diff --git a/docs/isgen5-inventory.md b/docs/isgen5-inventory.md
new file mode 100644
index 00000000..f0e5d40f
--- /dev/null
+++ b/docs/isgen5-inventory.md
@@ -0,0 +1,122 @@
+# `isGen5` inventory — DATA vs BEHAVIOUR
+
+Every band-specific branch in `lib/ble/ble_engine.dart`, classified — and, as
+of the D4/D9 wave, **the DATA half is done**: it lives in `BandEntry` /
+`BandWireCommands` in `lib/ble/adapters/_registry.dart` and the code around it
+is unconditional.
+
+Line numbers are against `ble_engine.dart` at **6,854 lines** (post-split).
+Re-derive them before acting — this file rots, and the previous revision's
+numbers had drifted by +21 to +23 while claiming 30 occurrences when there
+were 44.
+
+**DATA** — the branch chooses a *value*: an opcode, a payload, a delay, an
+offset, a flag. It belongs in the registry entry; the code around it becomes
+unconditional.
+
+**BEHAVIOUR** — the branch chooses a *different sequence of operations*: an
+extra handshake step, a different decoder, a different failure policy. It
+belongs in an adapter — except there is no adapter to put it in: the
+`run(BandLink)` move was DECLINED (ASSUMPTIONS G1–G4), so behaviour stays in
+the engine, deliberately, and this file no longer pretends otherwise.
+
+**Counts, re-derived: 21 lines mention `isGen5`, from 44.** The unit is a LINE
+matching `isGen5` and not matching `isGen5Clock` — `grep -c isGen5` reports 24
+here and 47 on main, and the three-line difference either end is `isGen5Clock`,
+which is not a band branch at all (last section). The previous revision counted
+one number each way and the breakdown could not add up.
+
+Sixteen logical sites moved to the table. The 21 that are left:
+
+| Lines | What |
+|---|---|
+| 11 | 9 BEHAVIOUR sites (one of the eleven is a comment) |
+| 4 | already-table-driven policy arguments |
+| 2 | the `final isGen5 = …` locals that feed two of those arguments |
+| 4 | log strings — 2 sites, a declaration and a use each |
+
+---
+
+## MOVED — the table (16 sites)
+
+Every value is transcribed verbatim from the arm it replaced and pinned in
+`test/band_registry_test.dart` ("the gen4/gen5 arm of every branch that moved").
+
+| Line | Site | Field it reads now | gen4 → gen5 |
+|---|---|---|---|
+| 2135 | pre-registration pause | `BandEntry.preRegistrationDelay` | `Duration.zero` → 600 ms |
+| 2333 | post-registration pause | `BandEntry.postRegistrationDelay` | `Duration.zero` → 500 ms |
+| 2446 | `_bootstrapSetClock` | `BandEntry.setClockDriftGated` | `false` → `true` |
+| 2585 | keep-alive live re-arm | `BandWireCommands.r10R11Realtime` | `0x3F` → `null` |
+| 3234 | `_offloadPayload` | `BandWireCommands.offloadBody` | `[0x00]` → `[]` |
+| 3467 | console-log line | `BandEntry.logsConsoleOutput` | `false` → `true` |
+| 4610 | `gateEnforced` | `BandEntry.burstCountGateEnforced` | `false` → `true` |
+| 5863 | `getStrapName` | `getAdvertisingName` + `…Body` | Harvard/`[0x00]` → custom/`[rev1]` |
+| 5877 | `setStrapName` | `setAdvertisingName` | Harvard → custom (body shared) |
+| 5888 | `getHello` | `hello` + `helloBody` | Harvard/`[0x00]` → `0x91`/`[0x01]` |
+| 5929 | `enableLiveStreams` R10/R11 | `r10R11Realtime` | send → omit |
+| 5943 | `enableLiveStreams` optical | `opticalDataIsLiveToggle` | `true` → `false` |
+| 5948 | `enableLiveStreams` log | `opticalDataIsLiveToggle` | string unchanged |
+| 5981 | `enableHrOnlyLive` | `r10R11Realtime` | send → omit |
+| 5999 | `disableLiveStreams` | `r10R11Realtime` | send → omit |
+| — | the two delays themselves | `kGen5Pre/PostRegistrationDelay` | moved out of `BleEngine` into `_registry.dart`; one copy, not two |
+
+**Two of these are the rows marked DO NOT UNIFY, and they still are.**
+`setClockDriftGated` and `burstCountGateEnforced` are `false` on WHOOP 4 because
+its unconditional SET_CLOCK is the proven flow and an enforced burst gate on a
+band whose count semantics nothing has pinned is a permanent stall (15 failures
+→ abort → Stuck). Moving a flag is not flipping it; both comments travelled with
+the field and are repeated on the field's own doc.
+
+## BEHAVIOUR — stays in the engine (9 sites, 11 lines)
+
+| Line | Site | What actually differs |
+|---|---|---|
+| 2363 | `_readGen5Hello()` in `_bootstrapAfterRegistration` | An extra handshake round-trip with its own link-death abort, ordered before the clock read. |
+| 2469 | `_readAdvertisingNameGen5` | A gen5-only setup command with its own "not a readiness gate" failure semantics. |
+| 2496 | `_maybeStartBatteryPackFollowUp` | A gen5-only background task with its own retry schedule and once-per-session latch. |
+| 3635–3674 | historical record dispatch | `decodeGen5HistoricalSample` vs the gen4 version-routed chain, and which kinds fall through to `raw_archive`. |
+| 5134 | `enableGen5DeepBuffers` | A gen5-only multi-frame `SET_FF_VALUE` sequence behind the one audited `allowDangerous: true`. |
+| 5160 | `sendInit` | Two INIT state machines in one method. Biggest single item — **and it writes host connection-priority state**: its `finally` clears `_connectSetup`, and a throw above that clear leaves the link pinned at setup priority for the whole connection with `_applyLinkPriority` early-returning forever. That is host state; it does not become data. |
+| 5734 | `setAlarm` pre-arm | gen5 issues SET_CLOCK + a 120 ms settle before arming. A sequence, not a payload. |
+| 5833 | `runAlarm` | Opcode swap **plus a computed body** — see below. |
+| 5898 | `buzzPattern` | Opcode swap **plus a computed body** — see below. |
+
+## NOT MOVED, and why — the honest boundary
+
+**`runAlarm` (5833) and `buzzPattern` (5898) — DATA that a `const` table cannot
+hold.** Both pick opcode *and* body. gen5's body is
+`AlarmPayloads.gen5MaverickBuzz()`, a computed list; `kWhoopGen4`/`kWhoopGen5`
+are `const`, so a field could only hold the twelve bytes transcribed into a
+second place — which is exactly the duplication a named constant exists to
+prevent. Moving the opcode alone would leave the body branch anyway, so both
+stay whole.
+
+**The four `AlarmPayloads` discriminators (5756, 5819, 5852, and `setAlarm`'s
+own 5733) are already table-driven.** They are not branches in the engine; they
+are one named ARGUMENT to a pure policy in `ble_state.dart` that already selects
+by band. Widening `isGen5:` to take the entry moves no decision, and that file is
+owned elsewhere. Left alone.
+
+**Two sites, four lines, are log text only** — 5353/5364 (`SET_CLOCK (gen5)`)
+and 5764/5768 (the alarm log), each a `final isGen5 = …` and its use. The
+live-stream log used to be a third and is keyed off `opticalDataIsLiveToggle`
+now, so it reads `isGen5` no more. Changing any of them changes a user-visible
+log line with no wire meaning.
+
+**`_maybeAugmentClockEpoch` (6206/6207/6223) is NOT a band branch — the previous
+revision got this wrong.** It reads `op == Cmd.getClockGen5` on the *received*
+response, not `session.band`, and edge sends `Cmd.getClock` (11) on both bands.
+It mirrors protocol's own `control.dart:928` (`op == Cmd.getClockGen5 ? 3 : 2`).
+Keying the offset off the session band would change behaviour for a `147` reply
+on either link and would diverge from the parse it exists to patch. Left as is,
+and it is why the count above excludes `isGen5Clock` at both ends: three lines
+here, three on main, and neither number is about the band.
+
+## What this wave actually cost
+
+One new type (`BandWireCommands`, eight fields), five new `BandEntry` fields,
+two constants relocated. No new mechanism, no capability booleans about our own
+features, no command DSL: `r10R11Realtime` being `null` is an ABSENT COMMAND,
+not a `supportsX()` claim, and it is the only field that decides whether
+something happens rather than what gets sent.
diff --git a/ios/Runner/AccessorySetup.swift b/ios/Runner/AccessorySetup.swift
index ee7c0a86..c68a4a14 100644
--- a/ios/Runner/AccessorySetup.swift
+++ b/ios/Runner/AccessorySetup.swift
@@ -7,11 +7,19 @@ import AccessorySetupKit
 
 /// AccessorySetupKit (ASK) bridge — iOS 18+ only.
 ///
-/// WHY: per Apple TN3115, starting in iOS 26 the OS only relaunches a *terminated* app
-/// into the background for a Bluetooth accessory that was provisioned via ASK. Our
-/// CoreBluetooth state-restoration central (BleRestoreManager) still does the actual
-/// relaunch/pending-connect work, but iOS 26 will only honour it if the peripheral was
-/// set up through the ASK picker. So pairing on iOS 18+ goes through this picker.
+/// WHY: TN3115's relaunch table has two rows that are "No" without ASK and "Yes" with it —
+/// "App Force Quit by the user" and "Control Center Bluetooth button toggled". Note 5:
+/// "Starting in iOS 26 and iPadOS 26, only apps that use AccessorySetupKit to setup
+/// Bluetooth accessories will be relaunched." Apple DTS has since clarified on the forums
+/// that note 5 scopes to *those two rows only* — it is a capability apps GAIN, not one they
+/// lose, and the ordinary relaunch cases (app removed from memory, crashed, device
+/// restarted) never depended on ASK. The condition is also stated per-APP, not
+/// per-accessory; the relaunch itself still fires "if and only if" a pending Core Bluetooth
+/// request completes, which is what BleRestoreManager holds.
+///
+/// So the load-bearing reason to route pairing through the picker is simpler than
+/// "otherwise no background sync": on iOS 18+ this picker IS how a user grants us the
+/// accessory, plus those two extra relaunch cases.
 ///
 /// COEXISTENCE: ASK is a provisioning/authorization gate, NOT a connection owner. It hands
 /// back `ASAccessory.bluetoothIdentifier` — the CoreBluetooth peripheral UUID, which is the
@@ -21,18 +29,17 @@ import AccessorySetupKit
 ///
 /// Dart MethodChannel `openstrap/accessory_setup`:
 ///   - `isSupported`        -> Bool   (true only on iOS 18+)
-///   - `provisionedId`      -> String?(uppercased UUID of an already-provisioned WHOOP, or nil)
-///   - `showPicker`         -> String (the provisioned band's UUID; throws on cancel/error)
+///   - `provisionedId`      -> String?(uppercased UUID of an already-provisioned band, or nil)
+///   - `showPicker`         -> String (the band provisioned by THIS call; throws on cancel/error)
+///                             optional Bool argument: true = add another accessory
 ///   - `removeAll`          -> nil    (deprovision all — used on unpair)
+///
+/// The service UUIDs the picker matches on are NOT duplicated here: they come from
+/// Info.plist's NSAccessorySetupBluetoothServices, which Apple requires to list every
+/// descriptor criterion anyway, and which is generated from `kBandRegistry` by
+/// `tool/gen_ios_ask_plist.dart`.
 enum AccessorySetup {
   private static let channelName = "openstrap/accessory_setup"
-  // WHOOP GATT service UUIDs, one per generation (match GattProfile in Dart).
-  // `fileprivate` so the iOS-18 Impl below can read them. BOTH must also be
-  // listed in Info.plist under NSAccessorySetupBluetoothServices.
-  //   • gen4 ("Harvard", WHOOP 4)  — 6108…
-  //   • gen5 ("fd4b", WHOOP 5)     — fd4b…  (EXPERIMENTAL)
-  fileprivate static let whoopServiceUUIDGen4 = "61080001-8d6d-82b8-614a-1c8cb0f8dcc6"
-  fileprivate static let whoopServiceUUIDGen5 = "fd4b0001-cce1-4033-93ce-002d5875f58a"
 
   static func register(messenger: FlutterBinaryMessenger) {
     let channel = FlutterMethodChannel(name: channelName, binaryMessenger: messenger)
@@ -43,14 +50,19 @@ enum AccessorySetup {
 
       case "provisionedId":
         if #available(iOS 18.0, *) {
-          Impl.shared.provisionedId { result($0) }
+          // ponytail: the channel still hands Dart ONE id because the Dart side is
+          // still two SharedPreferences scalars (change-list E3). Swift holds the
+          // whole array; widen this to a list when the device table lands.
+          Impl.shared.provisionedIds { result($0.first) }
         } else {
           result(nil)
         }
 
       case "showPicker":
         if #available(iOS 18.0, *) {
-          Impl.shared.showPicker { res in
+          // No argument (today's only caller) = today's behaviour exactly.
+          let addAnother = (call.arguments as? Bool) ?? false
+          Impl.shared.showPicker(addAnother: addAnother) { res in
             switch res {
             case .success(let id): result(id)
             case .failure(let err):
@@ -114,28 +126,44 @@ private final class Impl {
     }
   }
 
-  /// Returns the uppercased UUID of an already-provisioned WHOOP, or nil.
-  func provisionedId(_ completion: @escaping (String?) -> Void) {
+  /// Every provisioned accessory's uppercased CoreBluetooth UUID, in session order.
+  /// `session.accessories` is an ARRAY — one entry per accessory the user has granted.
+  private var provisionedIdList: [String] {
+    session.accessories.compactMap { $0.bluetoothIdentifier?.uuidString.uppercased() }
+  }
+
+  /// Returns the uppercased UUIDs of the already-provisioned accessories (possibly empty).
+  func provisionedIds(_ completion: @escaping ([String]) -> Void) {
     ensureActivated()
     // `accessories` is reliable only after activation has reported .activated; give the
     // session a brief beat to populate on a cold start, then read it.
     queue.asyncAfter(deadline: .now() + 0.2) { [weak self] in
-      guard let self = self else { completion(nil); return }
-      let id = self.session.accessories
-        .compactMap { $0.bluetoothIdentifier }
-        .first?
-        .uuidString
-        .uppercased()
-      completion(id)
+      guard let self = self else { completion([]); return }
+      completion(self.provisionedIdList)
     }
   }
 
-  func showPicker(_ completion: @escaping (Result<String, PickerError>) -> Void) {
+  /// - Parameter addAnother: show the picker even though an accessory is already
+  ///   provisioned, i.e. provision a SECOND band. See the ordering warning below.
+  func showPicker(addAnother: Bool = false,
+                  _ completion: @escaping (Result<String, PickerError>) -> Void) {
     ensureActivated()
-    // Already provisioned? Don't re-show the picker — just return the known id.
-    if let existing = session.accessories
-      .compactMap({ $0.bluetoothIdentifier })
-      .first?.uuidString.uppercased() {
+    let known = provisionedIdList
+    // Already provisioned and not explicitly adding another? Don't re-show the picker —
+    // just return the known id.
+    //
+    // ORDERING (do not "fix" this into an unconditional showPicker): ASK's picker fails
+    // with "CBManager is active with global permissions" once ANY CBCentralManager exists
+    // in the process, and BleRestoreManager creates one at launch on every already-paired
+    // launch. So this early return is also what keeps a repeat "pair" tap from turning
+    // into a guaranteed picker failure.
+    //
+    // ponytail: `addAnother` is therefore plumbing, not a working second-band flow — a
+    // second accessory can only be provisioned while no central is alive (fresh install,
+    // or after unpair, which releases the restore central via BleRestoreManager.disarm).
+    // A real "add a band" flow has to tear both centrals down first; that belongs with
+    // the device table (change-list E3/E4), not here.
+    if !addAnother, let existing = known.first {
       completion(.success(existing))
       return
     }
@@ -149,10 +177,15 @@ private final class Impl {
     // require an NSAccessorySetupBluetoothNames entry and risk excluding the band
     // on a name mismatch.)
     //
-    // ASK matches ANY item in the picker list, so we offer one item per WHOOP
-    // generation: gen4 (WHOOP 4) and gen5 (WHOOP 5, experimental). A band that
-    // advertises either service can be provisioned; the provisioned identifier is
-    // the same CoreBluetooth UUID regardless of generation.
+    // ASK matches ANY item in the picker list, so we offer one item per band in the
+    // registry. A band advertising any listed service can be provisioned; the
+    // provisioned identifier is the same CoreBluetooth UUID whichever it is.
+    //
+    // The list comes straight from Info.plist rather than a Swift copy: Apple requires
+    // every descriptor criterion to be declared there, so that array is by definition
+    // the complete set — a second copy here could only ever be the stale one. It is
+    // generated from kBandRegistry (tool/gen_ios_ask_plist.dart, pinned by
+    // test/ios_ask_plist_test.dart), so adding a band stays a one-file edit in Dart.
     let productImage = UIImage(named: "StrapProduct")
       ?? UIImage(systemName: "sensor.tag.radiowave.forward")
       ?? UIImage()
@@ -162,10 +195,15 @@ private final class Impl {
       return ASPickerDisplayItem(
         name: name, productImage: productImage, descriptor: descriptor)
     }
-    let items = [
-      item(AccessorySetup.whoopServiceUUIDGen4, "WHOOP band"),
-      item(AccessorySetup.whoopServiceUUIDGen5, "WHOOP 5 band"),
-    ]
+    let info = Bundle.main.infoDictionary ?? [:]
+    let services = info["NSAccessorySetupBluetoothServices"] as? [String] ?? []
+    let labels = info["OSBandLabels"] as? [String: String] ?? [:]
+    let items = services.map { item($0, labels[$0.uppercased()] ?? "Band") }
+    guard !items.isEmpty else {
+      completion(.failure(PickerError(
+        message: "No accessory services are declared in Info.plist.")))
+      return
+    }
 
     pickerResult = completion
     session.showPicker(for: items) { [weak self] error in
@@ -177,10 +215,13 @@ private final class Impl {
         }
         return
       }
-      // Picker succeeded — read the newly provisioned accessory's identifier.
-      let id = self.session.accessories
-        .compactMap { $0.bluetoothIdentifier }
-        .first?.uuidString.uppercased()
+      // Picker succeeded — return the accessory THIS run added, not `accessories.first`:
+      // once a second band is provisioned the first entry is the OLD one, so `.first`
+      // would hand Dart the wrong device to connect to. (With none previously known —
+      // every pairing today — the added one IS the first, so this is unchanged.)
+      let current = self.provisionedIdList
+      let knownSet = Set(known)
+      let id = current.first { !knownSet.contains($0) } ?? current.first
       if let cb = self.pickerResult {
         self.pickerResult = nil
         if let id = id {
diff --git a/ios/Runner/BleRestoreManager.swift b/ios/Runner/BleRestoreManager.swift
index 7634ae10..82db4233 100644
--- a/ios/Runner/BleRestoreManager.swift
+++ b/ios/Runner/BleRestoreManager.swift
@@ -47,7 +47,12 @@ class BleRestoreManager: NSObject {
 
   private var central: CBCentralManager?
   private var bandUUID: UUID?
-  private var pending: CBPeripheral?        // retained so ARC doesn't drop it mid-connect
+  // Peripherals we hold a pending connect for, retained so ARC doesn't drop them
+  // mid-connect. An array because willRestoreState hands back an array: dropping all but
+  // the first loses the retain on the rest, and a peripheral we no longer hold is one
+  // cancelPending can no longer cancel — so the two centrals would fight over it when the
+  // app reclaims the band. With one provisioned band there is exactly one entry.
+  private var pending: [CBPeripheral] = []
   private var channel: FlutterMethodChannel?
   private var flutterReady = false
   private var wakeQueuedBeforeReady = false
@@ -239,14 +244,14 @@ class BleRestoreManager: NSObject {
       NSLog("[ble-restore] band not retrievable yet")
       return
     }
-    pending = p
+    pending = [p]
     central.connect(p, options: nil)  // no timeout → persists, relaunches us when reachable
     NSLog("[ble-restore] armed pending connect")
   }
 
   private func cancelPending() {
-    if let p = pending { central?.cancelPeripheralConnection(p) }
-    pending = nil
+    for p in pending { central?.cancelPeripheralConnection(p) }
+    pending = []
   }
 
   private func disarm() {
@@ -327,12 +332,13 @@ extension BleRestoreManager: CBCentralManagerDelegate {
   }
 
   func centralManager(_ central: CBCentralManager, willRestoreState dict: [String: Any]) {
-    if let restored = dict[CBCentralManagerRestoredStatePeripheralsKey] as? [CBPeripheral],
-       let p = restored.first {
-      pending = p
-      NSLog("[ble-restore] willRestoreState restored \(restored.count) peripheral(s)")
-      // The pending/active connect was preserved; didConnect fires if it lands.
-    }
+    let restored = dict[CBCentralManagerRestoredStatePeripheralsKey] as? [CBPeripheral] ?? []
+    guard !restored.isEmpty else { return }
+    // Take ALL of them, not just the first — the count was already being logged, so the
+    // code always knew there could be more. Each carries a pending/active connect
+    // bluetoothd preserved for us; didConnect fires per peripheral if one lands.
+    pending = restored
+    NSLog("[ble-restore] willRestoreState restored \(restored.count) peripheral(s)")
   }
 
   func centralManager(_ central: CBCentralManager, didConnect peripheral: CBPeripheral) {
diff --git a/ios/Runner/Info.plist b/ios/Runner/Info.plist
index 338d3723..bf050401 100644
--- a/ios/Runner/Info.plist
+++ b/ios/Runner/Info.plist
@@ -51,6 +51,11 @@
 	<string>$(FLUTTER_BUILD_NUMBER)</string>
 	<key>LSRequiresIPhoneOS</key>
 	<true/>
+	<!-- GENERATED from lib/ble/adapters/_registry.dart — do not hand-edit.
+	     `dart run tool/gen_ios_ask_plist.dart` rewrites this array and the
+	     OSBandLabels dict below; test/ios_ask_plist_test.dart fails CI if
+	     they drift. On iOS 18+ the ASK picker is the pairing path, so a band
+	     missing here cannot be paired on iPhone at all. -->
 	<key>NSAccessorySetupBluetoothServices</key>
 	<array>
 		<string>61080001-8D6D-82B8-614A-1C8CB0F8DCC6</string>
@@ -62,6 +67,15 @@
 	</array>
 	<key>NSBluetoothAlwaysUsageDescription</key>
 	<string>OpenStrap connects to your WHOOP band over Bluetooth to sync your health data.</string>
+	<!-- GENERATED (see above): service UUID -> ASK picker row label. Cosmetic
+	     only; AccessorySetup.swift falls back to a generic name. -->
+	<key>OSBandLabels</key>
+	<dict>
+		<key>61080001-8D6D-82B8-614A-1C8CB0F8DCC6</key>
+		<string>WHOOP 4</string>
+		<key>FD4B0001-CCE1-4033-93CE-002D5875F58A</key>
+		<string>WHOOP 5</string>
+	</dict>
 	<!-- The automatic-backup folder lives in the app's Documents directory.
 	     Without BOTH of these it exists but is invisible in Files, so nothing
 	     the user might sync it with (iCloud Drive, Nextcloud, a cable) can
diff --git a/lib/ai/briefing_engine.dart b/lib/ai/briefing_engine.dart
index 47cc37b1..89ba5f78 100644
--- a/lib/ai/briefing_engine.dart
+++ b/lib/ai/briefing_engine.dart
@@ -11,11 +11,17 @@
 // absent from the store is absent from the prompt — the system prompt forbids
 // the model from mentioning anything it wasn't given, and the breakdown screen
 // shows exactly the inputs snapshot so the user can see what the model saw.
+//
+// Omission alone is NOT that contract, though, which is what [kWithheldKey]
+// exists for. See its doc: silence about a refused metric leaves the model free
+// to narrate the thing it measures out of whatever else it was handed, and this
+// file already documents that happening (see [readinessBand]).
 
 import '../coach/coach_config.dart';
 import '../coach/coach_engine.dart';
 import '../data/day_label.dart';
 import '../data/local_repository.dart';
+import '../models/metric.dart' show whyFromNote;
 import '../ui2/screens/home_screen.dart' as ring show readinessBand;
 import 'briefing.dart';
 import 'nightly_sweep.dart';
@@ -51,6 +57,30 @@ void _put(Map<String, dynamic> out, String key, num? v, {int? round}) {
       : num.parse(v.toStringAsFixed(round)); // keep ints as ints
 }
 
+/// Reserved key in the inputs snapshot: the metrics this briefing ASKED FOR and
+/// did not get, each with the reason the store gave, where it gave one.
+///
+/// WHY THIS IS NOT JUST OMISSION. Every refused metric is already dropped from
+/// the payload — `Metric.value` arrives as null (or the store's `'—'`
+/// placeholder), `_metricNum` returns null and `_put` skips the key. That much
+/// was always right and is unchanged. What omission cannot do is stop the model
+/// narrating the refused thing anyway out of what it WAS given: [readinessBand]
+/// below exists because a model handed HRV and RHR free-associates a recovery
+/// verdict from them, and when readiness is refused there is no score left to
+/// contradict it. A silence is the one input shape the model will fill in.
+///
+/// So the refusal is stated, not hidden. The notes are machine-readable
+/// precisely so this is possible — [whyFromNote] is the same parser the metric
+/// cards use, and it returns null rather than inventing a cause for a token
+/// nobody has written a sentence for, which is why an entry here may be a bare
+/// key name.
+///
+/// MORNING ONLY. The evening pass is the nightly sweep, which ships findings and
+/// nothing else; a list of what was refused is the day read back, which is the
+/// exact failure `sweepInputs` exists to prevent, and a non-empty map there
+/// would call a model on nights that should call none.
+const String kWithheldKey = 'withheld';
+
 /// Read-only snapshot of what the store knows for [period]. Only fields that
 /// exist end up in the map — the prompt builder and the "based on" UI both walk
 /// this map, so what the model saw and what the user sees are the same thing.
@@ -62,42 +92,74 @@ Future<Map<String, dynamic>> collectBriefingInputs(
   final t = await repo.getToday();
   final daily = _map(t['daily']) ?? const {};
   final out = <String, dynamic>{};
+  final withheld = <String>[];
+
+  /// Take the metric's value, or record the refusal. [env] is either a metric
+  /// envelope (`{value, note, …}`) or a bare number; only an envelope can say
+  /// why, and a bare absence is named without one rather than given a guess.
+  void take(String key, dynamic env, {int? round}) {
+    final v = _metricNum(env);
+    if (v != null && v.isFinite) {
+      _put(out, key, v, round: round);
+      return;
+    }
+    final why = whyFromNote(_map(env)?['note'] as String?);
+    withheld.add(why == null ? key : '$key ($why)');
+  }
 
   if (period == BriefingPeriod.morning) {
-    _put(out, 'readiness', _metricNum(daily['readiness']), round: 0);
-    _put(out, 'resting_hr', _metricNum(daily['resting_hr']), round: 0);
+    take('readiness', daily['readiness'], round: 0);
+    take('resting_hr', daily['resting_hr'], round: 0);
     final hrv = _map(t['hrv']);
-    _put(out, 'hrv_rmssd', _num(hrv?['rmssd']), round: 1);
+    take('hrv_rmssd', hrv?['rmssd'], round: 1);
 
