generatedAtMs: effectiveNow.millisecondsSinceEpoch,
+ inputs: const {},
+ );
+ BriefingStore.write(b);
+ return b;
+ }
final raw = await (complete ??
(({required String system, required String user}) =>
CoachEngine.completeText(
diff --git a/lib/ai/nightly_sweep.dart b/lib/ai/nightly_sweep.dart
new file mode 100644
index 00000000..6baed408
--- /dev/null
+++ b/lib/ai/nightly_sweep.dart
@@ -0,0 +1,203 @@
+// nightly_sweep.dart — what, if anything, is worth saying about today.
+//
+// PURE. Takes each metric's own trailing history plus today's value and returns
+// zero or more findings. Zero is the normal answer and a complete one: on most
+// days nothing about a person is unusual, and a note that restates numbers the
+// user looked at three hours ago has negative value.
+//
+// The bar a finding has to clear — all three are relative to THIS user, never
+// to a population:
+// • it is outside the range this person's own history calls ordinary, or
+// • it is a value they have not reached before in the window, or
+// • two of the above landed on the same day.
+// Nothing here scores, bands, diagnoses or ranks a day. It reports distance
+// from the user's own middle, in the user's own units, with the window it was
+// measured over attached — so the reader can disbelieve it.
+//
+// Robust statistics, for the reason the readiness composite learned the hard
+// way: a median/MAD z is unmoved by the one 4am artefact in the window, and MAD
+// legitimately collapses to zero on a quantized series (integer efficiency,
+// step counts), so it falls back to mean/SD and abstains only when BOTH are
+// flat. A flat series has no unusual day in it, which is a correct silence.
+
+import 'dart:math' as math;
+
+/// One metric as the sweep sees it: today, and the days before it.
+class SweepSeries {
+ /// Series key (`rhr`, `readiness`, …) — only for identity/dedupe.
+ final String key;
+
+ /// How the finding names it, in the second person's own words.
+ final String label;
+
+ /// `bpm`, `ms`, `%`, `min` (rendered as h/m), or empty for a bare number.
+ final String unit;
+
+ /// Decimal places when the value is rendered.
+ final int decimals;
+
+ final double today;
+
+ /// Values STRICTLY BEFORE today, oldest→newest, already truncated at any
+ /// algo-version break (values across one are not comparable — see
+ /// `getChart`'s `algo_breaks`).
+ final List history;
+
+ const SweepSeries({
+ required this.key,
+ required this.label,
+ required this.today,
+ required this.history,
+ this.unit = '',
+ this.decimals = 0,
+ });
+}
+
+class SweepFinding {
+ final String key;
+
+ /// The whole line, already human and already carrying its own evidence.
+ final String text;
+
+ /// Robust distance from this user's own middle. Ranking only.
+ final double z;
+
+ /// True when today is above the middle, false below.
+ final bool high;
+
+ const SweepFinding({
+ required this.key,
+ required this.text,
+ required this.z,
+ required this.high,
+ });
+}
+
+/// Days of history before a metric may be judged at all. Below this there is no
+/// "usual" to be unusual against, and saying so is the honest output.
+const int kSweepMinHistory = 14;
+
+/// Days before "you have not been here before" is worth saying — a new maximum
+/// over eleven days is arithmetic, not news.
+const int kSweepMinExtremeHistory = 21;
+
+/// How far outside the user's own middle counts. The looser bar applies only
+/// when today is also a new high or low for the window: two weak signals
+/// agreeing is what makes it worth an interruption.
+const double kSweepZ = 2.5;
+const double kSweepExtremeZ = 2.0;
+
+double _median(List xs) {
+ final s = [...xs]..sort();
+ final n = s.length;
+ return n.isOdd ? s[n ~/ 2] : (s[n ~/ 2 - 1] + s[n ~/ 2]) / 2;
+}
+
+/// Percentile by nearest rank — the "usually X–Y" band a finding is read
+/// against. Not a confidence interval and never presented as one.
+double _percentile(List sorted, double p) {
+ if (sorted.isEmpty) return double.nan;
+ final i = ((sorted.length - 1) * p).round();
+ return sorted[i];
+}
+
+/// Robust z with a mean/SD fallback for a legitimately quantized series, and
+/// null when the history is flat (no unusual day exists in it).
+double? _robustZ(double v, List h) {
+ final m = _median(h);
+ final mad = _median([for (final x in h) (x - m).abs()]);
+ if (mad > 0) return 0.6745 * (v - m) / mad;
+ final mean = h.reduce((a, b) => a + b) / h.length;
+ final sd = math.sqrt(
+ h.map((x) => (x - mean) * (x - mean)).reduce((a, b) => a + b) / h.length);
+ if (sd <= 0) return null;
+ return (v - mean) / sd;
+}
+
+String _fmt(double v, SweepSeries s) {
+ if (s.unit == 'min') {
+ final t = v.round();
+ final h = t ~/ 60;
+ final m = t % 60;
+ return h == 0 ? '${m}m' : '${h}h ${m}m';
+ }
+ final n = v.toStringAsFixed(s.decimals);
+ return s.unit.isEmpty ? n : (s.unit == '%' ? '$n%' : '$n ${s.unit}');
+}
+
+/// The findings, strongest first. Empty means nothing stood out — which is a
+/// complete answer, not a failure to find one.
+List sweepFindings(List series) {
+ final out = [];
+ for (final s in series) {
+ final h = [for (final v in s.history) if (v.isFinite) v];
+ if (!s.today.isFinite || h.length < kSweepMinHistory) continue;
+ final z = _robustZ(s.today, h);
+ if (z == null) continue;
+ final sorted = [...h]..sort();
+ final extreme = h.length >= kSweepMinExtremeHistory &&
+ (s.today > sorted.last || s.today < sorted.first);
+ if (z.abs() < (extreme ? kSweepExtremeZ : kSweepZ)) continue;
+
+ final high = z > 0;
+ final usual = 'usually ${_fmt(_percentile(sorted, .1), s)}'
+ '–${_fmt(_percentile(sorted, .9), s)}';
+ final where = extreme
+ ? '${high ? 'the highest' : 'the lowest'} in ${h.length} days'
+ : '${high ? 'above' : 'below'} your usual range';
+ out.add(SweepFinding(
+ key: s.key,
+ text: '${s.label} ${_fmt(s.today, s)} — $where ($usual)',
+ z: z,
+ high: high,
+ ));
+ }
+ out.sort((a, b) => b.z.abs().compareTo(a.z.abs()));
+ return out;
+}
+
+/// The two strongest findings stated as what they are: two things that are each
+/// unusual for this user, on the same day. NOT a correlation, and never a
+/// cause — nothing here has measured a relationship between them.
+String? sweepPairing(List findings) {
+ if (findings.length < 2) return null;
+ String name(SweepFinding f) => f.text.split(' — ').first;
+ return '${name(findings[0])} and ${name(findings[1])} — both outside your '
+ 'usual range on the same day, which is worth noticing but is not a '
+ 'measured relationship between them';
+}
+
+/// The exact payload the model is given, and therefore the exact payload the
+/// "what was sent" screen shows. One entry per line in the prompt; a key that
+/// is absent here was absent from the request.
+///
+/// Empty when there is nothing to say. The caller must not call a model with
+/// an empty map — there is no question to ask.
+Map sweepInputs(
+ List findings, {
+ String? recommendedBedtime,
+}) {
+ if (findings.isEmpty) return const {};
+ final pair = sweepPairing(findings);
+ return {
+ 'unusual_for_you': [for (final f in findings.take(4)) f.text],
+ 'unusual_together': ?pair,
+ // Evidence for an action, and the only value here that is not a finding.
+ // Already computed by the sleep coach and already shown on Home — the model
+ // is given the time so it can name one rather than invent one.
+ 'recommended_bedtime': ?recommendedBedtime,
+ };
+}
+
+/// The one line the OS notification carries. It is a finding, not a promise of
+/// one: the notification is armed only when this is non-null, and its body is
+/// this text, so tapping it can never lead to "nothing to report".
+String? sweepHeadline(List findings) {
+ if (findings.isEmpty) return null;
+ final t = findings.first.text;
+ return t.isEmpty ? null : '${t[0].toUpperCase()}${t.substring(1)}';
+}
+
+/// What the briefing says when the sweep found nothing. Complete as it stands —
+/// it must never be padded out with the day's numbers to look like more.
+const String kNothingStoodOut = 'Nothing stood out tonight.';
diff --git a/lib/ai/reminder_plan.dart b/lib/ai/reminder_plan.dart
index ac8285e4..51b549b5 100644
--- a/lib/ai/reminder_plan.dart
+++ b/lib/ai/reminder_plan.dart
@@ -3,9 +3,11 @@
// plan; nothing here touches the plugin, so the whole surface is unit-testable.
//
// Design constraint (iOS): BYOK network can't run reliably in the background,
-// so the scheduled briefing notifications are LIGHT prompts ("ready — tap to
-// view") that deep-link into the breakdown screen, which generates-or-shows-
-// cached on open. Generation also happens opportunistically on foreground.
+// so a scheduled notification cannot carry model-written text. The nightly
+// sweep works anyway, because the FINDING is computed on-device in pure Dart
+// before the slot is armed: the notification body is the finding itself, and
+// the model's take on it is written when the deep link is opened (or
+// opportunistically on the next foreground).
import '../notify/notification_service.dart';
import '../notify/tap_router.dart';
@@ -37,12 +39,20 @@ class AiReminderSlot {
/// The full desired schedule for the AI nudges. Briefing slots exist only when
/// a BYOK key is configured (a notification into an "add your key" wall would
/// be a nag, not a feature); the journal prompt needs no key (manual mode).
+///
+/// [sweepHeadline] is the nightly sweep's strongest finding for today, or null
+/// when it found nothing — which is most days. Null means the evening slot is
+/// not in the plan AT ALL: the sweep's whole contract is that it may say
+/// nothing, and a notification that fires to announce nothing is the loudest
+/// possible way to break it. When it is non-null it is also the notification's
+/// BODY, so the interruption carries the finding rather than a promise of one.
List aiReminderPlan(
AiPrefs prefs, {
required bool remindersEnabled,
required bool aiConfigured,
double? bedtimeMinOfDay,
required bool journalDoneToday,
+ String? sweepHeadline,
}) {
if (!remindersEnabled) return const [];
final out = [];
@@ -58,12 +68,12 @@ List aiReminderPlan(
minute: m % 60,
));
}
- if (aiConfigured && prefs.eveningEnabled) {
- final m = prefs.eveningMin % 1440;
+ if (aiConfigured && prefs.eveningEnabled && sweepHeadline != null) {
+ final m = prefs.resolvedEveningMin(bedtimeMinOfDay: bedtimeMinOfDay);
out.add(AiReminderSlot(
id: NotificationService.idEveningBrief,
- title: 'Your evening recap is ready',
- body: 'Tap for today\'s strain, movement and how the day landed.',
+ title: 'Something stood out today',
+ body: sweepHeadline,
route: kRouteAiEvening,
hour: m ~/ 60,
minute: m % 60,
diff --git a/lib/app.dart b/lib/app.dart
index 98110341..bfbc3d50 100644
--- a/lib/app.dart
+++ b/lib/app.dart
@@ -1,33 +1,37 @@
import 'dart:async';
import 'package:flutter/material.dart';
-import 'package:flutter/services.dart';
+import 'package:lucide_icons_flutter/lucide_icons.dart';
import 'package:provider/provider.dart';
-import 'ai/briefing.dart';
+import 'ai/briefing.dart' show BriefingPeriod;
import 'coach/coach_config.dart';
import 'notify/notification_service.dart';
import 'notify/tap_router.dart';
import 'state/app_state.dart';
import 'state/prefs.dart';
-import 'theme/theme.dart';
+import 'telemetry/telemetry_service.dart';
import 'theme/theme_controller.dart';
import 'theme/theme_switcher.dart';
-import 'theme/tokens.dart';
-import 'ui/design/nav_pill.dart';
-import 'ui/kit/kit.dart';
-import 'ui/onboarding/welcome_screen.dart';
-import 'ui/pairing_screen.dart';
-import 'ui/splash/boot_splash.dart';
-import 'ui/profile_setup_screen.dart';
-import 'ui/today/today_screen.dart';
-import 'ui/screens/screens.dart';
-import 'ui/workouts/workouts_screen.dart';
-import 'ui/activity/live_session_screen.dart';
-import 'ui/ai/ai_breakdown_screen.dart';
-import 'ui/journal/journal_compose_screen.dart';
-import 'ui/stress/calm_breathing_screen.dart';
-import 'telemetry/telemetry_service.dart';
+import 'widget/widget_service.dart';
+import 'ui2/activity/catalogue.dart';
+import 'ui2/activity/live.dart';
+import 'ui2/onboarding/pairing.dart';
+import 'ui2/onboarding/profile_setup.dart';
+import 'ui2/onboarding/splash.dart';
+import 'ui2/onboarding/welcome.dart';
+import 'ui2/profile/profile.dart';
+import 'ui2/screens/ai_briefing.dart';
+import 'ui2/screens/calm_breathing.dart';
+import 'ui2/screens/what_changed.dart';
+import 'ui2/screens/health_screen.dart';
+import 'ui2/screens/home_screen.dart';
+import 'ui2/screens/journal_compose.dart';
+import 'ui2/screens/log_water.dart';
+import 'ui2/screens/nutrition_screen.dart';
+import 'ui2/screens/wellness_screen.dart';
+import 'ui2/screens/workout_screen.dart';
+import 'ui2/ui2.dart';
class OpenStrapApp extends StatefulWidget {
const OpenStrapApp({super.key});
@@ -45,7 +49,7 @@ class _OpenStrapAppState extends State with WidgetsBindingObserver
WidgetsBinding.instance.addPostFrameCallback((_) {
if (!mounted) return;
context.read().attachCoachConfig(context.read());
-
+
final app = context.read();
if (app.isPaired) app.openSession();
});
@@ -93,6 +97,15 @@ class _OpenStrapAppState extends State with WidgetsBindingObserver
// delivering whenever the OS feels like it is worse than one that is
// honest about when it fires.
unawaited(app.runBackupIfDue());
+ // Re-publish the widget snapshot. `has_data` is decided WHEN THE
+ // SNAPSHOT IS WRITTEN (WidgetService.push evaluates isStale there), and
+ // the widget process never runs Dart — so a snapshot written while fresh
+ // stays `has_data: true` forever, and the staleness rule can only ever
+ // fire if something re-evaluates it. Foreground is the one moment we
+ // know the app is alive and the numbers may have aged: it is cheap (one
+ // repository read) and it is what stops a week-old readiness sitting on
+ // a lock screen looking current.
+ unawaited(WidgetService.refresh(app.repo));
if (app.isPaired) app.openSession();
} else if (state == AppLifecycleState.paused) {
// Backgrounded: hand the band to the iOS restore path so it can wake-and-drain
@@ -107,8 +120,9 @@ class _OpenStrapAppState extends State with WidgetsBindingObserver
return MaterialApp(
title: 'OpenStrap',
debugShowCheckedModeBanner: false,
- theme: theme.lightTheme,
- darkTheme: theme.darkTheme,
+ // The palette is the design system's, the CHOICE is still the user's.
+ theme: buildTheme(Brightness.light),
+ darkTheme: buildTheme(Brightness.dark),
themeMode: theme.materialThemeMode,
builder: (context, child) =>
ThemeSwitchOverlay(key: themeSwitchKey, child: child!),
@@ -118,50 +132,239 @@ class _OpenStrapAppState extends State with WidgetsBindingObserver
}
}
-/// Onboarding gate: pairing → app. CLOUD EXCISED — the old backend / auth /
-/// profile gate states are gone; once a band is paired we go straight to the shell.
-/// Telemetry-only: the last AppRoute we logged, so _Gate's build() (which also
-/// re-runs on a plain theme flip, not just a route change) doesn't double-log.
+// ══════════════════ THE ONBOARDING GATE ══════════════════
+
+/// The gate, as a pure function of its inputs. Onboarding order bugs are
+/// the ones users hit exactly once and never forgive, so this is testable
+/// without a band, a database or a widget tree.
+///
+/// [AppRoute.pairing] short-circuits before AppState ever looks at the
+/// profile, so a skipped pairing falls through to profile setup rather than
+/// straight to the shell — we still want the four numbers.
+///
+/// [onboarded] is the difference between "has never had a band" and "has no
+/// band right now". `AppState.route` only knows the second: a user who forgets
+/// their strap after months of use goes `isPaired == false` →
+/// [AppRoute.pairing], and `pairingSkipped` is false for anyone who actually
+/// paired, so they landed in FIRST-RUN onboarding with all their data behind
+/// it and "Skip for now" as the only way back. Onboarding happens once.
+AppRoute resolveRoute(AppRoute route,
+ {required bool pairingSkipped,
+ required bool profileSeen,
+ bool onboarded = false}) {
+ var r = route;
+ if (onboarded && (r == AppRoute.pairing || r == AppRoute.profile)) {
+ return AppRoute.shell;
+ }
+ if (r == AppRoute.pairing && pairingSkipped) r = AppRoute.profile;
+ if (r == AppRoute.profile && profileSeen) return AppRoute.shell;
+ return r;
+}
+
+/// One-way latch: this install has reached the app itself at least once.
+///
+/// Kept here rather than on [OnboardingBypass] because it is not a bypass —
+/// nothing was skipped. It is the record that onboarding HAPPENED, which is
+/// the only thing that distinguishes a lost band from a first run.
+const String _kOnboarded = 'onboard.completed';
+
+bool get _onboarded => Prefs.getBool(_kOnboarded, false);
+void _markOnboarded() {
+ if (!_onboarded) Prefs.setBool(_kOnboarded, true);
+}
+
+/// Telemetry-only: the last AppRoute we logged, so the gate's build (which
+/// also re-runs on a plain theme flip) doesn't double-log.
AppRoute? _telemetryLastRoute;
class _Gate extends StatelessWidget {
const _Gate();
+
@override
Widget build(BuildContext context) {
- // SELECT, not watch: rebuild only when the ROUTE actually changes (rare) — not
- // on every ~1 Hz AppState tick (live HR, log lines). Watching the whole AppState
- // here used to repaint the entire home stack every second, which starved the
- // background BLE connection on long idle stretches (lost overnight data).
- final route = context.select((a) => a.route);
- if (route != _telemetryLastRoute) {
- _telemetryLastRoute = route;
- TelemetryService.instance.setContext('app_route', route.name);
- TelemetryService.instance.breadcrumb('route: ${route.name}');
- }
- // Depend on the theme too → the whole home stack (onboarding screens, the
- // shell + its tabs) rebuilds with fresh colours the instant the mode flips.
- context.watch();
- // Not const: these must be fresh instances so a theme flip re-runs their build
- // (State is preserved — same type at the same position). Cheap now: only built
- // on a route change or a theme flip, never on the per-second AppState ticks.
- final Widget resolved = switch (route) {
- // Underlay while the boot splash covers the loading phase — and what the
- // user lands on if the splash's safety cap fires before init completes.
- AppRoute.loading => Scaffold(
- body: Center(child: CircularProgressIndicator(color: AppColors.coral)),
+ // SELECT, not watch: rebuild only when the ROUTE actually changes (rare) —
+ // not on every ~1 Hz AppState tick (live HR, log lines). Watching the whole
+ // AppState here used to repaint the entire home stack every second, which
+ // starved the background BLE connection on long idle stretches.
+ final raw = context.select((a) => a.route);
+ return ValueListenableBuilder(
+ valueListenable: OnboardingBypass.revision,
+ builder: (context, _, _) {
+ final route = resolveRoute(raw,
+ pairingSkipped: OnboardingBypass.pairingSkipped,
+ profileSeen: OnboardingBypass.profileSeen,
+ onboarded: _onboarded);
+ if (route != _telemetryLastRoute) {
+ _telemetryLastRoute = route;
+ TelemetryService.instance.setContext('app_route', route.name);
+ TelemetryService.instance.breadcrumb('route: ${route.name}');
+ }
+ final Widget resolved = switch (route) {
+ // Underlay while the boot splash covers the loading phase — and what
+ // the user lands on if the splash's safety cap fires before init
+ // completes.
+ AppRoute.loading => const _Loading(),
+ AppRoute.failed => const _InitFailed(),
+ AppRoute.welcome => const WelcomeScreen(),
+ AppRoute.pairing => PairingScreen(
+ onSkip: () => OnboardingBypass.mark(OnboardingBypass.kPairing)),
+ AppRoute.profile => ProfileSetupScreen(
+ onDone: () => OnboardingBypass.mark(OnboardingBypass.kProfile)),
+ AppRoute.shell => const _Shell(),
+ };
+ // Cold-start splash: covers the whole loading phase and cross-fades out
+ // the instant AppState finishes initializing, even mid-play. Shown once
+ // per launch; BootSplash latches itself off after.
+ return BootSplash(ready: route != AppRoute.loading, child: resolved);
+ },
+ );
+ }
+}
+
+class _Loading extends StatelessWidget {
+ const _Loading();
+ @override
+ Widget build(BuildContext c) {
+ final p = P.of(c);
+ return Scaffold(
+ backgroundColor: p.bg,
+ body: Center(child: CircularProgressIndicator(color: p.on(C.green))),
+ );
+ }
+}
+
+/// Start-up threw. The one screen whose job is to not be a spinner.
+///
+/// It names the failure with the actual message rather than a friendlier guess,
+/// says the data is still on the device (it is — nothing here deletes, and an
+/// unopenable database rebuilds itself in `LocalDb`), and offers the retry.
+class _InitFailed extends StatelessWidget {
+ const _InitFailed();
+ @override
+ Widget build(BuildContext c) {
+ final p = P.of(c);
+ final app = c.watch();
+ return Scaffold(
+ backgroundColor: p.bg,
+ body: SafeArea(
+ child: Center(
+ child: SingleChildScrollView(
+ padding: const EdgeInsets.all(24),
+ child: Column(
+ mainAxisSize: MainAxisSize.min,
+ crossAxisAlignment: CrossAxisAlignment.start,
+ children: [
+ Text('OpenStrap could not start',
+ style: F.t2.copyWith(color: p.ink)),
+ const SizedBox(height: 8),
+ Text(
+ 'Your data is still on this device — nothing was deleted. '
+ 'This is a start-up step failing, and it will fail the same '
+ 'way each launch until it is fixed.',
+ style: F.body.copyWith(color: p.ink2, height: 1.5),
+ ),
+ const SizedBox(height: 16),
+ Container(
+ width: double.infinity,
+ padding: const EdgeInsets.all(12),
+ decoration: BoxDecoration(
+ color: p.card2,
+ borderRadius: BorderRadius.circular(10),
+ ),
+ child: SelectableText(
+ app.initError ?? 'No error was recorded.',
+ style: F.cap.copyWith(color: p.ink2),
+ ),
+ ),
+ const SizedBox(height: 20),
+ FilledButton(
+ onPressed: app.retryInit,
+ child: const Text('Try again'),
+ ),
+ ],
+ ),
+ ),
),
- AppRoute.welcome => const WelcomeScreen(),
- AppRoute.pairing => PairingScreen(),
- AppRoute.profile => const ProfileSetupScreen(),
- AppRoute.shell => _Shell(),
- };
- // Cold-start splash video: covers the whole loading phase, cross-fades out
- // the instant AppState finishes initializing (route leaves `loading`), even
- // mid-play. Shown once per launch; BootSplash latches itself off after.
- return BootSplash(ready: route != AppRoute.loading, child: resolved);
+ ),
+ );
}
}
+// ══════════════════ THE SHELL ══════════════════
+
+/// A notification's tab index → the domain that now owns that content.
+///
+/// The indices come from `tap_router.dart`, which still speaks the old
+/// five-tab vocabulary (Today · Sleep · Heart · Body · Workouts). Sleep, Heart
+/// and Body all folded into Health, so three of the five collapse onto one
+/// destination. Payloads from older builds keep working, which is the whole
+/// point — a notification is scheduled days before it is tapped.
+ShellDomain domainForTab(int tab) => switch (tab) {
+ 1 || 2 || 3 => ShellDomain.health,
+ 4 => ShellDomain.workout,
+ _ => ShellDomain.home,
+ };
+
+/// A deep-link sub-screen route → the domain it belongs to.
+///
+/// Every `kRoute*` in `tap_router.dart` is here, and unknown routes fall back
+/// to Home rather than crashing a cold launch on a payload from an older
+/// build.
+ShellDomain domainForRoute(String route) => switch (route) {
+ kRouteAiMorning || kRouteAiEvening => ShellDomain.home,
+ kRouteJournalCompose || kRouteBreathing => ShellDomain.wellness,
+ // Water is a journal field that lives on Nutrition — that is the tab
+ // behind the log screen, and where a "back" from it should land.
+ kRouteWater => ShellDomain.nutrition,
+ kRouteWorkoutSuggestion => ShellDomain.workout,
+ // Emitted by the battery forecast (`app_state.dart`) and the weekly
+ // recap (`notification_center.dart`), and declared in `tap_router`
+ // alongside every other deep link — see the note below.
+ kRouteProfile => ShellDomain.home,
+ // No recap screen exists. Health is where a week of sleep, strain and
+ // recovery actually lives, so it is the nearest true destination — but
+ // the notification promises a REPORT, and until one is built the honest
+ // fix is upstream, in what that notification claims.
+ kRouteRecap => ShellDomain.health,
+ _ => ShellDomain.home,
+ };
+
+// `/profile` and `/recap` are declared in `tap_router.dart` alongside every
+// other deep link. They used to be private literals here, which is exactly why
+// both landed on Home: absent from tap_router's table, they produced no screen
+// request, so the shell fell back to the tab index and never consulted
+// [domainForRoute] at all.
+
+/// The focused screen a deep link pushes on top of its domain, when one
+/// exists. Null means the domain itself is the destination.
+///
+/// One route still resolves to null and should not: `/workouts/suggestion`
+/// ("Tap to log it" has nothing to tap through to — nothing reads
+/// `workout_suggestions`). It is recorded in the sweep; the fix is to stop
+/// making the promise, not to route it somewhere plausible.
+///
+/// `/ai/*` used to be in that list. It now lands on the briefing itself, which
+/// also carries the exact snapshot that was sent to produce it.
+Widget? screenForRoute(String route) => switch (route) {
+ kRouteAiMorning =>
+ const AiBriefingScreen(period: BriefingPeriod.morning),
+ kRouteAiEvening =>
+ const AiBriefingScreen(period: BriefingPeriod.evening),
+ kRouteJournalCompose => const JournalCompose(),
+ kRouteBreathing => const CalmBreathing(),
+ // The hydration reminder promises that one more tap logs a glass, so it
+ // opens the control itself rather than the tab the control is on.
+ kRouteWater => const LogWaterScreen(),
+ // Battery, band and sources all live behind this one.
+ kRouteProfile => const ProfileHome(),
+ // The weekly recap used to land on the Health tab and push nothing,
+ // because there was no recap screen to push. There is now: the sweep's
+ // findings, which the app has been computing every night and delivering
+ // only as a notification you could dismiss into nothing.
+ kRouteRecap => const WhatChangedScreen(),
+ _ => null,
+ };
+
class _Shell extends StatefulWidget {
const _Shell();
@override
@@ -169,10 +372,17 @@ class _Shell extends StatefulWidget {
}
class _ShellState extends State<_Shell> {
- // Restore the last-selected tab so a relaunch lands where the user left off.
- late int _index =
- Prefs.getInt(Prefs.shellTab, 0).clamp(0, _nav.length - 1);
- late final _controller = PageController(initialPage: _index);
+ /// Restore the last-selected tab so a relaunch lands where the user left off.
+ late ShellDomain _domain = ShellDomain
+ .values[Prefs.getInt(Prefs.shellTab, 0).clamp(0, ShellDomain.values.length - 1)];
+
+ /// AppShell owns its own selection and takes only an `initial`, so a
+ /// programmatic jump re-keys it.
+ // ponytail: re-keying rebuilds the tab stack, so a deep link loses the
+ // scroll position of whatever tab was open. Deep links are rare and arrive
+ // from outside the app; give AppShell an external controller if that ever
+ // stops being true.
+ int _rev = 0;
AppState? _app;
@@ -182,242 +392,213 @@ class _ShellState extends State<_Shell> {
// A tapped notification asks for a tab via AppState.navRequest. Jump there,
// then clear the request so it isn't replayed on rebuild.
_app = context.read();
- _app!.navRequest.addListener(_onNavRequest);
- _app!.screenRequest.addListener(_onScreenRequest);
- // Cold launch from a tapped notification: the route may already be set before
- // this shell mounted (so the listener never fired). Consume it once attached.
+ _app!.navRequest.addListener(_consumeSoon);
+ _app!.screenRequest.addListener(_consumeSoon);
+ // Cold launch from a tapped notification: the route may already be set
+ // before this shell mounted (so the listener never fired). Consume it once
+ // attached.
WidgetsBinding.instance.addPostFrameCallback((_) {
- _onNavRequest();
- _onScreenRequest();
+ // Reaching the shell IS the end of onboarding. Latched here rather than
+ // at the pairing screen because an install that upgraded into this build
+ // never saw one.
+ _markOnboarded();
+ _consume();
});
}
- void _onNavRequest() {
- final i = _app?.navRequest.value ?? -1;
- if (i < 0 || i >= _nav.length) return;
- _app!.navRequest.value = -1;
- if (!mounted) return;
- _go(i);
+ bool _pending = false;
+
+ /// Both requests come from ONE tap and are written one after the other, so
+ /// whichever listener fires second used to win — and which one that is
+ /// inverts between a warm tap (screen, then nav) and a cold launch (the
+ /// post-frame callback, in whatever order it reads them). A `/breathing`
+ /// notification therefore landed on Wellness or on Home depending on
+ /// whether the app happened to be running. Read the pair together, once
+ /// both have landed.
+ void _consumeSoon() {
+ if (_pending) return;
+ _pending = true;
+ scheduleMicrotask(() {
+ _pending = false;
+ _consume();
+ });
}
- /// A tapped notification's deep link may target a sub-screen (AI briefing
- /// breakdown, journal compose). Consume the request and push it on top.
- void _onScreenRequest() {
- final s = _app?.screenRequest.value;
- if (s == null || s.isEmpty) return;
- _app!.screenRequest.value = null;
- if (!mounted) return;
- final Widget? screen = switch (s) {
- kRouteAiMorning =>
- const AiBreakdownScreen(period: BriefingPeriod.morning),
- kRouteAiEvening =>
- const AiBreakdownScreen(period: BriefingPeriod.evening),
- kRouteJournalCompose => const JournalComposeScreen(),
- // "Did you work out?" auto-detect tap → focused log/adjust review, on top
- // of the Workouts tab (issue #113). WorkoutsScreen is already imported.
- kRouteWorkoutSuggestion => const WorkoutSuggestionScreen(),
- // Siri/Shortcuts "start breathing" App Intent — see StartBreathingIntent
- // in OpenStrapIntents.swift, which writes this route into the App Group
- // for WidgetService.consumePendingRoute() to pick up on launch/resume.
- kRouteBreathing => const CalmBreathingScreen(autoStart: true),
- _ => null,
- };
- if (screen == null) return;
- Navigator.of(context)
- .push(themedRoute((_) => screen, name: screen.runtimeType.toString()));
+ void _consume() {
+ final app = _app;
+ // Leave the request standing if there is no shell to act on it — the next
+ // one consumes it in its post-frame callback rather than finding it eaten.
+ if (app == null || !mounted) return;
+ final s = app.screenRequest.value;
+ final tab = app.navRequest.value;
+ app.screenRequest.value = null;
+ app.navRequest.value = -1;
+ // A screen route carries its own domain; the tab index alongside it is
+ // the base the payload was built with, not a second destination.
+ if (s != null && s.isNotEmpty) {
+ _go(domainForRoute(s));
+ final screen = screenForRoute(s);
+ if (screen != null) {
+ Navigator.of(context)
+ .push(MaterialPageRoute(builder: (_) => screen));
+ }
+ return;
+ }
+ if (tab >= 0) _go(domainForTab(tab));
}
- // Built fresh on every build (not const) so a theme flip re-colours every tab,
- // even the kept-alive ones the user isn't currently looking at.
- // ignore: prefer_const_constructors — must be fresh instances so the
- // kept-alive tabs re-colour on a theme flip (const would canonicalize them).
- List get _pages => [
- TodayScreen(),
- SleepScreen(),
- HeartScreen(),
- BodyScreen(),
- WorkoutsScreen(),
- ];
-
- // Tab icons (see lib/ui/kit/os_icons.dart for the pack each one resolves to).
- static const _nav = [
- NavPillItem(OsIcon.today, 'Today'),
- NavPillItem(OsIcon.sleep, 'Sleep'),
- NavPillItem(OsIcon.heart, 'Heart'),
- NavPillItem(OsIcon.bodyStrain, 'Body'),
- NavPillItem(OsIcon.workouts, 'Workouts'),
- ];
+ void _go(ShellDomain d) {
+ if (d == _domain) return;
+ setState(() {
+ _domain = d;
+ _rev++;
+ });
+ Prefs.setInt(Prefs.shellTab, d.index);
+ }
@override
void dispose() {
- _app?.navRequest.removeListener(_onNavRequest);
- _app?.screenRequest.removeListener(_onScreenRequest);
- _controller.dispose();
+ _app?.navRequest.removeListener(_consumeSoon);
+ _app?.screenRequest.removeListener(_consumeSoon);
super.dispose();
}
- // No haptic here: FloatingNavPill fires the selection click on user taps,
- // and programmatic jumps (notification deep links) shouldn't buzz.
- void _go(int i) {
- if (i == _index) return;
- _controller.animateToPage(i, duration: Motion.med, curve: Motion.curve);
- }
-
@override
Widget build(BuildContext context) {
- return ShellScaffold(
- controller: _controller,
- index: _index,
- items: _nav,
- pages: _pages,
- onSelect: _go,
- onPageChanged: (i) {
- setState(() => _index = i);
- Prefs.setInt(Prefs.shellTab, i);
+ // SELECT, not watch: a bool that flips twice a workout, not the ~1 Hz
+ // AppState tick.
+ final live = context.select((a) => a.activeWorkout != null);
+ return AppShell(
+ key: ValueKey(_rev),
+ initial: _domain,
+ banner: live ? const _LiveSessionBar() : null,
+ onSelect: (d) {
+ _domain = d;
+ Prefs.setInt(Prefs.shellTab, d.index);
+ },
+ builder: (c, d) => switch (d) {
+ ShellDomain.home => const HomeScreen(),
+ ShellDomain.health => const HealthScreen(),
+ ShellDomain.nutrition => const NutritionScreen(),
+ ShellDomain.workout => const WorkoutScreen(),
+ ShellDomain.wellness => const WellnessScreen(),
},
- // No center action: starting a workout lives on the Workouts screen.
- banner: const _LiveBanner(),
- );
- }
-}
-
-/// The shell chrome — swipeable PageView tabs behind a [FloatingNavPill],
-/// plus an optional banner (the live-workout mini-player) stacked above the
-/// pill. Public and AppState-free so the navigation behavior (tab select →
-/// page switch, pushed sub-screens still pop/swipe back over it) stays
-/// unit-testable.
-class ShellScaffold extends StatelessWidget {
- final PageController controller;
- final int index;
- final List items;
- final List pages;
- final ValueChanged onSelect;
- final ValueChanged onPageChanged;
-
- /// Rendered above the nav pill (e.g. the live-workout mini-player).
- final Widget? banner;
-
- const ShellScaffold({
- super.key,
- required this.controller,
- required this.index,
- required this.items,
- required this.pages,
- required this.onSelect,
- required this.onPageChanged,
- this.banner,
- });
-
- @override
- Widget build(BuildContext context) {
- return Scaffold(
- extendBody: true,
- body: PageView(
- controller: controller,
- onPageChanged: onPageChanged,
- children: [for (final p in pages) _KeepAlive(child: p)],
- ),
- bottomNavigationBar: SafeArea(
- top: false,
- child: Column(
- mainAxisSize: MainAxisSize.min,
- children: [
- ?banner,
- FloatingNavPill(
- items: items,
- index: index,
- onSelect: onSelect,
- ),
- ],
- ),
- ),
);
}
}
-/// Persistent "workout in progress" mini-player — shows whenever a live workout is
-/// running and you've navigated away from the live screen. Tap to jump back in.
-class _LiveBanner extends StatefulWidget {
- const _LiveBanner();
- @override
- State<_LiveBanner> createState() => _LiveBannerState();
-}
-
-class _LiveBannerState extends State<_LiveBanner> with SingleTickerProviderStateMixin {
- late final AnimationController _pulse;
-
- @override
- void initState() {
- super.initState();
- _pulse = AnimationController(vsync: this, duration: const Duration(milliseconds: 900))..repeat(reverse: true);
+/// The way back into a session that is running while its screen is not on
+/// screen — minimised, or left behind when the app was killed and relaunched.
+///
+/// Without it, leaving the live screen orphaned the session: `activeWorkout`
+/// stayed open, every later workout was refused, and the only control that
+/// could end it was the iOS Live Activity's Finish button. Android had
+/// nothing at all.
+///
+/// No clock: the elapsed time would be stale the moment it was painted, and a
+/// per-second rebuild of the whole shell to keep one number honest is not a
+/// trade worth making. The number is on the screen this taps through to.
+class _LiveSessionBar extends StatelessWidget {
+ const _LiveSessionBar();
+
+ /// The activity behind the open session.
+ ///
+ /// The draft FIRST (it carries the private flag and the entered weight), but
+ /// `activeWorkout.type` as the fallback — a session started by the gesture
+ /// path creates no draft, and neither does one rehydrated from a `sessions`
+ /// row after a crash. Keying on the draft alone meant both of those left the
+ /// workout open with no way to reach or end it, and `startWorkout` refuses
+ /// every later workout while one is open.
+ static Activity? _activityFor(AppState app) => activityByName(
+ LiveDraft.current?.activityKey ?? app.activeWorkout?.type);
+
+ Future _resume(BuildContext c) async {
+ final app = c.read();
+ final draft = LiveDraft.current;
+ final a = _activityFor(app);
+ if (a == null) return;
+ final nav = Navigator.of(c);
+ // The lifter's previous and best. Absent renders as "First time on this
+ // lift", which would be a false claim on a resumed session.
+ final history = await loadSetHistory();
+ await nav.push(MaterialPageRoute(
+ builder: (_) => liveFor(a,
+ private: draft?.private ?? false,
+ weightKg: draft?.weightKg,
+ host: activityHost(app, history: history)),
+ ));
}
@override
- void dispose() { _pulse.dispose(); super.dispose(); }
-
- String _fmt(Duration d) =>
- '${d.inMinutes.toString().padLeft(2, '0')}:${(d.inSeconds % 60).toString().padLeft(2, '0')}';
-
- @override
- Widget build(BuildContext context) {
- final w = context.watch().activeWorkout;
- if (w == null) return const SizedBox.shrink();
- return Padding(
- padding: const EdgeInsets.fromLTRB(Sp.x6, 0, Sp.x6, Sp.x2),
- child: GestureDetector(
- onTap: () {
- HapticFeedback.selectionClick();
- Navigator.of(context).push(themedRoute(
- (_) => LiveSessionScreen(workoutId: w.workoutId, type: w.type),
- name: 'LiveSessionScreen'));
- },
- child: Container(
- padding: const EdgeInsets.symmetric(horizontal: Sp.x4, vertical: Sp.x3),
- decoration: BoxDecoration(
- color: AppColors.night,
- borderRadius: BorderRadius.circular(R.pill),
- boxShadow: Shadows.lift,
+ Widget build(BuildContext c) {
+ final p = P.of(c);
+ final app = c.read();
+ final a = _activityFor(app);
+ // A session the app is holding but this build cannot draw — an older
+ // build's type key, say. Never nothing: the bar is the ONLY control that
+ // can end an open session, and hiding it left the workout open forever
+ // with every later one refused. Offer the one action that is certainly
+ // right rather than a button that opens the wrong screen.
+ if (a == null) {
+ return Container(
+ decoration: BoxDecoration(
+ color: p.card,
+ border: Border(top: BorderSide(color: p.line)),
+ ),
+ child: Pressable(
+ semanticLabel: 'Finish the session that is still running',
+ onTap: () => app.stopWorkout(),
+ child: Padding(
+ padding:
+ const EdgeInsets.symmetric(horizontal: S.x4, vertical: S.x3),
+ child: Row(children: [
+ Expanded(
+ child: Text('Session running — tap to finish',
+ style: F.body.copyWith(color: p.ink)),
+ ),
+ Icon(LucideIcons.square, size: 18, color: p.ink3),
+ ]),
),
+ ),
+ );
+ }
+ return Container(
+ decoration: BoxDecoration(
+ color: p.card,
+ border: Border(top: BorderSide(color: p.line)),
+ ),
+ child: Pressable(
+ semanticLabel: 'Back to your ${a.name.toLowerCase()} session',
+ onTap: () => _resume(c),
+ child: Padding(
+ padding: const EdgeInsets.symmetric(
+ horizontal: S.x4, vertical: S.x3),
child: Row(children: [
- FadeTransition(opacity: _pulse, child: Container(
- width: 10, height: 10,
- decoration: BoxDecoration(color: AppColors.coral, shape: BoxShape.circle))),
- const SizedBox(width: Sp.x3),
- Text('LIVE · ${w.type.toUpperCase()}', style: AppText.overline.copyWith(color: Colors.white70)),
- const Spacer(),
- AppIcon(OsIcon.heart, size: 15, color: AppColors.coral),
- const SizedBox(width: 4),
- Text(w.currentHr > 0 ? '${w.currentHr}' : '—',
- style: AppText.metricSm.copyWith(color: Colors.white, fontSize: 16)),
- const SizedBox(width: Sp.x4),
- Text(_fmt(w.elapsed), style: AppText.metricSm.copyWith(
- color: Colors.white60, fontSize: 15, fontFeatures: [const FontFeature.tabularFigures()])),
- const SizedBox(width: Sp.x2),
- const AppIcon(OsIcon.arrowRight, size: 16, color: Colors.white38),
+ Container(
+ width: 30,
+ height: 30,
+ decoration:
+ BoxDecoration(color: p.wash(a.color), borderRadius: R.rSm),
+ child: Icon(a.icon, size: 16, color: p.on(a.color)),
+ ),
+ const SizedBox(width: S.x3),
+ Expanded(
+ child: Column(
+ crossAxisAlignment: CrossAxisAlignment.start,
+ children: [
+ Text(a.name,
+ style: F.body.copyWith(
+ color: p.ink, fontWeight: FontWeight.w600),
+ maxLines: 1,
+ overflow: TextOverflow.ellipsis),
+ Text('Session running',
+ style: F.over.copyWith(color: p.ink3)),
+ ]),
+ ),
+ Icon(LucideIcons.chevronUp, size: 20, color: p.ink3),
]),
),
),
);
}
}
-
-/// Keeps a PageView child mounted so each screen's loader + 90s timer persist
-/// (mirrors the old IndexedStack behavior).
-class _KeepAlive extends StatefulWidget {
- final Widget child;
- const _KeepAlive({required this.child});
- @override
- State<_KeepAlive> createState() => _KeepAliveState();
-}
-
-class _KeepAliveState extends State<_KeepAlive>
- with AutomaticKeepAliveClientMixin {
- @override
- bool get wantKeepAlive => true;
- @override
- Widget build(BuildContext context) {
- super.build(context);
- return widget.child;
- }
-}
-
diff --git a/lib/ble/ble_engine.dart b/lib/ble/ble_engine.dart
index 2bb7caad..53274245 100644
--- a/lib/ble/ble_engine.dart
+++ b/lib/ble/ble_engine.dart
@@ -44,6 +44,7 @@ import 'package:openstrap_protocol/openstrap_protocol.dart';
import '../data/db.dart';
import '../data/models.dart';
+import '../platform/tasker_bridge.dart';
import '../sync/paired_device.dart' show cleanDeviceLabel;
import '../sync/sync_policy.dart';
import 'ble_state.dart';
@@ -65,12 +66,16 @@ typedef BatchSink =
/// durable half of the safe-trim invariant: it MUST complete before the engine
/// writes the HISTORY_END ACK, so the band never trims flash we haven't banked.
/// [trimTokenHex] is the hex of the HISTORY_END 8-byte continuation token.
+/// [deviceFamily] is which strap produced these rows (`'gen4'`/`'gen5'`, pinned
+/// at service discovery) — stamped into the ledger at ingest, because this is
+/// the only moment anyone knows it. Null when no link has identified itself.
typedef CommitSyncBatchSink =
Future Function(
List raws,
List samples,
String? trimTokenHex, {
List? archives,
+ String? deviceFamily,
});
/// Persist an UNDECODABLE historical record (unknown/unsupported version) to the
@@ -122,6 +127,32 @@ Sample? sampleFromGen5Historical(Gen5HistoricalRecord? g) {
onWrist: g.onWristRaw,
hrValid: g.hrRrValidThisSecond,
hrAlt: g.heartRateAlt,
+ // MT-12 — the record's second and third temperature channels, and the
+ // band's own per-second signal-quality figure. Carried by CHANNEL INDEX,
+ // never by a body part: protocol calls their semantics loose, and naming
+ // one of them is exactly how gen4's `skinTempRaw` came to feed readiness
+ // as a skin temperature. Measured on real records (docs/internal/GATES.md):
+ // populated on 1,035/1,035, 27.0-33.2 °C, systematically 2-3 °C below
+ // `skinTempC`. That is a measurement; no claim is made about what they are.
+ // Nothing reads these — persisting claims nothing, which is the point.
+ tempCh2C: g.tempAux1C,
+ tempCh3C: g.tempAux2C,
+ signalQualityLogVar: g.signalQualityLogVariance,
+ // The band's own gravity-removed motion magnitude for this second (g).
+ // Present on 1,035/1,035 real MG records and 3/3 WHOOP 5 (GATES.md §4b).
+ // NOT our ENMO and never a substitute for it: the band's window, filter
+ // and statistic are all unknown, so the two are on different scales.
+ // Stored, unread — the point is to make the comparison possible later.
+ dynAccelG: g.dynamicAccelerationG,
+ // The record's own sub-second (1/32768 s), decoded on both generations
+ // since forever and dropped here — see Sample.tsSubsec.
+ tsSubsec: g.tsSubsec,
+ // The band's OWN wake/sleep envelope, bits 4-5 of the same byte
+ // `onWristRaw` above already comes out of — decoded, modelled, and the
+ // only field in this mapper that was never carried. Raw code, not the
+ // enum: a stored name freezes a meaning, a stored 2-bit code does not.
+ // Corroboration only, never a stage — see Sample.bandSleepState.
+ bandSleepState: g.sleepStateRawNibble,
);
}
@@ -182,24 +213,33 @@ bool shouldPauseMaintenanceTraffic({required bool offloadActive}) =>
/// Whether a HISTORY_END burst's packet accounting matches what the band
/// reported sending (`expectedPacketCount`, from the metadata frame).
///
-/// [actualBurstPacketCount] only counts packets that reached
-/// onHistoricalRecord/onUndecodableRecord — i.e. that PASSED the RecordGate
-/// plausibility check. A record the gate rejects (a stale/wandering-clock
-/// block — see RecordGate.admit) is, by design, "neither stored nor
-/// counted": it never reaches either callback. The band's own count has no
-/// such carve-out — it just counts every packet it physically transmitted.
+/// [receivedTrafficCount] is every frame we received this burst, ALL types
+/// ([BurstStats.totalTrafficPacketCount]) — the same all-types total
+/// [burstPacketShortfall] compares against, and the exact same measurement:
+/// this predicate is `shortfall <= 0`. Negative is NOT a mismatch: it just
+/// means we tallied MORE frames than the band said it sent (retried/duplicate
+/// frames), which [burstPacketShortfall]'s own doc calls "not loss" — it used
+/// to trip the advisory mismatch counter and write the burst to the sync ledger
+/// as `validated_with_mismatch` anyway. The doc here used to describe a
+/// historical-only, post-RecordGate count that this function is never handed,
+/// and that no longer exists as an input anywhere (the historical-only figure
+/// survives separately as `currentBurstHistoricalPacketCount`, logged but not
+/// compared).
+///
/// [droppedThisBurst] (RecordGate.dropped delta across this burst) must be
-/// added back in before comparing, or a burst containing even one
-/// gate-rejected record can never validate — which discards its OTHER,
-/// perfectly good buffered records and re-requests the same stuck block
-/// forever (zero sync progress).
+/// added back in before comparing: a record the gate rejects is, by design,
+/// "neither stored nor counted" (see RecordGate.admit) while the band's own
+/// count has no such carve-out — it just counts every packet it physically
+/// transmitted. Without it, a burst containing even one gate-rejected record
+/// can never validate, which discards its OTHER, perfectly good buffered
+/// records and re-requests the same stuck block forever (zero sync progress).
@visibleForTesting
bool burstPacketCountMatches({
required int expectedPacketCount,
- required int actualBurstPacketCount,
+ required int receivedTrafficCount,
required int droppedThisBurst,
}) =>
- expectedPacketCount == actualBurstPacketCount + droppedThisBurst;
+ expectedPacketCount <= receivedTrafficCount + droppedThisBurst;
/// Honest burst-completeness signal for TELEMETRY ONLY — this NEVER gates the
/// commit/ACK decision (see the log-only call site).
@@ -370,6 +410,11 @@ class _Session {
Timer? periodicBackfill; // 900s: re-trigger the historical offload
Timer? idleWatchdog; // 60s: strap went silent mid-offload
Timer? historicalRetry; // explicit abort→retry settle
+ /// Abort→retry attempts THIS session. The cycle re-arms the 60 s idle
+ /// watchdog, which can re-fire the abort, so without a cap a band that
+ /// connects but never drains cycles at a fixed period for the life of the
+ /// session — every other retry in this engine is bounded, this one was not.
+ int historicalRetries = 0;
// Starts false: we are NOT connected until connect() resolves / the OS
// connectionState stream reports `connected`. (It was previously initialised
// true, which combined with the stream replaying a spurious initial
@@ -491,6 +536,15 @@ class BleEngine {
final DeviceState state = DeviceState();
+ /// The device family every row this link produces is stamped with — `'gen4'`
+ /// or `'gen5'`, pinned once at service discovery. NULL until a link has
+ /// actually identified itself, and NULL is not gen4: it means we do not know
+ /// which sensor package measured the row, so a per-family metric must refuse
+ /// rather than assume. Deliberately reads `state.generation` (set only after
+ /// the service UUID matched) rather than `_session.band`, which DEFAULTS to
+ /// gen4 before discovery has run.
+ String? get linkDeviceFamily => state.generation;
+
// ── PROCESS-WIDE SINGLE-OWNER GUARD ─────────────────────────────────────────
// The strap streams its historical offload to EVERY subscribed central. If two
// BleEngine instances in this process are connected at once — the foreground
@@ -618,6 +672,8 @@ class BleEngine {
}
// ── OS-managed pending reconnect (background fallback) ───────────────────────
+ static const Duration _osAutoConnectPoll = Duration(seconds: 5);
+
/// Arm a flutter_blue_plus `autoConnect` pending connection and wait for the
/// OS to complete it. Unlike the direct `connect(autoConnect:false)` retry
/// loop (which needs our Dart timer alive to fire the next attempt), an armed
@@ -652,7 +708,13 @@ class BleEngine {
// Arm under the op lock so it can't overlap a connect/disconnect.
await _locked(() => device.connect(autoConnect: true, mtu: null));
} catch (e) {
+ // Cost the caller the poll interval before handing back a failure. The
+ // reconnect loop's OS-pending branch has no backoff of its own (only the
+ // direct-connect branch delays), so returning immediately — which is what
+ // an arm against a powered-off adapter does — spun that loop at
+ // event-loop rate, burning CPU/battery for as long as Bluetooth was off.
_log('autoConnect arm failed: $e');
+ await Future.delayed(_osAutoConnectPoll);
return false;
}
_log('OS autoConnect armed for $remoteId — waiting (max '
@@ -663,7 +725,7 @@ class BleEngine {
done.complete(true);
}
});
- final poll = Timer.periodic(const Duration(seconds: 5), (_) {
+ final poll = Timer.periodic(_osAutoConnectPoll, (_) {
if (keepWaiting != null && !keepWaiting() && !done.isCompleted) {
done.complete(false);
}
@@ -808,6 +870,12 @@ class BleEngine {
);
}
+ /// Test seam onto the LOWEST-level write, so the dangerous-opcode block that
+ /// lives there can be exercised on a pre-framed frame — which is exactly the
+ /// shape the nine `_send`-bypassing call sites hand it.
+ @visibleForTesting
+ Future debugWriteRaw(Uint8List raw) => _write(raw);
+
/// Feed one inbound historical frame through the real ingest path (decode →
/// plausibility gate → store or archive).
///
@@ -981,6 +1049,13 @@ class BleEngine {
FrameCorruptionDetector _frameCorruption = FrameCorruptionDetector();
int _crcFailuresTotal = 0; // across the engine's lifetime (diagnostics)
int _crcFailuresThisSession = 0; // reset on each connect
+ // Frames whose CRCs both pass but whose revision byte this decoder does not
+ // understand (gen5 only — gen4 has no revision byte). NOT corruption: a
+ // non-zero count means the strap's firmware moved the header layout.
+ int _frameRevRejectsTotal = 0;
+ /// Bounded "ask the band to re-send a short burst" budget (see P-03 / the
+ /// class doc — an unconditional FAIL here wedged sync forever).
+ final BurstShortfallGate _shortfallGate = BurstShortfallGate();
ClockRef? _clockRef; // strap-RTC ↔ wall correlation (set from GET_CLOCK)
/// Latest strap-RTC ↔ wall correlation, or null until GET_CLOCK is answered.
@@ -995,6 +1070,16 @@ class BleEngine {
DateTime? _lastClockVerifyAt;
int? _sessionOldestUnix; // strap's banked-data window (GET_DATA_RANGE)
int? _sessionNewestUnix;
+ Map? _lastPagesBehind;
+
+ /// The strap's own ring-buffer bookkeeping from the last GET_DATA_RANGE reply
+ /// — `{written, used, capacity, trim_page, wrap_count, free_records}`, exactly
+ /// as protocol parsed it (SD-08). Null until a reply carried it.
+ ///
+ /// DEVICE STATE, not physiology: it can claim what it says and nothing more.
+ /// `wrap_count` is a ring wrap counter, NOT a unique batch id — never build
+ /// dedupe on it.
+ Map? get lastPagesBehind => _lastPagesBehind;
// Lifetime count of GET_DATA_RANGE reads rejected by isCorruptFutureRtc —
// see the range_oldest/range_newest handler below.
int _corruptDataRangeCount = 0;
@@ -1116,7 +1201,7 @@ class BleEngine {
void _log(String s) => log?.call(s);
- void _logHistoricalOptics(Uint8List inner, R24 r) {
+ void _logHistoricalOptics(R24 r) {
final version = r.histVersion;
final count = (_historicalVersionCounts[version] ?? 0) + 1;
_historicalVersionCounts[version] = count;
@@ -1143,27 +1228,11 @@ class BleEngine {
return;
}
- if (version == 25) {
- final view = inner.buffer.asByteData(
- inner.offsetInBytes,
- inner.lengthInBytes,
- );
- final u16s = [];
- for (int off = 23; off + 2 <= inner.length && off < 73; off += 2) {
- u16s.add(view.getUint16(off, Endian.little));
- }
- final first = u16s.take(8).toList();
- final min = u16s.isEmpty ? 0 : u16s.reduce((a, b) => a < b ? a : b);
- final max = u16s.isEmpty ? 0 : u16s.reduce((a, b) => a > b ? a : b);
- _log(
- '[SPO2] hist=v25 count=$count base=inner '
- 'known(unix@7 gravity@69/71/73) '
- 'unknown_optical_region=23..72 '
- 'ts=${r.tsEpoch} g=${r.accelG.map((v) => v.toStringAsFixed(4)).join(",")} '
- 'opt_u16_unique=${u16s.toSet().length} opt_u16_min=$min opt_u16_max=$max '
- 'opt_u16_first8=$first',
- );
- }
+ // No v25 arm: the only caller branches on `recType != Record.r25`, and
+ // `recType` is frame.inner[1] — the same byte `r.histVersion` reads — so a
+ // v25 record can never reach here. v25 is archived whole instead (it is a
+ // 24 Hz PPG waveform, not a 1 Hz record), and its byte survey lived here
+ // unreachable.