     // The overnight bundle Today is showing (may be yesterday's sleep if this
     // day hasn't derived yet) — same source of truth as the Sleep screen.
     final status = _map(t['status']);
     final sleepDay =
         (status?['overnight_day'] as String?) ?? todayLabel(now);
+    Map<String, dynamic>? ds;
     try {
-      final ds = await repo.getDaySleep(sleepDay);
-      if (ds['has_sleep'] == true || _num(ds['duration_min']) != null) {
-        _put(out, 'sleep_min', _num(ds['duration_min']), round: 0);
-        final eff = _num(ds['efficiency']);
-        _put(out, 'sleep_efficiency_pct',
-            eff == null ? null : (eff <= 1 ? eff * 100 : eff),
-            round: 0);
-        _put(out, 'sleep_debt_min', _num(ds['debt_min']), round: 0);
-        _put(out, 'deep_min', _num(ds['deep_min']), round: 0);
-        _put(out, 'rem_min', _num(ds['rem_min']), round: 0);
-        _put(out, 'awake_min', _num(ds['awake_min']), round: 0);
-        final onset = _num(ds['onset_ts'])?.toInt();
-        final wake = _num(ds['wake_ts'])?.toInt();
-        if (onset != null && onset > 0) {
-          out['bedtime'] = _hhmm(
-              DateTime.fromMillisecondsSinceEpoch(onset * 1000));
-        }
-        if (wake != null && wake > 0) {
-          out['wake_time'] =
-              _hhmm(DateTime.fromMillisecondsSinceEpoch(wake * 1000));
-        }
+      final read = await repo.getDaySleep(sleepDay);
+      if (read['has_sleep'] == true || _num(read['duration_min']) != null) {
+        ds = read;
       }
     } catch (_) {/* sleep detail absent → morning runs on the daily scalars */}
+    if (ds == null) {
+      // One refusal for the whole night, not five for its parts: there is no
+      // night, so no per-field gate ever ran and none of them has a reason.
+      withheld.add('sleep (no scored night)');
+    } else {
+      take('sleep_min', ds['duration_min'], round: 0);
+      final eff = _num(ds['efficiency']);
+      take('sleep_efficiency_pct',
+          eff == null ? null : (eff <= 1 ? eff * 100 : eff), round: 0);
+      take('sleep_debt_min', ds['debt_min'], round: 0);
+      take('deep_min', ds['deep_min'], round: 0);
+      take('rem_min', ds['rem_min'], round: 0);
+      take('awake_min', ds['awake_min'], round: 0);
+      final onset = _num(ds['onset_ts'])?.toInt();
+      final wake = _num(ds['wake_ts'])?.toInt();
+      // Named when absent, like every other field — [take] cannot do these two
+      // because they are clock strings rather than numbers, and that is the
+      // whole of the difference. A scored night with no onset used to hand over
+      // six sleep numbers and no refusal rule for the seventh, which is exactly
+      // the hole `withheld` exists to close. Bare, with no reason: these are
+      // raw columns, not metric envelopes, so there is no note to read one from.
+      if (onset != null && onset > 0) {
+        out['bedtime'] = _hhmm(
+            DateTime.fromMillisecondsSinceEpoch(onset * 1000));
+      } else {
+        withheld.add('bedtime');
+      }
+      if (wake != null && wake > 0) {
+        out['wake_time'] =
+            _hhmm(DateTime.fromMillisecondsSinceEpoch(wake * 1000));
+      } else {
+        withheld.add('wake_time');
+      }
+    }
+    if (withheld.isNotEmpty) out[kWithheldKey] = withheld;
   } else {
     // The evening pass is the nightly SWEEP, not a recap. It used to hand over
     // strain, steps, calories, stress and the day's workouts, which produced
@@ -288,6 +350,12 @@ String briefingSystemPrompt(BriefingPeriod period) {
       'written. Start straight with the substance.\n'
       '- Use ONLY the numbers provided. Never invent, estimate or mention a '
       'metric that is not in the data. No medical advice or diagnosis.\n'
+      '- Anything under "withheld" was REFUSED by the measurement layer, not '
+      'merely forgotten. You may say it is unavailable and give the reason '
+      'shown, and nothing else: never a value, never a range, never a '
+      'direction, never a quality word for what it measures — and never '
+      'reasoned out of the numbers you WERE given. Calling recovery strong '
+      'while readiness is withheld IS stating the withheld number.\n'
       '- If a "readiness" value is given, its parenthesized band label '
       '(low / moderate / good) is AUTHORITATIVE for tone: a low or moderate '
       'band must never be described as strong, solid or good recovery, even '
@@ -314,10 +382,22 @@ String buildBriefingUserPrompt(
             'Overnight data:'
         : 'Nightly sweep for $day (reader\'s local time: $timeOfDay). What '
             'came back as unusual for this person, and nothing else:');
-  if (inputs.isEmpty) {
+  // A payload of nothing but refusals is still a payload of no measurements,
+  // so the "nothing yet" line is keyed off the MEASURED entries, not the map.
+  //
+  // The null/`'—'` filter is the structural half of the withheld rule, and it
+  // is HERE rather than in the collector because every prompt routes through
+  // this function while collectors can be added. `'$v'` renders an absent
+  // metric as the word "null" or as the store's em-dash placeholder
+  // (`local_repository_impl._scalarMetric` writes `value: v ?? '—'`), and
+  // either one is a refused metric arriving in the prompt looking like data.
+  final measured = inputs.keys.where((k) =>
+      k != kWithheldKey && inputs[k] != null && inputs[k] != '—');
+  if (measured.isEmpty) {
     b.writeln('(no metrics available yet)');
   } else {
-    inputs.forEach((k, v) {
+    for (final k in measured) {
+      final v = inputs[k];
       if (k == 'readiness' && v is num) {
         // Inject the band label the model must treat as authoritative (see
         // the system prompt) — a bare "readiness: 16" otherwise reads as
@@ -326,7 +406,16 @@ String buildBriefingUserPrompt(
       } else {
         b.writeln(v is List ? '$k: ${v.join(', ')}' : '$k: $v');
       }
-    });
+    }
+  }
+  // Last, under its own header, so the rule in the system prompt has something
+  // to name and a refusal can never be read as just another line of data.
+  final w = inputs[kWithheldKey];
+  if (w is List && w.isNotEmpty) {
+    b.writeln('withheld (refused — see the withheld rule):');
+    for (final e in w) {
+      b.writeln('- $e');
+    }
   }
   return b.toString().trimRight();
 }
diff --git a/lib/ble/adapters/_registry.dart b/lib/ble/adapters/_registry.dart
new file mode 100644
index 00000000..f4346c4d
--- /dev/null
+++ b/lib/ble/adapters/_registry.dart
@@ -0,0 +1,443 @@
+// The const table of bands this build can see.
+//
+// Dart AOT has no runtime code loading, no `dart:mirrors`, and lazy static
+// initialisation defeats import-for-side-effects registration (ASSUMPTIONS
+// E4), so this is a hand-maintained `const` list. Adding a band is a source
+// edit here and nothing else. Revisit past ~50 entries.
+//
+// SCOPE — this file is the IDENTITY half only. The session seam now exists in
+// `adapter.dart` (`BandAdapter` / `BandLink` / `BandEvent`) and an adapter
+// points BACK at its entry here rather than restating a service UUID that the
+// iOS AccessorySetupKit plist is generated from. Two declarations of one UUID
+// is one declaration too many.
+//
+// This file holds the facts `ble_engine.dart` used to hardcode:
+//
+//   • which service UUIDs the scan filters on            (D1)
+//   • which characteristics a link must expose to connect (D2)
+//   • where the inner-record fields sit                   (D3)
+//
+// `run(BandLink)`, `BandEvent` and `InputSignal` live in `adapter.dart` /
+// `signals.dart`. There are — per MULTIBAND_PLAN §3.1 — no capability
+// booleans here or there, ever: an adapter declares the INPUT signals a device
+// physically emits, never a `supportsX()` claim about our own features.
+//
+// WHAT THE FIRST NON-WHOOP ENTRY PROVED (D10, the `0x180D` strap below).
+// The identity half of this type held: id, label, service UUID and
+// `requiredCharacteristics` describe a generic heart-rate strap exactly, and
+// `requiredCharacteristics` had already been made a field for precisely this.
+// Two halves did NOT hold, and both are recorded here rather than papered over:
+//
+//   1. The WIRE half is WHOOP-shaped by construction. [GattProfile] is six
+//      named command/notify characteristics and [BandProfile] is a framed
+//      envelope over a CLOSED `DeviceType {gen4, gen5}` enum — neither can
+//      express one service with one notify characteristic and no envelope, and
+//      `protocol` is SEALED so neither can be widened there. So both are
+//      NULLABLE now: null means "not a framed WHOOP-family band", and
+//      [isFramed] is the predicate every WHOOP-only consumer filters on.
+//   2. There was no SESSION half at all — a [BandEntry] DESCRIBES a band, it
+//      cannot DRIVE one. CLOSED by `adapter.dart`: the `0x180D` strap is now a
+//      `BandAdapter` whose whole session is one `run(BandLink)`, and this
+//      entry is what that adapter points at for its identity. gen4 and gen5
+//      still run through `ble_engine._doConnect`; moving them behind the seam
+//      is the next wave, and until then `isFramed` remains the predicate that
+//      tells the two worlds apart.
+
+import 'package:openstrap_protocol/openstrap_protocol.dart';
+
+/// GATT Heart Rate Service and its Heart Rate Measurement characteristic.
+/// Written out in full 128-bit form rather than the 16-bit shorthand: the
+/// shorthand's expansion is a platform detail we should not depend on.
+const String kHeartRateServiceUuid = '0000180d-0000-1000-8000-00805f9b34fb';
+const String kHeartRateMeasurementUuid = '00002a37-0000-1000-8000-00805f9b34fb';
+
+/// The Oura ring's GATT service, identical across the generations seen so far.
+const String kOuraService = '98ed0001-a541-11e4-b6a0-0002a5d5c51b';
+
+/// Host to ring. Every Oura command is written here, with response.
+const String kOuraCommandChar = '98ed0002-a541-11e4-b6a0-0002a5d5c51b';
+
+/// Ring to host. Command replies, asynchronous notifications and every history
+/// event share this one characteristic — there is no separate data pipe.
+const String kOuraNotifyChar = '98ed0003-a541-11e4-b6a0-0002a5d5c51b';
+
+/// What a stored timestamp actually IS for a given band.
+///
+/// The distinction is load-bearing and it is not cosmetic. A WHOOP record
+/// carries the instant the band itself stamped on the reading; a `0x2A37`
+/// strap carries beat-to-beat DURATIONS and no clock at all, so the only time
+/// we can attach is the moment the notification reached this phone — which
+/// BLE delivery jitter and stack batching move by tens of milliseconds.
+///
+/// RMSSD, pNN50 and everything else computed off the durations stay correct on
+/// [arrival]. Lomb-Scargle, `cvhr_per_hour`, `spanSec` and anything else that
+/// reads the time AXIS must refuse on it (MULTIBAND_PLAN §3.2, §5.3). This
+/// enum is what lets that refusal be code instead of a doc note.
+enum TimeAnchor {
+  /// The source stamped the reading itself. Every WHOOP record.
+  measured,
+
+  /// The instant the sample reached the phone. Approximate, and never to be
+  /// written into a column that means "where the beat was".
+  arrival,
+}
+
+/// The two OBSERVED client delays in the WHOOP 5 bootstrap: 600 ms between the
+/// bond completing and notification registration, and 500 ms between the last
+/// CCC write and the first command (on a captured link GET_HELLO went out
+/// 585 ms after it). The firmware rationale is not documented anywhere, which
+/// is exactly why they are per-band values and not a global settle: WHOOP 4's
+/// flow is proven without them, and perturbing it for a reason nobody can state
+/// is how a working band stops working.
+const Duration kGen5PreRegistrationDelay = Duration(milliseconds: 600);
+const Duration kGen5PostRegistrationDelay = Duration(milliseconds: 500);
+
+/// The command table for one framed band.
+///
+/// Every field here was an `if (session.band.isGen5)` in `ble_engine.dart` that
+/// chose a VALUE — an opcode, a body, a wire fact. Each is transcribed verbatim
+/// from the arm it replaces (`band_registry_test.dart` pins them), and the code
+/// around it is now unconditional.
+///
+/// What is deliberately NOT here: anything that chooses a different SEQUENCE of
+/// operations — the gen5 HELLO step, the advertising-name read, the battery-pack
+/// follow-up, the deep-buffer unlock, the two INIT state machines, the gen5
+/// alarm pre-arm, the historical decoder. Those are behaviour; they stay in the
+/// engine where the order can be read top to bottom (ASSUMPTIONS G1-G4 — the
+/// `run(BandLink)` move was declined, so there is nowhere else for them to go).
+///
+/// It is a TABLE, not a policy: no field is computed, and no field decides
+/// WHETHER something happens except by being absent ([r10R11Realtime]).
+class BandWireCommands {
+  /// GET_HELLO and its body. WHOOP 5 does not implement the Harvard opcode.
+  final int hello;
+  final List<int> helloBody;
+
+  /// GET_ADVERTISING_NAME and its body — a different opcode pair on each
+  /// generation, and gen5's takes a revision byte where gen4 takes 0x00.
+  final int getAdvertisingName;
+  final List<int> getAdvertisingNameBody;
+
+  /// SET_ADVERTISING_NAME. Only the opcode differs; the body
+  /// (`[0x01][len][ascii][u32 0]`) is identical on both and stays at the call
+  /// site that builds it.
+  final int setAdvertisingName;
+
+  /// SEND_R10_R11 (0x3F), the high-rate raw live-stream toggle — or NULL on a
+  /// band that does not implement the opcode (a WHOOP 5 console answers
+  /// Unknown/Unhandled). Null is what the four live-stream paths read to skip
+  /// the toggle; it is an absent command, not a capability claim.
+  final int? r10R11Realtime;
+
+  /// Whether ENABLE_OPTICAL_DATA is this band's LIVE optical toggle.
+  ///
+  /// A wire-semantics fact and a safety boundary, not a preference: on WHOOP 5
+  /// the same opcode is the SAVE-to-history toggle, so arming it for a live
+  /// stream would write a persistent save-enable that leaves the LEDs on.
+  final bool opticalDataIsLiveToggle;
+
+  /// Body of the offload commands (GET_DATA_RANGE, SEND_HISTORICAL_DATA).
+  /// gen4 sends a single 0x00; gen5 sends an EMPTY body.
+  final List<int> offloadBody;
+
+  const BandWireCommands({
+    required this.hello,
+    required this.helloBody,
+    required this.getAdvertisingName,
+    required this.getAdvertisingNameBody,
+    required this.setAdvertisingName,
+    required this.r10R11Realtime,
+    required this.opticalDataIsLiveToggle,
+    required this.offloadBody,
+  });
+}
+
+/// One band the app can discover and connect to.
+///
+/// The wire format itself stays in `protocol` ([BandProfile] = header length,
+/// size-field offset, direction markers; [GattProfile] = the UUID map). This
+/// type carries the edge-side facts that live above the codec — discovery and
+/// the inner-record field offsets — following the same "it is data, not a
+/// branch" pattern rather than inventing a parallel one.
+class BandEntry {
+  /// Stable identifier. Stamped into `DeviceState.generation` and, downstream,
+  /// `device_family` and `decoded_*.source` — so it is a storage key: never
+  /// rename a shipped one.
+  final String id;
+
+  /// Human label for logs and (later) the pairing UI.
+  final String label;
+
+  /// GATT UUID map for this band. NULL for a band that is not a WHOOP-family
+  /// six-characteristic link — see the header note.
+  final GattProfile? gatt;
+
+  /// Frame envelope profile — header length, size-field offset, header CRC.
+  /// NULL means this band sends no envelope at all, which is also what
+  /// [isFramed] reports and what the offload engine filters on.
+  final BandProfile? wire;
+
+  /// What [TimeAnchor] this band's stored timestamps carry.
+  final TimeAnchor timeAnchor;
+
+  final String? _service;
+
+  /// The characteristics a link MUST expose or the connect aborts.
+  ///
+  /// Defaults to this entry's own four command/notify characteristics, which
+  /// is what a WHOOP link genuinely needs. It is a FIELD and not a constant
+  /// because demanding four unconditionally is why a second, parallel BLE
+  /// stack had to exist at all: a generic HRS device exposes one notify
+  /// characteristic and nothing else.
+  final List<String>? _requiredCharacteristics;
+
+  /// Offset of the opcode byte within the inner payload
+  /// (`[pktType, seq, opcode, body…]`). Framed entries only.
+  final int innerOpcodeOffset;
+
+  /// Offset of the record-version byte within a historical record's inner
+  /// payload. Framed entries only.
+  final int innerVersionOffset;
+
+  /// Offset of the u32-LE record counter within a historical record's inner
+  /// payload. Framed entries only.
+  final int innerCounterOffset;
+
+  final BandWireCommands? _commands;
+
+  /// This band's command table. Framed entries only — a notify-only sensor has
+  /// no command channel at all, which is why this throws rather than answering
+  /// with a plausible-looking WHOOP default.
+  BandWireCommands get commands => _commands!;
+
+  /// Pause between the bond completing and notification registration, and
+  /// between the last CCC write and the first command. [Duration.zero] means
+  /// "no pause", which is what every band does unless it has evidence for one.
+  final Duration preRegistrationDelay;
+  final Duration postRegistrationDelay;
+
+  /// Whether the bootstrap SET_CLOCK is gated on measured drift
+  /// (`BootstrapClockGate`) rather than written unconditionally.
+  ///
+  /// FALSE ON WHOOP 4 ON PURPOSE, and it is not an oversight to be tidied: its
+  /// unconditional write is the proven flow, and the WHOOP 5 bootstrap is where
+  /// the evidence for gating lives. Flipping it changes a band that works.
+  final bool setClockDriftGated;
+
+  /// Whether a burst's declared `expectedPacketCount` is trustworthy enough to
+  /// GATE the burst, or is advisory only.
+  ///
+  /// FALSE ON WHOOP 4 ON PURPOSE. The gap between expected and actual varies
+  /// run to run there with no fixed offset, so a hard gate becomes a permanent
+  /// stall — 15 validation failures, abort, terminal Stuck — on a band whose
+  /// count semantics nothing has pinned. False is also the SAFE default for a
+  /// band nobody has measured.
+  final bool burstCountGateEnforced;
+
+  /// Whether this band's decoded `console_log` frames are echoed into the
+  /// engine log. Debug visibility only — never persisted, never gated on.
+  ///
+  /// It is per-band because the value of the noise is: WHOOP 5's handshake and
+  /// offload are the untested ones, so its console is worth reading. Note that
+  /// `protocol` decodes a console frame on BOTH bands, so false here means a
+  /// WHOOP 4 that emits one is silently dropped on the floor.
+  final bool logsConsoleOutput;
+
+  /// A framed WHOOP-family band: an envelope, a command characteristic, and a
+  /// flash the offload engine trims.
+  const BandEntry.framed({
+    required this.id,
+    required this.label,
+    required GattProfile this.gatt,
+    required BandProfile this.wire,
+    required this.innerOpcodeOffset,
+    required this.innerVersionOffset,
+    required this.innerCounterOffset,
+    required BandWireCommands commands,
+    List<String>? requiredCharacteristics,
+    this.preRegistrationDelay = Duration.zero,
+    this.postRegistrationDelay = Duration.zero,
+    this.setClockDriftGated = false,
+    this.burstCountGateEnforced = false,
+    this.logsConsoleOutput = false,
+  })  : _requiredCharacteristics = requiredCharacteristics,
+        _commands = commands,
+        _service = null,
+        timeAnchor = TimeAnchor.measured;
+
+  /// A notify-only sensor: one service, one or more notify characteristics, no
+  /// envelope, no commands, no stored history to offload.
+  ///
+  /// The record offsets are -1 on purpose. They describe a position inside a
+  /// framed payload this band never sends, and a plausible-looking 2/1/3 would
+  /// read the wrong byte in silence — which is the exact failure the registry
+  /// exists to prevent. -1 throws.
+  const BandEntry.notify({
+    required this.id,
+    required this.label,
+    required String service,
+    required List<String> characteristics,
+    required this.timeAnchor,
+  })  : _service = service,
+        _requiredCharacteristics = characteristics,
+        gatt = null,
+        wire = null,
+        // No envelope, no command channel: [commands] throws for the same
+        // reason the offsets are -1.
+        _commands = null,
+        preRegistrationDelay = Duration.zero,
+        postRegistrationDelay = Duration.zero,
+        setClockDriftGated = false,
+        burstCountGateEnforced = false,
+        logsConsoleOutput = false,
+        innerOpcodeOffset = -1,
+        innerVersionOffset = -1,
+        innerCounterOffset = -1;
+
+  /// True when this band speaks a framed envelope, i.e. the offload engine can
+  /// drive it. The one predicate every WHOOP-only consumer filters on.
+  bool get isFramed => wire != null;
+
+  /// Service UUID to advertise-filter the scan on.
+  String get service => gatt?.service ?? _service!;
+
+  /// 32-bit prefix used to match this band's service from a scan result or a
+  /// discovered service list (case-insensitive `startsWith`).
+  String get servicePrefix => service.substring(0, 8);
+
+  List<String> get requiredCharacteristics =>
+      _requiredCharacteristics ??
+      <String>[gatt!.cmdTo, gatt!.cmdFrom, gatt!.events, gatt!.data];
+
+  /// Index of the opcode byte in a fully-framed packet. Framed entries only —
+  /// this is the byte the dangerous-opcode block reads, and a band with no
+  /// envelope has no such byte to read.
+  int get frameOpcodeIndex => wire!.headerLen + innerOpcodeOffset;
+}
+
+/// WHOOP 4 ("Harvard", 6108xxxx).
+///
+/// Every value below is the gen4 arm of an `isGen5` branch that used to live in
+/// `ble_engine.dart`, transcribed unchanged. The four session flags are written
+/// out rather than left to their defaults because this is a table, and a table
+/// that says nothing about a band is not evidence that the band does nothing.
+const BandEntry kWhoopGen4 = BandEntry.framed(
+  id: 'gen4',
+  label: 'WHOOP 4',
+  gatt: GattProfile.gen4,
+  wire: BandProfile.gen4,
+  innerOpcodeOffset: 2,
+  innerVersionOffset: 1,
+  innerCounterOffset: 3,
+  preRegistrationDelay: Duration.zero,
+  postRegistrationDelay: Duration.zero,
+  setClockDriftGated: false,
+  burstCountGateEnforced: false,
+  logsConsoleOutput: false,
+  commands: BandWireCommands(
+    hello: Cmd.getHelloHarvard,
+    helloBody: <int>[0x00],
+    getAdvertisingName: Cmd.getAdvertisingNameHarvard,
+    getAdvertisingNameBody: <int>[0x00],
+    setAdvertisingName: Cmd.setAdvertisingNameHarvard,
+    r10R11Realtime: Cmd.sendR10R11Realtime,
+    opticalDataIsLiveToggle: true,
+    offloadBody: <int>[0x00],
+  ),
+);
+
+/// WHOOP 5 / MG ("fd4b"). Same inner payload layout as gen4 — only the
+/// envelope differs, which is exactly what [BandProfile] models.
+const BandEntry kWhoopGen5 = BandEntry.framed(
+  id: 'gen5',
+  label: 'WHOOP 5',
+  gatt: GattProfile.gen5,
+  wire: BandProfile.gen5,
+  innerOpcodeOffset: 2,
+  innerVersionOffset: 1,
+  innerCounterOffset: 3,
+  preRegistrationDelay: kGen5PreRegistrationDelay,
+  postRegistrationDelay: kGen5PostRegistrationDelay,
+  setClockDriftGated: true,
+  burstCountGateEnforced: true,
+  logsConsoleOutput: true,
+  commands: BandWireCommands(
+    hello: Cmd.getHello,
+    helloBody: <int>[0x01],
+    getAdvertisingName: Cmd.getCustomAdvertisingName,
+    getAdvertisingNameBody: <int>[revision1],
+    setAdvertisingName: Cmd.setCustomAdvertisingName,
+    // 0x3F answers Unknown/Unhandled on a WHOOP 5 console.
+    r10R11Realtime: null,
+    // ENABLE_OPTICAL_DATA is the SAVE-to-history toggle here, not the realtime
+    // stream (the realtime one is the next opcode up) — arming it for live
+    // would write a persistent save-enable on every live-stream start.
+    opticalDataIsLiveToggle: false,
+    offloadBody: <int>[],
+  ),
+);
+
+/// Any standard Bluetooth heart-rate sensor — the SIG's Heart Rate Service.
+/// Chest straps, optical armbands, some rings, and a WHOOP in broadcast mode.
+///
+/// EXPERIMENTAL and it stays that way: nobody on this project owns one yet, so
+/// not a byte of this path has met hardware (ASSUMPTIONS R6). It IS reachable
+/// now — `PairSensorScreen` writes the `device` row `HrsLink.arm` reads — but
+/// reachable is not verified, and `kDerivableSources` stays empty: a strap
+/// captures beats, and nothing derives from them until someone has held one.
+const BandEntry kBleHrs = BandEntry.notify(
+  id: 'ble_hrs',
+  label: 'Bluetooth heart rate sensor',
+  service: kHeartRateServiceUuid,
+  characteristics: <String>[kHeartRateMeasurementUuid],
+  // The strap reports durations and has no clock. See [TimeAnchor].
+  timeAnchor: TimeAnchor.arrival,
+);
+
+/// The Oura ring, a fetch-by-cursor band with a challenge-response handshake.
+///
+/// NOT framed, and the three fields a framed entry carries would each be wrong
+/// here: the length is a u8 that counts payload only, there is no CRC anywhere
+/// in the protocol, and there is no inner opcode byte to find. `isFramed ==
+/// false` keeps it out of [kFramedBands], which is what keeps it out of the
+/// offload engine's scan filter and out of the iOS AccessorySetupKit plist —
+/// both of which are about the primary band that holds a link and gets trimmed.
+///
+/// [TimeAnchor.arrival] is the conservative half of a two-clock situation, not
+/// a claim that the ring has no clock. See `oura.dart`.
+///
+/// EXPERIMENTAL, and it stays that way: nobody on this project owns a ring, so
+/// not a byte of this path has met hardware (ASSUMPTIONS R6). It is also not
+/// yet reachable — there is no pairing screen and nothing constructs the
+/// adapter.
+const BandEntry kOura = BandEntry.notify(
+  id: 'oura',
+  label: 'Oura Ring',
+  service: kOuraService,
+  // Both, and the command characteristic is genuinely required: unlike a
+  // heart-rate strap this band answers nothing until it has been written to.
+  characteristics: <String>[kOuraCommandChar, kOuraNotifyChar],
+  timeAnchor: TimeAnchor.arrival,
+);
+
+/// Every band this build can see. Order is match order during discovery.
+const List<BandEntry> kBandRegistry = <BandEntry>[
+  kWhoopGen4,
+  kWhoopGen5,
+  kBleHrs,
+  kOura,
+];
+
+/// The bands the OFFLOAD ENGINE can drive, and the bands iOS provisions
+/// through the AccessorySetupKit picker — the same set, for the same reason:
+/// both are about the primary band that holds a link, keeps a flash and gets
+/// trimmed. A notify-only sensor is connected straight from its stored remote
+/// id during a workout, so putting it in the ASK plist would only add chest
+/// straps to the WHOOP pairing picker.
+final List<BandEntry> kFramedBands =
+    kBandRegistry.where((e) => e.isFramed).toList(growable: false);
+
+/// The entry speaking [wire]. Used by the engine's test seam, which is handed
+/// a [BandProfile] rather than an entry.
+BandEntry bandEntryFor(BandProfile wire) =>
+    kBandRegistry.firstWhere((e) => e.wire?.type == wire.type);
diff --git a/lib/ble/adapters/adapter.dart b/lib/ble/adapters/adapter.dart
new file mode 100644
index 00000000..53505910
--- /dev/null
+++ b/lib/ble/adapters/adapter.dart
@@ -0,0 +1,321 @@
+// The SESSION seam: what it takes to DRIVE a band, not merely describe one.
+//
+// `_registry.dart` gave three bands a shared identity — id, label, service
+// UUID, required characteristics. What it could not give them was shared
+// PLUMBING: SET_CLOCK, INIT, the drain, `RecordGate`, the batch ACK and the
+// liveness fuse were all hardcoded in `ble_engine._doConnect`, so a band that
+// did not speak that exact sequence still needed ~200 lines of its own. This
+// file is the interface that closes that gap (MULTIBAND_PLAN §3.1).
+//
+// FIVE MEMBERS, and the shape of each one is a decision with a reason:
+//
+//  * No separate `handshake()`. `run()` is `async*`, so authentication is
+//    simply the statements before the first `yield`. A second lifecycle method
+//    is a second place to get the ordering wrong.
+//  * No `tier` field on an event. Tier is a property of a DERIVATION and
+//    `Metric.tier` already carries it; an adapter claiming a tier would be
+//    claiming something about analytics it cannot know.
+//  * No capability booleans, EVER. See `signals.dart`.
+//  * Offload is ONE callback. Four models reduce to "the host has committed
+//    durably; now do the band-specific thing that lets the band forget".
+//  * `ephemeral` exists because a live frame must never reach `raw_records`.
+//
+// DELIBERATELY EXCLUDED — named here so nobody adds them speculatively:
+// typed resumption cursors; progress/ETA models; gap detection and partial
+// re-request (gen4-specific policy, which lives INSIDE the gen4 adapter, not
+// at the seam); OTA; a cross-band command abstraction; per-sample cross-device
+// fusion; and any waveform channel.
+//
+// WHAT A CONTRIBUTOR NEVER TOUCHES, and cannot reach from here: the
+// `flutter_blue_plus` API, bonding, CoreBluetooth restoration, iOS
+// AccessorySetupKit provisioning, Android permission blockers, the
+// process-wide band lock, connection priority, MTU negotiation, `sqflite`, any
+// schema migration, `kAlgoVersion`, `Substrate`, any analytics function, the
+// derivation engine or scheduler, and any widget, card, screen or golden. If a
+// change to this file would expose one of those, the change is wrong.
+
+import 'dart:async';
+import 'dart:typed_data';
+
+import '_registry.dart';
+import 'signals.dart';
+
+/// The radio, as an adapter is allowed to see it.
+///
+/// This is the smallest surface that serves BOTH a framed, authenticated,
+/// offloading band (three notify characteristics, one write characteristic, a
+/// flash to trim) and a one-characteristic notify sensor with no clock and
+/// nothing stored. Everything a band-agnostic host must own — discovery,
+/// connect, bond, MTU, priority, restoration, the band lock — happens ABOVE
+/// this and is not reachable through it.
+///
+/// LIFETIME. A link is valid for exactly one connection. When the link drops,
+/// the host cancels the [BandAdapter.run] subscription; the `async*` body's
+/// `finally` is where an adapter cancels its own timers. There is no `close()`
+/// here for the adapter to call — an adapter does not get to hang up.
+abstract class BandLink {
+  /// Subscribe to a characteristic and receive its notifications, each paired
+  /// with the wall-clock second it ARRIVED at this phone.
+  ///
+  /// The arrival second is on the packet rather than read from a clock inside
+  /// the adapter for one reason: it is the only honest anchor a source with no
+  /// clock of its own has, and putting it here means it can be replayed
+  /// deterministically from a fixture ([ReplayBandLink]) instead of depending
+  /// on `DateTime.now()` inside adapter code. A band that stamps its own
+  /// records IGNORES it and uses the epoch it decoded.
+  ///
+  /// Yields nothing at all for a characteristic this peripheral does not
+  /// expose — an adapter that requires one should have declared it in its
+  /// [BandEntry.requiredCharacteristics], where the connect aborts loudly.
+  Stream<(int atSec, List<int> value)> notify(String characteristicUuid);
+
+  /// Write with response, which is also what triggers bonding. Returns whether
+  /// the GATT write was confirmed; false covers a missing characteristic, a
+  /// dead link, a timeout and a refused opcode alike.
+  ///
+  /// The dangerous-opcode block lives in the IMPLEMENTATION of this method,
+  /// not in adapter code, so no adapter can reach FORCE_TRIM, REBOOT or
+  /// POWER_CYCLE by any path.
+  Future<bool> write(String characteristicUuid, List<int> value);
+
+  /// One line into the engine log the user can already see and export.
+  void log(String message);
+}
+
+/// One sample, in the vocabulary of the substrate rather than of any band.
+///
+/// This is NOT a third name for `Substrate` and it is not a copy of protocol's
+/// `Sample`. It is the adapter-facing shape of ONE `decoded_onehz` row plus
+/// the `decoded_rr` beats belonging to that row, which is the real
+/// contributor-facing contract (MULTIBAND_PLAN §3.6): it already encodes
+/// absence as null, and it is the only place a band's bytes become neutral.
+///
+/// ABSENT IS NULL, NEVER ZERO. A notification that carried no heart rate
+/// leaves [hr] null; it does not report 0 bpm, which the substrate reads as
+/// the off-skin sentinel. A zero anywhere here is a measurement claim.
+///
+/// The field list is the `decoded_onehz` COLUMN SET, and it is deliberately
+/// only as wide as something currently emits. Adding a nullable field later is
+/// free — every constructor argument is named and optional — so a band that
+/// brings accelerometer, optical or thermistor channels widens this class in
+/// its own wave rather than having them declared here in advance.
+class NeutralSample {
+  /// What [tsEpoch] actually IS. Load-bearing, not cosmetic: RMSSD, pNN50 and
+  /// SDNN stay correct on [TimeAnchor.arrival] because they are computed from
+  /// the durations, while Lomb-Scargle, `cvhr_per_hour`, `spanSec` and
+  /// `night_hrv_shape` read the time AXIS and must REFUSE on it.
+  final TimeAnchor anchor;
+
+  /// Whole seconds since the Unix epoch. Seconds, not milliseconds, because
+  /// `decoded_onehz` is keyed at one row per second and `ts_ms` is exactly
+  /// `rec_ts * 1000` (ASSUMPTIONS A2).
+  final int tsEpoch;
+
+  /// Beats per minute, or null when this sample carries no heart rate. Never 0
+  /// — the substrate treats 0 as the off-skin sentinel.
+  final int? hr;
+
+  /// Beat-to-beat DURATIONS in milliseconds, in the order the band sent them.
+  /// Empty means "not reported", never "no beats".
+  final List<int> rrMs;
+
+  /// Skin temperature in ABSOLUTE degrees Celsius, or null.
+  ///
+  /// It lands in `decoded_onehz.skin_temp_c` and NEVER in `skin_temp_raw`,
+  /// which is a relative ADC count on the bands that have one. They are
+  /// different quantities: a raw count is only meaningful against a per-family
+  /// calibration, a Celsius reading is meaningful on its own, and putting one
+  /// in the other's column would give every consumer of that column a number in
+  /// the wrong units with no way to tell.
+  ///
+  /// There is deliberately no [InputSignal] for it — I8 names the raw-ADC input
+  /// specifically — so a band supplying this declares no signal for it and no
+  /// metric is claimed on its behalf.
+  final double? skinTempC;
+
+  /// Anything the band emitted that we do not have a column for, under the
+  /// band's OWN name for it (owner rulings R1-R3: capture everything, decide
+  /// what to do with it later). Never an input to a derivation, never in a
+  /// baseline, and never sharing a key with a number we compute ourselves.
+  final Map<String, Object?> vendor;
+
+  const NeutralSample({
+    required this.anchor,
+    required this.tsEpoch,
+    this.hr,
+    this.rrMs = const <int>[],
+    this.skinTempC,
+    this.vendor = const <String, Object?>{},
+  });
+}
+
+/// Everything an adapter can tell the host. Sealed: adding a fourth kind is a
+/// deliberate decision that breaks every host switch, which is the point.
+sealed class BandEvent {
+  const BandEvent();
+}
+
+/// Decoded samples, and optionally the bytes they came from.
+class SampleBatch extends BandEvent {
+  final List<NeutralSample> samples;
+
+  /// The verbatim frames these samples were decoded from, for `raw_archive` —
+  /// the never-pruned store of bytes we could not decode or do not yet
+  /// understand. Null when the band has no envelope worth keeping (a `0x2A37`
+  /// notification IS the sample; archiving it stores the same numbers twice).
+  final List<Uint8List>? raw;
+
+  /// TRUE = this batch is a live stream, and NOTHING here may be persisted.
+  ///
+  /// Not a nicety. A band's 100 Hz live frames arriving in `raw_records` is a
+  /// database-size failure that has already happened once, and the second
+  /// implementation that justifies the field is a strap that emits a live
+  /// stream AND a recorded file covering the same wall-clock span — where
+  /// "which of these two identical-looking batches is durable" cannot be
+  /// answered by the host from the bytes.
+  final bool ephemeral;
+
+  const SampleBatch(this.samples, {this.raw, this.ephemeral = false});
+}
+
+/// The band is holding data it will only forget once told to.
+///
+/// The host commits durably FIRST and calls [confirm] second. That ordering is
+/// the safe-trim invariant and it is not negotiable: confirming before the
+/// commit lets a band delete records that exist nowhere. It stays host-side
+/// precisely so no adapter can get it backwards.
+///
+/// THE VERDICT IS SPLIT, AND NEITHER HALF CAN OVERRIDE THE OTHER. Emitting a
+/// checkpoint at all is the ADAPTER's half — it is what knows a burst was
+/// abandoned mid-transfer, or came up short against a declared packet count,
+/// and it withholds the event rather than passing a veto flag. Calling
+/// [confirm] is the HOST's half — it is what knows whether the commit landed
+/// and whether anything durable was in it. An adapter that never emits, and a
+/// host that never calls, both mean "the band keeps its flash", which is
+/// always the safe outcome.
+///
+/// | model                    | what `confirm()` does                    |
+/// |--------------------------|------------------------------------------|
+/// | trim-on-ack (WHOOP)      | writes the batch ACK; the band trims     |
+/// | fetch-by-range           | advances the adapter's own cursor        |
+/// | file transfer            | deletes the transferred file             |
+/// | live-only (chest strap)  | never emitted; the host flushes on its own |
+class OffloadCheckpoint extends BandEvent {
+  /// Called by the host AFTER its durable commit, and only then.
+  ///
+  /// Returns whether the band actually accepted it. NOT `Future<void>`: on a
+  /// trim-on-ack band a silently-swallowed ACK failure means the band never
+  /// trims and re-floods the same chunk forever, and the shipped remedy is for
+  /// the HOST to bounce the link — which it cannot decide to do if the result
+  /// is thrown away. Retry policy is the adapter's; bouncing is the host's.
+  final Future<bool> Function() confirm;
+
+  /// Roughly how much the band still holds, when it says. Advisory only —
+  /// there is deliberately no progress or ETA model at this seam.
+  final int? remaining;
+
+  const OffloadCheckpoint(this.confirm, {this.remaining});
+}
+
+/// A fact about the band that is not a sample: battery, firmware, serial, an
+/// alarm confirmation, a strap event.
+///
+/// Open key/value on purpose (R1: an unrecognised field is stored under its
+/// own name, not dropped). It is NOT a command channel — the host reacts to
+/// notes, an adapter cannot make it act.
+class BandNote extends BandEvent {
+  final String key;
+  final Object? value;
+  const BandNote(this.key, [this.value]);
+}
+
+/// One band, driven.
+///
+/// Five members. Discovery is NOT restated here — it is [entry], the registry
+/// row that already carries the service UUID and the required characteristic
+/// set, and which the iOS AccessorySetupKit plist is generated from. A second
+/// declaration of a service UUID is a second thing to get out of sync.
+abstract class BandAdapter {
+  const BandAdapter();
+
+  /// This band's registry row: id, label, service UUID, required
+  /// characteristics, and (for a framed band) its envelope profile.
+  BandEntry get entry;
+
+  /// Stamped into `device_family` and `decoded_*.source`, so it is a storage
+  /// key: never rename a shipped one.
+  String get id => entry.id;
+
+  String get label => entry.label;
+
+  /// What this band SUPPLIES, at what cadence. Not decorative: it is the input
+  /// to the cadence refusal guard, and a mandatory test asserts that every
+  /// signal declared here actually appears in an emitted sample at roughly
+  /// this rate.
+  ///
+  /// A declared-but-absent signal is WORSE than a missing one — it turns a
+  /// card that should have deleted itself into one that is permanently empty.
+  Map<InputSignal, Duration> get signals;
+
+  /// Handshake, session and decode, as one stream.
+  ///
+  /// Ends when the band's data ends or the host cancels. Timers, reassemblers
+  /// and any per-session state belong in the body of this method (a `finally`
+  /// is where they die), not on the adapter instance — an adapter is const and
+  /// a session is not.
+  Stream<BandEvent> run(BandLink link);
+}
+
+/// A [BandLink] fed from recorded bytes instead of a radio.
+///
+/// `flutter_blue_plus` has no simulator path, so without this there is no way
+/// to exercise an adapter at all. It is the link a contributor's
+/// `test/adapters/<id>_test.dart` replays a captured fixture through, and it
+/// is also what drives `HrsLink.ingestForTest` — two callers, which is why it
+/// is a shared type here rather than a fake copied into each test.
+class ReplayBandLink implements BandLink {
+  final Map<String, StreamController<(int, List<int>)>> _channels = {};
+
+  /// Every write an adapter attempted, in order. Assert against this rather
+  /// than mocking: a wrong ACK payload is a band that never trims its flash.
+  final List<(String uuid, List<int> value)> writes = [];
+
+  final List<String> logs = [];
+
+  /// What [write] returns. Set false to exercise an adapter's failure path.
+  bool writeSucceeds = true;
+
+  /// Single-subscription on purpose: it BUFFERS, so a fixture may be fed
+  /// before the adapter has got around to subscribing and nothing is dropped.
+  /// A second `notify()` of the same characteristic throws, which is correct —
+  /// an adapter subscribing twice to one characteristic is a bug.
+  StreamController<(int, List<int>)> _channel(String uuid) =>
+      _channels.putIfAbsent(uuid, StreamController<(int, List<int>)>.new);
+
+  @override
+  Stream<(int, List<int>)> notify(String characteristicUuid) =>
+      _channel(characteristicUuid).stream;
+
+  @override
+  Future<bool> write(String characteristicUuid, List<int> value) async {
+    writes.add((characteristicUuid, value));
+    return writeSucceeds;
+  }
+
+  @override
+  void log(String message) => logs.add(message);
+
+  /// Deliver one notification, stamped as having arrived at [atSec].
+  void feed(String characteristicUuid, List<int> value, {required int atSec}) {
+    _channel(characteristicUuid).add((atSec, value));
+  }
+
+  /// End every channel, which ends `run()`. Await the run subscription's
+  /// `done` after this rather than guessing at a delay.
+  Future<void> close() async {
+    for (final c in _channels.values) {
+      await c.close();
+    }
+    _channels.clear();
+  }
+}
diff --git a/lib/ble/adapters/ble_hrs.dart b/lib/ble/adapters/ble_hrs.dart
new file mode 100644
index 00000000..397e02c9
--- /dev/null
+++ b/lib/ble/adapters/ble_hrs.dart
@@ -0,0 +1,84 @@
+// Any standard Bluetooth heart-rate sensor — the SIG's Heart Rate Service
+// (0x180D) — as a [BandAdapter].
+//
+// This is the HOSTILE case for a WHOOP-shaped seam, and that is exactly why it
+// is the first one expressed in it: no envelope, no CRC, one notify
+// characteristic, no commands, no clock, no flash and therefore no offload. If
+// it needed a special case anywhere in `adapter.dart`, the seam would be wrong.
+// It did not.
+//
+// NOTHING HERE HAS MET HARDWARE. Nobody on this project owns a strap and
+// `flutter_blue_plus` has no simulator path, so everything below is verified by
+// the Bluetooth SIG's Heart Rate Service 1.0 layout, by the fixtures in
+// `test/hrs_link_test.dart`, and by the compiler. It ships EXPERIMENTAL
+// (ASSUMPTIONS R6) until he owns one and cross-confirms it.
+
+import 'package:openstrap_protocol/openstrap_protocol.dart';
+
+import '_registry.dart';
+import 'adapter.dart';
+import 'signals.dart';
+
+/// The adapter. Const, and it holds no session state — everything a session
+/// needs lives inside [run].
+class BleHrsAdapter extends BandAdapter {
+  const BleHrsAdapter();
+
+  @override
+  BandEntry get entry => kBleHrs;
+
+  /// I3 + I1, and nothing else. Every sleep, temperature, step and SpO2 card
+  /// therefore DELETES ITSELF through the absence contract that already
+  /// exists. No new UI conditionals were written for this band, and none
+  /// should be.
+  ///
+  /// One second is the SIG's typical notification rate, not a guarantee: a
+  /// strap notifies per beat or per second depending on the model, so
+  /// `sampleCadenceSeconds()` measures the real rate downstream and metrics
+  /// abstain rather than stretch a window.
+  @override
+  Map<InputSignal, Duration> get signals => const {
+        InputSignal.hrSparse: Duration(seconds: 1),
+        InputSignal.rrIntervals: Duration(seconds: 1),
+      };
+
+  @override
+  Stream<BandEvent> run(BandLink link) async* {
+    // No handshake. Nothing to authenticate, no clock to set, no INIT — the
+    // whole session is one subscription, which is what makes this the honest
+    // floor for "how little can an adapter be".
+    await for (final (atSec, value) in link.notify(kHeartRateMeasurementUuid)) {
+      final s = parseHeartRateMeasurement(value);
+      if (s == null) continue;
+      // The sensor's own "no skin contact" is a REFUSAL, not a low reading: a
+      // chest strap off the chest reports confident nonsense. Drop the sample.
+      if (s.contact == false) continue;
+      yield SampleBatch(
+        [
+          NeutralSample(
+            // ARRIVAL TIME, NOT BEAT TIME. The RR durations are exact; this
+            // anchor is not — BLE notification delivery jitters by tens of
+            // milliseconds and the stack batches. `anchor` says so, and the
+            // time-axis metrics refuse on `TimeAnchor.arrival`. Do not copy
+            // this line into a band that stamps its own records as if the
+            // timestamp were measured.
+            anchor: TimeAnchor.arrival,
+            tsEpoch: atSec,
+            hr: s.hr,
+            rrMs: s.rrMs,
+            vendor: s.contact == null ? const {} : {'contact': s.contact},
+          ),
+        ],
+        // No `raw`: a 0x2A37 notification IS the sample, so archiving the
+        // bytes would store the same two numbers a second time.
+        // Not ephemeral: these rows are the point.
+        ephemeral: false,
+      );
+    }
+    // No OffloadCheckpoint, ever. The sensor stores nothing, so there is
+    // nothing to tell it to forget — the host flushes on its own cadence.
+  }
+}
+
+/// The single instance. Const, so it costs nothing to reference.
+const BleHrsAdapter kBleHrsAdapter = BleHrsAdapter();
diff --git a/lib/ble/adapters/gatt_link.dart b/lib/ble/adapters/gatt_link.dart
new file mode 100644
index 00000000..7e24b784
--- /dev/null
+++ b/lib/ble/adapters/gatt_link.dart
@@ -0,0 +1,195 @@
+// The real [BandLink]: `flutter_blue_plus` on one side, an adapter on the
+// other.
+//
+// This file is HOST PLUMBING that happens to live in `adapters/` because
+// MULTIBAND_PLAN §3.6 makes this directory the only place `protocol` may be
+// imported, and the dangerous-opcode block below needs protocol's opcode
+// tables. A contributor writing an adapter reads `adapter.dart` and their own
+// `<id>.dart` and never this.
+//
+// It deliberately does NOT do: discovery, connect, bond, MTU negotiation,
+// connection priority, CoreBluetooth restoration, AccessorySetupKit
+// provisioning, or the process-wide band lock. Those are per-PLATFORM and
+// per-APP concerns owned above the seam; a link is handed the services of an
+// already-connected peripheral and does nothing but move bytes.
+
+import 'dart:async';
+
+import 'package:flutter/foundation.dart' show visibleForTesting;
+import 'package:flutter_blue_plus/flutter_blue_plus.dart';
+import 'package:openstrap_protocol/openstrap_protocol.dart';
+
+import '../ble_state.dart' show WriteChain;
+import '_registry.dart';
+import 'adapter.dart';
+
+/// Whether the peripheral's [actual] uuid is the one [requested] names.
+///
+/// MATCHED ON `str128`, NOT `str`. `Guid.str` is the SHORTEST form: for any
+/// SIG-assigned uuid (`0000xxxx-0000-1000-8000-00805f9b34fb`) it returns the
+/// four-character short form, so `2a37` never starts with the `00002a37` prefix
+/// a registry entry carries and the heart-rate measurement characteristic could
+/// never be found — `HrsLink.arm` reported it MISSING on every strap and
+/// aborted, which reads exactly like "the adapter doesn't work". WHOOP's uuids
+/// are 128-bit either way, which is why gen4/gen5 never saw it and the first
+/// SIG band did. `str128` is always the canonical lowercase full form.
+///
+/// Still a 32-bit prefix rather than equality: it is what the engine's own
+/// match does, and it is what lets a registry entry name a family of uuids.
+@visibleForTesting
+bool gattUuidMatches(String requested, Guid actual) =>
+    actual.str128.startsWith(requested.substring(0, 8).toLowerCase());
+
+/// A [BandLink] over an already-connected, already-discovered peripheral.
+class GattBandLink implements BandLink {
+  /// Which band this is, so [write] knows where the opcode byte sits. A band
+  /// whose entry gets [BandEntry.frameOpcodeIndex] wrong reads the wrong byte
+  /// and the dangerous-opcode block stops protecting it.
+  final BandEntry entry;
+
+  /// The peripheral's discovered services. Characteristics are matched on a
+  /// 32-bit prefix of the 128-bit form, the same way `ble_engine` matches them
+  /// — see [gattUuidMatches] for why the form, not the prefix, is the part
+  /// that has to be said out loud.
+  final List<BluetoothService> services;
+
+  final void Function(String message) onLog;
+
+  GattBandLink({
+    required this.entry,
+    required this.services,
+    required this.onLog,
+  });
+
+  // Same numbers as the engine's, and for the same reason: an untimed GATT op
+  // on a wedged stack hangs the session forever with no failure state to
+  // recover from.
+  static const Duration _notifyTimeout = Duration(seconds: 15);
+  static const Duration _writeTimeout = Duration(seconds: 8);
+
+  /// One write in flight at a time — the same [WriteChain] `BleEngine._write`
+  /// runs on, one instance per link. Not shared with the engine's: two
+  /// peripherals queueing behind each other is exactly what the per-remoteId
+  /// ownership model exists to prevent.
+  final WriteChain _chain = WriteChain();
+
+  /// Set by the HOST when it tears this link down.
+  ///
+  /// This is `_write`'s `owner: session` guard, in the only currency a link
+  /// has. A link is valid for exactly ONE connection (see [BandLink]), but a
+  /// write queued before a teardown and reached after one would still land:
+  /// `flutter_blue_plus` resolves a [BluetoothCharacteristic] against whatever
+  /// connection to that peripheral is live NOW, not the one it was discovered
+  /// on. So a stale adapter's offload ACK, with a re-used sequence number,
+  /// writes onto a brand-new link — which is the failure `_write` has guarded
+  /// against since the batch-ACK path was written.
+  bool _closed = false;
+
+  /// Refuse every write from here on. Idempotent; call it from the host's
+  /// teardown, beside cancelling the `run()` subscription.
+  void close() => _closed = true;
+
+  /// Test seam onto the write, the counterpart of `BleEngine.debugWriteHook`.
+  /// [_closed] is checked BEFORE it, for the reason the engine's is: a seam
+  /// that skips the guard it stands in for makes every test using it prove the
+  /// wrong thing. `flutter_blue_plus` has no simulator path, so a link built
+  /// with no services is the only way to exercise the guards at all.
+  @visibleForTesting
+  Future<bool> Function(List<int> value)? debugWriteHook;
+
+  /// Which of [uuids] this peripheral does NOT expose. The host aborts the
+  /// connect when it is non-empty — WHICH characteristics a link must have is
+  /// registry data ([BandEntry.requiredCharacteristics]), and demanding four
+  /// unconditionally is why a second parallel BLE stack once had to exist.
+  List<String> missingCharacteristics(Iterable<String> uuids) =>
+      [for (final u in uuids) if (_find(u) == null) u];
+
+  BluetoothCharacteristic? _find(String uuid) {
+    for (final s in services) {
+      for (final c in s.characteristics) {
+        if (gattUuidMatches(uuid, c.uuid)) return c;
+      }
+    }
+    return null;
+  }
+
+  @override
+  Stream<(int, List<int>)> notify(String characteristicUuid) async* {
+    final c = _find(characteristicUuid);
+    if (c == null) {
+      log('notify: no characteristic ${characteristicUuid.substring(0, 8)} on '
+          'this peripheral.');
+      return;
+    }
+    await c.setNotifyValue(true).timeout(_notifyTimeout);
+    // The arrival second is stamped HERE, at the edge of the radio, and not
+    // inside the adapter — it is the closest we can get to when the
+    // notification actually landed, and it keeps `DateTime.now()` out of
+    // adapter code so a fixture can replay one deterministically.
+    yield* c.onValueReceived.map(
+      (v) => (DateTime.now().millisecondsSinceEpoch ~/ 1000, v),
+    );
+  }
+
+  @override
+  Future<bool> write(String characteristicUuid, List<int> value) {
+    // THE DANGEROUS-OPCODE BLOCK, at the one place every adapter's writes
+    // funnel through. It is here rather than in adapter code precisely so no
+    // adapter — including one a contributor wrote — can reach FORCE_TRIM
+    // (whose full-erase form is two 0xFEFEFEFE args), REBOOT or POWER_CYCLE by
+    // any path. There is no opt-out parameter: the one audited exception in
+    // this app (gen5 deep buffers) writes through `ble_engine._write`, which
+    // keeps its own carve-out, single and reviewed.
+    final opcode = _opcodeOf(value);
+    if (opcode != null &&
+        (dangerousCmds.contains(opcode) || OpcodeSafety.isDestructive(opcode))) {
+      log('REFUSED dangerous opcode 0x${opcode.toRadixString(16)} at BandLink');
+      return Future.value(false);
+    }
+    // Refused BEFORE the chain, as in the engine: a blocked opcode must not
+    // wait behind a parked write to be refused.
+    return _chain.add<bool>(() async {
+      try {
+        if (_closed) {
+          log('write skipped: it belongs to a link that is no longer live.');
+          return false;
+        }
+        final hook = debugWriteHook;
+        if (hook != null) return await hook(value);
+        final c = _find(characteristicUuid);
+        if (c == null) {
+          log('write: no characteristic ${characteristicUuid.substring(0, 8)} '
+              'on this peripheral.');
+          return false;
+        }
+        // withoutResponse: false is what triggers bonding AND what gets
+        // commands acknowledged; a without-response write is silently dropped
+        // by the band. allowLongWrite covers the one frame that exceeds the
+        // 20-byte ATT limit of a default MTU (the rich SET_ALARM_TIME), and is
+        // a no-op below it.
+        await c
+            .write(value, withoutResponse: false, allowLongWrite: true)
+            .timeout(_writeTimeout);
+        return true;
+      } on TimeoutException {
+        log('write timeout: no GATT response in ${_writeTimeout.inSeconds}s.');
+        return false;
+      } catch (e) {
+        log('write error: $e');
+        return false;
+      }
+    });
+  }
+
+  /// The command opcode carried by an already-framed outbound write, or null
+  /// when this band has no envelope (nothing to read an opcode out of) or the
+  /// frame is too short to carry one.
+  int? _opcodeOf(List<int> raw) {
+    if (!entry.isFramed) return null;
+    final i = entry.frameOpcodeIndex;
+    return i < raw.length ? raw[i] : null;
+  }
+
+  @override
+  void log(String message) => onLog(message);
+}
diff --git a/lib/ble/adapters/oura.dart b/lib/ble/adapters/oura.dart
new file mode 100644
index 00000000..dda8d4b6
--- /dev/null
+++ b/lib/ble/adapters/oura.dart
@@ -0,0 +1,489 @@
+// The Oura ring as a [BandAdapter]: authenticate, drain its history by cursor,
+// bank every byte, decode only what has been proven.
+//
+// NOTHING HERE HAS MET HARDWARE, and unlike `ble_hrs` there is not even a
+// public specification to fall back on. It ships EXPERIMENTAL (ASSUMPTIONS R6),
+// its rows carry a non-null `source` and `kDerivableSources` does not contain
+// it, so nothing it writes can become a number until the owner has held a ring
+// in his own hands. That is correct behaviour for an uncalibrated decoder, not
+// a limitation to work around.
+//
+// WHY THIS IS THE OPPOSITE SHAPE TO gen4, and why the seam fits it. gen4's
+// offload is TRIM-ON-ACK: the band deletes flash when the host says so, the
+// handshake has three wire outcomes, and the decision to trim depends on
+// whether the HOST's durable commit landed (ASSUMPTIONS G1-G4 — which is why
+// gen4 is not behind this seam). Oura's is FETCH-BY-CURSOR: the ring never
+// deletes anything on our say-so, there is no acknowledgement in the protocol
+// at all, and the host's only state is a bookmark. Re-reading a range is
+// idempotent — 48.5% of our own capture is the same records delivered
+// twice, and `decoded_onehz` is keyed `(device_id, ts_ms)` with REPLACE, so a
+// re-read overwrites rather than duplicates.
+//
+// That is exactly the "fetch-by-range: `confirm()` advances the adapter's own
+// cursor" row in [OffloadCheckpoint]'s own table, and this file is the first
+// implementation of it. The ordering still holds and still means something: the
+// cursor does not move until the host has committed, so an interrupted sync
+// re-reads rather than skips.
+//
+// PAIRING EVICTS THE OURA APP, AND IT IS A PRECONDITION RATHER THAN A SIDE
+// EFFECT. The ring holds exactly one 16-byte key and will only accept a new one
+// while it is FACTORY RESET — so a ring that is currently onboarded to Oura's
+// app cannot be paired here at all until the owner factory-resets it, which is
+// what removes it from that app. There is no state in which both work. Any
+// pairing UI must say that before the user commits, not after.
+//
+// THE KEY IS OURS AND IT NEVER LEAVES THE PHONE. It is generated locally, there
+// is no vendor server anywhere in the handshake and no Oura account is needed —
+// which is the whole reason this band is not declined the way a vendor-issued
+// pairing token would be. Losing it costs another factory reset, nothing more.
+
+import 'dart:async';
+import 'dart:typed_data';
+
+import 'package:openstrap_protocol/openstrap_protocol.dart';
+import 'package:pointycastle/export.dart' show AESEngine, ECBBlockCipher, KeyParameter;
+
+import '_registry.dart';
+import 'adapter.dart';
+import 'signals.dart';
+
+/// Encrypt one authentication challenge.
+///
+/// The ring issues a 15-byte nonce; PKCS#7 pads it to exactly one 16-byte block
+/// (a single 0x01), and the answer is that block under AES-128 in ECB mode with
+/// the pairing key. One block, so ECB's usual objection — that identical
+/// plaintext blocks repeat — has nothing to bite on, and the ring picks a fresh
+/// nonce per connection.
+///
+/// Exposed rather than private so the test can pin it against a known vector
+/// without a radio.
+Uint8List ouraAuthResponse(List<int> key, List<int> nonce) {
+  if (key.length != 16 || nonce.length != 15) {
+    throw ArgumentError('Oura auth takes a 16-byte key and a 15-byte nonce');
+  }
+  final block = Uint8List(16)
+    ..setRange(0, 15, nonce)
+    ..[15] = 0x01;
+  final out = Uint8List(16);
+  ECBBlockCipher(AESEngine())
+    ..init(true, KeyParameter(Uint8List.fromList(key)))
+    ..processBlock(block, 0, out, 0);
+  return out;
+}
+
+/// One Oura session.
+///
+/// NOT const and not a registry singleton, because it needs three things a
+/// const adapter cannot hold: the pairing key, the cursor to resume from, and
+/// the time origin to stamp against. All three belong to the HOST — the key is
+/// a secret it stores, the other two are bookmarks it persists — and handing
+/// them in at construction is what lets the seam stay a one-way
+/// `Stream<BandEvent>` instead of growing an inbound command channel. Each one
+/// comes back out as a [BandNote] when it moves, so the host never has to
+/// re-derive a second copy of something this file already knows.
+class OuraAdapter extends BandAdapter {
+  /// The 16-byte pairing key this phone generated and wrote to this ring.
+  final List<int> key;
+
+  /// Where to resume the history drain, on the ring's decisecond clock. 0 asks
+  /// for everything the ring still holds.
+  final int startCursorDs;
+
+  /// The `(ring decisecond, Unix second)` pair a previous session measured, if
+  /// the host kept one.
+  ///
+  /// THIS IS WHAT MAKES A TIMESTAMP REPRODUCIBLE ACROSS CONNECTS. The ring
+  /// stamps on a decisecond counter with no documented epoch and there is no
+  /// command anywhere in the protocol that reads its clock back — a measured
+  /// `time_sync` event is the ONLY bridge between the two, and it lands wherever
+  /// the ring happened to record one. Handing the last known pair in means a
+  /// given decisecond maps to the same second on every later session, so a
+  /// re-read overwrites its own row instead of writing a second copy of the
+  /// same physiological second under a key REPLACE can never collapse.
+  final (int ds, int unix)? anchor;
+
+  /// Wall-clock now, in Unix seconds. Injected so a fixture replay is
+  /// deterministic — `DateTime.now()` does not appear in this file.
+  final int Function() nowSeconds;
+
+  /// How long to wait for a reply the ring owes us.
+  final Duration replyTimeout;
+
+  /// How long to wait for the host to commit a batch and call `confirm`.
+  /// Expiring is SAFE: the cursor does not move, so the batch is re-read.
+  /// Overridable only so a test does not have to sit through it.
+  final Duration confirmTimeout;
+
+  OuraAdapter({
+    required this.key,
+    this.startCursorDs = 0,
+    this.anchor,
+    int Function()? nowSeconds,
+    this.replyTimeout = const Duration(seconds: 5),
+    this.confirmTimeout = const Duration(seconds: 30),
+  })  : nowSeconds = nowSeconds ??
+            (() => DateTime.now().millisecondsSinceEpoch ~/ 1000),
+        _anchor = anchor;
+
+  @override
+  BandEntry get entry => kOura;
+
+  /// NOTHING, and that is the honest answer today rather than a placeholder.
+  ///
+  /// The ring emits beat-to-beat intervals, SpO2 and a hypnogram, and this
+  /// adapter decodes none of them: their layouts are bit-packed and there is
+  /// not one captured byte of any of them to check a decoder against. A
+  /// declared-but-absent signal is WORSE than a missing one (see
+  /// [BandAdapter.signals]) — it turns a card that should delete itself into
+  /// one that is permanently empty — so nothing is claimed until a decoder
+  /// exists and a real capture has met it.
+  ///
+  /// Temperature is emitted below and still not declared here, deliberately:
+  /// [InputSignal.skinTempRaw] means RELATIVE ADC COUNTS (I8), and this ring
+  /// reports absolute degrees Celsius. They are not the same input and the
+  /// per-family calibration that I8 exists to key does not apply. There is no
+  /// member for absolute temperature and one should not be invented for a band
+  /// nobody owns.
+  @override
+  Map<InputSignal, Duration> get signals => const {};
+
+  /// How many events one history request may return. The wire field is a u8,
+  /// so this is its ceiling, and it is also what tells a full batch from a
+  /// short one when the cursor is advanced.
+  static const int _kMaxEventsPerBatch = 255;
+
+  /// The (ring decisecond, Unix second) pair this session is stamping against.
+  ///
+  /// Seeded from [anchor] and thereafter only IMPROVED — by a `time_sync`
+  /// event, the one record that carries both clocks. Never re-derived per
+  /// batch: a re-anchored batch would write the same physiological second under
+  /// a different `ts_ms` and duplicate rows that REPLACE cannot collapse.
+  ///
+  /// THERE IS NO FALLBACK, and that is the whole point. Seeding this from the
+  /// ARRIVAL of the first batch — the obvious-looking guess — produces an origin
+  /// that moves by the BLE delivery jitter on every connect, which is exactly
+  /// the duplication above with a plausible-looking number on it. When there is
+  /// no anchor there is no timestamp, and a sample without one is not emitted.
+  (int ds, int unix)? _anchor;
+
+  /// Readings decoded before an origin existed, as `(ds, °C)`.
+  ///
+  /// Every connect sets the ring's clock, so the ring records a fresh
+  /// `time_sync` — but it records it at its CURRENT decisecond, which is the
+  /// END of the drain. On a first pairing that is after the whole of its
+  /// history, so abstaining on the spot would throw all of it away. Held
+  /// instead, and stamped by the batch that finally carries an origin. If none
+  /// ever does, they are dropped: the frames are still handed over verbatim in
+  /// every [SampleBatch], so nothing is lost that was not already banked.
+  final List<(int ds, double tempC)> _held = [];
+
+  /// The Unix second [ds] falls on, or null when no origin is known.
+  int? _anchorUnixFor(int ds) {
+    final a = _anchor;
+    if (a == null) return null;
+    // 10 deciseconds to the second. The subtraction is on the ring's own clock,
+    // so the SPACING between records is exact however wrong the origin is.
+    return a.$2 + (ds - a.$1) ~/ 10;
+  }
+
+  @override
+  Stream<BandEvent> run(BandLink link) async* {
+    final inbox = _Inbox();
+    final sub = link.notify(kOuraNotifyChar).listen(
+          (rec) {
+            final f = parseOuraFrame(rec.$2);
+            // The notification bytes AS DELIVERED, not `f` re-encoded: the ring
+            // is known to append trailing bytes past `parseFrame`'s declared
+            // length (see its doc), and those bytes are exactly what a future
+            // decoder for the still-undecoded event types needs. Kept even
+            // though `f` was accepted, because it is `raw_archive`'s copy, not
+            // the parser's.
+            if (f != null) {
+              inbox.add(rec.$1, f, Uint8List.fromList(rec.$2));
+            }
+          },
+          onDone: inbox.close,
+          onError: (Object _) => inbox.close(),
+        );
+    try {
+      if (!await _authenticate(link, inbox)) return;
+
+      // Both writes are documented preconditions of a history drain rather than
+      // housekeeping. The clock set is also what makes a later `time_sync`
+      // event exist at all, and that event is the only anchor between the
+      // ring's decisecond counter and a date. A silent write failure here does
+      // not fail loud on its own: a refused notify-flag write leaves every
+      // later batch waiting out a full `replyTimeout` for frames that will
+      // never arrive, and a refused time-sync write leaves the session with no
+      // measured origin — there is no arrival-time fallback here (that is
+      // `TimeAnchor.arrival` on the *held* reading once SOME anchor exists,
+      // never a substitute for having none), so every reading this session
+      // sees is held in `_held` and stamped only if a stored anchor from an
+      // earlier session covers it.
+      if (!await link.write(kOuraCommandChar, ouraCmdSetNotifyFlags(0x3f))) {
+        link.log('oura: notify-flag write refused; ending the drain.');
+        return;
+      }
+      if (!await link.write(kOuraCommandChar, ouraCmdSyncTime(nowSeconds()))) {
+        link.log('oura: time-sync write refused; no new origin this session. '
+            'Readings are stamped only if a stored anchor covers them.');
+      }
+
+      var cursor = startCursorDs;
+      // A misbehaving ring that answers every request with the same batch would
+      // otherwise spin here forever on a live radio.
+      for (var batch = 0; batch < 5000; batch++) {
+        // Passed explicitly rather than left to the builder's default: the
+        // cursor advance below compares the batch's own count against this
+        // number, and two copies of it that could drift is a silent skip.
+        final req = ouraCmdGetEvents(cursor, maxEvents: _kMaxEventsPerBatch);
+        if (!await link.write(kOuraCommandChar, req)) {
+          link.log('oura: history request refused; ending the drain.');
+          return;
+        }
+        final got = await _collectBatch(inbox);
+        if (got == null) {
+          link.log('oura: no batch summary within the reply window.');
+          return;
+        }
+        if (got.events.isEmpty) {
+          // A CURSOR THE RING CANNOT ANSWER, told apart from an empty ring.
+          //
+          // The decisecond counter is an UPTIME, so a ring that reboots
+          // restarts it near zero — and a bookmark from before the reboot is
+          // then far AHEAD of everything it holds. Every request from there
+          // matches nothing, forever, and the sync looks exactly like "no new
+          // data" while the ring quietly fills up. `bytesLeft` is what
+          // separates them: data remaining and none delivered is not an empty
+          // ring, it is a bookmark pointing past the end. The host's remedy is
+          // to drop the bookmark and re-read from zero, which is free — a
+          // re-read of this band is idempotent by design.
+          if (got.summary.bytesLeft > 0) {
+            link.log('oura: the ring reports ${got.summary.bytesLeft} bytes '
+                'left but answered this cursor with nothing.');
+            yield const BandNote('oura_cursor_stranded');
+          }
+          return;
+        }
+
+        for (final e in got.events) {
+          final unix = decodeTimeSync(e);
+          if (unix == null) continue;
+          // A better origin for this record and every one after it, and for
+          // everything still held. Applied BEFORE the batch is stamped so the
+          // batch carrying the sync is itself correct.
+          _anchor = (e.tsDs, unix);
+          // Surfaced so the host can persist it without re-deriving one of its
+          // own. Two implementations of an origin is two origins.
+          yield BandNote('oura_anchor', '${e.tsDs},$unix');
+        }
+
+        yield* _emit(link, got);
+
+        // THE ORDERING IS THE POINT. The host commits durably, then calls
+        // confirm, and only then does the cursor move. Nothing is deleted
+        // either way — the ring has no trim — so a host that never confirms
+        // costs a re-read, never a record.
+        final done = Completer<bool>();
+        yield OffloadCheckpoint(
+          () async {
+            if (!done.isCompleted) done.complete(true);
+            return true;
+          },
+          remaining: got.summary.bytesLeft,
+        );
+        final confirmed = await done.future
+            .timeout(confirmTimeout, onTimeout: () => false);
+        if (!confirmed) {
+          link.log('oura: batch was not confirmed; leaving the cursor put.');
+          return;
+        }
+        // A FULL BATCH RE-READS ITS LAST DECISECOND; A SHORT ONE MOVES PAST IT.
+        //
+        // The cursor is a TIMESTAMP, not a record index, and the batch cap is a
+        // record count — so a batch that came back full may have been cut in
+        // the middle of a decisecond that holds more records than fitted.
+        // Jumping to `maxDs + 1` there silently drops the remainder, and
+        // nothing downstream can tell: the gap is in the ring's flash, not in
+        // ours. Re-reading `maxDs` instead costs one duplicated decisecond,
+        // which `decoded_onehz`'s REPLACE key absorbs for free.
+        //
+        // The `> cursor` guard is the escape: a ring with a whole batch inside
+        // one decisecond would otherwise re-ask for the same thing forever, and
+        // a bounded loss beats an unbounded stall.
+        final full = got.summary.received >= _kMaxEventsPerBatch;
+        cursor = (full && got.maxDs > cursor) ? got.maxDs : got.maxDs + 1;
+        yield BandNote('oura_cursor_ds', cursor);
+        if (got.summary.bytesLeft <= 0) return;
+      }
+    } finally {
+      await sub.cancel();
+    }
+  }
+
+  /// Nonce, encrypt, answer. False on any refusal — a session that carries on
+  /// unauthenticated gets `auth required` to every command and looks identical
+  /// to a dead link.
+  Future<bool> _authenticate(BandLink link, _Inbox inbox) async {
+    if (!await link.write(kOuraCommandChar, ouraCmdAuthNonce())) return false;
+    final challenge =
+        await inbox.firstWhere((f) => ouraAuthNonce(f) != null, replyTimeout);
+    if (challenge == null) {
+      link.log('oura: no authentication challenge.');
+      return false;
+    }
+    final answer = ouraAuthResponse(key, ouraAuthNonce(challenge)!);
+    if (!await link.write(kOuraCommandChar, ouraCmdAuthenticate(answer))) {
+      return false;
+    }
+    final reply =
+        await inbox.firstWhere((f) => ouraAuthResult(f) != null, replyTimeout);
+    final result = reply == null ? null : ouraAuthResult(reply);
+    if (result != 0) {
+      // Worth naming, because the remedies differ: a wrong key needs re-pairing
+      // and a ring in factory reset needs its key installed first.
+      link.log('oura: authentication refused (result ${result ?? "none"}).');
+      return false;
+    }
+    return true;
+  }
+
+  /// Read frames until the batch summary arrives.
+  Future<_Batch?> _collectBatch(_Inbox inbox) async {
+    final events = <OuraEvent>[];
+    final raw = <Uint8List>[];
+    var maxDs = 0;
+    while (true) {
+      final rec = await inbox.next(replyTimeout);
+      if (rec == null) return null;
+      final (_, f, rawBytes) = rec;
+      final summary = parseBatchSummary(f);
+      if (summary != null) return _Batch(events, raw, maxDs, summary);
+      if (ouraIsAuthRequired(f)) return null;
+      final e = parseOuraEvent(f);
+      if (e == null) continue;
+      events.add(e);
+      // The bytes AS THE RADIO DELIVERED THEM, not `[f.tag, f.payload.length,
+      // ...f.payload]` reconstructed from the parsed frame: `parseOuraFrame`
+      // truncates to the declared length and the ring is known to append
+      // bytes past it (see its doc). Re-encoding here would bank this file's
+      // idea of the frame instead of what a future decoder for the
+      // still-undecoded event types actually needs, and the trailing bytes are
+      // unrecoverable once dropped — `raw_archive` is never pruned but it
+      // cannot un-truncate what was never written.
+      raw.add(rawBytes);
+      if (e.tsDs > maxDs) maxDs = e.tsDs;
+    }
+  }
+
+  /// Turn one collected batch into events for the host.
+  Stream<BandEvent> _emit(BandLink link, _Batch got) async* {
+    final samples = <NeutralSample>[];
+    for (final e in got.events) {
+      switch (e.tag) {
+        case kOuraEvtTemp:
+        case kOuraEvtTempPeriod:
+          final t = decodeTemperatures(e);
+          // The array's probes are not identified — one may be an ambient
+          // reference — so the first is taken and the rest are left in the
+          // archive rather than averaged into a number that means nothing.
+          if (t != null && t.isNotEmpty) _held.add((e.tsDs, t.first));
+        case kOuraEvtDebugData:
+          final d = decodeDebugData(e.body);
+          if (d == null) break;
+          if (d.text != null) link.log('oura fw: ${d.text}');
+          if (d.batteryPct != null) yield BandNote('battery', d.batteryPct);
+          if (d.batteryMv != null) yield BandNote('battery_mv', d.batteryMv);
+      }
+    }
+    // Stamp everything an origin can now reach — this batch's readings and any
+    // held from earlier ones. What still cannot be stamped stays held for a
+    // later batch, and is dropped at the end of the drain rather than guessed
+    // at: a plausible wrong second is worse than a missing one, because nothing
+    // downstream can tell it apart from a measurement.
+    _held.removeWhere((h) {
+      final unix = _anchorUnixFor(h.$1);
+      if (unix == null) return false;
+      samples.add(NeutralSample(
+        anchor: TimeAnchor.arrival,
+        tsEpoch: unix,
+        skinTempC: h.$2,
+      ));
+      return true;
+    });
+    // EVERY event frame is archived, including the ones just decoded and every
+    // one that was not. Beat intervals, SpO2, the hypnogram and steps all live
+    // in here undecoded, and that is the point: the bytes are banked now so a
+    // decoder written when someone owns a ring can be run over them, instead of
+    // a guess being run over them today (owner rulings R1-R3).
+    yield SampleBatch(samples, raw: got.raw);
+  }
+}
+
+/// One batch of history, as collected off the wire.
+class _Batch {
+  final List<OuraEvent> events;
+  final List<Uint8List> raw;
+  final int maxDs;
+  final OuraBatchSummary summary;
+  const _Batch(this.events, this.raw, this.maxDs, this.summary);
+}
+
+/// Frames off the notify characteristic, buffered so that a reply landing
+/// before anyone is waiting is not dropped.
+///
+/// Hand-rolled rather than `package:async`'s `StreamQueue` because that would
+/// mean promoting a transitive dependency to a direct one for one class, and
+/// the whole of what this session needs is "the next frame, or nothing".
+class _Inbox {
+  // Third element is the notification bytes AS DELIVERED — `raw_archive`'s
+  // copy, kept alongside the parsed frame rather than re-derived from it. See
+  // `_collectBatch` for why re-deriving loses bytes.
+  final List<(int, OuraFrame, Uint8List)> _buf = [];
+  Completer<(int, OuraFrame, Uint8List)?>? _waiter;
+  bool _closed = false;
+
+  void add(int atSec, OuraFrame f, Uint8List raw) {
+    final w = _waiter;
+    if (w != null && !w.isCompleted) {
+      _waiter = null;
+      w.complete((atSec, f, raw));
+      return;
+    }
+    _buf.add((atSec, f, raw));
+  }
+
+  void close() {
+    _closed = true;
+    final w = _waiter;
+    _waiter = null;
+    if (w != null && !w.isCompleted) w.complete(null);
+  }
+
+  /// The next frame, or null on timeout or a closed link.
+  Future<(int, OuraFrame, Uint8List)?> next(Duration timeout) {
+    if (_buf.isNotEmpty) return Future.value(_buf.removeAt(0));
+    if (_closed) return Future.value(null);
+    final w = Completer<(int, OuraFrame, Uint8List)?>();
+    _waiter = w;
+    return w.future.timeout(timeout, onTimeout: () {
+      if (identical(_waiter, w)) _waiter = null;
+      return null;
+    });
+  }
+
+  /// The next frame satisfying [test], discarding what comes before it.
+  /// [timeout] bounds the whole search, not each frame.
+  Future<OuraFrame?> firstWhere(
+    bool Function(OuraFrame) test,
+    Duration timeout,
+  ) async {
+    final deadline = Stopwatch()..start();
+    while (deadline.elapsed < timeout) {
+      final rec = await next(timeout - deadline.elapsed);
+      if (rec == null) return null;
+      if (test(rec.$2)) return rec.$2;
+    }
+    return null;
+  }
+}
diff --git a/lib/ble/adapters/signals.dart b/lib/ble/adapters/signals.dart
new file mode 100644
index 00000000..c135a210
--- /dev/null
+++ b/lib/ble/adapters/signals.dart
@@ -0,0 +1,68 @@
+// What a band physically EMITS. Never what OpenStrap can compute from it.
+//
+// This is the whole reason the seam is shaped the way it is. A capability
+// boolean (`supportsSpo2()`) names an OUTPUT: metric N+1 widens the interface
+// and every implementation becomes a breaking change, so the blast radius of a
+// new feature is the device count. That is how Gadgetbridge's
+// `DeviceCoordinator` reached 1,092 lines, 168 methods and ~61 `supportsXxx()`
+// booleans while its device count went 270 -> 511.
+//
+// A signal names an INPUT — a physical fact that was true before anyone
+// conceived the metric. A Polar H10 emits RR intervals whether or not we have
+// written a respiratory-rate function. Blast radius of a new metric: one
+// analytics function and one card. ZERO adapters, forever.
+//
+// The consequence is free and it is the reason there are no UI conditionals:
+// an undeclared signal produces no substrate column, so the metric returns
+// absent and the card deletes itself through the absence contract that already
+// exists.
+//
+// DO NOT add a member for something we compute. `readiness`, `sleepScore` and
+// `hrv` are outputs. If you are about to add one, you want a metric, not a
+// signal.
+library;
+
+/// The eight raw-signal input classes (I1-I8 in `ADDING_A_DEVICE.md`), plus
+/// the one non-raw class a band can offer.
+enum InputSignal {
+  /// I1 — beat-to-beat intervals. The single most valuable thing a band can
+  /// emit: nine analytics files take interval lists directly, so HRV, stress
+  /// and respiration light up with no further work.
+  rrIntervals,
+
+  /// I2 — dense heart rate, roughly one reading per second.
+  hr1Hz,
+
+  /// I3 — heart rate at a coarser or irregular cadence. Declare the real
+  /// cadence; `sampleCadenceSeconds()` measures it and metrics that cannot be
+  /// supported at that rate ABSTAIN rather than stretch a window.
+  hrSparse,
+
+  /// I4 — tri-axial acceleration at ~1 Hz. Sleep staging and wear detection.
+  accel1Hz,
+
+  /// I5 — high-rate acceleration (~100 Hz). The only path to a real step
+  /// count. NOTE: the sustained-magnitude accel bound is derived for 1 Hz
+  /// vectors and is INVALID here — re-derive it before persisting one.
+  accelHighRate,
+
+  /// I6 — raw green PPG ADC counts.
+  ppgGreen,
+
+  /// I7 — raw red + infrared PPG ADC counts. Relative SpO2 only; an absolute
+  /// saturation is a calibration claim no adapter may make.
+  ppgRedIr,
+
+  /// I8 — relative skin-temperature ADC counts.
+  skinTempRaw,
+
+  /// NOT raw. Numbers the band computed itself — its RMSSD, its sleep score.
+  /// These land in `observation`, are attributed to the vendor, and are never
+  /// an input to one of our derivations and never enter a baseline.
+  vendorScalars,
+
+  // There is deliberately NO `ecg` / `ppgWaveform` member. `decoded_onehz` is
+  // one row per second and raw prunes at three days, so a waveform has nowhere
+  // to live. Adding the member before the store exists would let an adapter
+  // declare a capability with nothing behind it — see ADDING_A_DEVICE.md §5.
+}
diff --git a/lib/ble/ble_engine.dart b/lib/ble/ble_engine.dart
index afa7dc1f..2e7264a4 100644
--- a/lib/ble/ble_engine.dart
+++ b/lib/ble/ble_engine.dart
@@ -47,6 +47,7 @@ import '../data/models.dart';
 import '../platform/tasker_bridge.dart';
 import '../sync/paired_device.dart' show cleanDeviceLabel;
 import '../sync/sync_policy.dart';
+import 'adapters/_registry.dart';
 import 'ble_state.dart';
 