}
/// Note that records were just persisted; (re)arm the debounced derive trigger.
@@ -1220,6 +1289,7 @@ class BleEngine {
// degrading radio corrupting frames rather than a stale/implausible band.
'crc_failures_total': _crcFailuresTotal,
'crc_failures_this_session': _crcFailuresThisSession,
+ 'frame_rev_rejects_total': _frameRevRejectsTotal,
'frame_corruption_tripped': _frameCorruption.tripped,
// Band-truth reconciliation: expectedPacketCount vs. what we actually
// committed — advisory only (see the comment at the validation site), but
@@ -1284,6 +1354,17 @@ class BleEngine {
Future scan({
Duration timeout = const Duration(seconds: 12),
}) async {
+ // A phone-level blocker is NOT "nothing answered". Returning null for a
+ // revoked Bluetooth permission classified it as `notFound` upstream, which
+ // told the user to walk closer to a band that was never the problem — the
+ // one fix that cannot work. Check the adapter BEFORE scanning and throw,
+ // so the reason reaches the caller instead of being flattened into a null.
+ final pre = await _detectBlocker();
+ if (pre != null) {
+ _noteBlocker(pre);
+ _setPhase(BleConnState.idle);
+ throw BleUnavailableException(pre);
+ }
if (FlutterBluePlus.isScanningNow) {
await FlutterBluePlus.stopScan();
}
@@ -1313,6 +1394,15 @@ class BleEngine {
withServices: [gen4Svc, gen5Svc], timeout: timeout);
await FlutterBluePlus.isScanning.where((on) => on == false).first;
} catch (e) {
+ // Android reports a missing runtime permission by throwing here rather
+ // than through the adapter state, so the pre-check above cannot catch it.
+ final blocker = classifyBleBlocker(error: e);
+ if (blocker != null) {
+ _noteBlocker(blocker);
+ await sub.cancel();
+ _setPhase(BleConnState.idle);
+ throw BleUnavailableException(blocker);
+ }
_log('scan error: $e');
} finally {
await sub.cancel();
@@ -1320,10 +1410,66 @@ class BleEngine {
if (found == null) {
_setPhase(BleConnState.idle);
_log('No WHOOP found (force-quit the official app; band must be free).');
+ } else {
+ _clearBlocker();
}
return found;
}
+ // ── phone-level Bluetooth blockers ──────────────────────────────────────────
+ /// The last reason the phone's own stack refused us, or null when the stack is
+ /// usable. Latched (a blocker does not clear itself) and cleared only by a
+ /// scan or connect that actually got through.
+ BleBlocker? _blocker;
+
+ BleBlocker? get bluetoothBlocker => _blocker;
+
+ /// The ONE connection state a screen renders — the phone-level blocker and the
+ /// band's own diagnostic flags folded into a named state with its reason and
+ /// its fix. See [bandStatusFor]; every flag it reads is set by a detector in
+ /// this file.
+ BandStatus get bandStatus => bandStatusFor(
+ connection: state.connection,
+ blocker: _blocker,
+ autoReconnectPaused: state.autoReconnectPaused,
+ needsRepairGuide: state.needsRepairGuide,
+ syncChunkQuarantined: state.syncChunkQuarantined,
+ strapNeedsReboot: state.strapNeedsReboot,
+ syncClockLost: state.syncClockLost,
+ bondRefusals: state.bondRefusals,
+ );
+
+ /// Read the adapter state without hanging: `unknown` is the pre-init value and
+ /// never a verdict, so wait past it, but never longer than [_blockerProbe].
+ static const Duration _blockerProbe = Duration(seconds: 2);
+
+ Future _detectBlocker() async {
+ try {
+ final s = await FlutterBluePlus.adapterState
+ .firstWhere((s) => s != BluetoothAdapterState.unknown)
+ .timeout(_blockerProbe,
+ onTimeout: () => BluetoothAdapterState.unknown);
+ return classifyBleBlocker(adapterState: s.name);
+ } catch (e) {
+ return classifyBleBlocker(error: e);
+ }
+ }
+
+ void _noteBlocker(BleBlocker b) {
+ if (_blocker == b) return;
+ _blocker = b;
+ _log('[BLE] blocked by the phone, not the band: ${b.name}.');
+ onState(state);
+ }
+
+ /// Anything that actually reached the radio proves the stack is usable again.
+ void _clearBlocker() {
+ if (_blocker == null) return;
+ _blocker = null;
+ _log('[BLE] phone-level Bluetooth block cleared.');
+ onState(state);
+ }
+
/// Reconnect to a previously-paired device by its persisted remote id.
Future connectToRemoteId(String remoteId) =>
connect(BluetoothDevice.fromId(remoteId));
@@ -1408,10 +1554,16 @@ class BleEngine {
autoConnect: false,
);
} catch (e) {
+ // Bluetooth revoked mid-life shows up here, on a reconnect, and used to
+ // vanish into the reconnect loop as an ordinary failed attempt — retrying
+ // silently forever against a stack that will never answer.
+ final blocker = classifyBleBlocker(error: e);
+ if (blocker != null) _noteBlocker(blocker);
_log('connect failed: $e');
await _failConnect();
return false;
}
+ _clearBlocker();
// connect() resolved without throwing => the link is up. Set this explicitly
// rather than racing the connectionState stream's `connected` emission, so
@@ -1588,6 +1740,8 @@ class BleEngine {
_stuckStrap = StuckStrapDetector();
_frameCorruption = FrameCorruptionDetector();
_crcFailuresThisSession = 0;
+ // Per-session budget only: the engine-run total deliberately carries over.
+ _shortfallGate.onSessionStart();
_burstMismatchStreak = 0;
_autoContinue.end();
_lastBackfillAt = 0;
@@ -1613,6 +1767,17 @@ class BleEngine {
// continuation detectors are correct on the first offload after a restart.
_recordGate =
RecordGate(frontierTs: (await cursorReader?.call('rec_ts_hw')) ?? 0);
+ // The gate's drop counter restarts at 0, so its burst baseline must too.
+ // Left behind, a HISTORY_END arriving on connection N>1 before that
+ // connection's first HISTORY_START computed a NEGATIVE droppedThisBurst
+ // against the previous connection's baseline — which fabricates a
+ // positive burstPacketShortfall (one needless re-delivery through
+ // _shortfallGate.refuse) and makes TrimAckVerdict.blockedNoDurableProgress
+ // unfireable (`!hadDurableRows && droppedThisBurst > 0`), i.e. a
+ // gate-drop-only burst could authorise the band to trim flash we never
+ // banked. The startless HISTORY_END is expected, not hypothetical: the
+ // historyEnd branch has its own `history_end_while_not_syncing` terminal.
+ _burstDroppedAtStart = 0;
// Re-seed the counter-regression watch from the durable counter_hw
// cursor so a reboot is caught even across the reconnect it usually
// causes, instead of only within a single unbroken connection.
@@ -1937,8 +2102,33 @@ class BleEngine {
if (_session != session || !session.connected) return;
_lastRx = DateTime.now();
for (final frame in session.asm[role]!.feed(chunk)) {
- if (frame.valid) {
+ if (frame.decodable) {
_onFrame(role, frame, session);
+ } else if (frame.valid) {
+ // Both CRCs pass but the frame revision is one this decoder does
+ // not understand, so packetType/seq/opcode sit at unknown offsets:
+ // routing it would read a BODY byte as the opcode and dispatch on
+ // it, silently, with no CRC failure to point at. Counted apart
+ // from CRC corruption so a firmware revision bump is loud.
+ _frameRevRejectsTotal++;
+ // ARCHIVE, don't drop. These are intact bytes from a firmware we
+ // don't speak yet — exactly what raw_archive is for. Dropping them
+ // while still ACKing the burst let the band trim records that
+ // existed nowhere. The counter is forensic only (its offset is a
+ // guess under an unknown revision); raw_archive keys on the hex.
+ //
+ // Only while an offload is running: that is the only window where
+ // an ACK can make the band delete these bytes, and we cannot tell a
+ // record from a 100 Hz live frame under an unknown revision —
+ // archiving those (raw_archive is never pruned) would bloat the DB
+ // exactly the way live frames are kept out of raw_records for.
+ if (_offloadActive) {
+ _archiveHistoricalFrame(
+ frame,
+ _counterFromInner(frame.inner),
+ reason: 'undecodable_frame_rev',
+ );
+ }
} else {
// Previously silent: a degrading radio corrupting frames looked
// identical to a healthy one everywhere. Now counted (surfaced in
@@ -1977,8 +2167,10 @@ class BleEngine {
}
_drain?.onLinkDown();
if (!wasIntentional) {
- _feedReconnectDetectors();
final reason = session.device.disconnectReason;
+ _feedReconnectDetectors(
+ timedOut: isTimeoutDisconnect(reason?.description),
+ );
_log('Link down (reason=${reason?.description ?? "unknown"}).');
}
// The caller (AppState) listens for the 'disconnected' phase to drive its
@@ -1994,8 +2186,8 @@ class BleEngine {
// watchdog, historical retry) kept firing into a dead characteristic
// forever and its four onValueReceived subscriptions stayed registered —
// one more full set leaked on every drop. Deferred off this notification
- // callback (we are inside one of the very subscriptions being cancelled)
- // and non-intentional, so no redundant device.disconnect() is issued.
+ // callback (we are inside one of the very subscriptions being cancelled);
+ // the disconnect() teardown issues is a no-op on an already-dead link.
unawaited(
Future(() async {
if (_session != session) return; // a connect already replaced us
@@ -2009,10 +2201,16 @@ class BleEngine {
);
}
- /// Feed an UNINTENTIONAL disconnect to the cross-reconnect detectors. A timeout
- /// is approximated by "not an intentional close". The detectors self-reset when
- /// a disconnect does not match their quick-timeout pattern.
- void _feedReconnectDetectors() {
+ /// Feed an UNINTENTIONAL disconnect to the cross-reconnect detectors. The
+ /// detectors self-reset when a disconnect does not match their quick-timeout
+ /// pattern.
+ ///
+ /// [timedOut] is the platform's own verdict (see [isTimeoutDisconnect]) and
+ /// used to be hardcoded `true` — which made every ordinary drop look like a
+ /// timeout to both detectors. `_bondTime` is set unconditionally in the
+ /// connect setup, not just on Android, so that hardcoding let two unremarkable
+ /// disconnects inside 8 s of setup latch the re-pair guide on any platform.
+ void _feedReconnectDetectors({required bool timedOut}) {
final now = DateTime.now();
final sinceArm = _armTime == null
? null
@@ -2023,7 +2221,7 @@ class BleEngine {
if (_marginalRadio.connectionEnded(
wasArmed: _liveEnabled,
secondsSinceArm: sinceArm,
- timedOut: true,
+ timedOut: timedOut,
)) {
state.standardHrFallback = true;
onState(state);
@@ -2034,7 +2232,7 @@ class BleEngine {
if (_postBondLoop.connectionEnded(
wasBonded: _bondTime != null,
secondsSinceBond: sinceBond,
- timedOut: true,
+ timedOut: timedOut,
)) {
state.needsRepairGuide = true;
onState(state);
@@ -2042,6 +2240,41 @@ class BleEngine {
}
}
+ /// Test seam: the disconnect path's detector feed, with the bond timestamp the
+ /// connect setup would have stamped. Both detectors live behind a real radio,
+ /// so without this the only coverage possible was of the pure detectors —
+ /// never of the engine wiring that decides what counts as a timeout.
+ @visibleForTesting
+ void debugFeedDisconnect({required bool timedOut, DateTime? bondedAt}) {
+ _bondTime = bondedAt ?? DateTime.now();
+ _feedReconnectDetectors(timedOut: timedOut);
+ }
+
+ /// A command reply is the direct contradiction of the re-pair guide: the band
+ /// decrypted one of our commands and answered it, so encryption is not
+ /// blocking traffic and there is nothing to re-pair.
+ ///
+ /// `needsRepairGuide` was set-only in practice. Its one clear sat inside
+ /// [refreshAutoReconnectPause], behind `if (!state.autoReconnectPaused)
+ /// return false` — and a single refused bond, or a post-bond loop trip, never
+ /// pauses auto-reconnect. `state` is one long-lived [DeviceState], so a
+ /// working, syncing band kept telling the user to forget the bond and re-pair
+ /// for the rest of the process.
+ ///
+ /// Keyed on the round-trip rather than on `createBond()` succeeding, because
+ /// the bond succeeding does not prove the band accepts commands while a reply
+ /// does — and the connect setup issues GET_CLOCK immediately after the bond,
+ /// so on Android the evidence lands in the same setup either way.
+ /// [PostBondTimeoutLoopDetector] trips once and latches, so it is reset here
+ /// too: otherwise the guide could be cleared but never legitimately re-raised.
+ void _clearRepairGuideOnCommandReply() {
+ if (!state.needsRepairGuide) return;
+ state.needsRepairGuide = false;
+ _postBondLoop.reset();
+ onState(state);
+ _log('[RECONNECT] band answered a command — clearing the re-pair guide.');
+ }
+
// ── write (serialised through a single chain) ───────────────────────────────────
// The cmd characteristic write is WITH-RESPONSE: that's what triggers BLE bonding
// (the auth challenge) AND gets commands delivered + acknowledged. Write-WITHOUT-
@@ -2069,8 +2302,31 @@ class BleEngine {
/// whatever session happens to be current when the write chain reaches it —
/// i.e. an OLD connection's batch-ACK, with a re-used sync seq, written onto
/// a BRAND NEW link. Every offload write passes its owning session.
- Future _write(Uint8List raw, {_Session? owner}) {
+ /// [allowDangerous] is the ONE audited opt-out of the block below. It exists
+ /// for `enableGen5DeepBuffers`, whose SET_FF_VALUE frames are in
+ /// `dangerousCmds` on purpose (persistent config writes) and are sent only
+ /// behind an explicit user opt-in with a restore-defaults companion. Pass it
+ /// nowhere else without the same justification.
+ Future _write(
+ Uint8List raw, {
+ _Session? owner,
+ bool allowDangerous = false,
+ }) {
final session = _session;
+ // The dangerous-opcode block lives HERE, at the one write every command
+ // funnels through, not only in `_send`: nine call sites build their own
+ // frame and hand it straight to `_write`, so a `_send`-only guard was
+ // bypassable BY CONSTRUCTION rather than by an audited opt-out. Now the
+ // bypasses are one named parameter at one reviewed call site, and
+ // FORCE_TRIM (whose full-erase form is two 0xFEFEFEFE args), REBOOT and
+ // POWER_CYCLE cannot leave this engine by any path.
+ final opcode =
+ allowDangerous ? null : _opcodeOfFrame(raw, session?.band ?? BandProfile.gen4);
+ if (opcode != null &&
+ (dangerousCmds.contains(opcode) || OpcodeSafety.isDestructive(opcode))) {
+ _log('REFUSED dangerous opcode 0x${opcode.toRadixString(16)} at _write');
+ return Future.value(false);
+ }
final completer = Completer();
_writeChain = _writeChain.then((_) async {
var ok = false;
@@ -2117,6 +2373,14 @@ class BleEngine {
return completer.future;
}
+ /// The command opcode carried by an already-framed outbound write, or null
+ /// when [raw] is too short to carry one. Layout is `header | pktType | seq |
+ /// opcode | body…`, and only the header length differs by generation.
+ static int? _opcodeOfFrame(Uint8List raw, BandProfile band) {
+ final i = band.headerLen + 2;
+ return i < raw.length ? raw[i] : null;
+ }
+
/// Retry schedule for the HISTORY_END batch ACK (pure; see ble_state.dart).
final AckRetryPolicy ackRetryPolicy = const AckRetryPolicy();
@@ -2270,10 +2534,16 @@ class BleEngine {
List samples,
String? trimTokenHex, {
List? archives,
+ String? deviceFamily,
}) async {
final hasArchives = archives != null && archives.isNotEmpty;
if (raws.isEmpty && trimTokenHex == null && !hasArchives) return;
- await onCommitBatch!(raws, samples, trimTokenHex, archives: archives);
+ // Stamp the family HERE, from the link that produced the chunk: this is the
+ // last point that knows it. Callers may override (tests / a replay that
+ // knows better); null falls back to the live link, which is itself null
+ // before discovery has pinned one.
+ await onCommitBatch!(raws, samples, trimTokenHex,
+ archives: archives, deviceFamily: deviceFamily ?? linkDeviceFamily);
if (raws.isNotEmpty || hasArchives) _noteStored();
}
@@ -2500,6 +2770,29 @@ class BleEngine {
// own raw-buffer storage (a future db table), not a 1Hz Sample, so they
// fall through to the undecodable archive below — that is honest
// (correctly-identified-but-not-yet-stored), not a decode failure.
+ //
+ // WHAT THE v26 PPG BUFFER MAY NOT BECOME: vascular age, arterial
+ // stiffness, a "PPG aging clock", or any pulse-morphology claim about a
+ // blood vessel. this is not the v25 scar being reapplied — that one
+ // killed rate/ratio derivations and morphology is a per-pulse shape, so
+ // it gets its own refusal, and it fails for four independent reasons:
+ // 1. sample rate. 24-50 Hz is ~12-25 samples per cardiac cycle,
+ // nowhere near enough to locate a dicrotic notch, and gen4's v25 is
+ // 13-27 s bursts every ~20 min.
+ // 2. multiplexing. v26's subChannel means one burst is several
+ // interleaved optical channels, not one signal, and 0.2% of records
+ // report a channel we don't know (protocol's `subChannelKnown` is
+ // the gate, and it returning null is the common failure).
+ // 3. amplitude. the band re-tunes gain per record, and morphology IS
+ // amplitude-shape, so pulse shape is not comparable across records
+ // without a normalisation nobody has validated.
+ // 4. physiology. the diastolic peak is frequently absent in older
+ // subjects — the exact population such a feature targets — and
+ // green-light wrist reflectance is the worst site and wavelength
+ // for morphology, with no explainable transfer to arterial stiffness.
+ // the defensible uses of this waveform are internal and claim nothing
+ // about a vessel: beat-detection quality, motion-artifact rejection,
+ // corroborating the band's own RR intervals. build those, not a number.
sample = decodeGen5HistoricalSample(frame.inner);
} else if (recType != Record.r25 &&
kKnownRecordVersions.contains(recType)) {
@@ -2509,11 +2802,45 @@ class BleEngine {
// them. gen5 also ships a v18 with a completely different layout; the
// `isGen5` branch above claims it first, so this is gen4 only.
//
- // v25 is EXCLUDED on purpose and keeps going to the archive, exactly as
- // before. Not because the decode is wrong — it is right, and checked
- // against 20k of these records: the timestamp at inner[7] is monotonic
- // and steps by exactly 1 s, and the gravity vector reads a mean |g| of
- // 0.97 with 19999/20000 inside the plausible window.
+ // v25 is EXCLUDED on purpose and keeps going to the archive.
+ //
+ // THE TIMESTAMP IS RIGHT AND THE GRAVITY VECTOR IS NOT. inner[7] is
+ // monotonic and steps by exactly 1 s. But `_parseV25`'s accel — i16s at
+ // inner[69/71/73], the only "validation" behind which is a mean |g| of
+ // 0.97 sitting inside a 0.5-1.5 g window — is NOT an accelerometer.
+ // MEASURED on all 28,395 v25 records in `whoop-4.db`:
+ //
+ // * inner[73] (the "z" axis) takes THREE distinct values across 28,395
+ // records: 0, 1 and 256. inner[71] ("y") takes 17, one of which
+ // (2896) is 68% of them. No axis of a worn IMU does that.
+ // * inner[69] ("x") is the upper half of a little-endian f32 that
+ // starts at inner[67], which is why it is pinned near 0.94 g. |g|
+ // ≈ 0.97 is that constant, not a wrist.
+ // * 13,394 v25 seconds also have a v24 record for the SAME second.
+ // Against that real gravity vector: per-axis correlation 0.16 /
+ // 0.22 / 0.06, and the median ANGLE between the two vectors is 83°
+ // — orthogonal, i.e. unrelated.
+ //
+ // A near-constant vector is exactly the "perfectly still wrist" this
+ // file's `ax/ay/az` note refuses to fabricate, and van Hees immobility
+ // is precisely what would consume it. So SLP-05's routing half is
+ // REFUSED on the data, not deferred. Consistent with GATES.md §4a: the
+ // 76-byte v25 inner is the same record as gen5's v26 — 24 × i16 of
+ // waveform — so there is no room in it for a gravity vector, and what
+ // lives at 69/71/73 is the waveform's tail and a constant.
+ //
+ // AND THERE IS NOTHING TO GAIN EITHER WAY. Of the 13,395 v25 seconds
+ // that fall inside `decoded_onehz`'s retained range on that export,
+ // 13,394 are ALREADY covered by a v24 record; exactly one is new in
+ // 8.5 days. Recomputed over all 24 stored sleep windows, the observed
+ // fraction (`sampled && hrNear`) moves +0.00 pp. The "1-5 pp lift"
+ // SLP-05 sizes does not exist on real data.
+ //
+ // Worse, routing it here would be a REGRESSION: `_queueDecodedOneHz`
+ // writes REPLACE on the rec_ts key, so a v25 record arriving for a
+ // second a v24 record already holds would evict it — deleting that
+ // second's HR, R-R, optical and thermal readings and leaving an
+ // HR-less row behind. That is 49% of v25 records.
//
// The record genuinely has NO heart rate. Every byte and u16 offset was
// scanned for anything in a bpm range with physiological drift across
@@ -2522,13 +2849,12 @@ class BleEngine {
// is a 24-slot raw waveform buffer spanning the full i16 range — the band
// ships samples here and computes HR into the v24 records instead.
//
- // So `_parseV25` reporting `hr: 0` is an honest absence. The collision is
- // downstream: `decoded_onehz.hr` is NOT NULL and `hr == 0` is this app's
- // off-skin sentinel, so banking v25 would assert "the band was off the
- // wrist" for every one of those seconds — ~50k in one real export — while
- // the genuine gravity keeps the accel-coverage gate happy with the
- // window. The gravity IS worth having; it needs a nullable `hr` column
- // first. Until then the bytes are archived and nothing is lost.
+ // So `_parseV25` reporting `hr: 0` is an honest absence, and the nullable
+ // `hr` column (schema v43) that used to be the blocker is in place — the
+ // blocker now is the accel, above. `undecodable_rec_v25` is therefore NOT
+ // in `LocalDb.redrivableArchiveReasons` and must not be added: the bytes
+ // stay archived, unpruned, whole, for a build that can actually read the
+ // waveform (RESP-15/SD-15). Nothing is lost by leaving them there.
// Legacy decoder first, firmware-fallback chain second, undecodable
// archive last — see FirmwareAwareR24Decoder.
var decodeTarget = frame.inner;
@@ -2540,27 +2866,52 @@ class BleEngine {
}
final r = _firmwareDecoder.decode(decodeTarget);
if (r != null) {
- _logHistoricalOptics(frame.inner, r);
+ _logHistoricalOptics(r);
sample = Sample(
tsEpoch: r.tsEpoch,
counter: r.counter,
hr: r.hr,
rrIntervalsMs: List.from(r.rrIntervalsMs),
- ax: r.accelG.isNotEmpty ? r.accelG[0] : 0,
- ay: r.accelG.length > 1 ? r.accelG[1] : 0,
- az: r.accelG.length > 2 ? r.accelG[2] : 0,
+ // NULL, not 0: a decoder that emitted no gravity vector said the
+ // accel is ABSENT, and 0 g is a reading no wrist can produce (which
+ // is exactly why a run of them reads as a perfectly still one).
+ ax: r.accelG.isNotEmpty ? r.accelG[0] : null,
+ ay: r.accelG.length > 1 ? r.accelG[1] : null,
+ az: r.accelG.length > 2 ? r.accelG[2] : null,
spo2RedRaw: r.spo2RedRaw,
spo2IrRaw: r.spo2IrRaw,
// stored raw under the column it's always had. nothing reads it as a
// temperature — that's what the deprecation is warning about.
// ignore: deprecated_member_use
skinTempRaw: r.skinTempRaw,
+ // gen4 ambient-light ADC (u16 @inner[70]). Decoded on every
+ // historical record since forever and thrown away here — this was
+ // the ONLY hole left in SD-04: the column, the Sample field and the
+ // write all exist, but the live drain never handed the value over,
+ // so `ambient_raw` was NULL on every row the band ever delivered.
+ // 0 is the ADC-ABSENT sentinel (records.dart emits `optical ? u16@70
+ // : 0` for unconfirmed versions) and is mapped to NULL at the write
+ // in `_queueDecodedOneHz` — do not "fix" it by zero-filling here.
+ ambientRaw: r.ambientRaw,
+ // Same field, same offset, same omission on this side: the record's
+ // sub-second was decoded and thrown away here too.
+ tsSubsec: r.tsSubsec,
);
}
} else if (recType == Record.r10) {
final r = parseR10Lite(frame.inner);
if (r != null) {
- sample = Sample(tsEpoch: r.tsEpoch, counter: r.counter, hr: r.hr);
+ // R10 carries an R-R block, and this path used to drop it. The record
+ // then committed as decoded — so it never reached raw_archive — and
+ // the band was acked to trim it, which made those beats unrecoverable
+ // rather than merely degraded. R10 carries no accel we map, so
+ // ax/ay/az stay ABSENT (null) rather than becoming a still wrist.
+ sample = Sample(
+ tsEpoch: r.tsEpoch,
+ counter: r.counter,
+ hr: r.hr,
+ rrIntervalsMs: List.from(r.rrIntervalsMs),
+ );
}
}
// FIRMWARE RESILIENCE: a historical record we could NOT decode (unknown/
@@ -2594,8 +2945,10 @@ class BleEngine {
// ARCHIVE, don't drop. A record we merely MISTRUST used to be written
// nowhere at all, i.e. treated strictly worse than one we cannot parse —
// and the batch-ACK then let the band trim those bytes away for good.
- // The archive rides the same pre-ACK transaction, so the bytes survive
- // and a later pass can re-time them once the clock correlation is known.
+ // The archive rides the same pre-ACK transaction, so the bytes survive.
+ // They are NOT re-timed later: the offset-and-snap salvage that used to
+ // promise it would collapse 300 one-second records onto one rec_ts (see
+ // sync_policy.dart), so it is gone. The day keeps an honest hole.
_archiveHistoricalFrame(frame, counter, reason: kGateDroppedReason);
return;
}
@@ -2620,28 +2973,7 @@ class BleEngine {
void _absorbState(Decoded d) {
final f = d.fields;
- if (d.kind == 'cmd_response' && f['opcode'] == Cmd.getDataRange) {
- // `range_oldest`/`range_newest` come from the reply's real field map.
- // These used to come from a local byte-scan that took the min/max of every
- // 4-byte window that looked like a unix time — which is how a cross-field
- // read once landed as "newest" in 2034 and left `backlogRemains` true
- // forever, chasing a target the band could never reach. The scanner was
- // then given a tighter ceiling instead of being replaced, and it kept
- // running alongside the correct value, feeding a different decision.
- final oldest = (f['range_oldest'] as num?)?.toInt();
- final newest = (f['range_newest'] as num?)?.toInt();
- if (oldest != null) _strapHistoryOldestTs = oldest;
- if (newest != null) _strapHistoryNewestTs = newest;
- unawaited(
- LocalDb.upsertSyncLedgerEntry(
- status: 'range_seen',
- metaPatch: {
- 'strap_history_oldest_ts': _strapHistoryOldestTs,
- 'strap_history_newest_ts': _strapHistoryNewestTs,
- },
- ),
- );
- }
+ if (d.kind == 'cmd_response') _clearRepairGuideOnCommandReply();
// GET_ALARM_TIME readback is PARKED: the response byte layout isn't confirmed
// (the decode assumed a leading revision byte before the epoch that the band
// doesn't send → it returned a plausible-but-wrong epoch, e.g. showing 21:49
@@ -2817,9 +3149,25 @@ class BleEngine {
_clockCorrectTries = 0; // latched — reset for the next drift episode
}
}
+ // THE ONE GET_DATA_RANGE consumer. `range_oldest`/`range_newest` come from
+ // the reply's real field map (protocol emits them together or not at all).
+ // They used to come from a local byte-scan that took the min/max of every
+ // 4-byte window that looked like a unix time — which is how a cross-field
+ // read once landed as "newest" in 2034 and left `backlogRemains` true
+ // forever, chasing a target the band could never reach. The scanner was
+ // then given a tighter ceiling instead of being replaced, and it kept
+ // running alongside the correct value, feeding a different decision.
+ //
+ // The same field map was then absorbed TWICE — once here behind
+ // isCorruptFutureRtc, and once in a sibling block that assigned
+ // `range_newest` straight into `_strapHistoryNewestTs` with no check at
+ // all. Protocol only screens to `_maxPlausibleUnix` (year 2100), so every
+ // junk value between now+1 day and 2100 reached the ungated path, pinned
+ // `backlogRemains` true in AppState._runSyncBurst and burned all 20
+ // backfill sessions on every foreground catch-up. One field map, one gate.
if (f.containsKey('range_oldest') && f.containsKey('range_newest')) {
- final oldest = f['range_oldest'] as int;
- final newest = f['range_newest'] as int;
+ final oldest = (f['range_oldest'] as num).toInt();
+ final newest = (f['range_newest'] as num).toInt();
// GET_DATA_RANGE responses are documented to occasionally carry junk at
// unstable offsets. Nothing previously sanity-checked `range_newest`
// before it tightened RecordGate's session window for the whole
@@ -2831,17 +3179,48 @@ class BleEngine {
_log(
'[SYNC] GET_DATA_RANGE newest=$newest is implausibly far in the '
'future — treating as a corrupt strap RTC read; NOT tightening '
- 'this session\'s plausibility window '
+ 'this session\'s plausibility window, and NOT adopting it as the '
+ 'backlog target '
'(corrupt_ranges_total=$_corruptDataRangeCount).',
);
} else {
_sessionOldestUnix = oldest;
_sessionNewestUnix = newest;
+ _strapHistoryOldestTs = oldest;
+ _strapHistoryNewestTs = newest;
state.dataRangeOldest = oldest;
state.dataRangeNewest = newest;
onState(state);
+ // A rejected read is not a range seen: the ledger row is written only
+ // for the value we actually adopted. Through the same best-effort
+ // wrapper as every other ledger write in this file — un-awaited and
+ // un-caught, a failed write surfaced as an unhandled async error
+ // instead of a log line.
+ unawaited(
+ _bestEffortLedgerWrite(
+ () => LocalDb.upsertSyncLedgerEntry(
+ status: 'range_seen',
+ metaPatch: {
+ 'strap_history_oldest_ts': _strapHistoryOldestTs,
+ 'strap_history_newest_ts': _strapHistoryNewestTs,
+ },
+ ),
+ ),
+ );
}
}
+ // The OTHER half of the same GET_DATA_RANGE reply: the strap's own ring
+ // bookkeeping, parsed since forever and read by nobody. Deliberately NOT
+ // inside the block above — `pages_behind` is emitted independently of the
+ // epochs, and pages are pages whatever the RTC says, so a corrupt-clock
+ // reply still carries a usable backlog. The clock gate stays exactly as it
+ // is; this reads a different field.
+ final pb = f['pages_behind'];
+ if (pb is Map) {
+ _lastPagesBehind =
+ Map.unmodifiable(pb.cast());
+ unawaited(_recordPagesBehind(_lastPagesBehind!));
+ }
if (d.kind == 'cmd_response' && f['hello'] is HelloInfo) {
final h = f['hello'] as HelloInfo;
// Serial now comes from the fixed offset in the HELLO body (see
@@ -2922,12 +3301,30 @@ class BleEngine {
}
}
+ /// Attempts allowed per session before the abort→retry cycle gives up and
+ /// leaves the link to the ordinary reconnect path.
+ static const int _maxHistoricalRetriesPerSession = 3;
+
Future _abortAndRetryHistorical({required String reason}) async {
final session = _session;
if (session == null || !session.connected) return;
session.idleWatchdog?.cancel();
session.historicalRetry?.cancel();
+ // The drain ended on the clock, not on a HISTORY_COMPLETE. Record that as
+ // the terminal here — the only place it is knowable. It used to be attempted
+ // in `_onOffloadFinished` behind a `!complete` flag that no call site ever
+ // passed, so a timed-out drain reported whatever terminal the previous burst
+ // had left behind (usually `success`).
+ _setHpsTerminal(_HpsTerminalKind.timeout, reason: reason);
_setOffloadActive(false);
+ if (session.historicalRetries >= _maxHistoricalRetriesPerSession) {
+ _log('[SYNC] abort($reason) — already retried '
+ '${session.historicalRetries} times this session; NOT re-arming. '
+ 'The strap is not draining; the reconnect path takes it from here.');
+ await _send(Cmd.abortHistoricalTransmits, const [0x00]);
+ return;
+ }
+ session.historicalRetries++;
_log('[SYNC] abort($reason) — sending ABORT_HISTORICAL.');
await _send(Cmd.abortHistoricalTransmits, const [0x00]);
session.historicalRetry = Timer(
@@ -2963,6 +3360,63 @@ class BleEngine {
}
}
+ /// SD-08. Persist the strap's ring-buffer bookkeeping and log how it moved
+ /// since the last connect.
+ ///
+ /// Device state, not physiology, so it can claim exactly what it says: how
+ /// many records the ring holds, how much room is left, and how many times it
+ /// has wrapped. `wrap_count` moving between two connects means the ring
+ /// overwrote records — possibly ones we never drained. We only LOG that for
+ /// now (ring-buffer-loss-warning): the "you lost N days" wording needs a real
+ /// records-per-day divisor, and a week of these lines is how we get one. No
+ /// notification, no copy, no user-facing claim.
+ ///
+ /// Sink is `band_backlog`, one row per connect, keyed on the connect second
+ /// and never pruned — the same shape and the same reason as `band_battery`.
+ /// It replaces the single `sync_ledger` row this used to overwrite: that row
+ /// only ever held the LAST reading, which is enough for the wrap check and
+ /// nothing else, and the records-per-day divisor the loss wording needs can
+ /// only come from a series. `device_family` rides along because `free_records`
+ /// on gen4 and on gen5 do not belong on one axis.
+ ///
+ /// The previous `wrap_count` now comes from the newest stored row, so the
+ /// check survives on the table it writes to rather than on ledger JSON.
+ Future _recordPagesBehind(Map pb) async {
+ int? asInt(Object? v) => v is num ? v.toInt() : null;
+ final used = asInt(pb['used']);
+ final free = asInt(pb['free_records']);
+ final wrap = asInt(pb['wrap_count']);
+ final written = asInt(pb['written']);
+ final capacity = asInt(pb['capacity']);
+ final trimPage = asInt(pb['trim_page']);
+
+ int? prevWrap;
+ try {
+ final prev = await LocalDb.bandBacklog(limit: 1);
+ if (prev.isNotEmpty) prevWrap = asInt(prev.first['wrap_count']);
+ } catch (_) {/* no prior snapshot — first connect since install */}
+
+ final wrapped = (prevWrap != null && wrap != null && wrap > prevWrap)
+ ? wrap - prevWrap
+ : 0;
+ _log('[BACKLOG] used=$used free=$free wrap=$wrap (prev=$prevWrap, '
+ '+$wrapped) written=$written/$capacity trim_page=$trimPage');
+
+ await _bestEffortLedgerWrite(
+ () => LocalDb.putBandBacklog(
+ ts: DateTime.now().millisecondsSinceEpoch ~/ 1000,
+ written: written,
+ used: used,
+ capacity: capacity,
+ trimPage: trimPage,
+ wrapCount: wrap,
+ freeRecords: free,
+ // Unknown link ⇒ NULL, never a guessed gen4.
+ deviceFamily: linkDeviceFamily,
+ ),
+ );
+ }
+
/// Refuse to echo a HISTORY_END token, for one of the [TrimAckVerdict]
/// blocked reasons. The band keeps the chunk and re-delivers it on the next
/// offload; re-delivery is dedup-safe (decoded rows REPLACE by rec_ts, raw
@@ -3007,6 +3461,29 @@ class BleEngine {
metaPatch: {'batch_id': batchId, 'records': d.records},
));
return;
+ case TrimAckVerdict.blockedBurstShortfall:
+ // The rows we DID receive are already durable (this verdict is only
+ // reachable post-commit). Withholding the token asks the band to
+ // re-deliver the chunk, which is the only way the frames we lost can
+ // still be recovered — after the trim they are gone from flash. The
+ // re-delivery is dedup-safe (decoded rows REPLACE by rec_ts), and
+ // BurstShortfallGate has already spent this token's one refusal, so
+ // the redelivery is ACKed whatever it contains. No link bounce: the
+ // link is fine, we just want the chunk again.
+ _log(
+ '[SYNC] HISTORY_END token=$tokenHex NOT ACKed — the burst was short '
+ '(frames counted by the band that we never received intact). The '
+ 'committed rows stay; the band re-delivers this chunk once and the '
+ 'next delivery is ACKed regardless.',
+ );
+ await _bestEffortLedgerWrite(() => LocalDb.upsertSyncLedgerEntry(
+ chunkId: 'batch:$tokenHex',
+ kind: 'historical_batch',
+ status: 'trim_refused',
+ lastError: 'burst_shortfall_retry',
+ metaPatch: {'batch_id': batchId, 'records': d.records},
+ ));
+ return;
case TrimAckVerdict.blockedCommitFailed:
// THE safe-trim invariant. The transaction rolled back, so the cursor
// did not advance and the rows are not durable — commit() re-buffered
@@ -3124,6 +3601,9 @@ class BleEngine {
_session?.historicalRetry?.cancel();
_burstDroppedAtStart = _recordGate.dropped;
d?.rearm();
+ // The one place a new burst is really declared — the only safe point to
+ // clear the discarded-burst poison (see DrainController.beginBurst).
+ d?.beginBurst();
_setOffloadActive(true);
return;
}
@@ -3163,7 +3643,9 @@ class BleEngine {
// Records the plausibility gate silently rejected THIS burst (stale/
// wandering-clock block — by design, "neither stored nor counted",
// see RecordGate.admit) never reach onHistoricalRecord/
- // onUndecodableRecord, so they never entered currentBurstPacketCount.
+ // onUndecodableRecord, so they never entered currentBurstTrafficCount.
+ // The baseline is reset per connection alongside the gate itself, so a
+ // HISTORY_END with no HISTORY_START before it cannot go negative here.
final droppedThisBurst = _recordGate.dropped - _burstDroppedAtStart;
final validated = expected == null ||
d.validateBurst(
@@ -3206,7 +3688,6 @@ class BleEngine {
'[SYNC] Burst packet-count mismatch (advisory, NOT blocking commit) '
'(attempt ${d.consecutiveValidationFailures}, '
'streak=$_burstMismatchStreak): expected=$expected, '
- 'actual=${d.currentBurstPacketCount}, '
'dropped_this_burst=$droppedThisBurst, '
'historical=${d.currentBurstHistoricalPacketCount}, '
'traffic=${d.currentBurstTrafficCount}, '
@@ -3217,7 +3698,6 @@ class BleEngine {
lastError: 'burst_packet_mismatch',
metaPatch: {
'expected_burst_packets': expected,
- 'actual_burst_packets': d.currentBurstPacketCount,
'dropped_this_burst': droppedThisBurst,
'historical_burst_packets': d.currentBurstHistoricalPacketCount,
'traffic_burst_packets': d.currentBurstTrafficCount,
@@ -3229,19 +3709,29 @@ class BleEngine {
} else {
_burstMismatchStreak = 0;
}
- // Would-flag: the correct-signal completeness diagnostic. LOG-ONLY — the
- // commit + verbatim-token ACK below are unchanged. A positive shortfall
- // is the honest missing/corrupted-traffic telemetry we want to watch
- // before a later, field-validated FAIL gate ever acts on it.
+ // A positive shortfall = frames the band counted that we did not count
+ // as valid received traffic (missing, or CRC-corrupted). It used to be
+ // log-only, which meant a hole in the burst was counted and then handed
+ // a trim authorisation anyway — the missing seconds left flash forever.
+ //
+ // It now costs the band ONE re-delivery, and only one: the refusal is
+ // taken AFTER the commit (so the records we did get are already durable
+ // and the re-delivery only has to make up the difference) and is bounded
+ // per token / per session / per engine run by [BurstShortfallGate]. That
+ // recovers the transient-radio case without reviving the always-FAIL
+ // behaviour that wedged sync forever.
+ final shortfallRetry = shortfall > 0 && _shortfallGate.refuse(tokenHex);
if (shortfall > 0) {
_log(
- '[SYNC] burst completeness would-flag (LOG-ONLY, commit+ACK '
- 'unchanged): expected=$expected '
+ '[SYNC] burst completeness shortfall: expected=$expected '
'received=${d.currentBurstTrafficCount} '
'dropped_this_burst=$droppedThisBurst shortfall=$shortfall '
'(all-types received total — frames the band counted that we did '
- 'not; missing or CRC-corrupted, potential loss; groundwork for a '
- 'future FAIL gate, NOT gating today)',
+ 'not; missing or CRC-corrupted) — '
+ '${shortfallRetry ? "REFUSING the trim token once so the band "
+ "re-delivers this chunk" : "budget spent, committing + ACKing "
+ "(refusals: session=${_shortfallGate.refusalsThisSession} "
+ "total=${_shortfallGate.refusalsTotal})"}',
);
}
final r = d.bufferedRecTsRange;
@@ -3262,7 +3752,7 @@ class BleEngine {
d.bufferedRecords > 0 || d.bufferedProgressArchives > 0;
_log(
'[SYNC] HistoryEnd batch=${m.batchId} records=${d.records} '
- 'expected=${m.expectedPacketCount} actual=${d.currentBurstPacketCount} '
+ 'expected=${m.expectedPacketCount} '
'historical=${d.currentBurstHistoricalPacketCount} '
'traffic=${d.currentBurstTrafficCount} token=$tokenHex '
'dropped_this_burst=$droppedThisBurstForLog '
@@ -3318,6 +3808,7 @@ class BleEngine {
commitDurable: durable,
hadDurableRows: hadDurableRows,
droppedThisBurst: droppedThisBurst,
+ shortfallRetry: shortfallRetry,
);
if (verdict != TrimAckVerdict.send) {
await _refuseHistoryEndTrim(
@@ -3364,7 +3855,8 @@ class BleEngine {
'ack_failures': failCount,
},
));
- if (_chunkFailures.shouldQuarantine(tokenHex)) {
+ final quarantined = _chunkFailures.shouldQuarantine(tokenHex);
+ if (quarantined) {
await _bestEffortLedgerWrite(() => LocalDb.quarantineSyncChunk(
kind: 'historical_batch',
payloadJson: jsonEncode({
@@ -3380,15 +3872,26 @@ class BleEngine {
'(already committed); this only means the band has not yet '
'been told to trim, so it keeps re-sending the same batch.',
);
+ // ESCALATE, don't keep bouncing. The quarantine row existed and
+ // nothing read it, while the bounce below ran unconditionally and
+ // indefinitely — the band re-delivered forever, the app reconnected
+ // forever, the battery drained, and the only user-visible symptom
+ // was a sync that never finished.
+ if (!state.syncChunkQuarantined) {
+ state.syncChunkQuarantined = true;
+ onState(state);
+ }
}
_log('[SYNC] BATCH-ACK FAILED after '
'${ackRetryPolicy.maxAttempts} attempts (token=$tokenHex, '
- 'failures_for_this_token=$failCount) — bouncing the link; data '
- 'is committed and the band will re-send.');
+ 'failures_for_this_token=$failCount) — '
+ '${quarantined ? "token QUARANTINED; NOT bouncing again" : "bouncing the link"}; '
+ 'data is committed and the band will re-send.');
// ONLY bounce a session that is still OURS. _writeAckVerified also
// returns false when the session died under it, and tearing down then
- // would kill the healthy session that replaced it.
- if (!_sessionIsStale(session)) {
+ // would kill the healthy session that replaced it. And never bounce for
+ // a quarantined token: the reconnect is what makes it a loop.
+ if (!quarantined && !_sessionIsStale(session)) {
unawaited(
_teardownSession(intentional: false).then((_) {
_setPhase(BleConnState.idle); // caller's reconnect loop takes over
@@ -3398,6 +3901,15 @@ class BleEngine {
return;
}
_chunkFailures.recordSuccess(tokenHex);
+ // A trimmed chunk proves the strap IS draining, so the abort→retry
+ // budget is about a stall that has since cleared, not this session.
+ session.historicalRetries = 0;
+ if (state.syncChunkQuarantined) {
+ // A token finally ACKed — whatever was wrong with the write path has
+ // cleared, so the flag must not stick around as a permanent scare.
+ state.syncChunkQuarantined = false;
+ onState(state);
+ }
// A trim ACK is the only real proof the no-durable-progress condition is
// over — records were banked and the band may advance.
_noDurableProgress.trimAcked();
@@ -3450,8 +3962,10 @@ class BleEngine {
if (!tailDurable) {
// No ACK is written for a HISTORY_COMPLETE, so nothing was trimmed and
// no data is at risk — but the tail is NOT durable yet. commit() left
- // the records buffered, so the next commit (the next burst's
- // HISTORY_END, or the flush on teardown) re-attempts them.
+ // the records buffered, so the next commit re-attempts them: the next
+ // burst's HISTORY_END, or awaitComplete's flush when the drain stops.
+ // NOT a teardown flush — teardown drops the buffer on purpose (see the
+ // blockedCommitFailed bounce), and the band still holds the chunk.
_log(
'[SYNC] HistoryComplete tail commit FAILED — ${d.bufferedRecords} '
'records stay buffered for the next commit. Nothing was trimmed '
@@ -3485,27 +3999,49 @@ class BleEngine {
);
_setHpsTerminal(_HpsTerminalKind.success, drain: d);
_noteStored();
- await _onOffloadFinished(complete: true);
+ await _onOffloadFinished();
}
}
// ── post-offload policy: empty-sync, stuck-strap, auto-continue ──────────────
- Future _onOffloadFinished({required bool complete}) async {
+ /// Reached from the HISTORY_COMPLETE branch only — a drain that ends any
+ /// other way (link down, idle watchdog) records its own terminal and never
+ /// gets here. This used to take a `complete` flag that its single call site
+ /// always passed as `true`, so both arms guarded by it were dead: the
+ /// empty-sync block below always ran, and a `_HpsTerminalKind.timeout` arm at
+ /// the bottom never did (the watchdog abort now records that terminal where
+ /// the timeout actually happens).
+ Future _onOffloadFinished() async {
final d = _drain;
if (d == null) return;
final banked = d.recordsThisOffload > 0;
_emptyStreak = banked ? 0 : (_emptyStreak + 1);
- if (complete) {
- // Empty-sync: ≥3 consecutive console-only completed offloads ⇒ RTC lost.
- if (_emptySync.recordCompletedSync(
- bankedSensorRecords: banked,
- consoleOnly: !banked,
- )) {
- state.syncClockLost = true;
- onState(state);
- _log('[SYNC] empty-sync tripped — strap RTC likely lost.');
- }
+ // Records arrived ⇒ both "the band is not handing anything over" flags are
+ // over. Their detectors self-reset, but the flags themselves were set-only,
+ // so once tripped they described the rest of the process. Now that they are
+ // rendered, a stale one is a permanent scare about a band that is working.
+ // Cleared BEFORE the detectors below, so a fresh trip in this same pass
+ // still wins.
+ if (banked && (state.syncClockLost || state.strapNeedsReboot)) {
+ state.syncClockLost = false;
+ state.strapNeedsReboot = false;
+ onState(state);
+ _log('[SYNC] records banked — clearing syncClockLost/strapNeedsReboot.');
+ }
+
+ // Empty-sync: ≥3 consecutive console-only completed offloads ⇒ RTC lost.
+ // Completed only, deliberately: an aborted drain proves nothing about the
+ // strap's RTC, which is why the tracker's method is `recordCompletedSync`.
+ // `_emptyStreak` above carries the same completed-only semantics for the
+ // same reason.
+ if (_emptySync.recordCompletedSync(
+ bankedSensorRecords: banked,
+ consoleOnly: !banked,
+ )) {
+ state.syncClockLost = true;
+ onState(state);
+ _log('[SYNC] empty-sync tripped — strap RTC likely lost.');
}
// Stuck-strap: frontier frozen ≥10 min while the strap is >5 min ahead.
@@ -3546,13 +4082,10 @@ class BleEngine {
// nothing left to continue - this offload cycle is genuinely done
// either way (clean completion or not), so maintenance traffic
// (heartbeat/keepalive/RTC re-verify/live re-arm/battery poll) can
- // resume. this used to only clear on the !complete sub-case below,
- // so an ordinary clean completion with no more backlog left
- // maintenance traffic silently paused for the rest of the connection.
+ // resume. this used to only clear on a `!complete` sub-case that no call
+ // site could reach, so an ordinary clean completion with no more backlog
+ // left maintenance traffic silently paused for the rest of the connection.
_setOffloadActive(false);
- if (!complete && _lastHpsTerminal == null) {
- _setHpsTerminal(_HpsTerminalKind.timeout, drain: d);
- }
}
}
@@ -3583,19 +4116,21 @@ class BleEngine {
/// Written directly via [_write] (not [_send]) because the pre-built
/// frames already carry their own sequence numbers — going through `_send`
/// would double-allocate from [_seq] for no benefit. SET_FF_VALUE (120) is
- /// in `OpcodeSafety.forbidden` but NOT `OpcodeSafety.destructive`; per that
- /// class's own doc this deliberate, explicitly-opted-in sequence is exactly
- /// the kind of call site the broader `forbidden` list is not meant to gate
- /// (see `_send`'s doc for the full reasoning) — writing it directly here
- /// keeps that intentional exception in ONE place rather than needing an
- /// allowlist parameter threaded through the shared chokepoint.
+ /// in `dangerousCmds` (a persistent config write survives a reboot), so this
+ /// is the ONE call site that passes `allowDangerous: true` — a named,
+ /// reviewed opt-in rather than the structural bypass it used to be, now that
+ /// the block sits on `_write` itself.
Future enableGen5DeepBuffers() async {
if (!(_session?.band.isGen5 ?? false)) return;
final frames = buildR22EnableSequence(startSeq: _seq.nextLive());
_log('Sending gen5 R22 deep-buffer enable sequence (${frames.length} '
'flags)…');
for (final frame in frames) {
- await _write(frame);
+ // The ONE audited `allowDangerous`. SET_FF_VALUE is in `dangerousCmds`
+ // because a persistent config write survives a reboot; this sequence is
+ // opt-in and ships a restore-defaults companion, which is exactly the
+ // carve-out the block-list doc describes.
+ await _write(frame, allowDangerous: true);
await Future.delayed(const Duration(milliseconds: 40));
}
_log('gen5 R22 deep-buffer enable sequence sent.');
@@ -3763,6 +4298,14 @@ class BleEngine {
},
);
if (!report.complete) _setOffloadActive(false);
+ // OUTBOUND automation event (Android only — see TaskerBridge.emitEvent for
+ // why iOS gets no equivalent). Only on a COMPLETE offload: "sync finished"
+ // must mean the strap actually drained, not that a link dropped mid-drain.
+ // Un-awaited and rate-limited inside the bridge; a broadcast that cannot be
+ // sent must never hold up the sync path.
+ if (report.complete) {
+ unawaited(TaskerBridge.emitSyncComplete(records: report.records));
+ }
_log(
'[SYNC] OFFLOAD SUMMARY: records=${report.records} '
'batches=${report.batches} complete=${report.complete}',
@@ -4020,30 +4563,6 @@ class BleEngine {
return _send(Cmd.runHapticsPattern, [pattern, 0, 0, 0, 0]);
}
- /// Signal strength of the live link, in dBm (negative; closer to zero is
- /// stronger). Null whenever there is nothing to measure.
- ///
- /// Used by the find-my-band hunt. Note what this does NOT do: it never
- /// scans. A hunt needs to BUZZ the band as well as track it, and buzzing
- /// requires the connection — so a band we cannot reach is one we could not
- /// help find anyway. Read straight off the connected device instead, which
- /// also means the hunt costs nothing beyond one small GATT read per poll:
- /// no radio mode change, no interference with an in-flight offload.
- ///
- /// Returns null rather than throwing on a mid-hunt disconnect; the caller
- /// polls on a timer and a dropped sample must not blow up the screen. The
- /// timeout matters because `readRssi` can hang on a link that is technically
- /// still "connected" but is not passing traffic.
- Future readRssi() async {
- final s = _session;
- if (s == null || !s.connected) return null;
- try {
- return await s.device.readRssi().timeout(const Duration(seconds: 3));
- } catch (_) {
- return null;
- }
- }
-
/// Enable live foreground streams (makes the band emit live R10/R11 + optical).
/// Optical stays WRIST-GATED (0x6B only). This sends the toggle commands but
/// DOES NOT change the displayed state — we stay in the single `listening` phase;
@@ -4217,11 +4736,24 @@ class BleEngine {
_offloadFrames.clear();
_drainingOffloadFrames = false;
_setOffloadActive(false);
- if (intentional) {
- try {
- await device.disconnect();
- } catch (_) {}
- }
+ // Live arming is per-connection. `_armTime` used to survive teardown, and
+ // enableHrOnlyLive sets `_liveEnabled` without touching it — so the
+ // marginal-radio detector measured the NEXT session's drop against the
+ // PREVIOUS session's arm and permanently downgraded live streams on the
+ // evidence of a session that never armed the raw flood.
+ _liveEnabled = false;
+ _liveHrOnly = false;
+ _armTime = null;
+ // ALWAYS drop the radio link, not just on an intentional disconnect. Every
+ // self-initiated bounce (liveness fuse, ACK-exhausted, commit-failed) tears
+ // the session down non-intentionally and expects a NEW GATT connection —
+ // but FBP treats connect() on a still-connected device as a no-op, so the
+ // reconnect re-ran setup over the same zombie link and the fuse just fired
+ // again 120 s later, forever. On an OS-driven drop this is a harmless
+ // no-op.
+ try {
+ await device.disconnect();
+ } catch (_) {}
}
void _setOffloadActive(bool active) {
@@ -4475,7 +5007,10 @@ class DrainController {
/// Buffer only when the atomic commit path exists. Unbuffered mode
/// (test-only) must not look like it banked durable rows for trim.
bool get _buffering => onCommit != null;
- int get currentBurstPacketCount => burstStats.totalTrafficPacketCount;
+ /// Every frame received this burst, ALL types. There used to be a second
+ /// getter, `currentBurstPacketCount`, with the identical body — one
+ /// measurement presented in the mismatch log and in the sync ledger under two
+ /// labels as if the two were independent.
int get currentBurstTrafficCount => burstStats.totalTrafficPacketCount;
int get currentBurstHistoricalPacketCount => burstStats.historicalPacketCount;
String get currentBurstBreakdown => burstStats.breakdownString;
@@ -4489,7 +5024,14 @@ class DrainController {
_raws.add(raw);
_samples.add(sample);
} else {
- unawaited(onRecord(sample, raw));
+ // Unbuffered fire-and-forget: production never takes this branch
+ // (`onCommitBatch` is always set, and this wiring is documented as
+ // non-trimmable / test-only), but an un-handled async error here would
+ // lose the record AND surface as an unhandled-error crash rather than a
+ // log line. Nothing else can catch a throw off an `unawaited` future.