 // Little-endian u32 reader. The package keeps `u32` private, and the engine only
@@ -457,11 +458,19 @@ class _Session {
   final BluetoothDevice device;
   BluetoothCharacteristic? cmdTo;
 
-  /// Which WHOOP generation this link speaks. Defaults to gen4 (WHOOP 4) and is
+  /// Which registered band this link speaks. Defaults to gen4 (WHOOP 4) and is
   /// pinned once during service discovery via [applyBand] — everything that
-  /// differs by generation (frame header/CRC, GATT UUIDs, command envelope,
-  /// history ACK, record decode) reads from here.
-  BandProfile band = BandProfile.gen4;
+  /// differs by band (frame header/CRC, GATT UUIDs, command envelope, history
+  /// ACK, record field offsets) reads from here.
+  BandEntry entry = kWhoopGen4;
+
+  /// This link's frame envelope profile. Owned by [entry]; kept as a getter
+  /// because the wire format is `protocol`'s to define, not edge's.
+  ///
+  /// Non-null by construction: this engine only ever drives framed bands
+  /// ([kFramedBands] is what the scan and the discovery match filter on), and
+  /// [applyBand] asserts it at the one place an entry gets pinned.
+  BandProfile get band => entry.wire!;
 
   final Map<String, FrameReassembler> asm = {
     'cmd_from': FrameReassembler(),
@@ -469,13 +478,18 @@ class _Session {
     'data': FrameReassembler(),
   };
 
-  /// Pin this session's generation and rebuild the reassemblers with the
-  /// matching header shape. Called once, at discovery, before any frame is fed.
-  void applyBand(BandProfile b) {
-    band = b;
-    asm['cmd_from'] = FrameReassembler(profile: b);
-    asm['events'] = FrameReassembler(profile: b);
-    asm['data'] = FrameReassembler(profile: b);
+  /// Pin this session's band and rebuild the reassemblers with the matching
+  /// header shape. Called once, at discovery, before any frame is fed.
+  void applyBand(BandEntry e) {
+    final w = e.wire;
+    // A notify-only sensor has no envelope to reassemble and no command
+    // characteristic to write. It reaches the phone through `hrs_link.dart`,
+    // never through this engine — see the registry header.
+    assert(w != null, 'the offload engine only drives framed bands, not ${e.id}');
+    entry = e;
+    asm['cmd_from'] = FrameReassembler(profile: w!);
+    asm['events'] = FrameReassembler(profile: w);
+    asm['data'] = FrameReassembler(profile: w);
   }
   final List<StreamSubscription> subs = [];
   Timer? heartbeat;
@@ -665,12 +679,23 @@ class BleEngine {
   // stuck at 28, duplicate ACKs, sync never completes). Enforce a single owner,
   // FOREGROUND-PRIORITY: a background drainer yields if the band is already owned;
   // a foreground engine preempts a background owner by dropping its link.
-  static BleEngine? _bandOwner;
-
-  /// Claim exclusive ownership of the band for this engine. Returns false only for
-  /// a background drainer when another engine already owns it (→ it must NOT touch
-  /// the band this cycle). A foreground engine always succeeds and preempts any
-  /// background owner by disconnecting it.
+  //
+  // KEYED BY `remoteId`, because the hazard above is about ONE peripheral: two
+  // engines connected to two DIFFERENT devices never share a trim cursor, and
+  // a process-wide single owner made a second device's connect preempt the
+  // primary's link on every connect.
+  static final Map<String, BleEngine> _bandOwners = {};
+
+  /// The peripheral this engine currently holds a claim on, if any. Kept
+  /// because [_releaseBand] is called from paths with no device in scope, and
+  /// it must release exactly the key it took.
+  String? _claimedBandId;
+
+  /// Claim exclusive ownership of the peripheral [remoteId] for this engine.
+  /// Returns false only for a background drainer when another engine already
+  /// owns THAT peripheral (→ it must NOT touch it this cycle); a claim on a
+  /// different device does not block it. A foreground engine always succeeds
+  /// and preempts any background owner of the same device by disconnecting it.
   ///
   /// SERIALIZED PREEMPTION: the preempted engine's teardown is AWAITED (bounded)
   /// before we proceed — firing our connect while its disconnect is still in
@@ -679,8 +704,8 @@ class BleEngine {
   /// GATT). A hung teardown can't wedge us forever: after the timeout we log and
   /// proceed (the preempted engine's own session guards make its late teardown
   /// harmless once we own the band).
-  Future<bool> _claimBand() async {
-    final other = _bandOwner;
+  Future<bool> _claimBand(String remoteId) async {
+    final other = _bandOwners[remoteId];
     final incumbentPresent = other != null && !identical(other, this);
     final decision = BandClaimPolicy.decide(
       incumbentPresent: incumbentPresent,
@@ -716,7 +741,16 @@ class BleEngine {
         }
         break;
     }
-    _bandOwner = this;
+    // Moving to a different peripheral: let the old one go, or this engine
+    // holds two keys and the stale one starves a later drain. ONLY NOW that the
+    // new claim is granted — `connect()` calls this BEFORE `_teardownSession`,
+    // so a `yieldToOwner` returns false with the previous session still live.
+    // Releasing above the switch dropped that peripheral's key while this
+    // engine still held its link, and the next engine to claim it opened a
+    // second drain against a band we were still ACKing.
+    if (_claimedBandId != null && _claimedBandId != remoteId) _releaseBand();
+    _bandOwners[remoteId] = this;
+    _claimedBandId = remoteId;
     return true;
   }
 
@@ -730,17 +764,20 @@ class BleEngine {
       _phase != BleConnState.idle &&
       _phase != BleConnState.error;
 
-  /// Test-only view of the process-wide single-owner claim.
+  /// Test-only view of the per-peripheral single-owner claim.
   @visibleForTesting
-  static bool get bandClaimed => _bandOwner != null;
+  static bool get bandClaimed => _bandOwners.isNotEmpty;
 
-  /// Test-only reset of the process-wide claim (static state otherwise leaks
-  /// across test cases).
+  /// Test-only reset of the claims (static state otherwise leaks across test
+  /// cases).
   @visibleForTesting
-  static void resetBandClaimForTest() => _bandOwner = null;
+  static void resetBandClaimForTest() => _bandOwners.clear();
 
   void _releaseBand() {
-    if (identical(_bandOwner, this)) _bandOwner = null;
+    final id = _claimedBandId;
+    if (id == null) return;
+    if (identical(_bandOwners[id], this)) _bandOwners.remove(id);
+    _claimedBandId = null;
   }
 
   // ── transport state machine ─────────────────────────────────────────────────
@@ -752,7 +789,12 @@ class BleEngine {
   Future<void> _opLock = Future.value();
 
   final SeqAllocator _seq = SeqAllocator();
-  Future<void> _writeChain = Future.value();
+
+  /// This engine's link is ONE peripheral's command characteristic, so one
+  /// write is in flight at a time. Shared type with `GattBandLink`, which needs
+  /// the identical guarantee for the identical reason (ASSUMPTIONS G5) — one
+  /// chain each, never one between them.
+  final WriteChain _writeChain = WriteChain();
 
   /// Reconnection backoff schedule (bounded exponential + jitter). Owned by the
   /// transport; the caller's reconnect loop reads `reconnectDelay(attempt)` so the
@@ -1027,7 +1069,7 @@ class BleEngine {
     );
     session.connected = true;
     session.sawConnected = true;
-    session.applyBand(band);
+    session.applyBand(bandEntryFor(band));
     _session = session;
     debugWriteHook = onWrite;
     _drain = DrainController(
@@ -1388,16 +1430,11 @@ class BleEngine {
   int _helloFailures = 0;
   static const int kHelloFailuresBeforeBondReset = 5;
 
-  /// the pinned bootstrap waits **600 ms** after the
-  /// bond, before notification registration, and **500 ms** after the last
-  /// registration before running the higher-level state machine — on a captured
-  /// link GET_HELLO went out 585 ms after the final CCC write. These are
-  /// OBSERVED client delays; the doc says outright that "the firmware rationale
-  /// is not documented", so they are applied on gen5 only rather than
-  /// perturbing the proven gen4 flow for a reason nobody can state.
-  static const Duration kGen5PreRegistrationDelay = Duration(milliseconds: 600);
-  static const Duration kGen5PostRegistrationDelay =
-      Duration(milliseconds: 500);
+  // The two bootstrap delays moved to `adapters/_registry.dart`
+  // ([kGen5PreRegistrationDelay] / [kGen5PostRegistrationDelay]) and are read
+  // per band off [BandEntry.preRegistrationDelay] — a band-specific duration is
+  // data, and keeping a second copy here would be the one thing an assumption's
+  // named constant exists to prevent.
 
   /// while the band reports charging, ask it what
   /// battery pack it is on — "five attempts, 5,000 ms between attempts", and
@@ -1623,6 +1660,13 @@ class BleEngine {
     // packet count before comparing against the band's expectedPacketCount.
     'gate_dropped_total': _recordGate.dropped,
     'gate_dropped_this_burst': _recordGate.dropped - _burstDroppedAtStart,
+    // EVERY gate rejection was "below the 2023-11 epoch floor" — the signature
+    // of a source whose time base is uptime, a sequence number or milliseconds
+    // rather than wall clock (ASSUMPTIONS F1). Nothing is lost when it fires
+    // (TrimAckPolicy refuses the trim on a drop-only burst) but nothing is
+    // stored either and the chunk is re-delivered forever, so it needs a
+    // reader. This is it.
+    'gate_time_base_not_wallclock': _recordGate.timeBaseNotWallClock,
     // CRC8/CRC32 frame failures — previously silent (see `_subscribe`). A
     // rising count with a healthy `gate_dropped_*` is the signature of a
     // degrading radio corrupting frames rather than a stale/implausible band.
@@ -1719,9 +1763,17 @@ class BleEngine {
   /// Service-filtered scan (mandatory on iOS/macOS — passive scans hide the UUID).
   /// Start ONE scan, stop early on a match, otherwise let the timeout stop it.
   /// NEVER rapid start/stop (Android throttles → SCANNING_TOO_FREQUENTLY).
+  ///
+  /// Serialised process-wide through [withScanLock]: the HR-sensor scan shares
+  /// this one radio scanner, and the `isScanning == false` await below is
+  /// satisfied by ITS `stopScan` too — an unserialised scan silently ends
+  /// having seen nothing and reports "No band found".
   Future<BluetoothDevice?> scan({
     Duration timeout = const Duration(seconds: 12),
-  }) async {
+  }) =>
+      withScanLock(() => _scanLocked(timeout));
+
+  Future<BluetoothDevice?> _scanLocked(Duration timeout) async {
     // A phone-level blocker is NOT "nothing answered". Returning null for a
     // revoked Bluetooth permission classified it as `notFound` upstream, which
     // told the user to walk closer to a band that was never the problem — the
@@ -1737,10 +1789,16 @@ class BleEngine {
       await FlutterBluePlus.stopScan();
     }
     _setPhase(BleConnState.scanning);
-    // Advertise-filter on BOTH generations' service UUIDs (gen4 6108xxxx +
-    // gen5 fd4bxxxx); the actual generation is pinned later at discovery.
-    final gen4Svc = Guid(GattProfile.gen4.service);
-    final gen5Svc = Guid(GattProfile.gen5.service);
+    // Advertise-filter on every FRAMED band's service UUID. This is an
+    // OS-LEVEL filter: a device whose service is not in this list is invisible
+    // to the callback below, so the registry — not a literal here — is what
+    // decides which bands can be seen at all. The actual band is pinned later
+    // at discovery.
+    //
+    // [kFramedBands], not the whole registry: this is the "find my band" scan,
+    // and a notify-only sensor that matched here would be handed to
+    // `_doConnect`, which would then talk WHOOP at it.
+    final wanted = [for (final e in kFramedBands) Guid(e.service)];
     BluetoothDevice? found;
     final sub = FlutterBluePlus.onScanResults.listen((results) {
       for (final r in results) {
@@ -1748,18 +1806,20 @@ class BleEngine {
         final advNames = r.advertisementData.serviceUuids.map(
           (g) => g.str.toLowerCase(),
         );
+        // ponytail: `whoop` name-match is a WHOOP-only fallback for a band that
+        // advertises its name but not its service UUID. A per-entry name
+        // matcher is D9's `BandDiscovery`; until then this one literal stays.
         if (found == null &&
             (name.contains('whoop') ||
                 advNames.any((s) =>
-                    s.startsWith('61080001') || s.startsWith('fd4b0001')))) {
+                    kFramedBands.any((e) => s.startsWith(e.servicePrefix))))) {
           found = r.device;
           FlutterBluePlus.stopScan();
         }
       }
     });
     try {
-      await FlutterBluePlus.startScan(
-          withServices: [gen4Svc, gen5Svc], timeout: timeout);
+      await FlutterBluePlus.startScan(withServices: wanted, timeout: timeout);
       await FlutterBluePlus.isScanning.where((on) => on == false).first;
     } catch (e) {
       // Android reports a missing runtime permission by throwing here rather
@@ -1777,7 +1837,10 @@ class BleEngine {
     }
     if (found == null) {
       _setPhase(BleConnState.idle);
-      _log('No WHOOP found (force-quit the official app; band must be free).');
+      // The remedy in this line is still WHOOP-specific ("the official app").
+      // Per-band copy needs the per-entry discovery/label of D9; the registry
+      // does not make it fixable on its own.
+      _log('No band found (force-quit the official app; band must be free).');
     } else {
       _clearBlocker();
     }
@@ -1858,7 +1921,7 @@ class BleEngine {
     // band the foreground session already owns (duplicate ACKs corrupt the trim
     // cursor). Foreground engines preempt instead — awaiting the preempted
     // engine's teardown so two FBP ops never overlap. See [_claimBand].
-    if (!await _claimBand()) return false;
+    if (!await _claimBand(device.remoteId.str)) return false;
     // Any prior session is dead to us now — tear it down before a new one.
     await _teardownSession(intentional: true);
     try {
@@ -1881,7 +1944,7 @@ class BleEngine {
   /// down, drop to `idle`, AND RELEASE THE BAND CLAIM.
   ///
   /// [_claimBand] runs BEFORE the link is up, so a connect that threw used to
-  /// leave `_bandOwner` pointing at an engine with no link — and only
+  /// leave the claim pointing at an engine with no link — and only
   /// `disconnect()` ever released it, which nothing calls on this path. Every
   /// later background drain then saw a non-null owner and yielded forever.
   Future<void> _failConnect() async {
@@ -2005,68 +2068,85 @@ class BleEngine {
       final services = await device
           .discoverServices()
           .timeout(_serviceDiscoveryTimeout);
-      // Pin the generation from whichever service the peripheral exposes:
-      // gen4 "Harvard" 6108xxxx, or gen5 "fd4b" fd4bxxxx. This drives the frame
-      // header/CRC, command envelope, ACK, and record decode for the session.
+      // Pin the band from whichever registered service the peripheral exposes.
+      // This drives the frame header/CRC, command envelope, ACK, and record
+      // decode for the session.
       BluetoothService? svc;
-      BandProfile band = BandProfile.gen4;
+      BandEntry? entry;
       for (final s in services) {
-        final u = s.uuid.str.toLowerCase();
-        if (u.startsWith(GattProfile.gen4.servicePrefix)) {
-          svc = s;
-          band = BandProfile.gen4;
-          break;
-        }
-        if (u.startsWith(GattProfile.gen5.servicePrefix)) {
-          svc = s;
-          band = BandProfile.gen5;
-          break;
+        // `str128`, not `str`: `str` is the SHORTEST form, so a SIG-assigned
+        // service comes back as `180d` and never starts with a `0000180d`
+        // prefix. WHOOP's uuids are 128-bit either way — see
+        // `GattBandLink._find`, which had the live version of this bug.
+        final u = s.uuid.str128;
+        // [kFramedBands], for the same reason the scan filters on it: this
+        // engine speaks a framed envelope and nothing else.
+        for (final e in kFramedBands) {
+          if (u.startsWith(e.servicePrefix)) {
+            svc = s;
+            entry = e;
+            break;
+          }
         }
+        if (svc != null) break;
       }
-      if (svc == null) {
-        _log('No WHOOP service (gen4 6108xxxx / gen5 fd4bxxxx) found on device.');
+      if (svc == null || entry == null) {
+        _log('No known band service found on device (looked for: '
+            '${kFramedBands.map((e) => "${e.servicePrefix}xxxx").join(", ")}).');
         await _failConnect();
         return false;
       }
-      session.applyBand(band);
-      state.generation = band.isGen5 ? 'gen5' : 'gen4';
-      _log('Detected ${band.isGen5 ? "WHOOP 5 (gen5)" : "WHOOP 4 (gen4)"} link.');
-      final gatt = band.gatt;
-      BluetoothCharacteristic? find(String prefix) {
+      session.applyBand(entry);
+      state.generation = entry.id;
+      _log('Detected ${entry.label} (${entry.id}) link.');
+      // Non-null: `entry` came out of [kFramedBands].
+      final gatt = entry.gatt!;
+      BluetoothCharacteristic? find(String uuid) {
+        final prefix = uuid.substring(0, 8);
         for (final c in svc!.characteristics) {
-          if (c.uuid.str.toLowerCase().startsWith(prefix)) return c;
+          // `str128` — see the service match above.
+          if (c.uuid.str128.startsWith(prefix)) return c;
         }
         return null;
       }
 