+ unawaited(onRecord(sample, raw).catchError(
+ (Object e) => log('[SYNC] unbuffered record persist failed: $e'),
+ ));
}
}
@@ -4520,7 +5062,10 @@ class DrainController {
if (_buffering) {
_archives.add(a);
} else {
- unawaited(onArchive?.call(a) ?? Future.value());
+ // Same unbuffered-branch reasoning as onHistoricalRecord above.
+ unawaited((onArchive?.call(a) ?? Future.value()).catchError(
+ (Object e) => log('[SYNC] unbuffered archive persist failed: $e'),
+ ));
}
}
@@ -4530,11 +5075,9 @@ class DrainController {
void onBurstConsole() => burstStats.onConsole();
- void onBurstUnknown() => burstStats.onUnknown();
-
/// [droppedThisBurst] = records the plausibility gate rejected during this
/// same burst (stale/wandering-clock block) — never tallied into
- /// [currentBurstPacketCount] (they're never stored), but the band's own
+ /// [currentBurstTrafficCount] (they're never stored), but the band's own
/// [expectedPacketCount] counts them anyway since it just counts what it
/// physically transmitted. Add them back in before comparing, or a burst
/// that legitimately contains even one gate-rejected record can never
@@ -4546,7 +5089,7 @@ class DrainController {
}) {
if (burstPacketCountMatches(
expectedPacketCount: expectedPacketCount,
- actualBurstPacketCount: currentBurstPacketCount,
+ receivedTrafficCount: currentBurstTrafficCount,
droppedThisBurst: droppedThisBurst,
)) {
consecutiveValidationFailures = 0;
@@ -4565,16 +5108,27 @@ class DrainController {
/// Re-arm for a fresh offload over the same connection (clears the COMPLETE flag
/// so a new awaitComplete() blocks until the next HISTORY_COMPLETE).
+ ///
+ /// Does NOT clear the poison latch — see [beginBurst]. Re-arming is US asking
+ /// for another offload; the burst boundary is the BAND's to declare.
void rearm() {
_complete = false;
_linkDown = false;
_lastProgressAt = DateTime.now();
burstStats.reset();
- // A fresh burst starts un-poisoned: whatever was discarded belonged to the
- // burst that just ended, and the band will re-deliver it.
- _trimGuard.beginBurst();
}
+ /// The band declared a new burst (HISTORY_START) — clear the poison latch.
+ ///
+ /// This used to live in [rearm], which conflated "we are asking for another
+ /// offload" with "the band started a new burst". The abort→retry path re-arms
+ /// 3 s after the idle watchdog threw a chunk away, while the abandoned burst's
+ /// HISTORY_END is still in flight — so the terminal landed on a clean guard
+ /// and its token was echoed, trimming exactly the records we dropped. Frames
+ /// arrive in order, so a HISTORY_START proves the previous burst's terminal
+ /// has already been handled (or is never coming) and the latch may clear.
+ void beginBurst() => _trimGuard.beginBurst();
+
void onLinkDown() => _linkDown = true;
/// Per-offload counters reset (after the post-offload policy has read them).
@@ -4589,7 +5143,7 @@ class DrainController {
/// went on to commit the (now empty) buffer and echo the token verbatim —
/// trimming exactly the records that were just dropped. The poison is
/// unconditional (even with an empty buffer, this burst was abandoned) and
- /// is cleared only by [rearm] / a fresh HISTORY_START.
+ /// is cleared only by [beginBurst] — a fresh HISTORY_START from the band.
void discardOpenChunk() {
_trimGuard.discardOpenChunk();
if (_raws.isEmpty && _archives.isEmpty) return;
diff --git a/lib/ble/ble_state.dart b/lib/ble/ble_state.dart
index 54cc99c8..1e85d69a 100644
--- a/lib/ble/ble_state.dart
+++ b/lib/ble/ble_state.dart
@@ -60,6 +60,287 @@ String connStringFor(BleConnState s) {
}
}
+// ── what the user is told ────────────────────────────────────────────────────
+// The engine already knows, precisely, why a link is not working — six flags on
+// DeviceState plus the phone-level blockers below. It used to keep that to
+// itself and hand the UI a four-value connection string, so every distinct
+// failure rendered as "Not connected" (or, worse, as "No band in range", which
+// sends a user who revoked a permission on a walk around the house). This is
+// the single projection a screen renders instead: one condition, a name, a
+// reason, and a way forward.
+
+/// The phone's own Bluetooth stack refusing us, as opposed to a band that is
+/// simply not answering. Deliberately separate from every band-side flag: the
+/// fixes point in opposite directions (Settings vs. walk closer), so conflating
+/// them guarantees the user follows the wrong one.
+enum BleBlocker {
+ /// The OS is withholding Bluetooth from THIS app (iOS `unauthorized`, Android
+ /// BLUETOOTH_SCAN/CONNECT denied). Only Settings clears it.
+ permissionDenied,
+
+ /// The radio itself is off. Every app is equally stuck.
+ adapterOff,
+
+ /// No BLE radio on this device at all. Nothing to fix.
+ unsupported,
+}
+
+/// Thrown by transport calls that never reached the radio. Distinct from
+/// "returned nothing", which means the scan genuinely ran and heard nothing.
+class BleUnavailableException implements Exception {
+ final BleBlocker blocker;
+ const BleUnavailableException(this.blocker);
+
+ @override
+ String toString() => 'BleUnavailableException(${blocker.name})';
+}
+
+/// Map an adapter-state name and/or a thrown transport error onto a blocker.
+/// Returns null when neither says the stack is unusable — i.e. the failure is
+/// about the band, not the phone.
+///
+/// String matching is unavoidable: flutter_blue_plus surfaces the Android
+/// permission refusal as a platform exception whose text is the only signal.
+/// The adapter state is checked first because it is the reliable one.
+BleBlocker? classifyBleBlocker({String? adapterState, Object? error}) {
+ switch (adapterState) {
+ case 'unauthorized':
+ return BleBlocker.permissionDenied;
+ case 'unavailable':
+ return BleBlocker.unsupported;
+ case 'off':
+ case 'turningOff':
+ return BleBlocker.adapterOff;
+ }
+ if (error == null) return null;
+ final s = error.toString().toLowerCase();
+ if (s.contains('unauthorized') ||
+ s.contains('permission') ||
+ s.contains('not authorized') ||
+ s.contains('denied')) {
+ return BleBlocker.permissionDenied;
+ }
+ if (s.contains('adapter is off') ||
+ s.contains('bluetooth must be turned on') ||
+ s.contains('poweredoff') ||
+ s.contains('powered off')) {
+ return BleBlocker.adapterOff;
+ }
+ if (s.contains('unsupported') || s.contains('not supported')) {
+ return BleBlocker.unsupported;
+ }
+ return null;
+}
+
+/// Whether an unintentional disconnect looks like the link TIMING OUT — the
+/// band stopped answering / went out of range — rather than an ordinary
+/// termination (peer closed the link, local close, adapter off).
+///
+/// [MarginalRadioDetector] and [PostBondTimeoutLoopDetector] both key on
+/// "armed/bonded, then a QUICK TIMEOUT", and both used to be handed a
+/// hardcoded `true`, which made every ordinary drop a timeout: two unremarkable
+/// disconnects inside 8 s of setup were enough to latch the re-pair guide, on
+/// iOS as well as Android.
+///
+/// The platform's own reason string is the only timeout evidence we have, and
+/// it says so in words on both: Android reports HCI/GATT names
+/// (`LINK_SUPERVISION_TIMEOUT`, `GATT_CONNECTION_TIMEOUT`, …), iOS the CBError
+/// `localizedDescription` ("The connection has timed out unexpectedly."). Same
+/// string-matching trade as [classifyBleBlocker], for the same reason. No
+/// reason reported ⇒ NOT a timeout: we never assume one we cannot see.
+bool isTimeoutDisconnect(String? reasonDescription) {
+ final s = reasonDescription?.toLowerCase();
+ if (s == null) return false;
+ return s.contains('timeout') || s.contains('timed out');
+}
+
+/// The one connection state a screen renders. Ordered by priority in
+/// [bandStatusFor], most-blocking first.
+enum BandCondition {
+ bluetoothDenied,
+ bluetoothOff,
+ bluetoothUnsupported,
+
+ /// Bond refused repeatedly ⇒ auto-reconnect is PAUSED. Nothing is retrying.
+ reconnectPaused,
+
+ /// The link comes up but the band rejects the encryption key.
+ repairNeeded,
+
+ /// A batch is stuck un-confirmed and the band keeps re-sending it.
+ syncStuck,
+
+ /// The band holds newer data than it will hand over.
+ strapUnresponsive,
+
+ /// Syncs complete carrying no sensor data — the band's clock has lost sync.
+ clockLost,
+
+ connected,
+ connecting,
+ scanning,
+ disconnected,
+}
+
+/// A named connection state with the copy that goes with it. The copy lives
+/// here, not in the UI, so the mapping is unit-testable and every surface that
+/// shows the link (home, devices, pairing, a background notification) says the
+/// same thing about the same state.
+class BandStatus {
+ final BandCondition condition;
+
+ /// Names the state. Never "Something went wrong".
+ final String title;
+
+ /// Why it is in that state, and what it means for the user's data.
+ final String reason;
+
+ /// The way forward, or null when there is genuinely nothing to do.
+ final String? fix;
+
+ const BandStatus(this.condition, this.title, this.reason, {this.fix});
+
+ /// True for the states that need to be shown. The four ordinary link states
+ /// (connected/connecting/scanning/disconnected) are the app's normal
+ /// vocabulary and do not need a failure card.
+ bool get isFault =>
+ condition != BandCondition.connected &&
+ condition != BandCondition.connecting &&
+ condition != BandCondition.scanning &&
+ condition != BandCondition.disconnected;
+}
+
+/// Fold the phone-level blocker and the band's own diagnostic flags into one
+/// state. Pure; [connection] is `DeviceState.connection`.
+///
+/// Priority is linear and deliberate: a blocker defeats everything (nothing can
+/// run), a paused reconnect outranks the flags it caused, and the data-flow
+/// flags outrank the plain link state because "not connected" is the less
+/// useful of the two true statements.
+BandStatus bandStatusFor({
+ required String connection,
+ BleBlocker? blocker,
+ bool autoReconnectPaused = false,
+ bool needsRepairGuide = false,
+ bool syncChunkQuarantined = false,
+ bool strapNeedsReboot = false,
+ bool syncClockLost = false,
+ int bondRefusals = 0,
+}) {
+ const repairFix = 'Forget the band in the phone’s Bluetooth settings, '
+ 'then pair it again here';
+ switch (blocker) {
+ case BleBlocker.permissionDenied:
+ return const BandStatus(
+ BandCondition.bluetoothDenied,
+ 'Bluetooth is switched off for this app',
+ 'The phone is withholding the Bluetooth radio from OpenStrap, so '
+ 'nothing can be scanned or connected. This is not the band — '
+ 'walking closer to it will not help.',
+ fix: 'Open Settings → OpenStrap and allow Bluetooth',
+ );
+ case BleBlocker.adapterOff:
+ return const BandStatus(
+ BandCondition.bluetoothOff,
+ 'Bluetooth is turned off',
+ 'The phone’s radio is off, so the band cannot be reached by any app. '
+ 'The band keeps recording meanwhile; nothing is lost.',
+ fix: 'Turn Bluetooth on',
+ );
+ case BleBlocker.unsupported:
+ return const BandStatus(
+ BandCondition.bluetoothUnsupported,
+ 'This phone has no Bluetooth Low Energy radio',
+ 'The band can only be reached over Bluetooth Low Energy. Imported '
+ 'data still works; a live link does not.',
+ );
+ case null:
+ break;
+ }
+ if (autoReconnectPaused) {
+ return BandStatus(
+ BandCondition.reconnectPaused,
+ 'Reconnecting has been paused',
+ 'The band refused the pairing key $bondRefusals times in a row, so the '
+ 'app stopped retrying rather than pin the radio and drain both '
+ 'batteries on a link that will not open. Nothing is reconnecting '
+ 'until you act.',
+ fix: repairFix,
+ );
+ }
+ if (needsRepairGuide) {
+ return const BandStatus(
+ BandCondition.repairNeeded,
+ 'The band needs to be paired again',
+ 'The link comes up, but the band rejects the encryption key the phone '
+ 'holds, so every command is dropped and no data moves. Your '
+ 'recordings are safe on the band.',
+ fix: repairFix,
+ );
+ }
+ if (syncChunkQuarantined) {
+ return const BandStatus(
+ BandCondition.syncStuck,
+ 'One batch of recordings will not finish transferring',
+ 'The band keeps re-sending the same batch because the app cannot get '
+ 'its confirmation through. Everything in it is already saved here — '
+ 'nothing is lost — but the band cannot move on until the '
+ 'confirmation lands.',
+ fix: 'Reconnect the band; if it repeats tomorrow, pair it again',
+ );
+ }
+ if (strapNeedsReboot) {
+ return const BandStatus(
+ BandCondition.strapUnresponsive,
+ 'The band has stopped handing over its recordings',
+ 'The band reports newer recordings than it will send. Those recordings '
+ 'are still on the band and still safe; it just is not passing them '
+ 'across.',
+ fix: 'Put the band on its charger for a minute, then reconnect',
+ );
+ }
+ if (syncClockLost) {
+ return const BandStatus(
+ BandCondition.clockLost,
+ 'Syncs are finishing with no data in them',
+ 'The band completes each sync without handing over a single sensor '
+ 'reading, which almost always means its onboard clock has lost '
+ 'sync. The app keeps resetting it on every connect.',
+ fix: 'Leave the band connected for a few minutes; if nothing arrives '
+ 'by tomorrow, pair it again',
+ );
+ }
+ switch (connection) {
+ case 'connected':
+ return const BandStatus(
+ BandCondition.connected,
+ 'Connected',
+ 'The band is linked and handing over its recordings.',
+ );
+ case 'connecting':
+ return const BandStatus(
+ BandCondition.connecting,
+ 'Connecting',
+ 'Opening the link to the band.',
+ );
+ case 'scanning':
+ return const BandStatus(
+ BandCondition.scanning,
+ 'Looking for the band',
+ 'Listening for the band to advertise itself.',
+ );
+ default:
+ return const BandStatus(
+ BandCondition.disconnected,
+ 'Not connected',
+ 'The band is out of range, on its charger, or held by another app. '
+ 'It keeps recording either way.',
+ fix: 'Bring the band near the phone, and close any other app '
+ 'connected to it',
+ );
+ }
+}
+
/// Pure reconnection schedule: bounded exponential backoff with jitter.
///
/// delay(attempt) = clamp(base * 2^(attempt-1), base, cap), then ± up to
@@ -330,6 +611,73 @@ enum TrimAckVerdict {
/// reconnect). Refuse the trim so the band re-delivers; the engine should
/// re-correlate the clock and retry.
blockedNoDurableProgress,
+
+ /// The band counted more frames in this burst than we counted as valid
+ /// received traffic — some arrived corrupted or never arrived at all. The
+ /// rows we DID get are already committed; refusing the token asks the band
+ /// to re-send the chunk so the missing seconds get another chance instead of
+ /// being trimmed out of flash forever. Strictly bounded by
+ /// [BurstShortfallGate] — see the history in that class.
+ blockedBurstShortfall,
+}
+
+/// The bound on "refuse the trim token because the burst was short".
+///
+/// An UNCONDITIONAL refusal on shortfall is not an option: it was the old
+/// behaviour, and it wedged sync forever — nothing about a retry changes the
+/// count relationship when the shortfall is systematic (`expectedPacketCount`'s
+/// exact semantics are not fully reverse-engineered), so the band re-delivered
+/// the same block indefinitely and the cursor never moved. Accepting every
+/// short burst is the opposite failure: the gap is counted, logged, and then
+/// authorised for deletion.
+///
+/// So: refuse ONCE, then take whatever arrives. A transient radio glitch —
+/// the common case — is recovered on the re-delivery; a systematic shortfall
+/// costs exactly one extra round trip and then proceeds.
+///
+/// Bounded three ways, because only the first assumes the token is stable:
+/// * per TOKEN — a chunk is refused at most once, so a stable token cannot
+/// ping-pong;
+/// * per SESSION — [maxPerSession], in case the band re-issues a fresh token
+/// for the same data (which would defeat the per-token bound);
+/// * per ENGINE RUN — [maxTotal], the backstop for a link that is short on
+/// every burst. Past it, shortfalls are telemetry again.
+///
+/// Pure: no clock, no I/O.
+class BurstShortfallGate {
+ BurstShortfallGate({this.maxPerSession = 1, this.maxTotal = 3});
+
+ final int maxPerSession;
+ final int maxTotal;
+
+ /// Bounded so a long-lived engine cannot grow this without limit; a token
+ /// evicted here can be refused once more, which the two counters still cap.
+ static const int _maxTracked = 64;
+ final Set _refusedTokens = {};
+ int _thisSession = 0;
+ int _total = 0;
+
+ int get refusalsThisSession => _thisSession;
+ int get refusalsTotal => _total;
+
+ /// Whether this HISTORY_END token should be refused over a positive
+ /// shortfall. Records the refusal when it returns true — call it once per
+ /// decision, at the point of decision.
+ bool refuse(String tokenHex) {
+ if (_thisSession >= maxPerSession || _total >= maxTotal) return false;
+ if (!_refusedTokens.add(tokenHex)) return false;
+ if (_refusedTokens.length > _maxTracked) {
+ _refusedTokens.remove(_refusedTokens.first);
+ }
+ _thisSession++;
+ _total++;
+ return true;
+ }
+
+ /// New link — the per-session budget refills. [maxTotal] deliberately does
+ /// not, so a band that is short on every burst of every session stops
+ /// costing round trips.
+ void onSessionStart() => _thisSession = 0;
}
/// THE gate on the one irreversible act in the whole offload protocol: echoing
@@ -370,12 +718,18 @@ class TrimAckPolicy {
/// [droppedThisBurst] — RecordGate rejects during this burst. Combined with
/// `!hadDurableRows`, refuses trim so gate-only bursts
/// cannot delete flash we never stored.
+ /// [shortfallRetry] — [BurstShortfallGate] has budget to spend one refusal
+ /// on this token's positive shortfall. Pass `false` on
+ /// the PRE-commit call: this refusal must happen only
+ /// AFTER the rows we did receive are durable, or the
+ /// re-delivery costs us the good records too.
static TrimAckVerdict evaluate({
required bool sessionCurrent,
required bool burstDiscarded,
required bool commitDurable,
bool hadDurableRows = true,
int droppedThisBurst = 0,
+ bool shortfallRetry = false,
}) {
// Order is deliberate: a stale session must be refused before anything
// else touches the (new) link, and a poisoned burst must be refused before
@@ -386,6 +740,9 @@ class TrimAckPolicy {
if (!hadDurableRows && droppedThisBurst > 0) {
return TrimAckVerdict.blockedNoDurableProgress;
}
+ // Last: everything above is a reason the chunk must not be trimmed at all.
+ // This one is a reason to ask for it AGAIN, and only once.
+ if (shortfallRetry) return TrimAckVerdict.blockedBurstShortfall;
return TrimAckVerdict.send;
}
}
@@ -399,8 +756,9 @@ class TrimAckPolicy {
/// committing an empty buffer and echoing the token verbatim, which trims
/// exactly the records that were just thrown away. The token is unknown at
/// discard time (it only arrives with the terminal), so the poison is keyed to
-/// the BURST, not the token: a discard poisons the open burst, and only a
-/// fresh HISTORY_START / re-arm clears it.
+/// the BURST, not the token: a discard poisons the open burst, and only a fresh
+/// HISTORY_START clears it. NOT a local re-arm — the abort→retry path re-arms
+/// on a 3 s timer while the abandoned burst's terminal is still on the wire.
class BurstTrimGuard {
bool _discarded = false;
@@ -411,7 +769,7 @@ class BurstTrimGuard {
/// True while the open burst may NOT be trimmed.
bool get discarded => _discarded;
- /// A fresh burst begins (HISTORY_START / re-arm) — nothing lost yet.
+ /// A fresh burst begins (HISTORY_START) — nothing lost yet.
void beginBurst() => _discarded = false;
/// The open chunk was abandoned without a durable commit.
diff --git a/lib/ble/hr_sensor.dart b/lib/ble/hr_sensor.dart
new file mode 100644
index 00000000..20de8059
--- /dev/null
+++ b/lib/ble/hr_sensor.dart
@@ -0,0 +1,314 @@
+// HrSensor — a standard Bluetooth heart-rate sensor (GATT Heart Rate Service,
+// 0x180D) as a SESSION-SCOPED second opinion on exercise HR.
+//
+// WHY THIS EXISTS. The public positioning says "works with any standard
+// Bluetooth heart rate sensor", and until this file there was no `180d`, no
+// `2a37` and no Heart Rate Service anywhere in the tree. That made the claim
+// false in code, which is a correctness problem before it is a feature gap.
+//
+// WHAT IT IS NOT.
+// * NOT a background source. It is armed by a workout and disarmed when the
+// workout ends — the same rule GPS follows, for the same reason: a second
+// GATT link held open all day is a battery cost and a scan/connect fight
+// with the band's own link.
+// * NOT better than the band overnight. A chest strap is better at exercise HR
+// and beat timing; that is the whole of the claim.
+// * NOT a WHOOP replacement, and NOT baseline input. Its rows land in
+// `external_hr` with the sensor's name attached and NOTHING derives from
+// them. `decoded_onehz`/`decoded_rr` carry a `source` column so that even if
+// a future version does route these into the substrate, every baseline read
+// is already filtering them out — resting HR from a chest strap and from
+// wrist PPG differ systematically, and merging them quietly is how a step
+// change lands in every long-horizon number with no visible cause.
+// * NOT a sub-second beat timeline. The sensor reports RR *durations* and we
+// store durations. Beat TIMES are `decoded_rr`'s key and every consumer of
+// it; that is a separate change.
+//
+// PAIRING IS USER-INITIATED AND SEPARATE FROM ARMING. `scan()` runs only when
+// the user asks for it from a settings screen; arming connects straight to the
+// stored remote id with no scan at all, so a workout start never contends with
+// the band's service-filtered scan.
+
+import 'dart:async';
+import 'dart:convert';
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter_blue_plus/flutter_blue_plus.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+import '../data/db.dart';
+import '../sync/paired_device.dart' show cleanDeviceLabel;
+
+/// GATT Heart Rate Service and its Heart Rate Measurement characteristic.
+/// Written out in full 128-bit form rather than the 16-bit shorthand: the
+/// shorthand's expansion is a platform detail we should not depend on.
+const String kHeartRateServiceUuid = '0000180d-0000-1000-8000-00805f9b34fb';
+const String kHeartRateMeasurementUuid = '00002a37-0000-1000-8000-00805f9b34fb';
+
+/// One Heart Rate Measurement notification.
+@immutable
+class HrsSample {
+ /// Beats per minute as the sensor reported it.
+ final int hr;
+
+ /// Beat-to-beat DURATIONS in milliseconds carried by this notification, in
+ /// the order the sensor sent them. Empty when the sensor does not report RR
+ /// (many optical armbands do not) — empty is "not reported", never "zero".
+ final List rrMs;
+
+ /// The sensor's own contact claim: true/false when it reports one, null when
+ /// it does not support the field at all. Never inferred from HR.
+ final bool? contact;
+
+ const HrsSample({required this.hr, required this.rrMs, this.contact});
+}
+
+/// Parse a Heart Rate Measurement (0x2A37) value.
+///
+/// Layout (Bluetooth SIG, Heart Rate Service 1.0):
+/// byte 0 flags
+/// bit 0 HR format: 0 = uint8, 1 = uint16 little-endian
+/// bits 1-2 sensor contact: 0b00/0b01 = not supported, 0b10 = no contact,
+/// 0b11 = contact
+/// bit 3 Energy Expended present (uint16, kJ) — skipped, we do not use it
+/// bit 4 RR-Interval present (one or more uint16, units of 1/1024 s)
+/// then HR, then energy expended if present, then RR intervals to the end.
+///
+/// Returns null for a value that cannot be read as this characteristic (too
+/// short, or a truncated field). A malformed notification is DROPPED, never
+/// patched up into a plausible-looking beat.
+HrsSample? parseHeartRateMeasurement(List value) {
+ if (value.length < 2) return null;
+ final flags = value[0];
+ final wide = (flags & 0x01) != 0;
+ var i = 1;
+ final int hr;
+ if (wide) {
+ if (value.length < 3) return null;
+ hr = value[1] | (value[2] << 8);
+ i = 3;
+ } else {
+ hr = value[1];
+ i = 2;
+ }
+ // 0 bpm is not a measurement. Sensors emit it while searching for a signal;
+ // storing it would put a real-looking zero into a heart-rate series.
+ if (hr <= 0 || hr > 300) return null;
+
+ final contactBits = (flags >> 1) & 0x03;
+ final contact = contactBits < 2 ? null : contactBits == 3;
+
+ if ((flags & 0x08) != 0) i += 2; // energy expended — present, not used
+ final rr = [];
+ if ((flags & 0x10) != 0) {
+ // Trailing RR intervals, uint16 LE, 1/1024 s each. A trailing odd byte is a
+ // malformed value: stop rather than reading past it.
+ while (i + 1 < value.length) {
+ final ticks = value[i] | (value[i + 1] << 8);
+ i += 2;
+ // 1024 ticks = 1 s. Round to the nearest millisecond.
+ final ms = (ticks * 1000 + 512) ~/ 1024;
+ // 250-3000 ms is 20-240 bpm. Outside that the value is not a beat
+ // interval, and a chest strap emits exactly this junk on a dropped beat.
+ if (ms >= 250 && ms <= 3000) rr.add(ms);
+ }
+ }
+ return HrsSample(hr: hr, rrMs: rr, contact: contact);
+}
+
+/// The heart-rate sensor the user paired, if any. Separate keys from
+/// [PairedDevice] — the band and a sensor are two different links and pairing
+/// one must never disturb the other.
+class PairedHrSensor {
+ static const String _kId = 'hrs_remote_id';
+ static const String _kName = 'hrs_name';
+
+ final String remoteId;
+ final String name;
+ const PairedHrSensor(this.remoteId, this.name);
+
+ static Future load() async {
+ final prefs = await SharedPreferences.getInstance();
+ final id = prefs.getString(_kId);
+ if (id == null || id.isEmpty) return null;
+ return PairedHrSensor(id, prefs.getString(_kName) ?? 'Heart rate sensor');
+ }
+
+ static Future save(String remoteId, String? name) async {
+ final prefs = await SharedPreferences.getInstance();
+ await prefs.setString(_kId, remoteId);
+ // Same sanitiser the band label uses: a garbled advertised name must never
+ // become the `source` string stamped on stored rows.
+ await prefs.setString(_kName, cleanDeviceLabel(name) ?? 'Heart rate sensor');
+ }
+
+ static Future clear() async {
+ final prefs = await SharedPreferences.getInstance();
+ await prefs.remove(_kId);
+ await prefs.remove(_kName);
+ }
+}
+
+/// The live link to a paired heart-rate sensor. One instance; a second
+/// concurrent sensor is not a thing anyone asked for.
+class HrSensorLink {
+ HrSensorLink._();
+ static final HrSensorLink instance = HrSensorLink._();
+
+ /// Flush cadence for the write buffer. A sensor notifies ~1 Hz, and one
+ /// transaction per beat on the UI isolate is the mistake `commitSyncBatch`
+ /// already chunks around.
+ static const Duration _flushEvery = Duration(seconds: 15);
+
+ BluetoothDevice? _device;
+ StreamSubscription>? _valueSub;
+ StreamSubscription? _connSub;
+ Timer? _flushTimer;
+ final List> _pending = [];
+ String? _sessionId;
+ String? _source;
+
+ /// The most recent bpm the sensor reported, for a live readout. Null when no
+ /// sensor is armed or none has reported yet — an armed-but-silent sensor is
+ /// absent, not zero.
+ final ValueNotifier liveHr = ValueNotifier(null);
+
+ /// True once the sensor link is up and notifications are subscribed.
+ final ValueNotifier armed = ValueNotifier(false);
+
+ /// The sensor's name, used as the `source` on every row it produces.
+ String? get sourceName => _source;
+
+ /// Scan for heart-rate sensors. USER-INITIATED ONLY (a settings screen), never
+ /// on the workout path — it shares one radio scanner with the band's own scan.
+ ///
+ /// Returns (remoteId, name) pairs, deduplicated, strongest first.
+ Future> scan({
+ Duration timeout = const Duration(seconds: 8),
+ }) async {
+ if (FlutterBluePlus.isScanningNow) await FlutterBluePlus.stopScan();
+ final found = {};
+ final sub = FlutterBluePlus.onScanResults.listen((results) {
+ for (final r in results) {
+ final name = cleanDeviceLabel(r.device.platformName) ??
+ cleanDeviceLabel(r.advertisementData.advName);
+ if (name == null) continue;
+ found[r.device.remoteId.str] = (name, r.rssi);
+ }
+ });
+ try {
+ await FlutterBluePlus.startScan(
+ withServices: [Guid(kHeartRateServiceUuid)],
+ timeout: timeout,
+ );
+ await FlutterBluePlus.isScanning.where((on) => on == false).first;
+ } catch (_) {
+ // A revoked permission or a disabled adapter surfaces here on Android.
+ // The band engine already owns the blocker classification and the copy
+ // for it; from here an empty list is the honest answer.
+ } finally {
+ await sub.cancel();
+ }
+ final entries = found.entries.toList()
+ ..sort((a, b) => b.value.$2.compareTo(a.value.$2));
+ return [for (final e in entries) (e.key, e.value.$1)];
+ }
+
+ /// Connect to the paired sensor and start logging for [sessionId].
+ /// No-op (returns false) when nothing is paired — this is opt-in hardware.
+ ///
+ /// Never scans: it connects straight to the stored remote id, so arming a
+ /// workout cannot contend with the band's scan.
+ Future arm(String sessionId) async {
+ if (armed.value) return true;
+ final paired = await PairedHrSensor.load();
+ if (paired == null) return false;
+ _sessionId = sessionId;
+ _source = paired.name;
+ try {
+ final device = BluetoothDevice.fromId(paired.remoteId);
+ _device = device;
+ await device.connect(timeout: const Duration(seconds: 12));
+ final services = await device.discoverServices();
+ BluetoothCharacteristic? measure;
+ for (final s in services) {
+ if (s.uuid != Guid(kHeartRateServiceUuid)) continue;
+ for (final c in s.characteristics) {
+ if (c.uuid == Guid(kHeartRateMeasurementUuid)) measure = c;
+ }
+ }
+ if (measure == null) {
+ await disarm();
+ return false;
+ }
+ _valueSub = measure.onValueReceived.listen(_onValue);
+ await measure.setNotifyValue(true);
+ // A sensor that walks out of range mid-session ends the log there rather
+ // than leaving `armed` claiming a link that is gone.
+ _connSub = device.connectionState.listen((s) {
+ if (s == BluetoothConnectionState.disconnected) unawaited(disarm());
+ });
+ _flushTimer = Timer.periodic(_flushEvery, (_) => unawaited(_flush()));
+ armed.value = true;
+ return true;
+ } catch (_) {
+ await disarm();
+ return false;
+ }
+ }
+
+ /// Stop logging, flush the tail and drop the link. Safe to call when not
+ /// armed. AWAIT it before a finish screen reads the session back — an
+ /// unawaited stop is how the last buffered batch goes missing.
+ Future disarm() async {
+ _flushTimer?.cancel();
+ _flushTimer = null;
+ await _valueSub?.cancel();
+ _valueSub = null;
+ await _connSub?.cancel();
+ _connSub = null;
+ await _flush();
+ final d = _device;
+ _device = null;
+ _sessionId = null;
+ _source = null;
+ armed.value = false;
+ liveHr.value = null;
+ if (d != null) {
+ try {
+ await d.disconnect();
+ } catch (_) {/* already gone */}
+ }
+ }
+
+ void _onValue(List value) {
+ final s = parseHeartRateMeasurement(value);
+ if (s == null) return;
+ // The sensor's own "no skin contact" is a refusal, not a low reading: a
+ // chest strap off the chest reports confident nonsense. Drop the sample and
+ // do not show it.
+ if (s.contact == false) return;
+ liveHr.value = s.hr;
+ final source = _source;
+ if (source == null) return;
+ _pending.add({
+ 'ts': DateTime.now().millisecondsSinceEpoch ~/ 1000,
+ 'source': source,
+ 'hr': s.hr,
+ 'rr_ms': s.rrMs.isEmpty ? null : jsonEncode(s.rrMs),
+ 'session_id': _sessionId,
+ });
+ }
+
+ Future _flush() async {
+ if (_pending.isEmpty) return;
+ final batch = List>.from(_pending);
+ _pending.clear();
+ try {
+ await LocalDb.appendExternalHr(batch);
+ } catch (_) {
+ // Losing a buffered batch is better than throwing out of a timer on the
+ // UI isolate; the next flush carries on.
+ }
+ }
+}
diff --git a/lib/ble/live_cadence.dart b/lib/ble/live_cadence.dart
new file mode 100644
index 00000000..02547359
--- /dev/null
+++ b/lib/ble/live_cadence.dart
@@ -0,0 +1,68 @@
+// Session cadence from the band's live 100 Hz IMU stream.
+//
+// The step COUNT was already wired: `_ingestLiveMagsAt` runs the analytics
+// `pedometer` over each completed 60 s chunk of live |a| samples. A completed
+// chunk is one minute, so its step count IS a steps-per-minute reading — the
+// cadence needs no second decode, no second stream and no second algorithm,
+// only the right way to summarise the minutes that are already being counted.
+//
+// WHY A MEDIAN OF GATED MINUTES, not steps ÷ duration. A 45-minute session with
+// ten minutes of walking in it has a mean of ~20 spm, which is not a cadence —
+// it is not the cadence of the walking and it is not the cadence of the rest. A
+// cadence is a property of ambulation, so only minutes that actually look like
+// ambulation may contribute, and the median keeps one traffic-light minute from
+// dragging the answer.
+//
+// CEILING. This is SESSION cadence off a LIVE stream. gen4's R10 is live-only,
+// so there is no 24/7 cadence and no daily figure here — the daily step story
+// stays with the phone pedometer. And it is cadence, not gait analysis: no
+// stride length, no ground contact, no activity name.
+
+import 'package:openstrap_analytics/onehz.dart' as ana;
+
+/// A minute below this is not sustained walking (it is a few steps to the
+/// kettle inside an otherwise still minute); above it is not walking either.
+/// The same 60-200 spm band `livePedometer` treats as confident gait.
+const int kMinCadenceSpm = 60;
+const int kMaxCadenceSpm = 200;
+
+/// At least this many gait-like minutes before we call it a cadence. One minute
+/// is an anecdote, and a session that never really walked should report nothing
+/// rather than a number built from its single busiest minute.
+const int kMinCadenceMinutes = 3;
+
+/// Session cadence (steps/min) from the per-minute RAW step counts the live
+/// pedometer already produced, or null when the session did not walk enough to
+/// have one.
+///
+/// [rawMinuteSteps] are pre-gain counts, exactly as `ana.pedometer` returns
+/// them.
+///
+/// GATE FIRST, GAIN LAST. `ana.StepParams.gain` used to be applied to each
+/// minute BEFORE the 60–200 spm test, which stretched the band by whatever the
+/// gain was: at the old 1.11 a raw minute of 54 read 60 and entered the median,
+/// and a raw 181 read 201 and was thrown out — an 11% wider window at both ends
+/// than the constants say. The band is a band of REAL cadences (it is the same
+/// one `livePedometer` applies to its own pre-gain count), so the raw minute is
+/// what it must test. The gain is a per-user count trim and belongs on the
+/// answer, applied once, at the end.
+///
+/// NULL IS THE ANSWER for a session with fewer than [kMinCadenceMinutes]
+/// gait-like minutes. It is never 0 and never the mean of everything — an
+/// indoor session that never walked has no cadence, and saying "0 spm" would
+/// read as a measurement of stillness rather than an absence of walking.
+int? sessionCadenceSpm(List rawMinuteSteps) {
+ final gait = [
+ for (final raw in rawMinuteSteps)
+ if (raw >= kMinCadenceSpm && raw <= kMaxCadenceSpm) raw,
+ ];
+ if (gait.length < kMinCadenceMinutes) return null;
+ gait.sort();
+ final mid = gait.length ~/ 2;
+ // Even count: mean of the two middle minutes — cadence is reported as a whole
+ // number of steps per minute, so the gain and the rounding both land here.
+ final median = gait.length.isOdd
+ ? gait[mid].toDouble()
+ : (gait[mid - 1] + gait[mid]) / 2;
+ return (median * ana.StepParams.gain).round();
+}
diff --git a/lib/ble/live_step_runs.dart b/lib/ble/live_step_runs.dart
new file mode 100644
index 00000000..3763781a
--- /dev/null
+++ b/lib/ble/live_step_runs.dart
@@ -0,0 +1,199 @@
+// live_step_runs.dart — pure, I/O-free: which SPANS of a live session the
+// strap's 100 Hz pedometer actually saw walking. No BLE, no DB, no clock.
+//
+// WHY THIS EXISTS
+// `live_coverage` used to get ONE row per connected session, spanning the whole
+// wall-clock hull of the link (`deriveLiveCoverageWindow`, deliberately biased
+// wide by `kCoverageDutyFloor`). That row answered "was a live link up", which
+// was the right question while its job was to exclude minutes from a 1 Hz step
+// ESTIMATE. That estimator is gone. The row's only remaining job is to say what
+// the strap measured and WHEN — and for that a hull is a lie by omission:
+// measured on the owner's own export for 2026-08-08, the band claimed 9.35 h of
+// coverage for 216 steps (0.4 spm) while the phone had 11 h for 7,775 (11.8
+// spm). Hand a per-window source ladder that hull and the day loses ~7,000
+// steps — a different failure from whole-day precedence, the same size.
+//
+// So a span here is "the stream was delivering AND the pedometer counted",
+// assembled from the same completed 60 s chunks the ingest path already runs
+// `pedometer()` over. A chunk that counted nothing does not extend a run; the
+// still hours between two walks are simply never claimed.
+//
+// SPAN LENGTH IS SAMPLED TIME, NEVER WALL TIME. A chunk covers `seconds` of
+// signal however long it took to arrive: 60 s of samples dribbled in over three
+// hours of a flaky link covers 60 s, not three hours. Over-claiming here would
+// be the same bug in a smaller box.
+//
+// The counter itself is unchanged and stays where it is (analytics
+// `pedometer`), and so is its gain — these runs carry the RAW count, and
+// `StepParams.gain` is applied exactly once, at the moment a run is banked.
+
+/// `live_coverage.source` for OUR OWN algorithm on the strap's 100 Hz IMU.
+///
+/// DISTINCT from `LocalDb.kStepSourceBand` ('band', which the NOOP importer
+/// also writes) and from the gen5 on-chip counter (which never reaches this
+/// table at all — it is read from `decoded_onehz.step_count`). A source ladder
+/// cannot rank tiers it cannot tell apart.
+const String kStepSourceStrap = 'strap_100hz';
+
+// ── GATE 1: the strap may only count steps during GAIT ──────────────────────
+//
+// OXWALK_VALIDATION §1/§5: on a free-living wrist the counter's error is
+// TWO-SIDED and unbounded above — worst over-count +199.5% (P18: 217 true steps
+// read as 650), against +5.3% worst at the hip. Both 3x over-counters were
+// low-ambulation hours, i.e. the wrist scored rhythmic ARM work as gait. A
+// rowing, boxing, elliptical or lifting session is an hour of exactly that, and
+// under a per-window source ladder the strap would win those windows outright
+// and bank hundreds of steps nobody took.
+//
+// So a session that is not locomotion on foot contributes NO steps. It keeps HR,
+// strain, zones and everything else; the phone covers those minutes instead. No
+// active session at all is unchanged — passive wear still counts, which is the
+// case the owner asked for ("when we get from strap is, when we get from strap").
+//
+// DERIVED-OR-PINNED, per the `kRouteTypeKeys` precedent: the catalogue has no
+// gait flag to derive from (and `Track`/`gps` do not separate gait — Track.
+// distance holds Rowing and Swimming, gps: true holds Cycling and Kayaking), so
+// this set is PINNED against the catalogue by `gait_step_types_test.dart` in
+// both directions. A key here that no activity can produce is the exact shape of
+// the bug that left {'run','cycle','walk','hike'} matching nothing, ever.
+//
+// The set is deliberately TIGHT — foot locomotion with a free, gait-cadence arm
+// swing, which is the only motion OxWalk measured:
+// * 'stairs' and 'stair_climber' are out — a hand on a rail damps the swing
+// and the corpus is level walking. Under-count risk only, but absent beats
+// wrong.
+// * 'sprinting', 'track_intervals', 'hurdles' are out — mostly standing
+// recovery, and sprint arm mechanics sit at the 5 steps/s ceiling of the
+// 0.2-2.0 s interval guard rather than inside it.
+// Widening it is one line plus a test edit; do that only with evidence.
+const Set kGaitStepTypeKeys = {
+ 'running',
+ 'trail_running',
+ 'walking',
+ 'hiking',
+ 'dog_walking',
+ 'treadmill',
+ 'cross_country',
+};
+
+/// True when a session of [type] is locomotion on foot, so the strap's
+/// pedometer may count it. False for null — "no type" is not a gait type; the
+/// caller decides separately what "no session at all" means.
+bool isGaitStepType(String? type) =>
+ type != null && kGaitStepTypeKeys.contains(type.toLowerCase());
+
+// ── GATE 2: the stream must actually be fast enough to count ────────────────
+//
+// OXWALK_VALIDATION §4, decimating the 100 Hz wrist set:
+// 100 Hz MAPE 33.0% 50 Hz 33.6% 33 Hz 66.2% 25 Hz 90.8%
+// The cliff sits between 50 and 33 Hz, and native 25 Hz reads MAPE 91.9% with
+// NINE of 39 participants at exactly zero. The mechanism is that every constant
+// in `pedometer` except the interval bounds is expressed in SAMPLES, so
+// `window = 33` is 0.33 s at 100 Hz and 1.32 s at 25 Hz — wider than a whole
+// gait cycle.
+//
+// 50 Hz is the floor because it is the last rate MEASURED to be indistinguishable
+// from 100 Hz (33.6% vs 33.0%); the next step down doubles the error. Anything
+// between them is unmeasured, so the floor sits on the last good measurement
+// rather than in the middle of the cliff.
+//
+// This must be MEASURED, never assumed: `kLiveSampleRateHz = 100.0` and
+// `_minuteSamples = 6000` rest on a `0x33` frame arrival rate that STEPS_ALGO §5
+// records as documented nowhere in this tree and impossible to recover from any
+// export (only historical `0x2f` records are archived; live frames are ephemeral
+// by design). If `0x33` runs slow, the shipped counter loses 60-90% of the count
+// silently.
+const double kMinLiveSampleRateHz = 50.0;
+
+/// Samples per wall-clock second actually achieved over a span — the measured
+/// rate, not the assumed one.
+///
+/// Null when it cannot be measured (no span, no samples), which callers must
+/// treat as "do not count": an unmeasurable window is exactly the one this gate
+/// exists for. This also catches the gap `_magMin` cannot see — it concatenates
+/// frames with no gap detection, discarding `ImuFrame.idx` and comparing no
+/// inter-frame timestamps, so a dropped frame or a stalled link splices a hole
+/// out and the state machine reads it as contiguous. A hole big enough to matter
+/// drags the achieved rate under the floor and the window is refused; a hole too
+/// small to move the rate is too small to move the count.
+double? achievedSampleRateHz(int samples, int? startMs, int? endMs) {
+ if (samples <= 0 || startMs == null || endMs == null || endMs <= startMs) {
+ return null;
+ }
+ return samples * 1000 / (endMs - startMs);
+}
+
+/// One contiguous stretch of streamed signal in which the pedometer counted.
+class LiveStepRun {
+ const LiveStepRun(this.startTs, this.endTs, this.rawSteps);
+
+ /// Epoch seconds in the BAND's record-time base — the same base
+ /// `live_coverage` rows are compared in.
+ final int startTs;
+ final int endTs;
+
+ /// PRE-gain count. See the file header.
+ final int rawSteps;
+
+ int get seconds => endTs - startTs;
+
+ @override
+ String toString() => 'LiveStepRun($startTs..$endTs, ${seconds}s, $rawSteps)';
+}
+
+/// Folds completed pedometer chunks into contiguous gait runs.
+class GaitRuns {
+ GaitRuns({this.maxRuns = 512});
+
+ /// Ceiling on how many separate runs one connected session may hold — a bound
+ /// on both memory and the session checkpoint that mirrors them. 512
+ /// non-contiguous counting minutes is ~8.5 h of stop-start walking inside a
+ /// single session.
+ final int maxRuns;
+
+ final List _runs = [];
+
+ List get runs => List.unmodifiable(_runs);
+ bool get isEmpty => _runs.isEmpty;
+ void clear() => _runs.clear();
+
+ /// Add one completed chunk: [rawSteps] counted over [seconds] of signal that
+ /// ENDED at [endTs] (band base, epoch sec).
+ ///
+ /// A chunk with no steps is dropped rather than recorded — that is exactly
+ /// what SPLITS one walk from the next, and a still minute is not coverage.
+ /// [floorTs] is the session's first sampled second; a chunk is never allowed
+ /// to claim signal from before it (the first chunk of a session ends slightly
+ /// under 60 s after the first frame, because the frames carrying its samples
+ /// took wall time to arrive).
+ void addChunk({
+ required int endTs,
+ required int seconds,
+ required int rawSteps,
+ required int floorTs,
+ }) {
+ if (rawSteps <= 0 || seconds <= 0) return;
+ var startTs = endTs - seconds;
+ if (startTs < floorTs) startTs = floorTs;
+ if (endTs <= startTs) return;
+ if (_runs.isNotEmpty) {
+ final last = _runs.last;
+ // Contiguous with the run in progress (the ordinary case: back-to-back
+ // counting minutes), or we are at the cap — either way extend instead of
+ // appending.
+ //
+ // ponytail: at the cap this merges across a gap it should have kept, so a
+ // pathological session over-claims one span. Raise `maxRuns` only if real
+ // sessions ever get near it.
+ if (startTs <= last.endTs || _runs.length >= maxRuns) {
+ _runs[_runs.length - 1] = LiveStepRun(
+ last.startTs,
+ endTs > last.endTs ? endTs : last.endTs,
+ last.rawSteps + rawSteps,
+ );
+ return;
+ }
+ }
+ _runs.add(LiveStepRun(startTs, endTs, rawSteps));
+ }
+}
diff --git a/lib/ble/proximity_policy.dart b/lib/ble/proximity_policy.dart
deleted file mode 100644
index 93051888..00000000
--- a/lib/ble/proximity_policy.dart
+++ /dev/null
@@ -1,262 +0,0 @@
-// proximity_policy.dart — pure smoothing/labelling for the "find my band"
-// hunt. No BLE types, no timers: samples in, a stable label out.
-//
-// WHY A POLICY AND NOT AN INLINE READING
-// Raw BLE RSSI is brutally noisy. Consecutive reads of a stationary device
-// routinely swing 10 dB from multipath alone, and a hand or a duvet between the
-// phone and the band costs another 10–20 dB. Painting that straight onto a
-// screen gives a number that jitters wildly while you stand still and barely
-// moves when you actually walk toward it — the exact opposite of what a hunt
-// needs. Two things fix it and both belong in one testable place:
-//
-// 1. EWMA smoothing, so a single bad read cannot move the label.
-// 2. HYSTERESIS on the zone boundaries, so hovering at a threshold does not
-// flicker between "Nearby" and "Close" several times a second.
-//
-// WHAT RSSI IS NOT
-// It is not distance, and this file will not pretend otherwise. There is no
-// path-loss-to-metres conversion here on purpose: that conversion needs a
-// calibrated TX power and a free-space assumption, and a band down the side of
-// a mattress violates the assumption completely. Showing "1.4 m" would be a
-// fabricated number in a codebase whose whole contract is not fabricating them.
-// Coarse zones plus an honest warmer/colder trend is what the signal can
-// actually support, so that is what it reports.
-
-/// How close the band looks, coarsely. Ordered strongest → weakest.
-enum ProximityZone {
- /// Within arm's reach — under a pillow, in the bedding, on the desk.
- immediate,
-
- /// Same room, a few paces away.
- near,
-
- /// Reachable but attenuated — another room, or buried in something.
- far,
-
- /// Connected, but the signal is too weak to guide a hunt.
- veryFar,
-
- /// Not enough samples yet.
- unknown,
-}
-
-/// Which way the signal is moving as you walk.
-enum ProximityTrend { warmer, colder, steady, unknown }
-
-/// One evaluated reading.
-class ProximityReading {
- const ProximityReading({
- required this.zone,
- required this.trend,
- required this.samples,
- this.smoothedRssi,
- this.rawRssi,
- });
-
- final ProximityZone zone;
- final ProximityTrend trend;
-
- /// How many samples have been folded in since the last reset.
- final int samples;
-
- /// EWMA of the raw values, in dBm. Null until the first sample.
- final double? smoothedRssi;
-
- /// The most recent raw value, in dBm. Shown only as a diagnostic.
- final int? rawRssi;
-
- /// 0..1 for a signal-strength bar. Maps the useful RSSI band (-95..-45 dBm)
- /// onto the unit interval; deliberately NOT presented as distance.
- double? get strength {
- final s = smoothedRssi;
- if (s == null) return null;
- const worst = -95.0;
- const best = -45.0;
- final t = (s - worst) / (best - worst);
- return t < 0 ? 0.0 : (t > 1 ? 1.0 : t);
- }
-}
-
-/// Stateful across samples, but pure: no clock, no I/O, no BLE dependency.
-class ProximityTracker {
- ProximityTracker({
- this.alpha = 0.35,
- this.hysteresisDb = 3.0,
- this.trendDeadbandDb = 2.0,
- this.trendLookback = 4,
- });
-
- /// EWMA weight for each new sample. 0.35 settles in roughly five reads —
- /// responsive enough to feel live at ~1.5 Hz polling, damped enough that one
- /// multipath dropout does not jump the label.
- final double alpha;
-
- /// A zone boundary must be crossed by this much before the label changes.
- /// Without it, a signal sitting exactly on a threshold flickers continuously.
- final double hysteresisDb;
-
- /// Movement smaller than this is called steady rather than warmer/colder.
- final double trendDeadbandDb;
-
- /// How many samples back the trend compares against. Too short and the trend
- /// is noise; too long and it lags behind you as you walk.
- final int trendLookback;
-
- double? _ewma;
- int? _lastRaw;
- int _samples = 0;
- ProximityZone _zone = ProximityZone.unknown;
- final List _history = [];
-
- /// Last three RAW samples, for the median prefilter below.
- final List _rawWindow = [];
-
- /// Zone lower bounds in dBm, strongest first. Values are the conventional
- /// BLE proximity bands; they are coarse by design.
- static const _bounds = <(ProximityZone, double)>[
- (ProximityZone.immediate, -60.0),
- (ProximityZone.near, -75.0),
- (ProximityZone.far, -88.0),
- ];
-
- /// Fold in one RSSI reading (dBm, negative).
- ProximityReading add(int rssi) {
- _lastRaw = rssi;
- _samples++;
-
- // MEDIAN-OF-3 PREFILTER, ahead of the EWMA. An EWMA alone cannot survive
- // impulse noise: at alpha 0.35 a single -100 dBm dropout (a hand over the
- // band, a multipath null — both common while hunting) drags the average
- // 15 dB in one step, which is enough to repaint the zone and send the user
- // walking the wrong way. A median of the last three RAW samples removes a
- // lone outlier completely while letting any change that persists for two
- // samples through, which is exactly the distinction we want. Below three
- // samples it passes through, so the very first reads still respond
- // immediately instead of sitting inert.
- _rawWindow.add(rssi);
- if (_rawWindow.length > 3) _rawWindow.removeAt(0);
- final filtered = _rawWindow.length < 3
- ? rssi.toDouble()
- : (List.from(_rawWindow)..sort())[1].toDouble();
-
- final prev = _ewma;
- _ewma = prev == null ? filtered : prev + alpha * (filtered - prev);
-
- _history.add(_ewma!);
- if (_history.length > trendLookback + 1) _history.removeAt(0);
-
- _zone = _zoneFor(_ewma!, _zone);
- return ProximityReading(
- zone: _samples >= _minSamplesForZone ? _zone : ProximityZone.unknown,
- trend: _trend(),
- samples: _samples,
- smoothedRssi: _ewma,
- rawRssi: _lastRaw,
- );
- }
-
- /// Current state without folding in a new sample.
- ProximityReading get current => ProximityReading(
- zone: _samples >= _minSamplesForZone ? _zone : ProximityZone.unknown,
- trend: _trend(),
- samples: _samples,
- smoothedRssi: _ewma,
- rawRssi: _lastRaw,
- );
-
- /// Forget everything — call when the hunt restarts or the link drops, so a
- /// stale EWMA from the last session cannot seed the new one.
- void reset() {
- _ewma = null;
- _lastRaw = null;
- _samples = 0;
- _zone = ProximityZone.unknown;
- _history.clear();
- _rawWindow.clear();
- }
-
- /// One sample is not a zone: the first read is as likely to be a multipath
- /// null as the truth.
- static const int _minSamplesForZone = 3;
-
- /// Hysteresis in both directions: to move to a STRONGER zone the value must
- /// clear that zone's floor by [hysteresisDb]; to fall to a weaker one it must
- /// drop below the current zone's floor by the same margin. Between those it
- /// holds whatever it already showed.
- ProximityZone _zoneFor(double v, ProximityZone currentZone) {
- final bare = _bareZone(v);
- if (currentZone == ProximityZone.unknown) return bare;
- final bareIdx = _index(bare);
- final curIdx = _index(currentZone);
- if (bareIdx == curIdx) return currentZone;
-
- if (bareIdx < curIdx) {
- // Candidate is a stronger zone — require clearing its floor by the margin.
- final floor = _floorOf(bare);
- return floor == null || v >= floor + hysteresisDb ? bare : currentZone;
- }
- // Candidate is weaker — require dropping below the CURRENT floor by margin.
- final curFloor = _floorOf(currentZone);
- return curFloor == null || v <= curFloor - hysteresisDb ? bare : currentZone;
- }
-
- static ProximityZone _bareZone(double v) {
- for (final (zone, floor) in _bounds) {
- if (v >= floor) return zone;
- }
- return ProximityZone.veryFar;
- }
-
- static double? _floorOf(ProximityZone z) {
- for (final (zone, floor) in _bounds) {
- if (zone == z) return floor;
- }
- return null; // veryFar / unknown have no floor
- }
-
- static int _index(ProximityZone z) => switch (z) {
- ProximityZone.immediate => 0,
- ProximityZone.near => 1,
- ProximityZone.far => 2,
- ProximityZone.veryFar => 3,
- ProximityZone.unknown => 4,
- };
-
- ProximityTrend _trend() {
- if (_history.length <= trendLookback) return ProximityTrend.unknown;
- final delta = _history.last - _history.first;
- if (delta.abs() < trendDeadbandDb) return ProximityTrend.steady;
- return delta > 0 ? ProximityTrend.warmer : ProximityTrend.colder;
- }
-}
-
-/// Display strings, kept beside the model so wording and thresholds stay in
-/// step. Deliberately about signal, never about metres.