-      session.cmdTo = find(gatt.cmdTo.substring(0, 8));
-      final cmdFrom = find(gatt.cmdFrom.substring(0, 8));
-      final events = find(gatt.events.substring(0, 8));
-      final data = find(gatt.data.substring(0, 8));
-      if (session.cmdTo == null ||
-          cmdFrom == null ||
-          events == null ||
-          data == null) {
-        _log('Missing one or more ${band.isGen5 ? "fd4b" : "Harvard"} characteristics.');
+      // WHICH characteristics a link must expose is registry data. Demanding
+      // all four unconditionally is why `hr_sensor.dart` exists as a second
+      // parallel BLE stack — a generic HRS device has ONE notify
+      // characteristic and would abort here.
+      final missing = [
+        for (final u in entry.requiredCharacteristics)
+          if (find(u) == null) u.substring(0, 8),
+      ];
+      if (missing.isNotEmpty) {
+        _log('${entry.label}: missing required characteristic(s) '
+            '${missing.join(", ")}.');
         await _failConnect();
         return false;
       }
-
-      // (gen5 only — see [kGen5PreRegistrationDelay]):
-      // the bond is complete by here, so this is the 600 ms that precedes
-      // notification registration.
-      if (band.isGen5 &&
+      session.cmdTo = find(gatt.cmdTo);
+      final cmdFrom = find(gatt.cmdFrom);
+      final events = find(gatt.events);
+      final data = find(gatt.data);
+
+      // The bond is complete by here, so this is the pause that precedes
+      // notification registration — [BandEntry.preRegistrationDelay], zero on
+      // a band with no evidence for one.
+      final preDelay = entry.preRegistrationDelay;
+      if (preDelay > Duration.zero &&
           !await _bootstrapPause(
             session,
-            kGen5PreRegistrationDelay,
+            preDelay,
             'the pre-registration delay',
           )) {
         return false;
       }
       _setPhase(BleConnState.subscribing);
-      await _subscribe(session, cmdFrom, 'cmd_from');
-      await _subscribe(session, events, 'events');
-      await _subscribe(session, data, 'data');
+      // Null only for a band whose entry does not require the characteristic —
+      // the `missing` gate above has already aborted for one that does.
+      if (cmdFrom != null) await _subscribe(session, cmdFrom, 'cmd_from');
+      if (events != null) await _subscribe(session, events, 'events');
+      if (data != null) await _subscribe(session, data, 'data');
 
       if (!await _bootstrapAfterRegistration(session)) return false;
       // Fresh clock verification stamp — see kRtcReverifyIntervalSeconds.
@@ -2247,12 +2327,14 @@ class BleEngine {
   /// Returns false when the link died under one of the steps; the session has
   /// already been torn down in that case.
   Future<bool> _bootstrapAfterRegistration(_Session session) async {
-    // 500 ms after the last registration, before the
-    // higher-level state machine runs. gen5 only — see the constant.
-    if (session.band.isGen5 &&
+    // The pause after the last registration, before the higher-level state
+    // machine runs — [BandEntry.postRegistrationDelay], zero on a band with no
+    // evidence for one.
+    final postDelay = session.entry.postRegistrationDelay;
+    if (postDelay > Duration.zero &&
         !await _bootstrapPause(
           session,
-          kGen5PostRegistrationDelay,
+          postDelay,
           'the post-registration delay',
         )) {
       return false;
@@ -2361,7 +2443,7 @@ class BleEngine {
   /// the WHOOP 5 bootstrap is where the evidence lives.
   Future<void> _bootstrapSetClock(_Session session) async {
     if (_deferForClock) return;
-    if (session.band.isGen5) {
+    if (session.entry.setClockDriftGated) {
       final drift = _clockRef?.driftSec;
       if (!BootstrapClockGate.needsCorrection(drift)) {
         _log('[CLOCK] in sync (drift ${drift}s, tolerance '
@@ -2498,13 +2580,14 @@ class BleEngine {
       // Re-arm ONLY what the current live mode wants: re-sending the high-rate
       // R10/R11 toggle while in HR-only mode (background downgrade) or under the
       // marginal-radio fallback would silently undo the downgrade every 30 s.
-      // gen5: 0x3F is Unknown/Unhandled — re-arm IMU instead when full live.
-      final isGen5 = _session?.band.isGen5 ?? false;
+      // A band with no SEND_R10_R11 opcode (WHOOP 5: Unknown/Unhandled) carries
+      // its high-rate live stream on the IMU toggle, so that is what re-arms.
+      final r10 = (_session?.entry ?? kWhoopGen4).commands.r10R11Realtime;
       if (!_liveHrOnly && !state.standardHrFallback) {
-        if (isGen5) {
+        if (r10 == null) {
           _sendToggleImu(true);
         } else {
-          _send(Cmd.sendR10R11Realtime, const [0x01]);
+          _send(r10, const [0x01]);
         }
       }
       // Evidence-gated: the HR re-arm exists to recover a stream that silently
@@ -2987,15 +3070,13 @@ class BleEngine {
     // FORCE_TRIM (whose full-erase form is two 0xFEFEFEFE args), REBOOT and
     // POWER_CYCLE cannot leave this engine by any path.
     final opcode =
-        allowDangerous ? null : _opcodeOfFrame(raw, session?.band ?? BandProfile.gen4);
+        allowDangerous ? null : _opcodeOfFrame(raw, session?.entry ?? kWhoopGen4);
     if (opcode != null &&
         (dangerousCmds.contains(opcode) || OpcodeSafety.isDestructive(opcode))) {
       _log('REFUSED dangerous opcode 0x${opcode.toRadixString(16)} at _write');
       return Future.value(false);
     }
-    final completer = Completer<bool>();
-    _writeChain = _writeChain.then((_) async {
-      var ok = false;
+    return _writeChain.add<bool>(() async {
       try {
         // Readiness and ownership are checked BEFORE the test seam, not after,
         // so a hooked write rejects a stale-session ACK exactly like the real
@@ -3003,21 +3084,18 @@ class BleEngine {
         // makes every test that relies on it prove the wrong thing.
         if (session == null || !session.connected) {
           _log('write skipped: link not ready.');
-          return;
+          return false;
         }
         if (owner != null && !identical(owner, session)) {
           _log('write skipped: it belongs to a session that is no longer live.');
-          return;
+          return false;
         }
         final hook = debugWriteHook;
-        if (hook != null) {
-          ok = await hook(raw);
-          return;
-        }
+        if (hook != null) return await hook(raw);
         final cmd = session.cmdTo;
         if (cmd == null) {
           _log('write skipped: link not ready.');
-          return;
+          return false;
         }
         // allowLongWrite: the rich SET_ALARM_TIME frame is 32B — the only write
         // that exceeds the 20B ATT limit of a default (23B) MTU. Without a long
@@ -3027,23 +3105,27 @@ class BleEngine {
         await cmd
             .write(raw, withoutResponse: false, allowLongWrite: true)
             .timeout(_writeTimeout);
-        ok = true;
+        return true;
       } on TimeoutException {
         _log('write timeout: no GATT response in ${_writeTimeout.inSeconds}s.');
+        return false;
       } catch (e) {
         _log('write error: $e');
-      } finally {
-        completer.complete(ok);
+        return false;
       }
     });
-    return completer.future;
   }
 
   /// The command opcode carried by an already-framed outbound write, or null
-  /// when [raw] is too short to carry one. Layout is `header | pktType | seq |
-  /// opcode | body…`, and only the header length differs by generation.
-  static int? _opcodeOfFrame(Uint8List raw, BandProfile band) {
-    final i = band.headerLen + 2;
+  /// when [raw] is too short to carry one. Where the opcode sits is registry
+  /// data ([BandEntry.frameOpcodeIndex] = the band's header length plus its
+  /// inner-payload opcode offset), not a WHOOP literal.
+  ///
+  /// This feeds the dangerous-opcode block, so a band whose entry gets this
+  /// wrong reads the wrong byte and the block stops protecting it — see the
+  /// guard's own test.
+  static int? _opcodeOfFrame(Uint8List raw, BandEntry entry) {
+    final i = entry.frameOpcodeIndex;
     return i < raw.length ? raw[i] : null;
   }
 
@@ -3144,12 +3226,12 @@ class BleEngine {
   }
 
   // Offload commands whose PAYLOAD (not just the frame envelope) is
-  // generation-specific: gen4 sends a single 0x00, gen5 sends an EMPTY payload.
-  // Centralised so every offload trigger — the initial handshake, periodic
-  // backfill, manual refresh, and retry — emits the correct gen5 format on a
-  // gen5 link. (_send already frames with the session's BandProfile.)
+  // band-specific: gen4 sends a single 0x00, gen5 sends an EMPTY payload.
+  // Read from [BandWireCommands.offloadBody] so every offload trigger — the
+  // initial handshake, periodic backfill, manual refresh, and retry — emits the
+  // right one. (_send already frames with the session's BandProfile.)
   List<int> get _offloadPayload =>
-      (_session?.band.isGen5 ?? false) ? const <int>[] : const <int>[0x00];
+      (_session?.entry ?? kWhoopGen4).commands.offloadBody;
   /// IMU_SET_DATA_STREAM for the session's band. gen5 wants a leading revision
   /// byte where gen4 sends a bare on/off byte; protocol's `cmdToggleImu` owns
   /// that split. Sent the gen4 body, a gen5 strap reads the state from past the
@@ -3372,16 +3454,17 @@ class BleEngine {
         onEvent?.call(e.eventId, e.tsEpoch, _innerHex(frame.inner));
       }
     }
-    final band = _session?.band ?? BandProfile.gen4;
+    final entry = _session?.entry ?? kWhoopGen4;
+    final band = entry.wire!;
     final decoded = _maybeAugmentClockEpoch(
       frame,
       decodeFrame(frame, profile: band),
     );
-    // gen5-only, debug-visibility ONLY (never persisted, never gated on):
-    // log the strap's own console text (now decoded by protocol's
-    // `parseConsoleLog`, wired into `decodeFrame` above). Genuinely useful
-    // for diagnosing the untested gen5 handshake/offload on real hardware.
-    if (band.isGen5 && decoded.kind == 'console_log') {
+    // Debug-visibility ONLY (never persisted, never gated on): log the strap's
+    // own console text (decoded by protocol's `parseConsoleLog`, wired into
+    // `decodeFrame` above). Per-band because the value of the noise is — see
+    // [BandEntry.logsConsoleOutput].
+    if (entry.logsConsoleOutput && decoded.kind == 'console_log') {
       _log('[CONSOLE gen5] idx=${decoded.fields['record_index']} '
           'ts=${decoded.fields['ts_epoch']}: ${decoded.fields['text']}');
     }
@@ -3528,7 +3611,9 @@ class BleEngine {
   void _ingestHistoricalFrame(Frame frame) {
     final pt = frame.packetType;
     if (pt != PacketType.historicalData) return;
-    final recType = frame.inner.length > 1 ? frame.inner[1] : -1;
+    // Where the record-version byte sits is registry data, not a literal.
+    final vAt = (_session?.entry ?? kWhoopGen4).innerVersionOffset;
+    final recType = frame.inner.length > vAt ? frame.inner[vAt] : -1;
     final counter = _counterFromInner(frame.inner);
     // Explicit, observable band-reboot signal — see CounterRegressionDetector.
     // 0 is _counterFromInner's fallback for a too-short frame, not a real
@@ -4520,8 +4605,9 @@ class BleEngine {
       // and actual varies run to run with no fixed offset, and a hard gate
       // turns that into a permanent stall (15 failures → abort → Stuck) on a
       // band whose count semantics nothing has pinned — so gen4 keeps the
-      // advisory-only behaviour until a gen4 capture settles it.
-      final gateEnforced = session.band.isGen5;
+      // advisory-only behaviour until a gen4 capture settles it. That is the
+      // whole content of [BandEntry.burstCountGateEnforced]; do not flip it.
+      final gateEnforced = session.entry.burstCountGateEnforced;
       final validated = expected == null ||
           !gateEnforced ||
           d.validateBurst(
@@ -5009,8 +5095,12 @@ class BleEngine {
     }
   }
 
-  int _counterFromInner(Uint8List inner) =>
-      inner.length >= 7 ? u32(inner, 3) : 0;
+  /// The record counter out of a historical record's inner payload. Where it
+  /// sits is registry data; 0 is the too-short fallback, not a real counter.
+  int _counterFromInner(Uint8List inner) {
+    final at = (_session?.entry ?? kWhoopGen4).innerCounterOffset;
+    return inner.length >= at + 4 ? u32(inner, at) : 0;
+  }
   static const _hexDigits = '0123456789abcdef';
   // Called once per stored record, once per archived record and once per live
   // frame, so it runs ~50k times in an offload on the UI isolate. The obvious
@@ -5766,10 +5856,12 @@ class BleEngine {
   }
 
   /// Read the strap's advertising name. gen5 does not implement gen4's
-  /// advertising-name opcodes at all — it has its own pair.
-  Future<void> getStrapName() => (_session?.band.isGen5 ?? false)
-      ? _send(Cmd.getCustomAdvertisingName, const [revision1])
-      : _send(Cmd.getAdvertisingNameHarvard, const [0x00]);
+  /// advertising-name opcodes at all — it has its own pair, which is why the
+  /// opcode AND the body come from the band's command table.
+  Future<void> getStrapName() {
+    final c = (_session?.entry ?? kWhoopGen4).commands;
+    return _send(c.getAdvertisingName, c.getAdvertisingNameBody);
+  }
 
   /// Rename the strap. Payload: [0x01][name length u8][ASCII name bytes][u32 0].
   /// Same body on both generations; only the opcode differs.
@@ -5781,9 +5873,8 @@ class BleEngine {
         .take(20)
         .toList();
     final payload = <int>[0x01, ascii.length, ...ascii, 0, 0, 0, 0];
-    final isGen5 = _session?.band.isGen5 ?? false;
     await _send(
-      isGen5 ? Cmd.setCustomAdvertisingName : Cmd.setAdvertisingNameHarvard,
+      (_session?.entry ?? kWhoopGen4).commands.setAdvertisingName,
       payload,
     );
     _log('SET_ADVERTISING_NAME → "$name"');
@@ -5792,9 +5883,10 @@ class BleEngine {
   // main's throttled poll (a raw send here was 2,880 round-trips a day), and
   // the branch's gen5 HELLO, which is a different opcode on Maverick.
   Future<void> getBattery() => _pollBatteryIfDue(force: true);
-  Future<void> getHello() => (_session?.band.isGen5 ?? false)
-      ? _send(Cmd.getHello, const [0x01])
-      : _send(Cmd.getHelloHarvard, const [0x00]);
+  Future<void> getHello() {
+    final c = (_session?.entry ?? kWhoopGen4).commands;
+    return _send(c.hello, c.helloBody);
+  }
   Future<void> buzz() => buzzPattern(hapticShortPulse);
 
   /// Play a haptic buzz. gen5 ("Maverick") has a DIFFERENT buzz opcode and
@@ -5822,7 +5914,7 @@ class BleEngine {
     unawaited(_applyLinkPriority()); // a live consumer earns the fast interval
     _armTime =
         DateTime.now(); // marginal-radio detector measures arm→drop latency
-    final isGen5 = _session?.band.isGen5 ?? false;
+    final c = (_session?.entry ?? kWhoopGen4).commands;
     await _send(Cmd.toggleRealtimeHr, const [0x01]);
     // MARGINAL-RADIO FALLBACK: a weak radio can't sustain the high-rate R10/R11 +
     // IMU + optical flood, so once the detector trips we arm HR only.
@@ -5831,27 +5923,29 @@ class BleEngine {
       return;
     }
     await Future.delayed(const Duration(milliseconds: 100));
-    // gen5 console: 0x3F (R10/R11 realtime) is Unknown/Unhandled — skip it.
-    // Live steps ride toggleImuMode (gen5: 0x2B rec 0x15; gen4: 0x33).
-    if (!isGen5) {
-      await _send(Cmd.sendR10R11Realtime, const [0x01]);
+    // A band with no SEND_R10_R11 opcode (gen5 console: 0x3F is
+    // Unknown/Unhandled) skips it. Live steps ride toggleImuMode there
+    // (gen5: 0x2B rec 0x15; gen4: 0x33).
+    final r10 = c.r10R11Realtime;
+    if (r10 != null) {
+      await _send(r10, const [0x01]);
       await Future.delayed(const Duration(milliseconds: 100));
     }
     await _sendToggleImu(true);
     await Future.delayed(const Duration(milliseconds: 100));
-    // gen4 only. On gen5 this opcode is the SAVE-to-history toggle, not the
-    // realtime stream — the realtime one is the next opcode up — so arming it
-    // here would write a save enable on every live-stream start, next door to
-    // the persistent-optical footgun that leaves the LEDs on and drains the
-    // battery. gen5's own 1 Hz stream already carries per-second HR, so there
-    // is nothing to gain until the roles are confirmed on hardware. The OFF
-    // writes in disableLiveStreams stay unconditional.
-    if (!isGen5) {
+    // Only where ENABLE_OPTICAL_DATA is the LIVE toggle. On gen5 it is the
+    // SAVE-to-history toggle — the realtime one is the next opcode up — so
+    // arming it here would write a save enable on every live-stream start, next
+    // door to the persistent-optical footgun that leaves the LEDs on and drains
+    // the battery. gen5's own 1 Hz stream already carries per-second HR, so
+    // there is nothing to gain until the roles are confirmed on hardware. The
+    // OFF writes in disableLiveStreams stay unconditional.
+    if (c.opticalDataIsLiveToggle) {
       await _send(Cmd.enableOpticalData, const [revision1, 0x01]);
     }
     _log(
       'Live streams enabled ('
-      '${isGen5 ? "gen5 IMU rev1; optical skipped" : "optical: wrist-gated"}).',
+      '${c.opticalDataIsLiveToggle ? "optical: wrist-gated" : "gen5 IMU rev1; optical skipped"}).',
     );
   }
 
@@ -5884,13 +5978,13 @@ class BleEngine {
     if (_session?.connected != true) return;
     _liveEnabled = true;
     _liveHrOnly = true;
-    final isGen5 = _session?.band.isGen5 ?? false;
+    final r10 = (_session?.entry ?? kWhoopGen4).commands.r10R11Realtime;
     unawaited(_applyLinkPriority()); // downgraded to HR-only ⇒ step the link down
     await _send(Cmd.toggleRealtimeHr, const [0x01]);
     final offOps = <Future<bool> Function()>[
       () => _send(Cmd.toggleOpticalMode, const [revision1, 0x00]),
       () => _send(Cmd.enableOpticalData, const [revision1, 0x00]),
-      if (!isGen5) () => _send(Cmd.sendR10R11Realtime, const [0x00]),
+      if (r10 != null) () => _send(r10, const [0x00]),
       () => _sendToggleImu(false),
     ];
     for (final op in offOps) {
@@ -5902,11 +5996,11 @@ class BleEngine {
 
   /// Turn everything off. Safe + idempotent. Clears flags back to wrist-gated.
   Future<void> disableLiveStreams() async {
-    final isGen5 = _session?.band.isGen5 ?? false;
+    final r10 = (_session?.entry ?? kWhoopGen4).commands.r10R11Realtime;
     final ops = <Future<bool> Function()>[
       () => _send(Cmd.toggleOpticalMode, const [revision1, 0x00]),
       () => _send(Cmd.enableOpticalData, const [revision1, 0x00]),
-      if (!isGen5) () => _send(Cmd.sendR10R11Realtime, const [0x00]),
+      if (r10 != null) () => _send(r10, const [0x00]),
       () => _sendToggleImu(false),
       () => _send(Cmd.toggleRealtimeHr, const [0x00]),
     ];
diff --git a/lib/ble/ble_state.dart b/lib/ble/ble_state.dart
index a9149fd5..4da50fde 100644
--- a/lib/ble/ble_state.dart
+++ b/lib/ble/ble_state.dart
@@ -15,7 +15,7 @@ import 'dart:math';
 import 'package:openstrap_protocol/openstrap_protocol.dart'
     show alarmRev1Payload;
 
-import '../sync/sync_policy.dart' show isPlausibleUnix;
+import '../sync/sync_policy.dart' show isPlausibleUnix, kMinPlausibleUnix;
 
 /// The explicit connection state machine. The flutter_blue_plus connection-state
 /// stream is the SOURCE OF TRUTH for connected/disconnected; this enum layers the
@@ -487,8 +487,27 @@ class RecordGate {
   /// Records rejected by the plausibility gate this connection.
   int dropped = 0;
 
+  /// Of [dropped], the ones that failed the ABSOLUTE floor
+  /// (`ts < kMinPlausibleUnix`) rather than the future or session-window tests.
+  /// The two have opposite prognoses: an unset or wandering RTC drifts back
+  /// into range (or SET_CLOCK pulls it back), while a source whose time base is
+  /// not a wall-clock epoch at all never will. Counted, never acted on — the
+  /// gate's verdict is identical either way, and must stay so.
+  int droppedBelowFloor = 0;
+
   RecordGate({this.frontierTs = 0});
 
+  /// True when this connection rejected records and EVERY rejection was below
+  /// the absolute floor — the signature of a source that does not stamp
+  /// wall-clock time (uptime-since-boot, a sequence number, milliseconds).
+  ///
+  /// Worth reporting apart from a transient clock problem because the stall is
+  /// PERMANENT: no retry, reconnect or SET_CLOCK resolves it, and the visible
+  /// symptom (records seen, nothing banked, the chunk re-delivered forever) is
+  /// identical to the transient case. See the `kMinPlausibleUnix` assumption
+  /// block in `sync_policy.dart` for the upgrade path.
+  bool get timeBaseNotWallClock => dropped > 0 && dropped == droppedBelowFloor;
+
   /// Should this record be stored? Records with no decodable time ([tsEpoch]
   /// null or <= 0) are always admitted (we can't gate them) and never advance
   /// the frontier. Plausible records advance [frontierTs]; implausible ones
@@ -507,6 +526,7 @@ class RecordGate {
       sessionNewestUnix: sessionNewestUnix,
     )) {
       dropped++;
+      if (tsEpoch < kMinPlausibleUnix) droppedBelowFloor++;
       return false;
     }
     if (tsEpoch > frontierTs) frontierTs = tsEpoch;
@@ -1688,3 +1708,71 @@ class BatteryPackInfoGate {
   }
 }
 
+/// Process-wide BLE scan mutex.
+///
+/// The radio has ONE scanner. Today `BleEngine.scan` is its only caller —
+/// `hr_sensor.dart`'s sensor scan had zero callers and went with the file, and
+/// a pairing screen for a second device is the next thing to take this lock.
+/// Every caller stops whatever is already scanning and then waits for
+/// `FlutterBluePlus.isScanning` to go false — an await that any scan stopping
+/// satisfies, including the OTHER caller's. The loser's scan therefore
+/// "completed" the instant the winner called `stopScan`, having seen nothing,
+/// and the caller reported "no device found" with no error anywhere to say
+/// why. Serialising the two bodies is the whole fix.
+///
+/// Same idiom as `BleEngine._locked` — chain onto the previous op, hand the
+/// caller a completer, swallow nothing — hoisted out of the engine because the
+/// contention is BETWEEN objects, not between two ops on one engine. It has to
+/// stay static once a primary band and a secondary device can both scan.
+///
+/// ponytail: one global lock, so a queued scan waits out the running one's
+/// whole timeout (~12 s) rather than joining it. Give waiters the running
+/// scan's results only if a screen ever needs both scans at once.
+Future<T> withScanLock<T>(Future<T> Function() body) {
+  final completer = Completer<T>();
+  // A body that throws must not break the chain — the error goes to its own
+  // caller and the next scan still runs.
+  _scanLock = _scanLock.then((_) async {
+    try {
+      completer.complete(await body());
+    } catch (e, st) {
+      completer.completeError(e, st);
+    }
+  });
+  return completer.future;
+}
+
+Future<void> _scanLock = Future.value();
+
+/// One GATT write in flight at a time, per LINK.
+///
+/// Same idiom as [withScanLock] — chain onto the previous op, hand the caller a
+/// completer, swallow nothing — but INSTANCE-scoped, because the thing being
+/// serialised is one peripheral's command characteristic and two peripherals
+/// must not queue behind each other (the per-remoteId ownership model exists so
+/// a background drainer and a foreground link can run at once).
+///
+/// Why it has to exist at all: a with-response write issued before the previous
+/// one has been acknowledged is dropped or reordered by the stack, and the
+/// failure is SILENT — the frame simply never reaches the band. `BleEngine`
+/// has had this since the batch-ACK path was written; `GattBandLink` shipped
+/// without it (ASSUMPTIONS G5) and could not bite only because no adapter
+/// wrote anything yet.
+class WriteChain {
+  Future<void> _tail = Future.value();
+
+  /// Run [op] after everything already queued on this chain. The returned
+  /// future carries [op]'s result or its error; the chain itself never carries
+  /// the error, so one failed write cannot wedge every write after it.
+  Future<T> add<T>(Future<T> Function() op) {
+    final completer = Completer<T>();
+    _tail = _tail.then((_) async {
+      try {
+        completer.complete(await op());
+      } catch (e, st) {
+        completer.completeError(e, st);
+      }
+    });
+    return completer.future;
+  }
+}
diff --git a/lib/ble/hr_sensor.dart b/lib/ble/hr_sensor.dart
deleted file mode 100644
index 20de8059..00000000
--- a/lib/ble/hr_sensor.dart
+++ /dev/null
@@ -1,314 +0,0 @@
-// HrSensor — a standard Bluetooth heart-rate sensor (GATT Heart Rate Service,
-// 0x180D) as a SESSION-SCOPED second opinion on exercise HR.
-//
-// WHY THIS EXISTS. The public positioning says "works with any standard
-// Bluetooth heart rate sensor", and until this file there was no `180d`, no
-// `2a37` and no Heart Rate Service anywhere in the tree. That made the claim
-// false in code, which is a correctness problem before it is a feature gap.
-//
-// WHAT IT IS NOT.
-//  * NOT a background source. It is armed by a workout and disarmed when the
-//    workout ends — the same rule GPS follows, for the same reason: a second
-//    GATT link held open all day is a battery cost and a scan/connect fight
-//    with the band's own link.
-//  * NOT better than the band overnight. A chest strap is better at exercise HR
-//    and beat timing; that is the whole of the claim.
-//  * NOT a WHOOP replacement, and NOT baseline input. Its rows land in
-//    `external_hr` with the sensor's name attached and NOTHING derives from
-//    them. `decoded_onehz`/`decoded_rr` carry a `source` column so that even if
-//    a future version does route these into the substrate, every baseline read
-//    is already filtering them out — resting HR from a chest strap and from
-//    wrist PPG differ systematically, and merging them quietly is how a step
-//    change lands in every long-horizon number with no visible cause.
-//  * NOT a sub-second beat timeline. The sensor reports RR *durations* and we
-//    store durations. Beat TIMES are `decoded_rr`'s key and every consumer of
-//    it; that is a separate change.
-//
-// PAIRING IS USER-INITIATED AND SEPARATE FROM ARMING. `scan()` runs only when
-// the user asks for it from a settings screen; arming connects straight to the
-// stored remote id with no scan at all, so a workout start never contends with
-// the band's service-filtered scan.
-
-import 'dart:async';
-import 'dart:convert';
-
-import 'package:flutter/foundation.dart';
-import 'package:flutter_blue_plus/flutter_blue_plus.dart';
-import 'package:shared_preferences/shared_preferences.dart';
-
-import '../data/db.dart';
-import '../sync/paired_device.dart' show cleanDeviceLabel;
-
-/// GATT Heart Rate Service and its Heart Rate Measurement characteristic.
-/// Written out in full 128-bit form rather than the 16-bit shorthand: the
-/// shorthand's expansion is a platform detail we should not depend on.
-const String kHeartRateServiceUuid = '0000180d-0000-1000-8000-00805f9b34fb';
-const String kHeartRateMeasurementUuid = '00002a37-0000-1000-8000-00805f9b34fb';
-
-/// One Heart Rate Measurement notification.
-@immutable
-class HrsSample {
-  /// Beats per minute as the sensor reported it.
-  final int hr;
-
-  /// Beat-to-beat DURATIONS in milliseconds carried by this notification, in
-  /// the order the sensor sent them. Empty when the sensor does not report RR
-  /// (many optical armbands do not) — empty is "not reported", never "zero".
-  final List<int> rrMs;
-
-  /// The sensor's own contact claim: true/false when it reports one, null when
-  /// it does not support the field at all. Never inferred from HR.
-  final bool? contact;
-
-  const HrsSample({required this.hr, required this.rrMs, this.contact});
-}
-
-/// Parse a Heart Rate Measurement (0x2A37) value.
-///
-/// Layout (Bluetooth SIG, Heart Rate Service 1.0):
-///   byte 0  flags
-///     bit 0  HR format: 0 = uint8, 1 = uint16 little-endian
-///     bits 1-2  sensor contact: 0b00/0b01 = not supported, 0b10 = no contact,
-///               0b11 = contact
-///     bit 3  Energy Expended present (uint16, kJ) — skipped, we do not use it
-///     bit 4  RR-Interval present (one or more uint16, units of 1/1024 s)
-///   then HR, then energy expended if present, then RR intervals to the end.
-///
-/// Returns null for a value that cannot be read as this characteristic (too
-/// short, or a truncated field). A malformed notification is DROPPED, never
-/// patched up into a plausible-looking beat.
-HrsSample? parseHeartRateMeasurement(List<int> value) {
-  if (value.length < 2) return null;
-  final flags = value[0];
-  final wide = (flags & 0x01) != 0;
-  var i = 1;
-  final int hr;
-  if (wide) {
-    if (value.length < 3) return null;
-    hr = value[1] | (value[2] << 8);
-    i = 3;
-  } else {
-    hr = value[1];
-    i = 2;
-  }
-  // 0 bpm is not a measurement. Sensors emit it while searching for a signal;
-  // storing it would put a real-looking zero into a heart-rate series.
-  if (hr <= 0 || hr > 300) return null;
-
-  final contactBits = (flags >> 1) & 0x03;
-  final contact = contactBits < 2 ? null : contactBits == 3;
-
-  if ((flags & 0x08) != 0) i += 2; // energy expended — present, not used
-  final rr = <int>[];
-  if ((flags & 0x10) != 0) {
-    // Trailing RR intervals, uint16 LE, 1/1024 s each. A trailing odd byte is a
-    // malformed value: stop rather than reading past it.
-    while (i + 1 < value.length) {
-      final ticks = value[i] | (value[i + 1] << 8);
-      i += 2;
-      // 1024 ticks = 1 s. Round to the nearest millisecond.
-      final ms = (ticks * 1000 + 512) ~/ 1024;
-      // 250-3000 ms is 20-240 bpm. Outside that the value is not a beat
-      // interval, and a chest strap emits exactly this junk on a dropped beat.
-      if (ms >= 250 && ms <= 3000) rr.add(ms);
-    }
-  }
-  return HrsSample(hr: hr, rrMs: rr, contact: contact);
-}
-
-/// The heart-rate sensor the user paired, if any. Separate keys from
-/// [PairedDevice] — the band and a sensor are two different links and pairing
-/// one must never disturb the other.
-class PairedHrSensor {
-  static const String _kId = 'hrs_remote_id';
-  static const String _kName = 'hrs_name';
-
-  final String remoteId;
-  final String name;
-  const PairedHrSensor(this.remoteId, this.name);
-
-  static Future<PairedHrSensor?> load() async {
-    final prefs = await SharedPreferences.getInstance();
-    final id = prefs.getString(_kId);
-    if (id == null || id.isEmpty) return null;
-    return PairedHrSensor(id, prefs.getString(_kName) ?? 'Heart rate sensor');
-  }
-
-  static Future<void> save(String remoteId, String? name) async {
-    final prefs = await SharedPreferences.getInstance();
-    await prefs.setString(_kId, remoteId);
-    // Same sanitiser the band label uses: a garbled advertised name must never
-    // become the `source` string stamped on stored rows.
-    await prefs.setString(_kName, cleanDeviceLabel(name) ?? 'Heart rate sensor');
-  }
-
-  static Future<void> clear() async {
-    final prefs = await SharedPreferences.getInstance();
-    await prefs.remove(_kId);
-    await prefs.remove(_kName);
-  }
-}
-
-/// The live link to a paired heart-rate sensor. One instance; a second
-/// concurrent sensor is not a thing anyone asked for.
-class HrSensorLink {
-  HrSensorLink._();
-  static final HrSensorLink instance = HrSensorLink._();
-
-  /// Flush cadence for the write buffer. A sensor notifies ~1 Hz, and one
-  /// transaction per beat on the UI isolate is the mistake `commitSyncBatch`
-  /// already chunks around.
-  static const Duration _flushEvery = Duration(seconds: 15);
-
-  BluetoothDevice? _device;
-  StreamSubscription<List<int>>? _valueSub;
-  StreamSubscription<BluetoothConnectionState>? _connSub;
-  Timer? _flushTimer;
-  final List<Map<String, Object?>> _pending = [];
-  String? _sessionId;
-  String? _source;
-
-  /// The most recent bpm the sensor reported, for a live readout. Null when no
-  /// sensor is armed or none has reported yet — an armed-but-silent sensor is
-  /// absent, not zero.
-  final ValueNotifier<int?> liveHr = ValueNotifier<int?>(null);
-
-  /// True once the sensor link is up and notifications are subscribed.
-  final ValueNotifier<bool> armed = ValueNotifier<bool>(false);
-
-  /// The sensor's name, used as the `source` on every row it produces.
-  String? get sourceName => _source;
-
-  /// Scan for heart-rate sensors. USER-INITIATED ONLY (a settings screen), never
-  /// on the workout path — it shares one radio scanner with the band's own scan.
-  ///
-  /// Returns (remoteId, name) pairs, deduplicated, strongest first.
-  Future<List<(String, String)>> scan({
-    Duration timeout = const Duration(seconds: 8),
-  }) async {
-    if (FlutterBluePlus.isScanningNow) await FlutterBluePlus.stopScan();
-    final found = <String, (String, int)>{};
-    final sub = FlutterBluePlus.onScanResults.listen((results) {
-      for (final r in results) {
-        final name = cleanDeviceLabel(r.device.platformName) ??
-            cleanDeviceLabel(r.advertisementData.advName);
-        if (name == null) continue;
-        found[r.device.remoteId.str] = (name, r.rssi);
-      }
-    });
-    try {
-      await FlutterBluePlus.startScan(
-        withServices: [Guid(kHeartRateServiceUuid)],
-        timeout: timeout,
-      );
-      await FlutterBluePlus.isScanning.where((on) => on == false).first;
-    } catch (_) {
-      // A revoked permission or a disabled adapter surfaces here on Android.
-      // The band engine already owns the blocker classification and the copy
-      // for it; from here an empty list is the honest answer.
-    } finally {
-      await sub.cancel();
-    }
-    final entries = found.entries.toList()
-      ..sort((a, b) => b.value.$2.compareTo(a.value.$2));
-    return [for (final e in entries) (e.key, e.value.$1)];
-  }
-
-  /// Connect to the paired sensor and start logging for [sessionId].
-  /// No-op (returns false) when nothing is paired — this is opt-in hardware.
-  ///
-  /// Never scans: it connects straight to the stored remote id, so arming a
-  /// workout cannot contend with the band's scan.
-  Future<bool> arm(String sessionId) async {
-    if (armed.value) return true;
-    final paired = await PairedHrSensor.load();
-    if (paired == null) return false;
-    _sessionId = sessionId;
-    _source = paired.name;
-    try {
-      final device = BluetoothDevice.fromId(paired.remoteId);
-      _device = device;
-      await device.connect(timeout: const Duration(seconds: 12));
-      final services = await device.discoverServices();
-      BluetoothCharacteristic? measure;
-      for (final s in services) {
-        if (s.uuid != Guid(kHeartRateServiceUuid)) continue;
-        for (final c in s.characteristics) {
-          if (c.uuid == Guid(kHeartRateMeasurementUuid)) measure = c;
-        }
-      }
-      if (measure == null) {
-        await disarm();
-        return false;
-      }
-      _valueSub = measure.onValueReceived.listen(_onValue);
-      await measure.setNotifyValue(true);
-      // A sensor that walks out of range mid-session ends the log there rather
-      // than leaving `armed` claiming a link that is gone.
-      _connSub = device.connectionState.listen((s) {
-        if (s == BluetoothConnectionState.disconnected) unawaited(disarm());
-      });
-      _flushTimer = Timer.periodic(_flushEvery, (_) => unawaited(_flush()));
-      armed.value = true;
-      return true;
-    } catch (_) {
-      await disarm();
-      return false;
-    }
-  }
-
-  /// Stop logging, flush the tail and drop the link. Safe to call when not
-  /// armed. AWAIT it before a finish screen reads the session back — an
-  /// unawaited stop is how the last buffered batch goes missing.
-  Future<void> disarm() async {
-    _flushTimer?.cancel();
-    _flushTimer = null;
-    await _valueSub?.cancel();
-    _valueSub = null;
-    await _connSub?.cancel();
-    _connSub = null;
-    await _flush();
-    final d = _device;
-    _device = null;
-    _sessionId = null;
-    _source = null;
-    armed.value = false;
-    liveHr.value = null;
-    if (d != null) {
-      try {
-        await d.disconnect();
-      } catch (_) {/* already gone */}
-    }
-  }
-
-  void _onValue(List<int> value) {
-    final s = parseHeartRateMeasurement(value);
-    if (s == null) return;
-    // The sensor's own "no skin contact" is a refusal, not a low reading: a
-    // chest strap off the chest reports confident nonsense. Drop the sample and
-    // do not show it.
-    if (s.contact == false) return;
-    liveHr.value = s.hr;
-    final source = _source;
-    if (source == null) return;
-    _pending.add({
-      'ts': DateTime.now().millisecondsSinceEpoch ~/ 1000,
-      'source': source,
-      'hr': s.hr,
-      'rr_ms': s.rrMs.isEmpty ? null : jsonEncode(s.rrMs),
-      'session_id': _sessionId,
-    });
-  }
-
-  Future<void> _flush() async {
-    if (_pending.isEmpty) return;
-    final batch = List<Map<String, Object?>>.from(_pending);
-    _pending.clear();
-    try {
-      await LocalDb.appendExternalHr(batch);
-    } catch (_) {
-      // Losing a buffered batch is better than throwing out of a timer on the
-      // UI isolate; the next flush carries on.
-    }
-  }
-}
diff --git a/lib/ble/hrs_link.dart b/lib/ble/hrs_link.dart
new file mode 100644
index 00000000..9ff4fd15
--- /dev/null
+++ b/lib/ble/hrs_link.dart
@@ -0,0 +1,776 @@
+// The HOST for a standard Bluetooth heart-rate sensor: connect it, drive
+// [BleHrsAdapter] over the link, and write what comes back into the substrate.
+//
+// WHAT MOVED, AND WHY IT MATTERS. The decode and the session used to be in
+// this file. They are now `adapters/ble_hrs.dart` — a 40-line
+// `Stream<BandEvent> run(BandLink)` — and everything left here is host work a
+// contributor must never see: `flutter_blue_plus`, the paired-device row,
+// `sqflite`, the per-second write buffer, `device_id` discipline. The seam
+// between the two halves is `adapters/adapter.dart`, and this is its first
+// caller.
+//
+// WHAT IT IS NOT.
+//  * NOT a background source. Armed by a workout, disarmed when the workout
+//    ends — the same rule GPS follows, for the same reason: a second GATT link
+//    held open all day is a battery cost and a scan/connect fight with the
+//    band's own link.
+//  * NOT better than the band overnight. A chest strap is better at exercise
+//    HR and beat timing; that is the whole of the claim.
+//  * NOT baseline input, and not yet input to anything. Its rows land in
+//    `decoded_onehz` / `decoded_rr` — the real substrate, not a side table —
+//    stamped `source = 'ble_hrs'`, and every derive/export read filters
+//    `source IS NULL`. Resting HR from a chest strap and from wrist PPG differ
+//    systematically, and merging them quietly is how a step change lands in
+//    every long-horizon number with no visible cause.
+//  * REACHABLE NOW, and it was not. [scanFor] finds a sensor and
+//    [pairNotifySensor] writes the `device` row [HrsLink.arm] reads, so
+//    arming stops being a no-op the moment a user picks one.
+//    `lib/ui2/profile/pair_sensor.dart` is the screen that drives both.
+//  * NOT hardware-verified. Nobody on this project owns a strap. Everything
+//    below is verified by the SIG spec, the fixtures in
+//    `test/hrs_link_test.dart` and the compiler. It ships EXPERIMENTAL
+//    (ASSUMPTIONS R6).
+//
+// BEAT TIME. A 0x2A37 strap reports beat-to-beat DURATIONS and carries no
+// clock. The durations are exact and land in `decoded_rr.rr_ms`; the only time
+// we can attach is the arrival of the notification, which BLE delivery jitter
+// and stack batching move by tens of milliseconds. That anchor goes in
+// `rr_ts_ms` (the whole-second column, which is what it is) and `beat_ts_ms` —
+// the column that means "where the beat actually WAS" — stays NULL, because we
+// do not know. `TimeAnchor.arrival` on the registry entry is the machine-
+// readable form of that sentence: RMSSD and pNN50 are correct on it,
+// Lomb-Scargle / `cvhr_per_hour` / `spanSec` must refuse on it.
+
+import 'dart:async';
+import 'dart:io' show Platform;
+
+import 'package:collection/collection.dart' show IterableExtension;
+import 'package:flutter/foundation.dart'
+    show ValueListenable, ValueNotifier, debugPrint, visibleForTesting;
+import 'package:flutter_blue_plus/flutter_blue_plus.dart';
+import 'package:sqflite/sqflite.dart' show ConflictAlgorithm;
+
+import '../data/db.dart';
+import '../sync/paired_device.dart' show cleanDeviceLabel;
+import 'accessory_setup.dart';
+import 'adapters/_registry.dart';
+import 'adapters/adapter.dart';
+import 'adapters/ble_hrs.dart';
+import 'adapters/gatt_link.dart';
+import 'ble_state.dart'
+    show BleBlocker, BleUnavailableException, classifyBleBlocker, withScanLock;
+import 'oura_link.dart' show OuraLink;
+
+/// One arrival second's worth of notifications.
+class _Second {
+  int? hr;
+  final List<int> rr = [];
+}
+
+/// One peripheral a pairing scan heard, in the shape a picker needs.
+///
+/// [label] is the advertised name AFTER `cleanDeviceLabel`, and it stays
+/// nullable: plenty of sensors advertise no name at all, and a made-up
+/// "Unknown device" would be a value where there is none. The screen shows the
+/// band's own label instead.
+typedef BandCandidate = ({BluetoothDevice device, String? label, int rssi});
+
+/// What a paired sensor is saying RIGHT NOW. Display only — see
+/// [HrsLink.reading].
+class HrsReading {
+  /// The last bpm the sensor reported, or null while the link is up and
+  /// nothing has arrived yet. A strap takes seconds to find a signal, and that
+  /// is a real state; it is never rendered as a zero. The parser already
+  /// refuses 0 bpm, so a non-null value here was measured.
+  final int? bpm;
+
+  /// Arrival second of [bpm] — `TimeAnchor.arrival`, same caveat as every
+  /// other timestamp on this path. Null with [bpm].
+  final int? atSec;
+
+  const HrsReading({this.bpm, this.atSec});
+}
+
+/// The live link to a paired heart-rate sensor. One instance; a second
+/// concurrent sensor is not a thing anyone asked for.
+class HrsLink {
+  HrsLink._();
+  static final HrsLink instance = HrsLink._();
+
+  /// Flush cadence for the write buffer. A sensor notifies ~1 Hz, and one
+  /// transaction per beat on the UI isolate is the mistake `commitSyncBatch`
+  /// already chunks around.
+  static const Duration _flushEvery = Duration(seconds: 15);
+
+  BluetoothDevice? _device;
+
+  /// Kept only so [disarm] can [GattBandLink.close] it. Closing is what stops a
+  /// write the adapter queued before the teardown from landing on a LATER
+  /// connection to the same strap — see the field's own doc.
+  GattBandLink? _link;
+  StreamSubscription<BandEvent>? _runSub;
+  StreamSubscription<BluetoothConnectionState>? _connSub;
+  Completer<void>? _runDone;
+  Timer? _flushTimer;
+
+  /// Arrival second -> that second's readings. Keyed by second because that is
+  /// the key `decoded_onehz` / `decoded_rr` are written under: accumulating
+  /// per second is what stops two notifications landing in the same second
+  /// from REPLACE-ing each other's beat 0.
+  final Map<int, _Second> _pending = {};
+
+  /// `device.id` of the paired sensor — the `device_id` every row it writes
+  /// carries. Never [LocalDb.kPrimaryDeviceId]: `''` is the primary band,
+  /// permanently (ASSUMPTIONS A1).
+  String? _deviceId;
+
+  bool _armed = false;
+
+  /// What the sensor is saying right now, or null when none is armed.
+  ///
+  /// THE DISPLAY PATH, AND ONLY THAT. [_flush] stays the single writer into
+  /// `decoded_*`; this notifier persists nothing and is read by nothing that
+  /// derives. A second write path built on the live number is exactly how a
+  /// displayed value and a stored value start disagreeing with no way to tell
+  /// which one a metric used.
+  ///
+  /// A [ValueListenable] rather than a stream because there is one current
+  /// reading and every consumer wants the latest one — a late listener on a
+  /// broadcast stream would render nothing until the next beat.
+  ValueListenable<HrsReading?> get reading => _reading;
+  final ValueNotifier<HrsReading?> _reading = ValueNotifier(null);
+
+  /// The `device` row for the paired heart-rate sensor, or null.
+  ///
+  /// The `device` table (schema 49) IS the pairing store now — this is what
+  /// replaced `PairedHrSensor`'s two SharedPreferences scalars, which could
+  /// hold one sensor, could not be joined to the rows it wrote, and had no
+  /// writer anyway. A pairing screen creates the row with
+  /// `LocalDb.upsertDevice(id: mintedId, adapterId: 'ble_hrs', remoteId:
+  /// bleId, label: advertisedName, tier: 'beatToBeat')`.
+  ///
+  /// `id` must be MINTED at pairing (e.g. `hrs-0a1b2c3d`), not the BLE remote
+  /// id: a remote id is a per-app CBPeripheral UUID on iOS and a rotating RPA
+  /// on Android, and letting one become the storage key fragments one strap
+  /// into N identities. `remote_id` is the column that may change under the
+  /// same row, and that is what this reads to connect.
+  static Future<Map<String, Object?>?> pairedSensorRow() async {
+    for (final r in await LocalDb.deviceRows()) {
+      if (r['adapter_id'] == kBleHrsAdapter.id) return r;
+    }
+    return null;
+  }
+
+  // ── pairing: scan ─────────────────────────────────────────────────────────
+
+  /// How long a pairing scan runs. Longer than the engine's 12 s because this
+  /// scan does NOT stop at the first hit — the whole window is the list the
+  /// user chooses from, and a strap that has just been put on can take several
+  /// seconds to start advertising.
+  static const Duration _scanWindow = Duration(seconds: 15);
+
+  /// Same bound, and for the same reason, as `BleEngine._blockerProbe`:
+  /// `unknown` is CoreBluetooth's pre-init value, never a verdict.
+  static const Duration _blockerProbe = Duration(seconds: 2);
+
+  static const Duration _connectTimeout = Duration(seconds: 12);
+
+  /// Scan for peripherals advertising [entry]'s service and report them as
+  /// they are heard.
+  ///
+  /// NOT `BleEngine.scan`, and not a copy of it either. That one filters on
+  /// every FRAMED band's service and stops dead on the first match, because it
+  /// answers "where is MY band" — one answer, no choice. This answers a
+  /// different question: "what is in the room", for a class of device the user
+  /// has to pick out of a list of several. So it filters on ONE entry's
+  /// service, runs the whole window, and reports every distinct peripheral.
+  ///
+  /// [kFramedBands] is deliberately not consulted: a notify-class entry is
+  /// excluded from it on purpose (see the comment on `kFramedBands`), and a
+  /// framed band matched here would be handed to a pairing path that has no
+  /// handshake. Hence the assert.
+  ///
+  /// Generic over [entry] rather than pinned to [kBleHrs]: the next
+  /// notify-class band needs exactly this scan and a different pairing step,
+  /// and a second copy of this function is how the two drift apart.
+  ///
+  /// [onResults] is called with the whole ranked list each time it changes —
+  /// strongest signal first, which is very nearly "the one on your chest".
+  /// Throws [BleUnavailableException] when the phone's own stack is the
+  /// problem; see [scanHeldBackReason] for the iOS case that is not an error.
+  static Future<void> scanFor(
+    BandEntry entry, {
+    required void Function(List<BandCandidate>) onResults,
+    Duration timeout = _scanWindow,
+  }) {
+    assert(!entry.isFramed,
+        '${entry.id} is a framed band — pair it through BleEngine.scan.');
+    // Process-wide, because the radio has ONE scanner and the band's own scan
+    // shares it. Without this, whichever scan called `stopScan` first ended
+    // the other one having seen nothing, with no error to say why.
+    return withScanLock(() => _scanFor(entry, onResults, timeout));
+  }
+
+  static Future<void> _scanFor(
+    BandEntry entry,
+    void Function(List<BandCandidate>) onResults,
+    Duration timeout,
+  ) async {
+    // A phone-level blocker is NOT "nothing answered" — the same lesson
+    // `BleEngine._scanLocked` learned. Returning an empty list for a revoked
+    // Bluetooth permission tells the user to move closer to a sensor that was
+    // never the problem.
+    final pre = await _detectBlocker();
+    if (pre != null) throw BleUnavailableException(pre);
+    if (FlutterBluePlus.isScanningNow) {
+      await FlutterBluePlus.stopScan();
+    }
+    // Keyed by remote id: a scan re-reports the same peripheral several times
+    // a second, and a list that grows a row per advertisement is not a picker.
+    final seen = <String, BandCandidate>{};
+    final sub = FlutterBluePlus.onScanResults.listen((results) {
+      var changed = false;
+      for (final r in results) {
+        final id = r.device.remoteId.str;
+        final was = seen[id];
+        // The ADVERTISED name first. `platformName` is the OS's cached name
+        // for a peripheral it has seen before, which can be stale or empty;
+        // the advertisement is what this sensor is saying now. Both go through
+        // `cleanDeviceLabel`, and null survives as null rather than becoming a
+        // placeholder. A name that drops out of a later advertisement keeps
+        // the one we already had — losing it mid-scan would make the row the
+        // user is reaching for change under their finger.
+        final label = cleanDeviceLabel(r.advertisementData.advName) ??
+            cleanDeviceLabel(r.device.platformName) ??
+            was?.label;
+        final now = (device: r.device, label: label, rssi: r.rssi);
+        if (was == null || was.rssi != now.rssi || was.label != now.label) {
+          changed = true;
+        }
+        seen[id] = now;
+      }
+      if (changed) onResults(_ranked(seen));
+    });
+    try {
+      await FlutterBluePlus.startScan(
+        withServices: [Guid(entry.service)],
+        timeout: timeout,
+      );
+      // The scan's own timeout is what stops it; this waits that out.
+      await FlutterBluePlus.isScanning.where((on) => on == false).first;
+    } catch (e) {
+      // Android reports a missing runtime permission by throwing HERE rather
+      // than through the adapter state, so the pre-check above cannot see it.
+      final blocker = classifyBleBlocker(error: e);
+      if (blocker != null) throw BleUnavailableException(blocker);
+      debugPrint('[hrs] scan error: $e');
+    } finally {
+      await sub.cancel();
+    }
+    onResults(_ranked(seen));
+  }
+
+  static List<BandCandidate> _ranked(Map<String, BandCandidate> seen) =>
+      seen.values.toList()..sort((a, b) => b.rssi.compareTo(a.rssi));
+
+  /// Why the phone's own stack cannot scan, or null when it can.
+  ///
+  /// A deliberate second copy of `BleEngine._detectBlocker`: that one is
+  /// private on an engine INSTANCE this file has no reference to and must not
+  /// grow one — the point of the sensor link is that it never routes through
+  /// the band's engine. The classifier itself ([classifyBleBlocker]) is
+  /// shared, which is the half that has to stay in one place.
+  static Future<BleBlocker?> _detectBlocker() async {
+    try {
+      final s = await FlutterBluePlus.adapterState
+          .firstWhere((s) => s != BluetoothAdapterState.unknown)
+          .timeout(_blockerProbe,
+              onTimeout: () => BluetoothAdapterState.unknown);
+      return classifyBleBlocker(adapterState: s.name);
+    } catch (e) {
+      return classifyBleBlocker(error: e);
+    }
+  }
+
+  /// One sentence saying why a scan should not be STARTED on this phone yet,
+  /// or null when it may run. Not an error — a warning the screen shows before
+  /// it does something it cannot take back within this app launch.
+  ///
+  /// THE iOS PROBLEM (ASSUMPTIONS I9), and it is real on this build. Verified
+  /// rather than assumed, because the whole question is whether a
+  /// `CBCentralManager` already exists by the time anyone reaches the pairing
+  /// screen — if one does, this scan changes nothing and the guard is theatre:
+  ///
+  ///  * `flutter_blue_plus_darwin` creates its central lazily, on the first
+  ///    method call that needs one — but `setLogLevel` and `setOptions` return
+  ///    BEFORE that init block, so `main()`'s two startup calls do not create
+  ///    one. Every other entry point (`getAdapterState`, `startScan`,
+  ///    `connect`) passes through it, so the first of those wins.
+  ///  * `AppState._initSteps` reaches flutter_blue_plus only under
+  ///    `if (isPaired)`.
+  ///
+  /// So on a phone with no WHOOP paired, no central exists, and starting one
+  /// here would make `AccessorySetup.showPicker()` fail with "CBManager is
+  /// active with global permissions" for the rest of the process. It is not
+  /// permanent — the next launch starts with no central — which is exactly
+  /// what the sentence has to say, because the alternative is a WHOOP that
+  /// silently cannot be paired and no way to guess why.
+  ///
+  /// Gated on `provisionedId() == null` and not on "is a band paired": once
+  /// ASK has provisioned the WHOOP the picker is not needed again, and a phone
+  /// that already has a live session already has a central anyway.
+  static Future<String?> scanHeldBackReason() async {
+    if (!Platform.isIOS) return null;
+    if (!await AccessorySetup.isSupported()) return null;
+    if (await AccessorySetup.provisionedId() != null) return null;
+    return 'Your WHOOP is not paired yet. Searching for a sensor now starts '
+        'Bluetooth in a way that hides the system WHOOP pairing sheet until '
+        'you restart the app — so pair the WHOOP first, or expect to restart '
+        'the app before you can.';
+  }
+
+  // ── pairing: the device row ───────────────────────────────────────────────
+
+  /// The `device.id` to store a peripheral under.
+  ///
+  /// MINTED, never the BLE remote id: that is a per-app CBPeripheral UUID on
+  /// iOS and a rotating RPA on Android, and letting one become the primary key
+  /// fragments one sensor into N identities whose rows can never be rejoined.
+  /// Never [LocalDb.kPrimaryDeviceId] either — `''` is the primary band,
+  /// permanently — which the `${entry.id}-` prefix makes structurally
+  /// impossible.
+  ///
+  /// DERIVED from the remote id rather than random, so re-pairing the same
+  /// sensor on the same phone lands back on its own row and its own history
+  /// instead of minting a stranger. When the remote id does rotate, the stored
+  /// one no longer connects either, so a new row is the truth: we cannot tell
+  /// it is the same strap.
+  static String mintDeviceId(BandEntry entry, String remoteId) =>
+      '${entry.id}-${_fnv1a(remoteId).toRadixString(16).padLeft(8, '0')}';
+
+  /// FNV-1a, 32-bit. `String.hashCode` is deliberately not used: Dart only
+  /// promises it is consistent within ONE run, and this value is a primary key
+  /// that has to name the same sensor after a restart.
+  static int _fnv1a(String s) {
+    var h = 0x811c9dc5;
+    for (final unit in s.codeUnits) {
+      h = (h ^ unit) & 0xffffffff;
+      h = (h * 0x01000193) & 0xffffffff;
+    }
+    return h;
+  }
+
+  /// Connect to [device], check it really exposes what [entry] requires, and
+  /// write the `device` row that makes it reachable. Returns null on success,
+  /// or a user-facing sentence on failure.
+  ///
+  /// The default pairing step for a notify-class band, which is the whole of
+  /// what a heart-rate strap needs: no handshake, no key, no clock. A band
+  /// that DOES need a key exchange supplies its own step to the screen and
+  /// never calls this.
+  ///
+  /// [tier] defaults to the strap's, and a band whose measurement quality
+  /// differs must say so rather than inherit it — the tier is what decides
+  /// precedence between two sources, so a wrong one is a silent wrong number.
+  ///
+  /// Nothing is written unless the peripheral passed the characteristic check:
+  /// a row pointing at a device that cannot answer is a sensor that appears
+  /// paired and never produces a beat.
+  static Future<String?> pairNotifySensor(
+    BandEntry entry,
+    BluetoothDevice device, {
+    String? label,
+    String tier = 'beatToBeat',
+  }) async {
+    try {
+      await device.connect(timeout: _connectTimeout);
+    } catch (e) {
+      debugPrint('[hrs] pair connect failed: $e');
+      return 'That sensor did not answer. It may have gone back to sleep, or '
+          'it may already be connected to another phone or app.';
+    }
+    try {
+      final services = await device.discoverServices();
+      final link = GattBandLink(
+        entry: entry,
+        services: services,
+        onLog: (m) => debugPrint('[hrs] pair: $m'),
+      );
+      final missing =
+          link.missingCharacteristics(entry.requiredCharacteristics);
+      link.close();
+      if (missing.isNotEmpty) {
+        return 'That device answered, but it does not expose the '
+            '${entry.label} data this needs '
+            '(missing ${missing.map((u) => u.substring(0, 8)).join(", ")}). '
+            'Nothing was saved.';
+      }
+      await LocalDb.upsertDevice(
+        id: mintDeviceId(entry, device.remoteId.str),
+        adapterId: entry.id,
+        remoteId: device.remoteId.str,
+        label: label,
+        tier: tier,
+      );
+      return null;
+    } catch (e) {
+      debugPrint('[hrs] pair setup failed: $e');
+      return 'That sensor disconnected before it could be set up. Nothing was '
+          'saved.';
+    } finally {
+      // The pairing connection is not the session. `arm()` opens its own when
+      // a workout starts, and holding this one would be a second GATT link
+      // nobody asked for.
+      try {
+        await device.disconnect();
+      } catch (_) {/* already gone */}
+    }
+  }
+
+  /// Forget a paired sensor. Generic over WHICH adapter paired it — this is
+  /// the one entry point the UI calls for any non-band row.
+  ///
+  /// THE PROMISE IS "this removes the source, not the data". The `device` row
+  /// goes; every second and beat it wrote keeps its `device_id` in
+  /// `decoded_onehz` / `decoded_rr`, so the history stays attributable and a
+  /// re-pair of the same sensor ([mintDeviceId] is derived) finds it again.
+  ///
+  /// Refuses [LocalDb.kPrimaryDeviceId] outright: that row is the band, and
+  /// unpairing the band is a different flow with a different promise.
+  ///
+  /// DISPATCHES ON `adapter_id` BEFORE TOUCHING ANYTHING. An Oura row carries
+  /// a secret this class knows nothing about — [OuraLink.forgetRing] drops the
+  /// stored key and the row together, and calling `disarm()` on it here would
+  /// leave that key behind while looking like a complete forget.
+  static Future<void> forgetDevice(String id) async {
+    if (id == LocalDb.kPrimaryDeviceId) {
+      debugPrint('[hrs] refusing to forget the primary band from here.');
+      return;
+    }
+    final row = (await LocalDb.deviceRows())
+        .where((r) => r['id'] == id)
+        .firstOrNull;
+    if (row?['adapter_id'] == kOura.id) {
+      await OuraLink.forgetRing(id);
+      return;
+    }
+    // Before the row goes, not after: a live session would keep writing rows
+    // under an id nothing can explain any more.
+    await instance.disarm();
+    await LocalDb.deleteDevice(id);
+  }
+
+  /// Connect to the paired sensor and start logging.
+  /// No-op (returns false) when nothing is paired — this is opt-in hardware.
+  ///
+  /// Never scans: it connects straight to the stored remote id, so arming a
+  /// workout cannot contend with the band's scan.
+  ///
+  /// SERIALISED, because every caller fires it `unawaited` and the body awaits
+  /// a database read, a 12 s connect and service discovery before it publishes
+  /// anything. A second call used to sail past the `_armed` check while the
+  /// first was still connecting and overwrite `_device`, `_link`, `_runSub` and
+  /// `_flushTimer` — the first one's timer and subscription then ran forever
+  /// with nothing holding them.
+  Future<bool> arm() {
+    if (_armed) return Future.value(true);
+    return _arming ??= _arm().whenComplete(() => _arming = null);
+  }
+
+  /// The in-flight [arm], or null. See [arm].
+  Future<bool>? _arming;
+
+  /// How many times [disarm] has run. An [arm] whose count moved under it has
+  /// been cancelled and must not publish — see the check in [_arm].
+  int _disarms = 0;
+
+  Future<bool> _arm() async {
+    final disarmsAtStart = _disarms;
+    final row = await pairedSensorRow();
+    if (row == null) return false;
+    final deviceId = row['id'] as String?;
+    final remoteId = row['remote_id'] as String?;
+    if (deviceId == null || remoteId == null || remoteId.isEmpty) return false;
+    if (deviceId == LocalDb.kPrimaryDeviceId) {
+      // The primary band's id, permanently. A sensor writing under it would
+      // interleave its seconds with the band's in one REPLACE-keyed table.
+      debugPrint('[hrs] refusing to arm: the sensor row claims the primary '
+          'device id — re-pair it with a minted id.');
+      return false;
+    }
+    _deviceId = deviceId;
+    try {
+      final device = BluetoothDevice.fromId(remoteId);
+      _device = device;
+      await device.connect(timeout: const Duration(seconds: 12));
+      // Connect, bond, MTU and discovery are HOST work and stay on this side
+      // of the seam. The adapter is handed the result and nothing else.
+      final services = await device.discoverServices();
+      // A `disarm()` that landed WHILE this was connecting has already torn the
+      // session down — it nulls `_device` and `_deviceId`. Publishing on top of
+      // it would set `_armed = true` over no device and no `_deviceId`, so
+      // `_flush` would discard every second and every later `arm()` would
+      // short-circuit on `_armed`: the sensor stays dead for the rest of the
+      // process. Reachable by the most ordinary thing a user does — start a
+      // workout and stop it inside twelve seconds.
+      if (_disarms != disarmsAtStart) {
+        debugPrint('[hrs] arm abandoned: it was disarmed while connecting.');
+        try {
+          await device.disconnect();
+        } catch (_) {/* already gone */}
+        return false;
+      }
+      final link = GattBandLink(
+        entry: kBleHrsAdapter.entry,
+        services: services,
+        onLog: (m) => debugPrint('[hrs] $m'),
+      );
+      _link = link;
+      final missing =
+          link.missingCharacteristics(kBleHrsAdapter.entry.requiredCharacteristics);
+      if (missing.isNotEmpty) {
+        debugPrint('[hrs] ${kBleHrsAdapter.label}: missing required '
+            'characteristic(s) ${missing.map((u) => u.substring(0, 8)).join(", ")}.');
+        await disarm();
+        return false;
+      }
+      _startRun(link);
+      // A sensor that walks out of range mid-session ends the log there rather
+      // than leaving the link claiming to be armed when it is gone.
+      _connSub = device.connectionState.listen((s) {
+        if (s == BluetoothConnectionState.disconnected) unawaited(disarm());
+      });
+      _flushTimer = Timer.periodic(_flushEvery, (_) => unawaited(_flush()));
+      _armed = true;
+      // "Live, nothing yet" — a distinct state from "no sensor", and the one
+      // a surface shows for the seconds a strap spends finding a signal.
+      _reading.value = const HrsReading();
+      return true;
+    } catch (_) {
+      await disarm();
+      return false;
+    }
+  }
+
+  /// Stop logging, flush the tail and drop the link. Safe to call when not
+  /// armed. AWAIT it before a finish screen reads the session back — an
+  /// unawaited stop is how the last buffered batch goes missing.
+  Future<void> disarm() async {
+    _disarms++;
+    _flushTimer?.cancel();
+    _flushTimer = null;
+    // Before the run subscription is cancelled: an adapter's `finally` can
+    // still write on the way out, and that write must not reach the radio.
+    _link?.close();
+    _link = null;
+    await _stopRun();
+    await _connSub?.cancel();
+    _connSub = null;
+    await _flush(all: true);
+    final d = _device;
+    _device = null;
+    _deviceId = null;
+    _armed = false;
+    // Null, not the last reading: a number left on screen after the link died
+    // is the one lie this surface can tell.
+    _reading.value = null;
+    if (d != null) {
+      try {
+        await d.disconnect();
+      } catch (_) {/* already gone */}
+    }
+  }
+
+  /// Drive the adapter over [link]. Cancelling [_runSub] is the ONLY way the
+  /// session ends from this side — an adapter does not get to hang up, so
+  /// every timer and buffer it owns dies with its `async*` body.
+  void _startRun(BandLink link) {
+    final done = Completer<void>();
+    _runDone = done;
+    void finish() {
+      if (!done.isCompleted) done.complete();
+    }
+
+    _runSub = kBleHrsAdapter.run(link).listen(
+      _onEvent,
+      onDone: finish,
+      onError: (Object e) {
+        debugPrint('[hrs] session ended on error: $e');
+        finish();
+        // ponytail: `setNotifyValue` is now awaited inside the link's stream
+        // rather than inside [arm], so a rejected subscribe surfaces HERE
+        // instead of propagating out of `arm()` as a `false`. The ceiling is
+        // that `arm()` can briefly answer true for a session that is already
+        // dying; the callers all ignore its result. Tearing down here is what
+        // stops the link sitting "armed" over a dead stream. Give `arm()` back
+        // its answer only if a caller ever starts reading it.
+        if (_armed) unawaited(disarm());
+      },
+      cancelOnError: true,
+    );
+  }
+
+  Future<void> _stopRun() async {
+    await _runSub?.cancel();
+    _runSub = null;
+    _runDone = null;
+  }
+
+  void _onEvent(BandEvent e) {
+    switch (e) {
+      case SampleBatch(:final samples, :final ephemeral):
+        // EPHEMERAL IS NEVER PERSISTED, and the check is the HOST's, not the
+        // adapter's promise. This band always sends false; the line exists so
+        // the one place that decides what reaches the database is the one
+        // place that reads the flag.
+        if (ephemeral) return;
+        for (final s in samples) {
+          final slot = _pending.putIfAbsent(s.tsEpoch, _Second.new);
+          // Last notification in the second wins.
+          if (s.hr != null) slot.hr = s.hr;
+          slot.rr.addAll(s.rrMs);
+          // The live surface, updated from the SAME sample that was just
+          // buffered so the two can never disagree. It is below the
+          // `ephemeral` guard on purpose: no adapter emits an ephemeral batch
+          // today, and if one ever does, this publish moves ABOVE the guard —
+          // display-only is precisely what ephemeral means — while the guard
+          // itself stays where it is, deciding what reaches the database.
+          if (s.hr != null) {
+            _reading.value = HrsReading(bpm: s.hr, atSec: s.tsEpoch);
+          }
+        }
+      case OffloadCheckpoint():
+        // A sensor with no flash cannot have anything to forget. If this ever
+        // fires, the adapter grew a store and this host has no
+        // commit-then-confirm path to honour the safe-trim invariant with —
+        // so it must NOT be confirmed. Dropping it stalls; confirming it would
+        // authorise a delete of data we never banked.
+        assert(false, 'ble_hrs emitted an OffloadCheckpoint; it stores nothing');
+      case BandNote(:final key, :final value):
+        debugPrint('[hrs] $key = $value');
+    }
+  }
+
+  /// Feed raw notification bytes as if a sensor with [deviceId] were armed,
+  /// and write them. The only way in: the real entry point is a BLE
+  /// notification and `flutter_blue_plus` has no simulator path, so without
+  /// this seam nothing below the parser could be exercised at all.
+  ///
+  /// It replays through the SAME [BleHrsAdapter.run] the radio drives, over a
+  /// [ReplayBandLink]. A test seam that skipped the adapter would prove the
+  /// wrong thing.
+  ///
+  /// [reading] is LEFT SET when this returns, exactly as a real session leaves
+  /// its last beat on screen — call [disarm] if a test needs it back at null.
+  @visibleForTesting
+  Future<void> ingestForTest(
+    String deviceId,
+    List<(int, List<int>)> arrivals,
+  ) async {
+    _deviceId = deviceId;
+    final link = ReplayBandLink();
+    _startRun(link);
+    for (final (sec, value) in arrivals) {
+      link.feed(kHeartRateMeasurementUuid, value, atSec: sec);
+    }
+    // Close, then wait for `run()` to actually finish, rather than guessing at
+    // a delay: the adapter's `await for` is asynchronous and a flush racing it
+    // would silently drop the tail.
+    await link.close();
+    await _runDone?.future;
+    await _flush(all: true);
+    await _stopRun();
+    _deviceId = null;
+  }
+
+  /// Write out every second that can no longer receive more notifications.
+  ///
+  /// The CURRENT second is held back unless [all]: a second written twice
+  /// would restart `beat_index` at 0 and REPLACE the beats already stored for
+  /// it. `disarm` passes `all: true` because nothing more is coming.
+  Future<void> _flush({bool all = false}) async {
+    final deviceId = _deviceId;
+    if (_pending.isEmpty) return;
+    if (deviceId == null) {
+      _pending.clear();
+      return;
+    }
+    final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+    final ready = _pending.keys.where((s) => all || s < now).toList()..sort();
+    if (ready.isEmpty) return;
+    // Taken out of the buffer BEFORE the await: losing a batch to a failed
+    // write is better than replaying it under a later second's beat indices.
+    final batchRows = [for (final s in ready) (s, _pending.remove(s)!)];
+    // `beat_ts_ms` is deliberately absent from every row below. It means "where
+    // the beat actually was", and for an arrival-anchored source we do not know
+    // — anchor-minus-durations would be a measured claim we cannot make. NULL
+    // is the column's own word for "not kept".
+    assert(kBleHrsAdapter.entry.timeAnchor == TimeAnchor.arrival);
+    // Its own transaction, NOT `commitSyncBatch`: that path is the ACK-gating
+    // commit, it raises `synchronous` for the duration and it refuses a
+    // non-primary `device_id` outright (the `sync_cursor` namespace is global).
+    // Nothing here trims a band's flash, so none of the safe-trim invariant is
+    // in play — this only has to queue politely behind a drain on the shared
+    // connection, which sqflite does.
+    try {
+      final db = await LocalDb.instance;
+      await db.transaction((txn) async {
+        final b = txn.batch();
+        for (final (sec, slot) in batchRows) {
+          b.insert(
+            'decoded_onehz',
+            {
+              'device_id': deviceId,
+              'ts_ms': sec * 1000,
+              'rec_ts': sec,
+              // ponytail: `counter` is NOT NULL and is a WHOOP flash-record
+              // number this sensor does not have. 0 for every row is a