-extension ProximityZoneLabel on ProximityZone {
- String get label => switch (this) {
- ProximityZone.immediate => 'Right here',
- ProximityZone.near => 'Close by',
- ProximityZone.far => 'Somewhere around',
- ProximityZone.veryFar => 'Faint signal',
- ProximityZone.unknown => 'Listening…',
- };
-
- String get hint => switch (this) {
- ProximityZone.immediate =>
- 'Within arm\'s reach — check the bedding, pockets and under cushions.',
- ProximityZone.near => 'You\'re in the right area. Sweep slowly.',
- ProximityZone.far => 'Try another part of the room, or the next one.',
- ProximityZone.veryFar =>
- 'Barely in range. Walk around and watch for the signal to climb.',
- ProximityZone.unknown => 'Getting a fix on the signal…',
- };
-}
-
-extension ProximityTrendLabel on ProximityTrend {
- String get label => switch (this) {
- ProximityTrend.warmer => 'Warmer',
- ProximityTrend.colder => 'Colder',
- ProximityTrend.steady => 'Steady',
- ProximityTrend.unknown => '',
- };
-}
diff --git a/lib/cloud/cloud_import.dart b/lib/cloud/cloud_import.dart
index c6fd7ac6..82261744 100644
--- a/lib/cloud/cloud_import.dart
+++ b/lib/cloud/cloud_import.dart
@@ -11,9 +11,12 @@
// SEEDS the rolling baselines the recovery/illness stack reads — that's the
// "snapshots + baselines" the onboarding promised.
//
-// Overlap with future 1 Hz days is safe: putDayResult is INSERT-OR-REPLACE on
-// (day_id, algo_version), so once the band syncs and a real 1 Hz day is derived
-// it OVERWRITES any imported snapshot for the same date (real data wins).
+// Overlap with 1 Hz days is safe in BOTH directions. Forwards: putDayResult is
+// INSERT-OR-REPLACE on (day_id, algo_version), so once the band syncs and a real
+// 1 Hz day is derived it overwrites any imported snapshot for the same date.
+// Backwards: `_writeDay` skips any date `LocalDb.isMeasuredDay` already claims —
+// without that, importing over history the band had measured destroyed it, and
+// the `finalized: true` below meant no re-derive could ever bring it back.
import 'dart:convert';
@@ -103,6 +106,11 @@ class CloudImporter {
static Future _writeDay(
String date, Map d, Map? sl) async {
+ // Real data wins BOTH ways. The header's claim only ever held in one
+ // direction (a later band sync overwriting a snapshot); importing over a
+ // day the band had already measured replaced it and, because the write is
+ // `finalized: true`, locked the replacement in for good.
+ if (await LocalDb.isMeasuredDay(date)) return;
num? n(Object? v) => v is num ? v : null;
final rhr = n(d['resting_hr']);
final rmssd = n(d['hrv_rmssd']);
@@ -228,6 +236,9 @@ class CloudImporter {
payloadJson: jsonEncode(bundle),
windowJson: jsonEncode(win ?? const {}),
finalized: true, // imported snapshot — never recomputed (no raw exists)
+ // export-provenance — see WhoopImporter. A vendor snapshot's scalars are
+ // that vendor's maths; the tag matches the one in the payload.
+ source: 'cloud_v2',
rhr: f(rhr),
rmssd: f(rmssd),
readiness: f(readiness),
diff --git a/lib/coach/coach_actions.dart b/lib/coach/coach_actions.dart
new file mode 100644
index 00000000..7596c2fa
--- /dev/null
+++ b/lib/coach/coach_actions.dart
@@ -0,0 +1,419 @@
+// CoachActions — what the coach's tools actually do.
+//
+// The engine owns the loop, the schema and the confirmation gate; this file
+// owns the stores. It is separate for two reasons: `coach_engine.dart` was
+// already the longest file in `lib/coach`, and a tool body that talks to a
+// table is the part worth testing without a provider.
+//
+// Two rules every function here keeps:
+//
+// • IT WRITES, OR IT THROWS. Nothing returns a cheerful string on a path that
+// stored nothing — that was the `set_step_goal` bug (P2), and a tool that
+// lies to the model lies to the user twice: once in the answer, once in the
+// summary it just confirmed.
+// • THE MODEL IS AN UNTRUSTED CALLER. Dates, meals, times and dose windows are
+// validated here rather than at the schema, because an OpenAI-compatible
+// provider will send you `"meal": "brunch"` and `"date": "yesterday"`.
+//
+// Reads live here too (nutrition, medication) because neither is in the coach's
+// SQL views: `run_sql` reaches derived health views ONLY, and widening that
+// allow-list to reach food and dose tables would trade a hard structural
+// boundary for a soft one. A narrow typed read tool costs nothing and keeps
+// `coach_db`'s btree gate exactly as it is.
+
+import 'dart:convert';
+
+import 'package:sqflite/sqflite.dart';
+
+import '../data/day_label.dart';
+import '../data/journal_fields.dart';
+import '../data/local_repository.dart';
+import '../data/med_store.dart';
+import '../data/nutrition_store.dart';
+
+/// Raised when the model's arguments cannot be honoured. The message goes back
+/// into the transcript so the model can correct itself rather than retrying the
+/// same call.
+class CoachActionError implements Exception {
+ final String message;
+ CoachActionError(this.message);
+ @override
+ String toString() => message;
+}
+
+class CoachActions {
+ CoachActions._();
+
+ // ── argument coercion ──────────────────────────────────────────────────────
+
+ static String str(Object? v) => v == null ? '' : v.toString().trim();
+
+ static double? num_(Object? v) {
+ if (v == null) return null;
+ if (v is num) return v.isFinite ? v.toDouble() : null;
+ return double.tryParse(v.toString().trim());
+ }
+
+ /// A local day label, defaulting to today. Rejects anything that is not
+ /// `YYYY-MM-DD` — a relative word ("yesterday") stored verbatim would key a
+ /// row nothing can ever read back.
+ static String day(Object? v, {DateTime? now}) {
+ final s = str(v);
+ if (s.isEmpty) return todayLabel(now ?? DateTime.now());
+ if (!RegExp(r'^\d{4}-\d{2}-\d{2}$').hasMatch(s)) {
+ throw CoachActionError(
+ 'Date "$s" is not a day. Use YYYY-MM-DD (today is '
+ '${todayLabel(now ?? DateTime.now())}).',
+ );
+ }
+ return s;
+ }
+
+ /// `HH:MM` on a 24-hour clock → minutes from midnight.
+ static int minuteOfDay(Object? v) {
+ final m = RegExp(r'^(\d{1,2}):(\d{2})$').firstMatch(str(v));
+ if (m == null) {
+ throw CoachActionError('Time "${str(v)}" is not HH:MM on a 24-h clock.');
+ }
+ final h = int.parse(m.group(1)!), mi = int.parse(m.group(2)!);
+ if (h > 23 || mi > 59) {
+ throw CoachActionError('Time "${str(v)}" is not a real time of day.');
+ }
+ return h * 60 + mi;
+ }
+
+ /// Local wall-clock date + time → epoch SECONDS, through `DateTime` so a DST
+ /// boundary lands where the user's clock says it does.
+ static int epochOf(String date, int minute) {
+ final p = date.split('-');
+ final d = DateTime(
+ int.parse(p[0]),
+ int.parse(p[1]),
+ int.parse(p[2]),
+ minute ~/ 60,
+ minute % 60,
+ );
+ return d.millisecondsSinceEpoch ~/ 1000;
+ }
+
+ // ── nutrition ──────────────────────────────────────────────────────────────
+
+ /// One day of food: every entry, plus the totals the app itself computes.
+ ///
+ /// The totals come from `rollupDay`, not from summing here, so the coach sees
+ /// the same number the Nutrition screen shows — including its FLOOR flag, the
+ /// one thing a naive sum destroys (a day with one unlabelled item has a total
+ /// that is a lower bound, not a total).
+ static Future nutritionDay(Database db, Object? date) async {
+ final d = day(date);
+ final entries = await NutritionDb.entriesForDay(db, d);
+ final roll = rollupDay(d, entries, today: todayLabel());
+ Map total(NutrientTotal t) => {
+ 'value': t.value,
+ if (t.isFloor) 'is_floor': true,
+ if (t.unknown > 0) 'entries_missing_it': t.unknown,
+ };
+ return jsonEncode({
+ 'date': d,
+ 'logged': roll.logged,
+ 'entries': [
+ for (final e in entries)
+ {
+ 'meal': e.meal,
+ 'label': e.label,
+ if (e.quantity != null) 'quantity': e.quantity,
+ if (e.quantity != null) 'unit': e.unit,
+ 'kcal': e.kcal,
+ 'protein_g': e.proteinG,
+ 'carbs_g': e.carbsG,
+ 'fat_g': e.fatG,
+ 'fibre_g': e.fibreG,
+ if (e.note.isNotEmpty) 'note': e.note,
+ },
+ ],
+ 'totals': {
+ 'kcal': total(roll.kcal),
+ 'protein_g': total(roll.protein),
+ 'carbs_g': total(roll.carbs),
+ 'fat_g': total(roll.fat),
+ 'fibre_g': total(roll.fibre),
+ },
+ });
+ }
+
+ /// Log one thing eaten. Every nutrient is optional: an eating occasion with
+ /// no numbers is a complete, valid log, and inventing a calorie figure to
+ /// fill the column is the one thing this must never do.
+ static Future logFood(Database db, Map a) async {
+ final d = day(a['date']);
+ final label = str(a['label']);
+ if (label.isEmpty) throw CoachActionError('A food needs a name.');
+ final meal = str(a['meal']).toLowerCase();
+ if (!kMeals.contains(meal)) {
+ throw CoachActionError(
+ 'Meal "$meal" is not one of ${kMeals.join(', ')}.',
+ );
+ }
+ final at = str(a['time']).isEmpty ? null : minuteOfDay(a['time']);
+ final e = FoodEntry(
+ id: NutritionDb.newId(),
+ date: d,
+ meal: meal,
+ label: label,
+ atTs: at == null ? null : epochOf(d, at),
+ quantity: num_(a['quantity']),
+ unit: str(a['unit']).isEmpty ? 'g' : str(a['unit']),
+ kcal: num_(a['kcal']),
+ proteinG: num_(a['protein_g']),
+ carbsG: num_(a['carbs_g']),
+ fatG: num_(a['fat_g']),
+ fibreG: num_(a['fibre_g']),
+ sugarG: num_(a['sugar_g']),
+ satFatG: num_(a['sat_fat_g']),
+ sodiumMg: num_(a['sodium_mg']),
+ ironMg: num_(a['iron_mg']),
+ calciumMg: num_(a['calcium_mg']),
+ // `manual` and confirmed: the user approved this exact entry at the
+ // confirmation gate, which is what `confirmed` records. It is NOT
+ // `verified` — that word means a manufacturer or USDA record, and a
+ // number the model recalled is not one.
+ source: FoodSource.manual,
+ confirmed: true,
+ note: str(a['note']),
+ );
+ await NutritionDb.put(db, e);
+ return jsonEncode({
+ 'saved': true,
+ 'date': d,
+ 'meal': meal,
+ 'label': label,
+ 'kcal': e.kcal,
+ });
+ }
+
+ // ── journal numbers (water, mood, and the rest) ────────────────────────────
+
+ /// Write one or more numeric journal fields for a day.
+ ///
+ /// `postJournalMetrics` replaces the WHOLE day — "the map IS the day, not a
+ /// patch on it" — so the stored day is read first and merged. Without that,
+ /// logging water at lunch would silently erase the morning's mood.
+ ///
+ /// Water is loggable here and is scored NOWHERE. There is no hydration score
+ /// in this app and there is not going to be one.
+ static Future logJournalFields(
+ LocalRepository repo,
+ Map a,
+ ) async {
+ final d = day(a['date']);
+ final raw = a['fields'];
+ if (raw is! Map || raw.isEmpty) {
+ throw CoachActionError('No fields given.');
+ }
+ final known = {for (final f in await repo.getJournalFields()) f.key: f};
+ final at = str(a['time']).isEmpty ? null : minuteOfDay(a['time']);
+ final merged = {...await repo.getJournalMetrics(d)};
+ final written = [];
+ for (final e in raw.entries) {
+ final key = str(e.key);
+ final spec = known[key];
+ if (spec == null) {
+ throw CoachActionError(
+ 'There is no journal field "$key". Known fields: '
+ '${known.keys.join(', ')}.',
+ );
+ }
+ final v = num_(e.value);
+ if (v == null) {
+ throw CoachActionError('Field "$key" needs a number.');
+ }
+ merged[key] = JournalMetricValue(
+ v,
+ atMinuteOfDay: spec.hasTime ? at : null,
+ );
+ written.add(key);
+ }
+ await repo.postJournalMetrics(d, merged);
+ return jsonEncode({'saved': true, 'date': d, 'fields': written});
+ }
+
+ // ── workouts ───────────────────────────────────────────────────────────────
+
+ /// Log a workout that ALREADY HAPPENED.
+ ///
+ /// The only workout tools before this were start/end, which cannot express
+ /// "I ran this morning" — the model had to either refuse or start a live
+ /// session at the wrong time. The window is scored from the 1 Hz substrate by
+ /// the repository; a window with no substrate behind it is still saved, just
+ /// unscored, and the result says which.
+ static Future addCompletedWorkout(
+ LocalRepository repo,
+ Map a,
+ ) async {
+ final d = day(a['date']);
+ final start = minuteOfDay(a['start_time']);
+ final mins = num_(a['duration_min'])?.round();
+ if (mins == null || mins <= 0) {
+ throw CoachActionError('A completed workout needs a duration in minutes.');
+ }
+ final type = str(a['type']).isEmpty ? 'other' : str(a['type']).toLowerCase();
+ final startTs = epochOf(d, start);
+ try {
+ final r = await repo.logManualWorkout(
+ startTs: startTs,
+ endTs: startTs + mins * 60,
+ type: type,
+ );
+ return jsonEncode({'saved': true, 'date': d, 'type': type, ...r});
+ } catch (e) {
+ // The repo rejects overlaps, futures and absurd durations. Hand the
+ // reason back verbatim so the model corrects the window instead of
+ // telling the user it worked.
+ throw CoachActionError('That window was rejected: $e');
+ }
+ }
+
+ // ── medication ─────────────────────────────────────────────────────────────
+
+ /// Every scheduled medication, with today's doses and their state.
+ static Future medications(Database db, {DateTime? now}) async {
+ final at = now ?? DateTime.now();
+ final d = todayLabel(at);
+ final defs = await MedDb.defs(db);
+ final slots = slotsForDay(defs, d, await MedDb.dosesForDay(db, d), now: at);
+ return jsonEncode({
+ 'date': d,
+ 'medications': [
+ for (final def in defs)
+ {
+ 'name': def.label,
+ 'dose': def.doseLabel,
+ 'schedule': [
+ for (final s in def.schedule)
+ {
+ 'time':
+ '${(s.minuteOfDay ~/ 60).toString().padLeft(2, '0')}:'
+ '${(s.minuteOfDay % 60).toString().padLeft(2, '0')}',
+ 'weekdays': s.days.isEmpty ? [1, 2, 3, 4, 5, 6, 7] : s.days,
+ },
+ ],
+ },
+ ],
+ 'today': [
+ for (final s in slots)
+ {'name': s.def.label, 'time': s.timeLabel, 'state': s.state.name},
+ ],
+ });
+ }
+
+ /// Add (or replace) a medication schedule.
+ ///
+ /// [weekdays] are `DateTime.weekday` values, 1 = Monday. They are REQUIRED in
+ /// spirit and default to every day only because that is what most schedules
+ /// are — the user can change them on the Wellness screen, which is the
+ /// precondition this tool waited on: an AI that writes a schedule the person
+ /// cannot correct is worse than no tool at all.
+ static Future addMedication(
+ Database db,
+ Map a,
+ ) async {
+ final name = str(a['name']);
+ if (name.isEmpty) throw CoachActionError('A medication needs a name.');
+ final minute = minuteOfDay(a['time']);
+ final days = {
+ for (final d in (a['weekdays'] as List? ?? const []))
+ if (num_(d) != null) num_(d)!.round(),
+ }..removeWhere((d) => d < 1 || d > 7);
+ final dose = num_(a['dose_value']);
+ final key = MedDb.keyFor(name);
+ // ADD, not replace. `putDef` writes the whole row, so building a fresh
+ // MedDef here meant a second "add paracetamol at 22:00" silently deleted
+ // the 08:00 and 14:00 doses already on it — and blanked the dose, unit,
+ // kind and note whenever the model did not resend them. An assistant that
+ // destroys a medication schedule as a side effect of adding to it is worse
+ // than one with no tool at all.
+ final existing = (await MedDb.defs(db, activeOnly: false))
+ .where((d) => d.key == key)
+ .firstOrNull;
+ final slot = MedSchedule(
+ minute,
+ days.isEmpty ? const [1, 2, 3, 4, 5, 6, 7] : (days.toList()..sort()),
+ );
+ // Same time of day twice is one entry, with the newer day-set winning —
+ // that is how a person edits which days a dose falls on.
+ final schedule = [
+ ...?existing?.schedule.where((e) => e.minuteOfDay != minute),
+ slot,
+ ]..sort((x, y) => x.minuteOfDay.compareTo(y.minuteOfDay));
+ await MedDb.putDef(
+ db,
+ MedDef(
+ key: key,
+ label: name,
+ doseValue: dose ?? existing?.doseValue,
+ doseUnit: str(a['dose_unit']).isEmpty
+ ? (existing?.doseUnit ?? '')
+ : str(a['dose_unit']),
+ kind: str(a['kind']).isEmpty
+ ? (existing?.kind ?? 'medication')
+ : (str(a['kind']) == 'supplement' ? 'supplement' : 'medication'),
+ schedule: schedule,
+ note: existing?.note ?? '',
+ active: existing?.active ?? true,
+ createdAt: existing?.createdAt,
+ ),
+ );
+ return jsonEncode({
+ 'saved': true,
+ 'name': name,
+ 'weekdays': days.isEmpty ? [1, 2, 3, 4, 5, 6, 7] : (days.toList()..sort()),
+ });
+ }
+
+ /// Record what happened to one scheduled dose.
+ ///
+ /// `skipped` and `not_taken` are different facts and both are storable — the
+ /// distinction the store was built for and the UI could not enter until now.
+ static Future markMedication(
+ Database db,
+ Map a,
+ ) async {
+ final name = str(a['name']);
+ final defs = await MedDb.defs(db);
+ MedDef? def;
+ for (final x in defs) {
+ if (x.label.toLowerCase() == name.toLowerCase()) def = x;
+ }
+ if (def == null) {
+ throw CoachActionError(
+ 'No medication called "$name". Known: '
+ '${defs.map((d) => d.label).join(', ')}.',
+ );
+ }
+ final d = day(a['date']);
+ final slot = str(a['time']).isEmpty
+ ? (def.schedule.isEmpty ? null : def.schedule.first.minuteOfDay)
+ : minuteOfDay(a['time']);
+ if (slot == null) {
+ throw CoachActionError('"$name" has no scheduled time to mark.');
+ }
+ final state = str(a['state']).toLowerCase();
+ if (!const ['taken', 'skipped', 'not_taken'].contains(state)) {
+ throw CoachActionError('State must be taken, skipped or not_taken.');
+ }
+ await MedDb.mark(
+ db,
+ medKey: def.key,
+ date: d,
+ slotMin: slot,
+ taken: state == 'taken',
+ skipped: state == 'skipped',
+ );
+ return jsonEncode({
+ 'saved': true,
+ 'name': def.label,
+ 'date': d,
+ 'state': state,
+ });
+ }
+}
diff --git a/lib/coach/coach_config.dart b/lib/coach/coach_config.dart
index ea26cb32..3593fd8c 100644
--- a/lib/coach/coach_config.dart
+++ b/lib/coach/coach_config.dart
@@ -76,7 +76,33 @@ class CoachConfig extends ChangeNotifier {
String get model => _model;
String? get apiKey => _key;
bool get hasKey => _key != null && _key!.isNotEmpty;
- bool get configured => hasKey && _baseUrl.isNotEmpty && _model.isNotEmpty;
+
+ /// A model served from this device or this network wants no API key, so
+ /// requiring one made Ollama and LM Studio impossible to finish configuring:
+ /// Save closed the form, `configured` stayed false, and the coach never came
+ /// on with nothing on screen to explain why.
+ ///
+ /// Deliberately narrow — loopback, the Android emulator's host alias, and the
+ /// three private IPv4 ranges. A public host still needs a key, because
+ /// "endpoint with no credential" is a thing worth being sure about before
+ /// sending someone's health data to it.
+ bool get isLocalEndpoint {
+ final h = Uri.tryParse(apiBase)?.host.toLowerCase() ?? '';
+ if (h == 'localhost' || h == '127.0.0.1' || h == '::1' ||
+ h == '10.0.2.2' || h.endsWith('.local')) {
+ return true;
+ }
+ final v4 = RegExp(r'^(\d{1,3})\.(\d{1,3})\.\d{1,3}\.\d{1,3}$')
+ .firstMatch(h);
+ if (v4 == null) return false;
+ final a = int.parse(v4.group(1)!), b = int.parse(v4.group(2)!);
+ return a == 10 ||
+ (a == 172 && b >= 16 && b <= 31) ||
+ (a == 192 && b == 168);
+ }
+
+ bool get configured =>
+ (hasKey || isLocalEndpoint) && _baseUrl.isNotEmpty && _model.isNotEmpty;
/// Normalised base, no trailing slash.
String get apiBase {
diff --git a/lib/coach/coach_engine.dart b/lib/coach/coach_engine.dart
index 40a2d529..10c79434 100644
--- a/lib/coach/coach_engine.dart
+++ b/lib/coach/coach_engine.dart
@@ -19,7 +19,9 @@ import 'package:http/http.dart' as http;
import 'package:path_provider/path_provider.dart';
import '../data/day_label.dart';
+import '../data/db.dart';
import '../data/local_repository.dart';
+import 'coach_actions.dart';
import 'coach_config.dart';
import 'coach_db.dart';
import 'coach_prompt.dart';
@@ -711,6 +713,15 @@ class CoachEngine {
case 'run_sql':
return await CoachDb.runCoachSql('${args['sql'] ?? ''}');
+ // data — the two stores that are NOT in the SQL views. Widening
+ // `coach_db`'s allow-list to reach them would trade a structural btree
+ // gate for a text-level one; a typed read tool costs nothing.
+ case 'get_nutrition':
+ return await CoachActions.nutritionDay(
+ await LocalDb.instance, args['date']);
+ case 'get_medications':
+ return await CoachActions.medications(await LocalDb.instance);
+
// plot — legacy bar/line/area figure
case 'plot_chart':
final spec = ChartSpec.tryParse(args);
@@ -750,11 +761,55 @@ class CoachEngine {
tool: name, title: 'End workout',
summary: 'End the active workout.', args: args,
), () async { final r = await api.endWorkout('${args['workout_id']}'); return _enc(r); });
+ case 'log_food':
+ return await _action(confirm, ActionRequest(
+ tool: name, title: 'Log food',
+ summary: 'Add "${args['label']}" to ${args['meal']} on '
+ '${args['date'] ?? 'today'}'
+ '${args['kcal'] == null ? '' : ' (${args['kcal']} kcal)'}.',
+ args: args,
+ ), () async => CoachActions.logFood(await LocalDb.instance, args));
+ case 'log_journal_fields':
+ return await _action(confirm, ActionRequest(
+ tool: name, title: 'Log how the day went',
+ summary: 'Record ${_fieldSummary(args['fields'])} for '
+ '${args['date'] ?? 'today'}.',
+ args: args,
+ ), () async => CoachActions.logJournalFields(api, args));
+ case 'add_completed_workout':
+ return await _action(confirm, ActionRequest(
+ tool: name, title: 'Log a workout',
+ summary: 'Save a ${args['duration_min']}-minute '
+ '${args['type'] ?? 'workout'} starting '
+ '${args['start_time']} on ${args['date'] ?? 'today'}.',
+ args: args,
+ ), () async => CoachActions.addCompletedWorkout(api, args));
+ case 'add_medication':
+ return await _action(confirm, ActionRequest(
+ tool: name, title: 'Add a medication',
+ summary: 'Schedule ${args['name']} at ${args['time']}, '
+ '${_daysSummary(args['weekdays'])}. '
+ 'This app does not check interactions.',
+ args: args,
+ ), () async => CoachActions.addMedication(await LocalDb.instance, args));
+ case 'mark_medication':
+ return await _action(confirm, ActionRequest(
+ tool: name, title: 'Mark a dose',
+ summary: 'Record ${args['name']} on ${args['date'] ?? 'today'} as '
+ '${args['state']}.',
+ args: args,
+ ), () async => CoachActions.markMedication(await LocalDb.instance, args));
case 'set_step_goal':
return await _action(confirm, ActionRequest(
tool: name, title: 'Set step goal',
summary: 'Set your daily step goal to ${args['goal']}.', args: args,
- ), () async { await api.setStepGoal((args['goal'] as num).toInt()); return 'Step goal updated.'; });
+ ), () async {
+ // A provider that sends "9000" as a string is not an edge case.
+ final goal = CoachActions.num_(args['goal']);
+ if (goal == null) throw CoachActionError('A step goal must be a number.');
+ await api.setStepGoal(goal.round());
+ return 'Step goal updated.';
+ });
default:
return 'Unknown tool: $name';
@@ -779,9 +834,30 @@ class CoachEngine {
return s.length > 16000 ? '${s.substring(0, 16000)}…(truncated)' : s;
}
+ /// "500 ml of water and mood 4" — the confirmation has to say what it writes,
+ /// not "3 fields".
+ static String _fieldSummary(Object? fields) {
+ if (fields is! Map || fields.isEmpty) return 'nothing';
+ return fields.entries
+ .map((e) => '${e.key.toString().replaceAll('_', ' ')} ${e.value}')
+ .join(', ');
+ }
+
+ static String _daysSummary(Object? weekdays) {
+ const names = ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun'];
+ if (weekdays is! List || weekdays.isEmpty || weekdays.length == 7) {
+ return 'every day';
+ }
+ return weekdays
+ .map((d) => d is num && d >= 1 && d <= 7 ? names[d.toInt() - 1] : '?')
+ .join(', ');
+ }
+
String _statusFor(String name, Map args) {
switch (name) {
case 'run_sql': return 'Querying your data…';
+ case 'get_nutrition': return 'Reading your food log…';
+ case 'get_medications': return 'Reading your medications…';
case 'plot_chart': return 'Plotting…';
case 'render': return 'Rendering ${args['type'] ?? 'figure'}…';
default: return 'Working…';
@@ -807,8 +883,13 @@ class CoachEngine {
'v_metric(date,key,value); '
'v_daily(date,resting_hr,hrv,sdnn,readiness,strain,resp_rate,stress,'
'sleep_efficiency,sleep_min,deep_min,rem_min,light_min,nap_min,steps,'
+ // `odi_per_hour` is NOT listed: the view still has the column but the
+ // pipeline stopped writing the key when SpO2 was refused edge-side, so
+ // it is permanently NULL. Advertising a column that can never hold a
+ // value makes the model query it, get nothing, and reason about the
+ // hole. A column that can never have data is a lie to the model.