+              // constant, not a measurement, and nothing reads the column
+              // except `ORDER BY rec_ts, counter`. Make it nullable when
+              // db.dart is next open.
+              'counter': 0,
+              'hr': slot.hr,
+              'device_family': kBleHrsAdapter.id,
+              'source': kBleHrsAdapter.id,
+            },
+            conflictAlgorithm: ConflictAlgorithm.replace,
+          );
+          // CLEAR THE SECOND BEFORE REINSERTING, exactly as `_queueRrBeats`
+          // does on the band path and for the same reason: REPLACE only
+          // overwrites `beat_index` 0..n-1, so a second that once carried more
+          // beats keeps the stale tail and reports beats the sensor never sent.
+          // Within one armed session a second is written once (`_pending`
+          // removes it), but re-arming inside the same second is not — and the
+          // 15 s flush cadence means the second on either side of a stop is
+          // exactly the one at risk. Scoped to THIS device, so it can never
+          // reach the band's beats for the same second.
+          b.rawDelete(
+            'DELETE FROM decoded_rr WHERE device_id = ? AND ts_ms = ?',
+            [deviceId, sec * 1000],
+          );
+          for (var i = 0; i < slot.rr.length; i++) {
+            b.insert(
+              'decoded_rr',
+              {
+                'device_id': deviceId,
+                'ts_ms': sec * 1000,
+                'rec_ts': sec,
+                'beat_index': i,
+                'rr_ts_ms': sec * 1000,
+                'rr_ms': slot.rr[i],
+                'device_family': kBleHrsAdapter.id,
+                'source': kBleHrsAdapter.id,
+              },
+              conflictAlgorithm: ConflictAlgorithm.replace,
+            );
+          }
+        }
+        await b.commit(noResult: true);
+      });
+    } catch (e) {
+      // Losing a buffered batch is better than throwing out of a timer on the
+      // UI isolate; the next flush carries on.
+      debugPrint('[hrs] flush failed, ${batchRows.length} second(s) lost: $e');
+    }
+  }
+}
diff --git a/lib/ble/oura_link.dart b/lib/ble/oura_link.dart
new file mode 100644
index 00000000..4e90d83f
--- /dev/null
+++ b/lib/ble/oura_link.dart
@@ -0,0 +1,834 @@
+// The HOST for the Oura ring: hold the pairing key, hold the drain cursor,
+// hold the time anchor, connect, drive [OuraAdapter] over the link, and bank
+// what comes back.
+//
+// NOTHING HERE HAS MET HARDWARE. Nobody on this project owns a ring (owner
+// ruling R6), so not one byte of this path has been exercised against one. The
+// registry entry stays EXPERIMENTAL, `OuraAdapter.signals` stays `const {}`,
+// and nothing this file writes becomes a number: its rows carry a non-null
+// `source`, and every derive/export read filters `source IS NULL`. That is
+// correct behaviour for an uncalibrated decoder, not a limitation to route
+// around.
+//
+// THE SHAPE, AND WHY IT IS NOT `HrsLink`'s. A heart-rate strap is a live
+// session armed by a workout; the ring is a FETCH-BY-CURSOR store. So this is
+// a one-shot [OuraLink.sync] — connect, drain to the end of history, tear down
+// — rather than an arm/disarm pair. Everything else is the same host work in
+// the same order: read the `device` row, connect by `remote_id`, discover,
+// check [GattBandLink.missingCharacteristics], drive `run()`, buffer, commit,
+// disconnect.
+//
+// WHAT THIS FILE OWNS THAT THE ADAPTER DELIBERATELY CANNOT (see `oura.dart`'s
+// own header):
+//
+//  1. THE 16-BYTE PAIRING KEY, in the platform keychain/keystore — never in
+//     the database. See [_readKey].
+//  2. THE DRAIN CURSOR, a decisecond on the ring's own clock, in `sync_cursor`
+//     so a drain resumes instead of re-fetching.
+//  3. THE TIME ANCHOR, the `(ring decisecond, Unix second)` pair, persisted
+//     beside the cursor and handed back in at the next connect. This is the fix
+//     for the cross-session origin hazard — see below.
+//
+// THE HOST HOLDS THE ORIGIN, THE ADAPTER STAMPS WITH IT. There is exactly one
+// implementation of "which second is this decisecond", and it is
+// `OuraAdapter._anchorUnixFor`. The host reads the stored `(ds, unix)` pair,
+// hands it in at construction, and writes back the better one the adapter
+// reports when a `time_sync` event gives it a measured pair — inside the same
+// transaction as the rows that pair stamped. Two implementations of an origin
+// would be two origins, which is the whole failure this mechanism exists to
+// stop: the same physiological second written under two different `ts_ms`,
+// which REPLACE cannot collapse because they no longer share a key.
+//
+// ABSTAINING IS THE CORRECT ANSWER WHEN THERE IS NO ORIGIN. A session with no
+// measured `time_sync` and nothing stored writes NO timestamped row. The frames
+// are still archived verbatim — the bytes are banked, and a plausible wrong
+// `ts_ms` is worse than a missing one.
+//
+// THE DESTRUCTIVE COMMANDS ARE UNREACHABLE FROM HERE, and their absence is the
+// only thing making that true. `GattBandLink`'s dangerous-opcode block reads an
+// opcode out of a WHOOP envelope and answers null for an unframed band, so it
+// does NOT cover this ring (ASSUMPTIONS I1). The ring has a factory reset, a
+// DFU state machine, a flight mode, a manufacturing-mode setter and a
+// bulk-sampler erase. This file writes NOTHING it did not get from a builder in
+// the protocol package's Oura wire format, that module has no builder for any
+// of them, and `oura_link_test.dart` asserts that every byte this host puts on
+// the wire came from a builder that exists. The one command here that writes
+// ring state is the key install, and it writes a credential rather than
+// erasing anything.
+
+import 'dart:async';
+import 'dart:math' show Random;
+
+import 'package:flutter/foundation.dart' show debugPrint, visibleForTesting;
+import 'package:flutter_blue_plus/flutter_blue_plus.dart';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:openstrap_protocol/openstrap_protocol.dart';
+import 'package:sqflite/sqflite.dart' show ConflictAlgorithm;
+
+import '../data/db.dart';
+import '../sync/paired_device.dart' show cleanDeviceLabel;
+import 'adapters/_registry.dart';
+import 'adapters/adapter.dart';
+import 'adapters/gatt_link.dart';
+import 'adapters/oura.dart';
+
+/// Keychain item name for one ring's pairing key. Suffixed with the MINTED
+/// device id, never the BLE remote id — that rotates.
+String _keyItem(String deviceId) => 'oura_pairing_key:$deviceId';
+
+/// `sync_cursor` names. Both are per-device: two rings are not a thing anyone
+/// asked for, but a second one must not silently inherit the first's bookmark.
+String _cursorItem(String deviceId) => 'oura_cursor_ds:$deviceId';
+String _anchorItem(String deviceId) => 'oura_anchor:$deviceId';
+
+/// FIRST-UNLOCK, not the plugin's default WHEN-UNLOCKED — the same choice, for
+/// the same reason, that `CoachConfig` documents at length. This app is
+/// relaunched in the background constantly (BGProcessingTask, the BLE restore
+/// central waking on a link drop) and those relaunches routinely happen while
+/// the phone is LOCKED, i.e. exactly when a `whenUnlocked` item cannot be read.
+/// A background sync that read nothing would conclude the ring is unpaired.
+const IOSOptions _kApple = IOSOptions(
+  accessibility: KeychainAccessibility.first_unlock,
+);
+const MacOsOptions _kMacos = MacOsOptions(
+  accessibility: KeychainAccessibility.first_unlock,
+);
+
+const FlutterSecureStorage _secure = FlutterSecureStorage();
+
+/// THE ORDER IS THE WHOLE MESSAGE. A ring only accepts a new key while it is
+/// factory reset, so the reset comes FIRST and pairing second — reversed, the
+/// user resets a ring this app has just keyed and loses both.
+const String _kResetFirst =
+    'The ring would not take a new key. It only accepts one while it is '
+    'factory reset, so reset it first and then pair here — that is the order, '
+    'and resetting is what frees the ring from whatever set it up before.';
+
+String _hex(List<int> b) =>
+    b.map((x) => x.toRadixString(16).padLeft(2, '0')).join();
+
+List<int>? _unhex(String s) {
+  if (s.length.isOdd || s.isEmpty) return null;
+  final out = <int>[];
+  for (var i = 0; i + 1 < s.length; i += 2) {
+    final v = int.tryParse(s.substring(i, i + 2), radix: 16);
+    if (v == null) return null;
+    out.add(v);
+  }
+  return out;
+}
+
+/// The live link to a paired Oura ring. One instance; a second concurrent ring
+/// is not a thing anyone asked for.
+class OuraLink {
+  OuraLink._();
+  static final OuraLink instance = OuraLink._();
+
+  /// The `device` row for the paired ring, or null.
+  ///
+  /// `id` is MINTED at pairing (`oura-0a1b2c3d`), never the BLE remote id: a
+  /// remote id is a per-app CBPeripheral UUID on iOS and a rotating RPA on
+  /// Android, and letting one become the storage key fragments one ring into N
+  /// identities. `remote_id` is the column that may change under the same row.
+  static Future<Map<String, Object?>?> pairedRingRow() async {
+    for (final r in await LocalDb.deviceRows()) {
+      if (r['adapter_id'] == kOura.id) return r;
+    }
+    return null;
+  }
+
+  /// Delete the stored 16-byte pairing key for [deviceId], best-effort.
+  ///
+  /// Two callers, one problem: an Oura pairing secret must not outlive the
+  /// thing it was for. [pairOuraRing] writes the key BEFORE the ring proves it
+  /// (see that function's own header) so a crash mid-pair leaves an orphaned
+  /// key with no `device` row pointing at it; forgetting a paired ring later
+  /// leaves the same kind of orphan if only the row goes. Swallows a locked
+  /// keychain/keystore exactly as [_readKey] does — there is nothing for the
+  /// user to redo, and a delete that cannot run now costs nothing left behind
+  /// that this app itself can read.
+  static Future<void> _dropKey(String deviceId) async {
+    try {
+      await _secure.delete(
+        key: _keyItem(deviceId),
+        iOptions: _kApple,
+        mOptions: _kMacos,
+      );
+    } catch (e) {
+      debugPrint('[oura] could not drop the stored key: $e');
+    }
+  }
+
+  /// Forget a paired ring: drop its key, drop its `device` row.
+  ///
+  /// THE ORDER IS THE OPPOSITE OF PAIRING'S, on purpose. [pairOuraRing] writes
+  /// the key before the row because an unpointed-to key is harmless; forgetting
+  /// deletes the key before the row for the same reason in reverse — a crash
+  /// between the two here would rather leave a `device` row whose key is
+  /// already gone (which just fails the next sync visibly) than a key outliving
+  /// the row that was its only reason to exist.
+  static Future<bool> forgetRing(String id) async {
+    if (id == LocalDb.kPrimaryDeviceId) {
+      debugPrint('[oura] refusing to forget the primary band from here.');
+      return false;
+    }
+    if (instance._deviceId == id) {
+      await instance.stop();
+    }
+    await _dropKey(id);
+    await LocalDb.deleteDevice(id);
+    return true;
+  }
+
+  /// The most recent battery reading the ring reported, or null.
+  ///
+  /// DELIBERATELY NOT WRITTEN TO `band_battery`. That table has no `device_id`
+  /// column and `LocalDb.batteryHealth()` reads it unfiltered — `MAX(millivolts)
+  /// WHERE charging = 1` across every row — so a ring cell's voltage would land
+  /// in the WHOOP band's pack-health series as the band's own full-charge
+  /// voltage, and the charge-cycle count beside it comes from `band_events`,
+  /// which the ring cannot contribute to. Two different cells reported as one
+  /// pack is a wrong number with no way to notice it. Held here instead.
+  int? get batteryPct => _batteryPct;
+  int? get batteryMv => _batteryMv;
+  int? _batteryPct;
+  int? _batteryMv;
+
+  BluetoothDevice? _device;
+
+  /// Kept only so teardown can [GattBandLink.close] it — that is what stops a
+  /// write the adapter queued before teardown from landing on a LATER
+  /// connection to the same ring.
+  GattBandLink? _link;
+  StreamSubscription<BandEvent>? _runSub;
+  Completer<void>? _runDone;
+
+  /// `device.id` of the paired ring — the `device_id` every row it writes
+  /// carries. Never [LocalDb.kPrimaryDeviceId]: `''` is the primary band,
+  /// permanently (ASSUMPTIONS A1).
+  String? _deviceId;
+
+  /// Wall-clock now, in Unix seconds. A field so a replay is deterministic.
+  int Function() _now =
+      () => DateTime.now().millisecondsSinceEpoch ~/ 1000;
+
+  /// The `(ring decisecond, Unix second)` origin, as it is stored: `"ds,unix"`.
+  ///
+  /// Read from `sync_cursor` at the start of a session and handed to the
+  /// adapter, which stamps against it and hands back a better one when a
+  /// `time_sync` event gives it a measured pair. The host keeps the STRING
+  /// because keeping it is all it does — parsing it into two ints and stamping
+  /// with them here would be a second implementation of an origin, and two
+  /// origins is the bug this whole mechanism exists to prevent.
+  String? _anchor;
+
+  /// Rows waiting for the batch's durable commit: `raw_archive` frames and
+  /// whatever could be stamped.
+  final List<Map<String, Object?>> _pendingArchive = [];
+  final List<(int sec, double tempC)> _pendingTemp = [];
+
+  /// Cursor writes, in arrival order, so teardown can wait for them.
+  ///
+  /// SERIALISED AND AWAITED, both load-bearing. The bookmark is written from an
+  /// event callback that nothing awaits, so fire-and-forget let a teardown run
+  /// first — and `stop()` clears `_deviceId`, which made the write a silent
+  /// no-op. It also let a stranded-bookmark RESET be overtaken by an ordinary
+  /// advance arriving after it, putting the useless bookmark straight back.
+  Future<void> _cursorWrites = Future.value();
+
+  void _writeCursor(int ds) {
+    _cursorWrites =
+        _cursorWrites.then((_) => _persistCursor(ds)).catchError((_) {});
+  }
+
+  bool _busy = false;
+
+  /// Connect to the paired ring, drain its history to the end, disconnect.
+  ///
+  /// Returns false when nothing is paired, the key is unreadable, or the
+  /// connect failed. SERIALISED: a second call while one is in flight is a
+  /// no-op rather than a second radio session over the same peripheral.
+  Future<bool> sync() {
+    if (_busy) return Future.value(false);
+    _busy = true;
+    return _sync().whenComplete(() => _busy = false);
+  }
+
+  Future<bool> _sync() async {
+    final row = await pairedRingRow();
+    if (row == null) return false;
+    final deviceId = row['id'] as String?;
+    final remoteId = row['remote_id'] as String?;
+    if (deviceId == null || remoteId == null || remoteId.isEmpty) return false;
+    if (deviceId == LocalDb.kPrimaryDeviceId) {
+      // The primary band's id, permanently. A ring writing under it would
+      // interleave its seconds with the band's in one REPLACE-keyed table.
+      debugPrint('[oura] refusing to sync: the ring row claims the primary '
+          'device id — re-pair it with a minted id.');
+      return false;
+    }
+    final key = await _readKey(deviceId);
+    if (key == null) {
+      // Distinct from "not paired": the row exists, so the user believes they
+      // paired it. A locked keystore fixes itself on the next unlocked run.
+      debugPrint('[oura] paired, but the pairing key could not be read. '
+          'Nothing is written and nothing is re-keyed.');
+      return false;
+    }
+
+    _deviceId = deviceId;
+    await _loadAnchor(deviceId);
+    final cursor = await LocalDb.getCursorInt(_cursorItem(deviceId)) ?? 0;
+
+    try {
+      final device = BluetoothDevice.fromId(remoteId);
+      _device = device;
+      await device.connect(timeout: const Duration(seconds: 20));
+      final services = await device.discoverServices();
+      final link = GattBandLink(
+        entry: kOura,
+        services: services,
+        onLog: (m) => debugPrint('[oura] $m'),
+      );
+      _link = link;
+      final missing = link.missingCharacteristics(kOura.requiredCharacteristics);
+      if (missing.isNotEmpty) {
+        debugPrint('[oura] ${kOura.label}: missing required characteristic(s) '
+            '${missing.map((u) => u.substring(0, 8)).join(", ")}.');
+        await stop();
+        return false;
+      }
+      _startRun(
+        link,
+        OuraAdapter(
+          key: key,
+          startCursorDs: cursor,
+          anchor: _parseAnchor(_anchor),
+          nowSeconds: _now,
+        ),
+      );
+      await _runDone?.future;
+      return true;
+    } catch (e) {
+      debugPrint('[oura] sync failed: $e');
+      return false;
+    } finally {
+      await stop();
+    }
+  }
+
+  /// Drop the link, flush what the session can still stamp, disconnect.
+  /// Safe to call when nothing is connected.
+  Future<void> stop() async {
+    // Before the run subscription is cancelled: an adapter's `finally` can
+    // still write on the way out, and that write must not reach the radio.
+    _link?.close();
+    _link = null;
+    await _runSub?.cancel();
+    _runSub = null;
+    _runDone = null;
+    await _flushPending();
+    await _cursorWrites;
+    _pendingArchive.clear();
+    _pendingTemp.clear();
+    _anchor = null;
+    _deviceId = null;
+    final d = _device;
+    _device = null;
+    if (d != null) {
+      try {
+        await d.disconnect();
+      } catch (_) {/* already gone */}
+    }
+  }
+
+  /// Drive [adapter] over [link]. Cancelling [_runSub] is the ONLY way the
+  /// session ends from this side — an adapter does not get to hang up.
+  void _startRun(BandLink link, OuraAdapter adapter) {
+    final done = Completer<void>();
+    _runDone = done;
+    void finish() {
+      if (!done.isCompleted) done.complete();
+    }
+
+    _runSub = adapter.run(link).listen(
+      _onEvent,
+      onDone: finish,
+      onError: (Object e) {
+        debugPrint('[oura] session ended on error: $e');
+        finish();
+      },
+      cancelOnError: true,
+    );
+  }
+
+  /// SYNCHRONOUS on purpose, apart from the checkpoint. `listen` does not await
+  /// its callback, so anything asynchronous here could interleave with the next
+  /// event; buffering is pure. The checkpoint is the exception and it is safe —
+  /// the adapter blocks on its own completer until `confirm()` resolves, so no
+  /// second checkpoint can arrive while one is being committed.
+  void _onEvent(BandEvent e) {
+    switch (e) {
+      case SampleBatch(:final samples, :final raw, :final ephemeral):
+        // EPHEMERAL IS NEVER PERSISTED, and the check is the HOST's rather than
+        // the adapter's promise. This band always sends false; the line exists
+        // so the one place that decides what reaches the database is the one
+        // place that reads the flag.
+        if (ephemeral) return;
+        _archive(raw ?? const []);
+        for (final s in samples) {
+          if (s.skinTempC == null) continue;
+          // NO RECORD IS FROM THE FUTURE. The only plausibility bound available
+          // for free, and the one that catches a stale origin extrapolating
+          // FORWARD after a ring reboot. The backwards direction has no free
+          // bound — the ring's history depth is not a number this project knows
+          // — so the lower bound is only the "an absolute Unix second in this
+          // decade" window an origin has to be inside to be an origin at all.
+          if (s.tsEpoch > _now() + 300 || s.tsEpoch < 1700000000) {
+            debugPrint('[oura] refusing an implausible second (${s.tsEpoch}); '
+                'the bytes are archived, the reading is not stored.');
+            continue;
+          }
+          _pendingTemp.add((s.tsEpoch, s.skinTempC!));
+        }
+      case OffloadCheckpoint():
+        unawaited(_commitThenConfirm(e));
+      case BandNote(:final key, :final value):
+        switch (key) {
+          case 'oura_cursor_ds':
+            // Emitted only AFTER the host confirmed, which is only after the
+            // commit landed. Persisting it here is therefore always behind the
+            // durable data, never ahead of it — see [_commitThenConfirm].
+            if (value is int) _writeCursor(value);
+          case 'oura_anchor':
+            // The origin the adapter measured. Persisted inside the SAME
+            // transaction as the rows it stamped — see [_commit] — so an origin
+            // can never survive a commit its own rows did not.
+            if (value is String) _anchor = value;
+          case 'oura_cursor_stranded':
+            // The bookmark points past everything the ring holds, which happens
+            // when the ring reboots and its decisecond counter restarts below
+            // it. Dropping it costs one full re-read and is otherwise free: a
+            // re-read is idempotent here (`decoded_onehz` REPLACEs by second,
+            // `raw_archive` dedups on the frame bytes). Leaving it costs every
+            // record the ring takes from here on, silently.
+            debugPrint('[oura] the bookmark is past the end of the ring — '
+                'dropping it so the next sync re-reads from the beginning.');
+            _writeCursor(0);
+          case 'battery':
+            if (value is int) _batteryPct = value;
+          case 'battery_mv':
+            if (value is int) _batteryMv = value;
+          default:
+            debugPrint('[oura] $key = $value');
+        }
+    }
+  }
+
+  /// Bank one batch's verbatim frames.
+  ///
+  /// EVERY frame is archived, decoded or not (owner rulings R1-R3): the beat
+  /// intervals, SpO2, the hypnogram and the steps are all in here undecoded and
+  /// the bytes are banked now so a decoder written when someone owns a ring can
+  /// be run over them.
+  void _archive(List<List<int>> raw) {
+    final capturedAt = _now() * 1000;
+    for (final bytes in raw) {
+      final f = parseOuraFrame(bytes);
+      if (f == null) continue;
+      _pendingArchive.add({
+        'hex': _hex(bytes),
+        // NULL, not 0. This band has no flash-record counter, and `counter` is
+        // what `thinRawArchiveBefore` samples on — a 0 for every row would make
+        // every Oura frame `0 % 60 == 0`, i.e. permanently exempt, which is
+        // accidental policy. NULL never matches its WHERE clause either, but it
+        // says so honestly, and the thinning is reason-scoped anyway.
+        'counter': null,
+        // The frame TAG. `packet_type` is documented as a WHOOP inner[0], and
+        // this is the same thing one layer over: the byte that says what the
+        // record is. Safe to share the column because `reason` below is what
+        // every reader of this table actually selects on.
+        'packet_type': f.tag,
+        // NULL, and it stays NULL. `rec_ts` would be this frame's wall-clock
+        // second, which is exactly the thing that may not be knowable — and it
+        // is NULL on every archived row this app has ever written.
+        'rec_ts': null,
+        'captured_at': capturedAt,
+        // ONE REASON PER TAG, so a decoder written later finds its records by
+        // name instead of re-scanning the table. NOT in
+        // `LocalDb.redrivableArchiveReasons`, deliberately and permanently:
+        // `redriveArchivedRecords` replays a row's `hex` through
+        // `_decodeOneHzSample`, which is the WHOOP R24 chain. Handing it an
+        // Oura frame would run the wrong decoder over the right bytes, which is
+        // the one failure this project treats as worse than an absent number.
+        'reason': 'oura_evt_0x${f.tag.toRadixString(16).padLeft(2, '0')}',
+      });
+    }
+  }
+
+  /// THE ORDERING IS THE POINT, and it is the safe-trim invariant in the only
+  /// currency this band has.
+  ///
+  /// The ring never trims: there is no acknowledgement in the protocol and
+  /// nothing this host writes causes it to delete anything. But the PERSISTED
+  /// CURSOR is the local analogue, and it loses data exactly the same way —
+  /// advancing it past records we did not commit means the next drain asks from
+  /// beyond them and they are never offered again. So the durable commit
+  /// (`raw_archive` + `decoded_onehz` + the anchor, one transaction) happens
+  /// HERE, before `confirm()`, and `confirm()` is what lets the adapter's
+  /// cursor move at all. A commit that throws returns false, the adapter leaves
+  /// the cursor where it was, and the batch is re-read next session — which
+  /// costs a re-read and never a record.
+  Future<void> _commitThenConfirm(OffloadCheckpoint cp) async {
+    final ok = await _commit();
+    if (!ok) {
+      debugPrint('[oura] batch not committed; leaving the cursor where it is.');
+      return;
+    }
+    await cp.confirm();
+  }
+
+  /// One transaction: the archive, the stamped rows, the anchor. Returns
+  /// whether it landed.
+  Future<bool> _commit() async {
+    final deviceId = _deviceId;
+    if (deviceId == null) return false;
+    if (_pendingArchive.isEmpty && _pendingTemp.isEmpty) return true;
+    // Taken out of the buffers BEFORE the await, so a retry cannot write them
+    // twice under two different anchors.
+    final archive = List<Map<String, Object?>>.from(_pendingArchive);
+    final temps = List<(int, double)>.from(_pendingTemp);
+    _pendingArchive.clear();
+    _pendingTemp.clear();
+    final anchor = _anchor;
+    try {
+      final db = await LocalDb.instance;
+      await db.transaction((txn) async {
+        final b = txn.batch();
+        for (final row in archive) {
+          // IGNORE on the `hex` primary key. The ring re-delivers freely — a
+          // re-read of the same range is idempotent by design — and two frames
+          // with identical bytes ARE the same record: the envelope decisecond
+          // is inside the bytes, so genuinely distinct records cannot collide.
+          b.insert('raw_archive', row,
+              conflictAlgorithm: ConflictAlgorithm.ignore);
+        }
+        for (final (sec, tempC) in temps) {
+          b.insert(
+            'decoded_onehz',
+            {
+              'device_id': deviceId,
+              'ts_ms': sec * 1000,
+              'rec_ts': sec,
+              // ponytail: `counter` is NOT NULL and is a WHOOP flash-record
+              // number this ring does not have. 0 for every row is a constant,
+              // not a measurement, and nothing reads the column except
+              // `ORDER BY rec_ts, counter`. Make it nullable when db.dart is
+              // next open — `hrs_link.dart` carries the same note.
+              'counter': 0,
+              // ABSOLUTE degrees Celsius, so `skin_temp_c` and never
+              // `skin_temp_raw`, which is a relative ADC count on the bands
+              // that have one. `hr` and the accelerometer columns are omitted
+              // entirely: this ring's beat intervals and motion are bit-packed
+              // and undecoded, and absent is NULL, never 0.
+              'skin_temp_c': tempC,
+              'device_family': kOura.id,
+              'source': kOura.id,
+            },
+            conflictAlgorithm: ConflictAlgorithm.replace,
+          );
+        }
+        if (anchor != null) {
+          // In the SAME transaction as the rows it stamped. An origin that
+          // survived a commit its own rows did not would stamp the next session
+          // against something nothing on disk agrees with.
+          await LocalDb.setCursor(_anchorItem(deviceId), anchor, txn: txn);
+        }
+        await b.commit(noResult: true);
+      });
+      return true;
+    } catch (e) {
+      debugPrint('[oura] commit failed, ${archive.length} frame(s) and '
+          '${temps.length} reading(s) not banked: $e');
+      return false;
+    }
+  }
+
+  /// Commit whatever a session ended holding.
+  ///
+  /// Reachable when a drain ends on the link dropping rather than on a batch
+  /// summary: the frames arrived, so they are ours to bank, and the adapter's
+  /// cursor never moved past them — so the worst case is that the next session
+  /// re-reads them.
+  Future<void> _flushPending() async {
+    if (_pendingArchive.isEmpty && _pendingTemp.isEmpty) return;
+    await _commit();
+  }
+
+  Future<void> _persistCursor(int ds) async {
+    final deviceId = _deviceId;
+    if (deviceId == null) return;
+    // NOT MONOTONIC, and it must not be. 0 arrives here when the ring reports
+    // data remaining and answers this bookmark with nothing — a bookmark past
+    // the end, which only ever gets there by going BACKWARDS. A guard that
+    // refused to lower it would turn the one recoverable case into the
+    // permanent stall it exists to fix.
+    await LocalDb.setCursor(_cursorItem(deviceId), '$ds');
+  }
+
+  Future<void> _loadAnchor(String deviceId) async {
+    _anchor = await LocalDb.getCursor(_anchorItem(deviceId));
+  }
+
+  /// The stored origin as a pair, or null when there is not a usable one.
+  /// A malformed value is treated as no origin: the session then abstains
+  /// until the ring hands it a measured one, which is the safe direction.
+  static (int, int)? _parseAnchor(String? raw) {
+    final parts = raw?.split(',') ?? const [];
+    if (parts.length != 2) return null;
+    final ds = int.tryParse(parts[0]);
+    final unix = int.tryParse(parts[1]);
+    return (ds == null || unix == null) ? null : (ds, unix);
+  }
+
+  static Future<List<int>?> _readKey(String deviceId) async {
+    try {
+      final hex = await _secure.read(
+        key: _keyItem(deviceId),
+        iOptions: _kApple,
+        mOptions: _kMacos,
+      );
+      return hex == null ? null : _unhex(hex);
+    } catch (e) {
+      // A locked keychain and a wedged keystore both land here. Distinct from
+      // "no key": there is nothing for the user to redo, and the next unlocked
+      // run reads it fine.
+      debugPrint('[oura] the keychain was unavailable: $e');
+      return null;
+    }
+  }
+
+  /// Replay a scripted ring through the REAL [OuraAdapter] and the real write
+  /// path. The only way in: the entry point is a BLE notification and
+  /// `flutter_blue_plus` has no simulator path.
+  ///
+  /// [reply] answers each write the way the ring would, exactly as
+  /// `oura_adapter_test.dart` scripts it — a replay link records writes but
+  /// cannot react to them.
+  @visibleForTesting
+  Future<ReplayBandLink> ingestForTest(
+    String deviceId,
+    List<int> key,
+    List<List<int>> Function(int writeIndex, List<int> value) reply, {
+    int Function()? nowSeconds,
+    Duration timeouts = const Duration(milliseconds: 50),
+  }) async {
+    _now = nowSeconds ?? _now;
+    _deviceId = deviceId;
+    await _loadAnchor(deviceId);
+    final cursor = await LocalDb.getCursorInt(_cursorItem(deviceId)) ?? 0;
+    final link = ReplayBandLink();
+    _startRun(
+      link,
+      OuraAdapter(
+        key: key,
+        startCursorDs: cursor,
+        anchor: _parseAnchor(_anchor),
+        nowSeconds: _now,
+        replyTimeout: timeouts,
+        confirmTimeout: timeouts,
+      ),
+    );
+    var served = 0;
+    for (var spin = 0; spin < 800 && !(_runDone?.isCompleted ?? true); spin++) {
+      await Future<void>.delayed(Duration.zero);
+      while (served < link.writes.length) {
+        for (final f in reply(served, link.writes[served].$2)) {
+          link.feed(kOuraNotifyChar, f, atSec: _now());
+        }
+        served++;
+      }
+    }
+    await link.close();
+    await _runDone?.future.timeout(
+      const Duration(seconds: 2),
+      onTimeout: () {},
+    );
+    await _runSub?.cancel();
+    _runSub = null;
+    _runDone = null;
+    await _flushPending();
+    await _cursorWrites;
+    _pendingArchive.clear();
+    _pendingTemp.clear();
+    _anchor = null;
+    _deviceId = null;
+    return link;
+  }
+}
+
+/// Pair [device] as this phone's Oura ring. Null on success, or a sentence the
+/// user can act on.
+///
+/// FACTORY RESET IS A PRECONDITION, NOT A CONSEQUENCE. The ring holds exactly
+/// one 16-byte key and will only accept a new one while it is factory reset —
+/// so a ring currently onboarded to its own vendor app cannot be paired here at
+/// all until the owner resets it, and resetting is what removes it from that
+/// app. There is no state in which both work. Say that BEFORE the user commits;
+/// this function is the point of no return, not the warning.
+///
+/// THE KEY IS OURS AND NEVER LEAVES THE PHONE. It is generated here by
+/// `Random.secure()`, there is no vendor server anywhere in the handshake and
+/// no account is needed. Losing it costs another factory reset, nothing more.
+///
+/// THE ORDER IS INSTALL, THEN PROVE. The key install is unauthenticated — it
+/// has to be, since it is what creates the credential — so it goes out first,
+/// before any nonce request. The authentication round trip after it is not
+/// required by the protocol; it is here because "the ring acknowledged the
+/// write" and "the ring will now let us in" are different claims, and a pairing
+/// that only checks the first hands the user a device row that can never sync.
+///
+/// STILL HARDWARE-UNVERIFIED, like everything else on this path (R6).
+Future<String?> pairOuraRing(BluetoothDevice device) async {
+  final rnd = Random.secure();
+  final key = List<int>.generate(16, (_) => rnd.nextInt(256));
+  final deviceId =
+      'oura-${_hex(List<int>.generate(4, (_) => rnd.nextInt(256)))}';
+  GattBandLink? link;
+  // Set true only on the one path that writes the `device` row. Every OTHER
+  // exit — a refused command, a silent ring, a caught exception, even the
+  // early `missingCharacteristics` return before the key is written at all —
+  // leaves this false, and the `finally` below drops whatever key the phone
+  // has stored for [deviceId] so a failed pairing never outlives itself as an
+  // orphaned secret with no row pointing at it.
+  var paired = false;
+  try {
+    await device.connect(timeout: const Duration(seconds: 20));
+    final services = await device.discoverServices();
+    link = GattBandLink(
+      entry: kOura,
+      services: services,
+      onLog: (m) => debugPrint('[oura pair] $m'),
+    );
+    final missing = link.missingCharacteristics(kOura.requiredCharacteristics);
+    if (missing.isNotEmpty) {
+      return 'That device does not expose the ring service this app speaks.';
+    }
+
+    // Install, then prove — over the real wire builders and nothing else.
+    //
+    // ONE subscription and a growing list, rather than a `firstWhere` per
+    // reply: `BandLink.notify` is single-subscription, so the second
+    // `firstWhere` would throw "already listened to" AFTER the first reply had
+    // been consumed — a pairing that fails on a ring that answered correctly.
+    // ponytail: a 20 ms poll over the list is the smallest correct thing here.
+    // The alternative is a second copy of `oura.dart`'s private `_Inbox`, for
+    // three replies, once, during pairing.
+    final inbox = <OuraFrame>[];
+    final sub = link.notify(kOuraNotifyChar).listen((rec) {
+      final f = parseOuraFrame(rec.$2);
+      if (f != null) inbox.add(f);
+    });
+    var read = 0;
+    Future<OuraFrame?> waitFor(bool Function(OuraFrame) matches) async {
+      final elapsed = Stopwatch()..start();
+      while (elapsed.elapsed < const Duration(seconds: 10)) {
+        while (read < inbox.length) {
+          final f = inbox[read++];
+          if (matches(f)) return f;
+        }
+        await Future<void>.delayed(const Duration(milliseconds: 20));
+      }
+      return null;
+    }
+
+    try {
+      // THE KEY IS STORED BEFORE IT IS SENT, and the order is deliberate. A
+      // crash between the write and the store leaves the ring holding a key
+      // this phone does not have — unrecoverable except by another factory
+      // reset, which is the one cost in this flow the user cannot undo. A
+      // stored key with no ring behind it costs nothing: `sync()` never looks
+      // at it, because there is no `device` row pointing to it yet.
+      await _secure.write(
+        key: _keyItem(deviceId),
+        value: _hex(key),
+        iOptions: _kApple,
+        mOptions: _kMacos,
+      );
+      if (!await link.write(kOuraCommandChar, ouraCmdSetAuthKey(key))) {
+        return 'The ring would not accept a command. Try again with it on '
+            'the charger and next to the phone.';
+      }
+      final installed = await waitFor((f) => ouraSetAuthKeyResult(f) != null);
+      // SILENCE IS A REFUSAL, NOT CONSENT. A ring that already holds a key is
+      // the case that matters here and it does not necessarily answer at all —
+      // and carrying on to mint a `device` row on the strength of a quiet ring
+      // is how a user spends a factory reset and ends up with nothing working.
+      if (installed == null || ouraSetAuthKeyResult(installed) != 0) {
+        return _kResetFirst;
+      }
+      if (!await link.write(kOuraCommandChar, ouraCmdAuthNonce())) {
+        return 'The ring would not accept a command. Try again with it on '
+            'the charger and next to the phone.';
+      }
+      final challenge = await waitFor((f) => ouraAuthNonce(f) != null);
+      if (challenge == null) {
+        return 'The ring stopped answering part-way through pairing. Put it on '
+            'the charger, keep it next to the phone, and try again.';
+      }
+      final answer = ouraAuthResponse(key, ouraAuthNonce(challenge)!);
+      if (!await link.write(kOuraCommandChar, ouraCmdAuthenticate(answer))) {
+        return 'The ring would not accept the pairing answer.';
+      }
+      final replyFrame = await waitFor((f) => ouraAuthResult(f) != null);
+      if (replyFrame == null) {
+        return 'The ring stopped answering part-way through pairing. Put it on '
+            'the charger, keep it next to the phone, and try again.';
+      }
+      // THE CODES CARRY DIFFERENT REMEDIES, so they are not collapsed into one
+      // sentence. `factoryReset` here means the install did not actually take
+      // even though it was acknowledged — retrying is worth a try and does not
+      // cost another reset. Everything else means the ring belongs to something
+      // else, and only a reset frees it.
+      final result = ouraAuthResult(replyFrame);
+      if (result == kOuraAuthFactoryReset) {
+        return 'The ring took the key but is still waiting for one, which '
+            'should not happen. Try pairing again.';
+      }
+      if (result != 0) {
+        return _kResetFirst;
+      }
+    } finally {
+      await sub.cancel();
+    }
+
+    // The `device` row LAST, because it is what makes the ring reachable: a row
+    // that exists is a ring `sync()` will try to drain, so it is only written
+    // once the key is stored AND the ring has proved it accepts it.
+    await LocalDb.upsertDevice(
+      id: deviceId,
+      adapterId: kOura.id,
+      remoteId: device.remoteId.str,
+      // Same filter the notify-class pairing path runs the advertised name
+      // through — the device list renders this column assuming it was
+      // cleaned here, and an unfiltered ring name would be the one row that
+      // was not.
+      label: cleanDeviceLabel(device.platformName) ?? kOura.label,
+      // `tier` is left unset on purpose. It means MEASUREMENT QUALITY and it is
+      // what decides precedence between two sources — and this ring supplies no
+      // signal at all today (`OuraAdapter.signals` is `const {}`), so there is
+      // no quality to rank. NULL is a refusal, not a default.
+    );
+    paired = true;
+    return null;
+  } catch (e) {
+    debugPrint('[oura pair] failed: $e');
+    return 'Could not connect to that ring.';
+  } finally {
+    if (!paired) await OuraLink._dropKey(deviceId);
+    link?.close();
+    try {
+      await device.disconnect();
+    } catch (_) {/* already gone */}
+  }
+}
diff --git a/lib/compute/derivation_engine.dart b/lib/compute/derivation_engine.dart
index d1ccd8ea..0b2b4b54 100644
--- a/lib/compute/derivation_engine.dart
+++ b/lib/compute/derivation_engine.dart
@@ -1014,11 +1014,12 @@ import 'substrate.dart';
 //      already gated `hr > 0`), but a new query must not assume NOT NULL.
 //
 //   6. FROM ANALYTICS (98d42b6, the device-seam commit — and only that):
-//      * `device.dart`: `DeviceFamily`, `deviceFamilyOf()` returning null for
-//        anything it does not recognise, and `calibrationFor()` returning null
-//        rather than handing back gen4's constants. This is what (1) dispatches
-//        on. No registry, no shared constants file — a metric declares its own
-//        map next to itself and refuses when the family is not in it.
+//      * `device.dart`: `calibrationFor()` returning null for an unstamped
+//        strap, or for one this metric has no numbers for, rather than handing
+//        back gen4's constants. This is what (1) dispatches on. No registry, no
+//        shared constants file and no closed list of families — a metric
+//        declares its own String-keyed map next to itself and refuses when the
+//        stamp is not a key in it.
 //      * journal correlations ran 9 numeric fields against 4 outcomes behind a
 //        per-test gate. That is 36 simultaneous tests, so ~2 spurious
 //        "meaningful" findings per user were guaranteed by construction.
@@ -1287,7 +1288,127 @@ import 'substrate.dart';
 // imported this is a strict no-op: the set is empty and every read is unchanged.
 // Days already finalized keep the score they were derived with — raw is pruned,
 // so no bump can heal them.
-const int kAlgoVersion = 76;
+// v77 — BAND-AGNOSTIC GROUPS A AND C. The 1 Hz assumption comes out of the
+// metrics that were counting array positions and calling them seconds, and four
+// gen4 defects found on the way out. Eight entries move a published number:
+//   1. A1 — BEAT TIMES REACH THE READ PATH. `decoded_rr.beat_ts_ms` (the
+//      record's own sub-second anchor) was written and never SELECTed, so every
+//      beat sat on a whole-second staircase and no dropout under 1 s was
+//      visible. LF/HF and `span_sec` move with the re-anchored axis.
+//
+//      MAGNITUDE, CORRECTED 2026-08-23 against the owner's own gen5 export.
+//      The +0.031% first recorded here was a LOWER BOUND — it came from a
+//      measurement that forced `tsSubsec = 0`, isolating the staircase→chain
+//      term and none of the real sub-second effect. On 2026-08-22: RMSSD
+//      78.571 → 73.198 (−6.84%), pNN50 −0.56%, SDNN −1.36%, and n_beats
+//      31177 → 30948 (−0.73%). 2026-08-23 moved the other way (+0.02%), so it
+//      is per-night, not a constant shift.
+//
+//      SDNN and the beat COUNT both move, which the original note said they
+//      would not. Not a defect: `beat_ts_ms` anchors a record's LAST beat and
+//      walks backwards through the durations, so a 4-beat record's first beat
+//      lands ~1444 ms BEFORE its own `rec_ts` (measured, and it scales one RR
+//      per beat exactly as that model predicts). `_beatTimes`' dropout test is
+//      `(rrTsMs[i] - rrTsMs[i-1]) - rrMs[i] > 1000`; on the staircase two beats
+//      inside one record differed by 0 ms so it could NEVER fire. Sub-second
+//      dropouts were structurally invisible. They fire now, the re-anchor set
+//      changes, and `hrv_time`'s contiguous-pair mask changes with it — the
+//      interval VALUES are untouched.
+//
+//      0.41% of beats (624/151,595, worst −1490 ms) step backwards where two
+//      records overlap. Handled, not a hazard: `cur = (dropout && anchored >
+//      cur) ? anchored : cur + rrMs[i]` never takes a backwards jump. `rr_ts_ms`
+//      measured 0.00% non-monotonic only because a whole-second staircase is
+//      trivially so — it hid the overlap rather than preventing it.
+//
+//      UNVALIDATED IN MAGNITUDE. Nothing available says whether 73.198 or
+//      78.571 is closer to truth: the band's `hr` comes from the same beat
+//      detector as `rr_ms`, so it is not independent evidence. That is the
+//      simultaneous-H10 experiment, and this is its second reason to happen.
+//   2. A2 — ACCEL VALIDITY SURVIVES SEGMENTATION. `AccelSample.valid` was
+//      dropped converting to the segmenter's own type, so a night the strap
+//      never vouched for was staged as if it had. Measured: 8 h of
+//      `valid:false` published `TST 28619s, efficiency 100.0%`; it is absent
+//      now.
+//   3. A3 — BEATS WITH NO FRAME ARE KEPT. RR was looked up only inside the
+//      frames loop, so a beat whose second has no `decoded_onehz` row was
+//      discarded — and gen4's hr-only historical R10-lite produces exactly
+//      those. The 1 Hz substrate is the UNION of frame and beat seconds now.
+//   4. A4 — READINESS NEEDS 14 NIGHTS, not 3. A 3-night baseline is three
+//      numbers: its MAD is routinely one quantum wide or zero, which is how a
+//      degenerate z reached the logistic and the ring flashed a rail. Sub-
+//      quantum spreads are refused outright rather than z-scored.
+//   5. C1 — THE 30-MINUTE TROUGH IS 30 MINUTES. `nocturnalRhr` walks a wall
+//      clock (`onehz_pipeline.dart`, `tsSec: sleepTs`) instead of counting 1800
+//      positions. At a perfectly dense 1 Hz the two coincide; on real nights
+//      they do not, because real nights have holes. Measured over this owner's
+//      export: 2026-08-13 and 2026-08-14 are bit-identical (1 and 243 missing
+//      seconds), 2026-08-12 moves 62.952 → 62.857 bpm (506 missing seconds of
+//      25,262 — the positional window was averaging over ~30.5 min of clock and
+//      missing the real trough). The wall-clock answer is the correct one, and
+//      the same edit is what lets the metric exist at all at 60 s and 300 s,
+//      where it previously abstained. It feeds readiness's 0.30-weight driver.
+//   6. C9 — no metric credits a sample whose cadence cannot be measured. One
+//      `sampleCadenceSeconds` with an ABSTENTION replaces three median-interval
+//      helpers with numeric fallbacks; a band slower than 300 s used to have
+//      every reading credited as one second (~300x zone undercount) and now has
+//      no zone figure at all.
+//   7. C13 — an unstamped substrate carrying a step counter reports
+//      `band_measured: null`. Without a device stamp there is no modulus to
+//      unwrap it with, and a guessed one publishes a step count at tier HIGH.
+//   8. THE SAME TREATMENT FOR R-R AND FOR GRAVITY, which the list above missed
+//      on the way past and which move published numbers exactly as items 1-7
+//      do. `kMinPlausibleHr`/`kMaxPlausibleHr` had a sibling added either side
+//      of it in `substrate.dart` and both are new here:
+//        * `kMinPlausibleRrMs..kMaxPlausibleRrMs` (250..2400). Only `rr <= 0`
+//          was dropped before, so a corrupt-but-CRC-valid interval reached
+//          RMSSD, pNNx and every frequency-domain read. It drops the BEAT, not
+//          the record — the surviving beats keep the placement `beatTimesMs`
+//          already gave them.
+//        * `kMaxSustainedAccelG` (4.0). `accelPresentAt` rejected only an exact
+//          `(0,0,0)` fill; a second-long mean above 4 g is not a wrist either,
+//          and it is now absent rather than present. That reaches every accel
+//          consumer — van Hees, ENMO, movement minutes, the sleep segmenter —
+//          because absent accel is NOT stillness.
+//      Both refuse rather than clamp, for the reason `plausibleHrOrNull` does.
+// v78 — REVIEW PASS ON v77. One edge fix and four analytics fixes, all in the
+// same "a rejected reading must not still move a kept one" family v77 was
+// itself about.
+//   1. `beatTimesMs` (`substrate.dart`) let an interval `plausibleRrOrNull`
+//      would go on to REJECT (positive but outside 250..2400 ms) still walk
+//      every EARLIER beat in the record back by it, before the caller ever
+//      saw the rejection. The interval that placed beat i-1 now has to pass
+//      the same plausibility test placing beat i's own reading already does
+//      — an implausible one breaks the chain (null, same as non-positive)
+//      instead of silently displacing a beat that is kept.
+//   2. `nocturnalRhr` (analytics) could reach a window with zero on-skin
+//      samples and land `sum / count` as NaN, which then LATCHES as the
+//      night's best trough (`m < best` is false for a NaN on either side) —
+//      a present metric with a NaN value. Only reachable with
+//      `minCoverage: 0`, which no call site in this repo passes; the fix is
+//      defensive, no WHOOP output moves.
+//   3. `_rescaleCounts` (analytics sleep stager) multiplied an
+//      already-cadence-invariant gravity-delta sum by the cadence a second
+//      time — the sum is already `epochSec * rate` independent of sample
+//      count, so the extra factor inflated a slower-than-1Hz band's
+//      Cole-Kripke score up to 5x. `cadenceSec == 1` at 1 Hz makes the factor
+//      a no-op, so no WHOOP output moves.
+//   4. `cardio_stager`'s epoch grid could silently drift from its own
+//      reported `epochSec` whenever the measured cadence did not divide it
+//      evenly — it abstains on that mismatch now rather than publish a grid
+//      whose real spacing does not match its own label. WHOOP's 1 Hz cadence
+//      always divides the 30 s epoch evenly, so no WHOOP output moves.
+//   5. Readiness's sub-quantum-dispersion guard (analytics, following A4
+//      above) only ran when `robustZ` came back null, missing a baseline
+//      with nonzero MAD but still-quantized SD (whole-bpm RHR alternating
+//      58/59: MAD 0.5, SD ~0.52, both below the 1-bpm quantum). Runs for
+//      every quantized input now. THIS ONE CAN MOVE A WHOOP READINESS SCORE
+//      — a baseline that happens to sit in that MAD-nonzero/SD-sub-quantum
+//      gap now refuses by name instead of contributing a z-score built on
+//      quantization noise.
+// Days already finalized keep the score they were derived with — raw prunes at
+// `rawRetentionDays`, so no bump can heal them.
+const int kAlgoVersion = 78;
 