'active_calories,total_calories,skin_temp_z,lf_hf,hrv_cv,dip_pct,'
- 'odi_per_hour,worn_min,hrr_bpm,brv_cv,irregular_flag); '
+ 'worn_min,hrr_bpm,brv_cv,irregular_flag); '
'v_series(date,series,t,v) — series ∈ hr_curve,strain_curve,hrv_timeline,'
'hrv_day,resp_day,skin_temp_day,zone_timeline,activity_curve; ALWAYS filter '
'WHERE date=\'YYYY-MM-DD\' AND series=\'…\'; '
@@ -851,6 +932,83 @@ class CoachEngine {
'type': {'type': 'string'},
'title': {'type': 'string'},
}, ['type']),
+ _fn('get_nutrition',
+ 'Read one day of food. Returns every entry and the day totals as the '
+ 'app computes them (a total over an entry with no numbers is a FLOOR '
+ 'and says so). Food is NOT in run_sql — use this.',
+ {'date': {'type': 'string', 'description': 'YYYY-MM-DD, default today'}}),
+ _fn('get_medications',
+ 'Read the medication/supplement schedule and today\'s doses '
+ '(taken/skipped/missed/upcoming). Not in run_sql — use this.', {}),
+ _fn('log_food',
+ 'Log something eaten (asks the user to confirm). EVERY nutrient is '
+ 'optional: an eating occasion with no numbers is a complete log, and '
+ 'you must never invent a calorie or macro figure to fill a field. Only '
+ 'pass a number the user told you or that is on a label they described.',
+ {
+ 'date': {'type': 'string', 'description': 'YYYY-MM-DD, default today'},
+ 'meal': {'type': 'string', 'enum': ['breakfast', 'lunch', 'dinner', 'snack']},
+ 'label': {'type': 'string', 'description': 'what it was'},
+ 'time': {'type': 'string', 'description': 'HH:MM, optional'},
+ 'quantity': {'type': 'number'},
+ 'unit': {'type': 'string', 'description': 'g, ml, piece…'},
+ 'kcal': {'type': 'number'},
+ 'protein_g': {'type': 'number'},
+ 'carbs_g': {'type': 'number'},
+ 'fat_g': {'type': 'number'},
+ 'fibre_g': {'type': 'number'},
+ 'sugar_g': {'type': 'number'},
+ 'sat_fat_g': {'type': 'number'},
+ 'sodium_mg': {'type': 'number'},
+ 'iron_mg': {'type': 'number'},
+ 'calcium_mg': {'type': 'number'},
+ 'note': {'type': 'string'},
+ }, ['meal', 'label']),
+ _fn('log_journal_fields',
+ 'Record the user\'s own numbers for a day (asks them to confirm). This '
+ 'is where WATER and MOOD live. Fields: mood, sleep_quality, energy, '
+ 'stress, soreness (all 1–5), water_ml, caffeine_mg, alcohol_units, '
+ 'screens_min, weight_kg. Fields you do not pass are left as they are.',
+ {
+ 'date': {'type': 'string', 'description': 'YYYY-MM-DD, default today'},
+ 'fields': {'type': 'object', 'description': 'field key -> number'},
+ 'time': {'type': 'string', 'description': 'HH:MM — only used by caffeine/alcohol'},
+ }, ['fields']),
+ _fn('add_completed_workout',
+ 'Log a workout that ALREADY HAPPENED (asks the user to confirm). Use '
+ 'this for "I ran this morning" — start_workout is only for one starting '
+ 'right now. The window is scored from the recorded 1 Hz data; a window '
+ 'with nothing recorded behind it is saved unscored, and the result says '
+ 'which.',
+ {
+ 'date': {'type': 'string', 'description': 'YYYY-MM-DD, default today'},
+ 'start_time': {'type': 'string', 'description': 'HH:MM local, 24-h'},
+ 'duration_min': {'type': 'integer'},
+ 'type': {'type': 'string', 'description': 'run, ride, walk, strength, swim, yoga…'},
+ }, ['start_time', 'duration_min', 'type']),
+ _fn('add_medication',
+ 'Add or replace a medication/supplement schedule (asks the user to '
+ 'confirm). weekdays are 1=Monday…7=Sunday; pass them whenever the user '
+ 'says anything other than daily. This app does NOT check interactions '
+ 'and you must not imply that it does.',
+ {
+ 'name': {'type': 'string'},
+ 'time': {'type': 'string', 'description': 'HH:MM, 24-h'},
+ 'weekdays': {'type': 'array', 'items': {'type': 'integer'}},
+ 'dose_value': {'type': 'number'},
+ 'dose_unit': {'type': 'string', 'description': 'mg, ml, tablet…'},
+ 'kind': {'type': 'string', 'enum': ['medication', 'supplement']},
+ }, ['name', 'time']),
+ _fn('mark_medication',
+ 'Record one scheduled dose (asks the user to confirm). "skipped" is a '
+ 'decision the user made; "not_taken" undoes a mark. They are different '
+ 'facts — do not collapse them.',
+ {
+ 'name': {'type': 'string'},
+ 'date': {'type': 'string', 'description': 'YYYY-MM-DD, default today'},
+ 'time': {'type': 'string', 'description': 'HH:MM of the slot; default the first'},
+ 'state': {'type': 'string', 'enum': ['taken', 'skipped', 'not_taken']},
+ }, ['name', 'state']),
_fn('log_journal', 'Log a journal entry (asks the user to confirm).', {
'date': {'type': 'string'}, 'tags': {'type': 'array', 'items': {'type': 'string'}}, 'note': {'type': 'string'},
}, ['date']),
diff --git a/lib/coach/coach_prompt.dart b/lib/coach/coach_prompt.dart
index 148413d7..4d15a0f0 100644
--- a/lib/coach/coach_prompt.dart
+++ b/lib/coach/coach_prompt.dart
@@ -1,111 +1,133 @@
-// The coach's system prompt — domain knowledge + STRICT tool + output contract.
-// The coach reasons ONLY over data it fetches with tools; it never invents numbers.
+// The coach's system prompt — the tool contract, the schema, and the house
+// honesty laws, in the order the model needs them.
+//
+// It ships on EVERY turn, so length is a real cost. Everything here earns its
+// place by being something the model gets wrong without it: the exact view and
+// field names (it invents plausible ones), the figure types the app can
+// actually draw (it will happily ask for a scatter that renders as an apology),
+// and the laws — which are the difference between a health app and a chatbot
+// with a database.
const String kCoachSystemPrompt = '''
-You are the OpenStrap AI Coach — an expert in wearable physiology, training load,
-sleep science, and HRV, embedded in the user's own OpenStrap app (an open-source
-WHOOP-4.0 alternative). You can read EVERY metric in the user's account via tools
-and render charts the app draws natively.
+You are the OpenStrap coach, running inside the user's own app on their own
+device, reading their own data. You can read every derived metric, their food
+log and their medications; you can write food, workouts, journal numbers, doses
+and a step goal — always with their explicit confirmation.
-# SCOPE — stay strictly on-topic (most important rule)
-ONLY answer questions about the user's health and fitness: recovery, sleep, HRV,
-heart rate, strain/training, workouts, steps, body metrics, menstrual cycle,
-recovery-focused nutrition/hydration/caffeine, illness signals, and how to read
-their own OpenStrap data and app features.
+# SCOPE
+Answer only about this person's health, training, sleep, recovery, nutrition,
+cycle and the app's own data. Anything else — code, trivia, essays, news — gets
+one friendly sentence declining and steering back. Never write code.
-REFUSE everything else — coding/programming, math homework, general knowledge,
-trivia, writing essays/emails, current events, anything unrelated to the user's
-health. Do NOT write code under any circumstances. When a request is off-topic,
-decline in ONE friendly sentence and steer back, e.g.: "I'm your health & fitness
-coach, so I'll stick to that — ask me about your recovery, sleep, training, or any
-metric in your data." Do not partially comply (no code snippets, no exceptions).
+# THE LAWS (these outrank being helpful)
+1. NEVER state a number you did not fetch this turn. No recall, no estimate
+ dressed as a reading, no "roughly".
+2. ABSENT IS AN ANSWER. A null is not a zero and a zero is not a null. If the
+ data is missing, say it is missing and say what would fill it. Never print a
+ 0.0 for something unmeasured.
+3. DETECTION, NEVER DIAGNOSIS. State that a pattern is unlike THIS person's own
+ baseline. Never "you have", never a condition name, never a severity band
+ (mild/moderate/severe), never an AHI or an apnea/hypopnea count — the app
+ cannot compute one. Anything in that territory ends at "worth asking a
+ clinician to test properly", never at a number.
+4. NO STREAKS. Count out of a window ("18 of 24 nights"), never a run that
+ resets to zero.
+5. HONEST CEILINGS, unprompted when relevant: HRV is beat-timing at 1 Hz, not a
+ research ECG; sleep STAGES are wrist estimates and deep sleep especially is
+ low confidence; skin temperature is a relative index versus their own
+ baseline, never a clinical °C; there is NO SpO2 and no desaturation index in
+ this app, so never reason about one. Water can be LOGGED and is SCORED
+ NOWHERE — there is no hydration score and you must not invent one.
+6. Not a doctor. One "Not medical advice." line ONLY when you actually gave
+ health guidance.
-# How OpenStrap measures things (interpret correctly)
-- Resting HR: 5th-percentile sleeping HR. Lower trend = fitter/recovered.
-- Strain: Banister TRIMP, log-squashed to 0–21 (like WHOOP). Daily load.
-- HRV: RMSSD/SDNN/pNN50 from real RR intervals. Higher RMSSD = more recovered.
-- Recovery: Plews ln(RMSSD) z-score vs the user's baseline → 0–100. Needs ~5 nights.
-- Sleep: Cole-Kripke + HR-dip; stages are BETA (wrist ≠ EEG — never claim clinical accuracy).
-- Training load: EWMA ACWR; 0.8–1.3 = sweet spot, >1.5 = spike risk.
-- Illness watch: Mahalanobis of {resting HR↑, RMSSD↓, skin-temp↑}.
-- Skin temp & SpO₂ are RELATIVE indices (Δ vs personal baseline), NOT clinical °C / %.
-- Steps: AN-2554 estimate. Cycle: log-anchored calendar method (only if user enabled it).
+# DON'T RESTATE THE APP
+They can already see last night's numbers. Repeating them back is noise. Say
+something only when it (a) crossed a threshold, (b) moved together with
+something else in a way that is unusual for them, or (c) implies one specific
+thing to do. If none of those is true, say so in a sentence and stop. "Nothing
+stands out — your week looks like your normal" is a complete, correct answer.
-# DATA — you MUST query before you answer. Never state a number you didn't fetch.
-You have ONE data tool: run_sql(sql). It runs a single READ-ONLY SQLite SELECT over
-the user's DERIVED data (raw signals are intentionally unavailable). Tables are VIEWS:
+# READING DATA
+`run_sql(sql)` — ONE read-only SQLite SELECT over derived VIEWS only. No other
+tables exist to you.
+- v_daily(date, resting_hr, hrv, sdnn, readiness, strain, resp_rate, stress,
+ sleep_efficiency, sleep_min, deep_min, rem_min, light_min, nap_min, steps,
+ active_calories, total_calories, skin_temp_z, lf_hf, hrv_cv, dip_pct,
+ worn_min, hrr_bpm, brv_cv, irregular_flag) — one row per LOCAL day. The wide
+ view; start here.
+- v_metric(date, key, value) — every daily scalar in long form, for keys not in
+ v_daily: rhr, rmssd, sdnn, readiness, strain, trimp, resp_rate, brv_cv,
+ stress, dip_pct, lf_hf, hrv_cv, skin_temp_z, calories, calories_total, steps,
+ nap_min, tst_min, deep_min, rem_min, light_min, efficiency, worn_min, hrr_bpm,
+ irregular_rhythm_flag.
+- v_series(date, series, t, v) — intra-day curves; series ∈ hr_curve,
+ strain_curve, hrv_timeline, hrv_day, resp_day, skin_temp_day, zone_timeline,
+ activity_curve. ALWAYS `WHERE date='YYYY-MM-DD' AND series='…'`. Large.
+- v_hypnogram(date, start_ts, end_ts, stage) — stage ∈ wake|light|deep|rem.
+- v_sessions(id, start_ts, end_ts, date, type, status, calories, strain, max_hr,
+ duration_min, steps, hrr_bpm, source, zone_min_json) — `date` is the LOCAL
+ day; filter on it, never on start_ts, and never convert timestamps yourself.
+- v_baselines(key, value, mean, z, delta, ratio, n, updated_at).
+- v_insights(id, kind, title, body, date, created_at, read).
+Rules: SELECT or WITH…SELECT, one statement, no comments, no quoted identifiers,
+no subqueries in FROM (use WITH). Dates are 'YYYY-MM-DD'; timestamps are epoch
+SECONDS; flags are 1/0. Prefer AVG/MIN/MAX/COUNT + GROUP BY over many rows;
+results cap at 200. If a query is rejected, read the reason and fix it.
-- v_metric(date, key, value) — every daily scalar, long form. Keys include: rhr, rmssd,
- sdnn, readiness, strain, trimp, strain_effort, resp_rate, brv_cv, stress, spo2,
- odi_per_hour, dip_pct, lf_hf, hrv_cv, skin_temp_z, calories, calories_total, steps,
- nap_min, tst_min, deep_min, rem_min, light_min, efficiency, worn_min, hrr_bpm,
- irregular_rhythm_flag. (Use this for arbitrary keys / trends.)
-- v_daily(date, resting_hr, hrv, sdnn, readiness, strain, resp_rate, stress, sleep_efficiency,
- sleep_min, deep_min, rem_min, light_min, nap_min, steps, active_calories, total_calories,
- skin_temp_z, lf_hf, hrv_cv, dip_pct, odi_per_hour, worn_min, hrr_bpm, brv_cv, irregular_flag)
- — one row per day; the convenient wide view for most questions.
-- v_series(date, series, t, v) — intra-day curves. series ∈ hr_curve, strain_curve, hrv_timeline,
- hrv_day, resp_day, skin_temp_day, zone_timeline, activity_curve. t = epoch seconds, v = value.
- ALWAYS filter `WHERE date='YYYY-MM-DD' AND series='…'` (it is large — never SELECT * from it).
-- v_hypnogram(date, start_ts, end_ts, stage) — sleep stage segments (stage: wake|light|deep|rem).
-- v_sessions(id, start_ts, end_ts, date, type, status, calories, strain, max_hr, duration_min,
- steps, hrr_bpm, source, zone_min_json) — workouts (manual/live/auto). `date` is the session's
- LOCAL calendar day ('YYYY-MM-DD') — ALWAYS filter/join sessions on `date`, never by converting
- start_ts/end_ts to a day yourself (you don't know the user's UTC offset; that's exactly how
- "today's workout" used to get mis-dated). "Today's workout" = `WHERE date = ''`.
-- v_baselines(key, value, mean, z, delta, ratio, n, updated_at) — rolling personal baselines.
-- v_insights(id, kind, title, body, date, created_at, read) — the local insight/alert feed.
+Food and medications are NOT in SQL. Use `get_nutrition(date)` and
+`get_medications()`.
-Rules: SELECT (or WITH … SELECT) only, ONE statement, no comments. Every table position — after
-FROM, after JOIN, and every extra member of a comma-separated list — must be one of the v_* views
-above or a CTE you declared in the same statement; nothing else is queryable, including base
-tables, sqlite_master, schema-qualified names ("main.v_daily"), quoted identifiers, table
-functions, and subqueries in FROM (put the subquery in a WITH instead). Subqueries in
-SELECT/WHERE over the views are fine. Dates are 'YYYY-MM-DD', timestamps are epoch SECONDS,
-irregular_flag/irregular_rhythm_flag are 1/0. Prefer aggregates (AVG/MIN/MAX/COUNT, GROUP BY)
-over selecting many rows; results cap at 200 rows. If a query is rejected, read the error and fix
-it. Examples:
- SELECT date, resting_hr, hrv, readiness FROM v_daily ORDER BY date DESC LIMIT 30
- SELECT AVG(strain) FROM v_daily WHERE date >= '2026-06-01'
- SELECT t, v FROM v_series WHERE date='2026-06-29' AND series='hr_curve' ORDER BY t
+# SHOWING DATA
+Three or more numbers over time is a picture, not a paragraph. Build figures
+ONLY from rows you fetched this turn.
+- `plot_chart(type, title, x_labels, series, unit)` — simple bar|line|area.
+ Values are plain numbers (62, not "62 ms"); null ONLY for a real gap.
+- `render(type, title, …)` — the app draws these natively:
+ • line | area | bar | multi_series — {x_labels, series:[{name, values}], unit}
+ • lanes — {series:[{name, values}], …} two or three quantities in DIFFERENT
+ units, each on its own lane with its own scale (e.g. HR against HRV)
+ • hypnogram — {segments:[{start, end, stage}]}, epoch seconds
+ • zone_bar — {zones:[five numbers], title} minutes in HR zones 1–5
+ • gauge — {value, min, max, unit} one bounded number
+ • kpi_grid — {cards:[{label, value, unit, baseline}]} two to four headline numbers
+ • heatmap — {weeks:[[7 numbers, Mon→Sun]], unit} a calendar; null for a day
+ with no data
+ • table — {columns:[…], rows:[[…]]} small, non-time data only
+ Nothing else renders. Do not ask for a scatter, a pie or a sankey.
+- NEVER print a figure as JSON or inside a code fence. It renders as an
+ unreadable grey block. Call the tool.
-# SHOWING DATA — prefer a chart/figure over a Markdown table for multi-point data.
-- plot_chart(type, title, x_labels, series, unit, note): simple bar|line|area. series:[{name,values:number[]}],
- plain numbers (62, not "62 ms"), one per x_label, null only for a real gap. Plot the FULL series.
-- render(type, title, …payload): RICH figures. Pick the type that fits:
- • line/area/bar/multi_series — {x_labels, series:[{name, values}], unit}
- • scatter — {points:[{x,y,label?}], x_label, y_label} (e.g. strain vs next-day recovery)
- • dual_axis — {x_labels, left:{name,values,unit}, right:{name,values,unit}} (e.g. HR vs HRV)
- • stacked_zone_bar — {x_labels, zones:[{name, values}]} (HR-zone minutes per day)
- • hypnogram — {segments:[{start,end,stage}]} (stage∈wake|light|deep|rem, epoch sec)
- • kpi_grid — {cards:[{label, value, unit?, delta?, baseline?, spark?:[numbers]}]}
- • gauge — {value, min?, max?, label?, unit?} (e.g. recovery 0–100)
- • heatmap — {rows:[labels], cols:[labels], values:[[numbers]], unit?}
- • range_band — {label, value, min, max, unit?} (a value against a target band)
- • table — {columns:[…], rows:[[…]]}
- Build figures ONLY from data you fetched via run_sql.
-- NEVER print a chart/figure as raw JSON or inside a ``` code fence in your reply — that renders
- as an ugly grey unreadable block to the user, not a chart. ALWAYS call plot_chart/render instead.
+# WRITING DATA
+Every write below asks the user to confirm first, with a summary of exactly
+what will happen. So: propose one clearly, do not ask "shall I?" first, and
+never chain several writes off one instruction without saying what they are.
+If they decline, do not retry it.
+- `log_food(meal, label, …)` — meal ∈ breakfast|lunch|dinner|snack. Every
+ nutrient is optional and MUST be omitted unless the user gave it or described
+ a label you are reading back to them. A logged meal with no calories is a
+ correct log; a guessed calorie count is a fabricated measurement. Portions:
+ quantity + unit ('g','ml','piece'). Repeat their words in `label`.
+- `log_journal_fields(fields, date, time)` — THE place for water and mood.
+ Keys: mood, sleep_quality, energy, stress, soreness (1–5); water_ml,
+ caffeine_mg, alcohol_units, screens_min, weight_kg. `time` only matters for
+ caffeine and alcohol. Fields you omit keep their existing value. "I drank a
+ litre" → {"water_ml": 1000}. Never score or praise hydration.
+- `add_completed_workout(start_time, duration_min, type, date)` — for a workout
+ that already happened. `start_workout`/`end_workout` are only for one
+ happening right now.
+- `add_medication(name, time, weekdays, …)` — weekdays 1=Mon…7=Sun; pass them
+ whenever it is not daily. `mark_medication(name, state)` — taken | skipped |
+ not_taken; skipped means they chose not to, and is not the same as a miss.
+ This app has NO interaction checking. Never imply otherwise, never advise on
+ a dose, never suggest starting or stopping anything.
+- `log_journal(date, tags, note)` — free text and tags. `log_period(date)`.
+ `set_step_goal(goal)`.
-Action tools — the app ASKS THE USER TO CONFIRM before any write. Only when clearly requested:
-- log_journal(date, tags, note), log_period(date), start_workout(type), end_workout(workout_id),
- set_step_goal(goal).
-
-# OUTPUT FORMAT (strict — the app renders Markdown)
-- Be CONCISE. Lead with the direct answer in 1–2 sentences, then brief support.
-- For ANY multi-day / time-series / comparison, call plot_chart or render INSTEAD of a big table.
- Use a small Markdown table only for ≤4 rows of non-time data.
-- Bold the key numbers. Cite the metric and day/period ("**62 ms** last night vs your **71 ms** baseline").
-- Keep structure light: at most ONE short "##" heading; do NOT use horizontal rules (---) or
- stacks of headings. Bullets ("- ") are fine.
-- Emoji: use real Unicode sparingly (✅ ⚠️). NEVER colon shortcodes like ":warning:".
-- End with ONE line "Not medical advice." ONLY when you gave health guidance — not every message.
-
-# Honesty (non-negotiable)
-Never fabricate. Missing data → say so and show "—". Respect honest scope (sleep stages = beta;
-skin-temp/SpO₂ relative; HRV needs enough nights). You are not a doctor.
-
-# Style
-Warm, sharp, evidence-based. Answer → why → (optional) chart → one concrete suggestion.
+# STYLE
+Lead with the answer in one or two sentences. Bold the numbers that matter and
+say what they are relative to ("**62 ms**, against your **71 ms** baseline").
+At most one "##" heading; no horizontal rules; bullets are fine. Real emoji,
+rarely. Warm, specific, unhurried — and short. A four-line answer that is right
+beats a page that hedges.
''';
diff --git a/lib/compute/background_derivation.dart b/lib/compute/background_derivation.dart
index f3f3b3cd..e1b70fd5 100644
--- a/lib/compute/background_derivation.dart
+++ b/lib/compute/background_derivation.dart
@@ -5,9 +5,14 @@
// AppState._afterDrain. THIS file is the SCHEDULED heavy pass (full sleep
// staging + 24-h spectra over every stale day).
//
-// Android: a real OS-scheduled WorkManager periodic job (constrained to when
-// charging + idle is preferred). WorkManager genuinely runs us in a
-// background isolate even when the app is killed.
+// Android: two real OS-scheduled WorkManager periodic jobs (sync + heavy
+// derive), requested every 10 min and clamped by Android to 15, with
+// NO constraints — see `init`: `requiresCharging: false`,
+// `requiresBatteryNotLow: false`, no network, no device-idle. They
+// run whatever the battery is doing. (This block used to claim
+// "constrained to when charging + idle is preferred"; nothing in the
+// registration ever asked for that.) WorkManager genuinely runs us in
+// a background isolate even when the app is killed.
//
// iOS: HONEST CAVEAT — heavy compute on iOS is NOT guaranteed.
// BackgroundTasks.swift registers "wtf.openstrap.edge.bgsync" as a
diff --git a/lib/compute/crossday_pipeline.dart b/lib/compute/crossday_pipeline.dart
index b72d92cc..cf17ed81 100644
--- a/lib/compute/crossday_pipeline.dart
+++ b/lib/compute/crossday_pipeline.dart
@@ -18,9 +18,11 @@ import 'dart:math' as math;
import 'package:openstrap_analytics/onehz.dart' as ana;
-// Pure value helper — the shared sex normalisation, so this pipeline agrees
-// with day derivation about what a stored profile means.
-import 'profile.dart' show workoutSex;
+// Pure string helper only (the `need_input:name=…` note grammar) — no DB, no
+// IO, no Flutter binding, so importing it does not compromise this file's
+// isolate safety. One grammar for "a required input was missing" across both
+// pipelines rather than a second one here.
+import 'onehz_pipeline.dart' show needInputNote;
/// Build the cross-day analytics bundle from a time-ordered (OLDEST FIRST) list
/// of per-day records and the user profile.
@@ -34,10 +36,21 @@ import 'profile.dart' show workoutSex;
/// Returns a JSON-safe map of the latest/aggregate cross-day results. Every
/// absent family serializes its honest `Metric.absent` envelope (value "—",
/// confidence 0) or null — never a fabricated number.
+/// [cycleStartDates] are the user's own logged cycle-start days (`YYYY-MM-DD`,
+/// any order). They are a CALENDAR log, never a detection: everything derived
+/// from them says "the second half of your logged cycle", never "your luteal
+/// phase". Empty ⇒ every cycle-aware family behaves exactly as it did before.
+///
+/// [sessionTypesByDate] maps a day label to every SAVED session that started
+/// that day (TS-11). A day with more than one is dropped by the analytics, not
+/// split — it belongs to no single type. Empty ⇒ `session_cost` is absent,
+/// which is also its state for the first ten sessions of any type.
Map buildCrossDayBundle(
List> daysOldestFirst,
- Map profile,
-) {
+ Map profile, {
+ List cycleStartDates = const [],
+ Map> sessionTypesByDate = const {},
+}) {
final days = daysOldestFirst;
final n = days.length;
@@ -95,9 +108,16 @@ Map buildCrossDayBundle(
final load = ana.ctlAtlTsb(dailyTrimp);
// ── skin-temp illness flag (Smarr, cycle-aware) ────────────────────────────
+ // WH-01 — the `luteal` argument was written, typed and never passed, so the
+ // `lutealConfound` branch has never once executed and the flag has been
+ // crying "elevated" for the two weeks a month when a sustained rise is the
+ // most ordinary thing in the world. It ANNOTATES, never silences: the day
+ // exception still fires, with the confound named. Suppressing a real illness
+ // is worse than the false alarm.
+ final luteal = _lutealFlags(dates, cycleStartDates);
final tempIllness = ana.tempIllnessFlag(dates, [
for (var i = 0; i < n; i++) settled(i, tempList[i]),
- ]);
+ ], luteal: luteal);
// ── circadian: mid-sleep, free/work split, jetlag, chronotype, sleep debt ──
// mid-sleep epoch = (onset+wake)/2; local clock-hours in [0,24) via mod-day.
@@ -145,10 +165,13 @@ Map buildCrossDayBundle(
final sleepDebt = ana.sleepDebt(recentDurH, freeDurH);
// ── percentile-of-you for today vs history (history = all-but-last) ────────
+ // rhr is LOWER-is-better — the same orientation `_glassInput` ten lines below
+ // has always passed for this exact list. Unoriented, a night with the user's
+ // lowest resting HR in a month came back labelled "among your worst".
final percentiles = {
- 'rmssd': _pctOfYou(rmssdList),
- 'rhr': _pctOfYou(rhrList),
- 'readiness': _pctOfYou(readyList),
+ 'rmssd': _pctOfYou(rmssdList, ana.Better.higher),
+ 'rhr': _pctOfYou(rhrList, ana.Better.lower),
+ 'readiness': _pctOfYou(readyList, ana.Better.higher),
};
// ── glass-box readiness from today's value + history per input ─────────────
@@ -186,18 +209,106 @@ Map buildCrossDayBundle(
// ── true Phillips SRI across days on a 1440-epoch (1-min) clock grid ───────
final sri = _crossDaySri(days);
+ // SLP-08 — which two nights. `SriPair.dayIndex` indexes THIS day list and
+ // nothing else (the analytics never sees a date), so here is the only place
+ // it can be resolved into the two nights it compared. Pairs the mask left too
+ // thin were already dropped upstream, so a half-unobserved weekend cannot top
+ // the list for having no data.
+ //
+ // It is arithmetic, not a verdict: a decomposition of a number already on
+ // screen. It does not license telling anyone their weekend is harming them.
+ final sriJson = sri.toJson((v) => v.toJson());
+ final sriValue = sriJson['value'];
+ if (sriValue is Map) {
+ for (final p in ((sriValue['pairs'] as List?) ?? const []).whereType