 /// The sibling SHAs this version was derived against, asserted against
 /// pubspec.yaml in test/db_serve_version_and_reads_test.dart.
@@ -1334,8 +1455,27 @@ const int kAlgoVersion = 76;
 // COMMAND builders (alarmRev1Payload and friends) plus their exports and
 // test. Commands go TO the strap; no decoder line moves, so no stored number
 // can.
-const String kAnalyticsPin = 'd9362a66fbeac326d5d7d7b1fe27b28e41169a79';
-const String kProtocolPin = '4ce8f021568a4cd9a1d86c91004f91c6b21980da';
+//
+// THE ANALYTICS DEBT THIS BLOCK RECORDED IS PAID. Four of the items above (A2,
+// A4, C1's window, C9) live in analytics, and for most of this branch's life
+// they were UNCOMMITTED: `pubspec_overrides.yaml` pointed the local build at
+// `../analytics`, so a dev build already ran them while the pin (`d9362a6`) did
+// not contain a line of them — a build shipping this constant against that pin
+// would have served days derived from different maths under one version number,
+// the exact v67/v68 failure. The pin is `d6ba41c` now and carries all four,
+// checkable one at a time:
+//   git show d6ba41c:lib/src/onehz/sleep/segment.dart | grep 'valid: trimmedAccel'
+//   git show d6ba41c:lib/src/onehz/wellness/readiness_composite.dart \
+//     | grep 'readinessCompositeMinBaseline = 14'
+//   git show d6ba41c:lib/src/onehz/clinical/nocturnal.dart | grep 'tsSec'
+//   git show d6ba41c:lib/src/onehz/util.dart | grep 'sampleCadenceSeconds'
+// The guard test compares this constant to pubspec.yaml and would not have
+// caught the gap — both were consistent the whole time. Whether the pinned SHA
+// contains the change a bump CITES is still a thing a human checks; v43 shipped
+// a changelog for an analytics fix its pin never had, and the bug it claimed to
+// fix stayed live for three releases.
+const String kAnalyticsPin = '353c6bc30f56b936c450e25a3759e5572b164bd8';
+const String kProtocolPin = '19d72919ecc0cbca518e0fdbbe2f6f9dc7ffe265';
 
 // Fold idempotency, the minimum-nights warm-up, and legacy-payload handling
 // all live in SleepProfilePolicy (pure, unit-tested) — see
@@ -1527,16 +1667,28 @@ class _BaselineHistoryCache {
   ///
   /// The mask is taken ONCE per load and applied to every key, because the
   /// query behind it scans day bundles (see [LocalDb.importedDates]).
+  ///
+  /// A SECOND, NARROWER MASK rides along: days measured by a different BAND
+  /// FAMILY, applied only to [LocalDb.familySeamKeys]. That one is not about a
+  /// foreign algorithm — it is this app's own maths over a sensor whose units
+  /// differ (`skin_temp_adc` is a gen4 ADC count on one side of a strap swap
+  /// and a gen5 centi-degree on the other), so it is masked PER-METRIC rather
+  /// than blanket: a family seam that only makes a number noisier (RHR, RMSSD)
+  /// stays in the window. Empty for a user who has never changed generation,
+  /// which is why it moves no number today.
   static Future<_BaselineHistoryCache> load() async {
     final imported = await LocalDb.importedDates();
+    final foreignFamily = await LocalDb.foreignFamilyDates();
     Future<List<_DatedValue>> hist(String key) async {
       final rows = await LocalDb.metricSeries(key);
+      final seam =
+          LocalDb.familySeamKeys.contains(key) ? foreignFamily : const <String>{};
       final out = <_DatedValue>[];
       for (final row in rows) {
         final date = row['date'];
         final value = row['value'];
         if (date is! String || date.isEmpty || value is! num) continue;
-        if (imported.contains(date)) continue;
+        if (imported.contains(date) || seam.contains(date)) continue;
         out.add((date: date, value: value.toDouble()));
       }
       return out;
@@ -2636,6 +2788,16 @@ class DerivationEngine {
       int? afterCursor;
       var rangePages = 0;
       var rangeRows = 0;
+      // Low water mark for the BEAT read, which is NOT the same window as the
+      // frame read. Paging is driven by `decoded_onehz`, but a beat can exist
+      // for a second with no 1 Hz row at all (gen4 R10-lite is hr-only and
+      // stays out of that table — see db.dart `_queueDecodedOneHz`). Clamping
+      // each page's beat read to that page's own first/last frame second
+      // dropped every such beat that fell before the day's first frame, after
+      // its last, or in the seam between two pages. Each page instead reads
+      // beats from wherever the previous page stopped, and the tail is swept
+      // after the loop — so the day's beat window is covered exactly once.
+      var rrFrom = fromRecTs;
       while (true) {
         final decodedRows = await LocalDb.decodedOneHzBatchByRecTsRange(
           limit: _rawDecodeBatchSize,
@@ -2659,17 +2821,17 @@ class DerivationEngine {
             rangePages: rangePages,
             rangeRows: rangeRows,
           );
-          // The page is ordered rec_ts ASC, so first = min second, last = max.
-          // decoded_rr shares the rec_ts key, so this pulls exactly the page's
-          // beats — no counter span (which broke across the strap's reboot reset).
-          final firstRecTs = (decodedRows.first['rec_ts'] as num?)?.toInt();
+          // The page is ordered rec_ts ASC, so last = max second. decoded_rr
+          // shares the rec_ts key, so [rrFrom, lastRecTs] is a PK range read —
+          // no counter span (which broke across the strap's reboot reset).
           final lastRecTs = (decodedRows.last['rec_ts'] as num?)?.toInt();
-          final rrRows = firstRecTs == null || lastRecTs == null
+          final rrRows = lastRecTs == null
               ? const <Map<String, dynamic>>[]
               : await LocalDb.decodedRrByRecTsRange(
-                  fromRecTs: firstRecTs,
+                  fromRecTs: rrFrom,
                   toRecTs: lastRecTs,
                 );
+          if (lastRecTs != null) rrFrom = lastRecTs + 1;
           worker.send({'type': 'page', 'frames': decodedRows, 'rr': rrRows});
           final last = decodedRows.last;
           afterRecTs = (last['rec_ts'] as num?)?.toInt() ?? afterRecTs;
@@ -2679,6 +2841,23 @@ class DerivationEngine {
         }
         break;
       }
+      // The tail: beats after the last frame second (or, on a range with no
+      // frames at all, the whole range). Usually zero rows and one indexed
+      // lookup; when it is not, these are seconds the band recorded and only
+      // reported beats for.
+      if (rrFrom <= toRecTs) {
+        final tailRr = await LocalDb.decodedRrByRecTsRange(
+          fromRecTs: rrFrom,
+          toRecTs: toRecTs,
+        );
+        if (tailRr.isNotEmpty) {
+          worker.send({
+            'type': 'page',
+            'frames': const <Map<String, dynamic>>[],
+            'rr': tailRr,
+          });
+        }
+      }
       worker.send(const {'type': 'finish'});
       // BOUNDED. `result.future` had no timeout at all, so any path that left
       // the worker unable to answer hung this call — and with it the whole
@@ -3250,7 +3429,6 @@ class DerivationEngine {
         if (v == null) continue;
         flat['${key}_value'] = v['value'];
         flat['${key}_baseline_n'] = v['baseline_n'];
-        flat['${key}_baseline_sd'] = v['baseline_sd'];
       }
       flat['note'] = diag['note'];
       TelemetryService.instance.record(
@@ -3283,8 +3461,7 @@ class DerivationEngine {
           final v = (diag[key] as Map?)?.cast<String, dynamic>();
           if (v == null) continue;
           summary.write(
-              ' $key=${v['value'] == true ? 'Y' : 'n'}/${v['baseline_n']}'
-              '(sd=${v['baseline_sd']})');
+              ' $key=${v['value'] == true ? 'Y' : 'n'}/${v['baseline_n']}');
         }
         summary.write(' | $note');
         TelemetryService.instance.recordNonFatal(
@@ -3634,6 +3811,10 @@ class DerivationEngine {
       // score and must carry its own tag; a day whose provenance is genuinely
       // unknown stays NULL and is never retro-filled with this.
       source: 'band',
+      // WHICH BAND'S UNITS these scalars are in (B5). Already null when the
+      // day's substrate spans two straps or carries no stamp — the same
+      // "unknown, never guessed" value the column is documented with.
+      deviceFamily: daySub.deviceFamily,
       series: {
         'rhr': sc('rhr'),
         'rmssd': sc('rmssd'),
@@ -4652,7 +4833,13 @@ class DerivationEngine {
       samples.add(ana.HrSample(ts * 1000.0, s.hr[i].toDouble()));
     }
     final zoneSet = ana.HeartRateZones.zonesFromMaxHr(hrMax);
-    return ana.HeartRateZones.timeInZone(samples, zoneSet).toRoundedMinuteMap();
+    // Null = the stream has no cadence `sampleCadenceSeconds` will vouch for.
+    // An empty map is already this function's "no zones" answer everywhere it
+    // is read; a zero-filled one would claim the day was measured and spent at
+    // rest. See `HeartRateZones.timeInZone`.
+    return ana.HeartRateZones.timeInZone(samples, zoneSet)
+            ?.toRoundedMinuteMap() ??
+        const {};
   }
 
   /// ONE HR-flex pass, returning the day's active, basal and total figures
@@ -5173,7 +5360,11 @@ class DerivationEngine {
         scMap,
         liveStepsReal,
         liveStepsFromStrap: liveStepsFromStrap,
-        bandSteps: hardwareStepsFromCounter(daySub),
+        bandSteps: hardwareStepsFromCounter(
+          daySub,
+          cumulativeCounterModulus:
+              ana.calibrationFor(_stepCounterModulus, daySub.deviceFamily),
+        ),
       );
 
       if (daySub.length < 60) return;
@@ -5986,9 +6177,19 @@ class DerivationEngine {
   /// pretending to separate postures. Listed per family because the cut is only
   /// meaningful against that family's accel scale; an unknown strap gets no cut
   /// and the whole block refuses.
-  static const Map<ana.DeviceFamily, double> _quietEnmoCutG = {
-    ana.DeviceFamily.gen4: 0.02,
-    ana.DeviceFamily.gen5: 0.02,
+  /// On-chip step counters whose BEHAVIOUR we have established, by the family
+  /// stamped on the row: the modulus it wraps at, and — the part that actually
+  /// matters — that it is cumulative and does NOT reset at midnight. Both are
+  /// verified for gen5 (see `Substrate.stepCount`). A stamp that is not a key
+  /// here, including no stamp at all, gets no band-step number: summing deltas
+  /// off a resetting counter loses the day's whole pre-sync prefix, and it
+  /// cannot be told apart from a wrap afterwards. See
+  /// [hardwareStepsFromCounter].
+  static const Map<String, int> _stepCounterModulus = {'gen5': 65536};
+
+  static const Map<String, double> _quietEnmoCutG = {
+    'gen4': 0.02,
+    'gen5': 0.02,
   };
 
   @visibleForTesting
diff --git a/lib/compute/derive_prepare.dart b/lib/compute/derive_prepare.dart
index ebc0b0fa..a21d9af3 100644
--- a/lib/compute/derive_prepare.dart
+++ b/lib/compute/derive_prepare.dart
@@ -249,11 +249,13 @@ void derivationPrepareWorker(SendPort mainSendPort) {
           .whereType<Map>()
           .map((e) => e.cast<String, dynamic>())
           .toList();
-      if (frames.isNotEmpty) {
-        final rr = ((message['rr'] as List?) ?? const [])
-            .whereType<Map>()
-            .map((e) => e.cast<String, dynamic>())
-            .toList();
+      final rr = ((message['rr'] as List?) ?? const [])
+          .whereType<Map>()
+          .map((e) => e.cast<String, dynamic>())
+          .toList();
+      // A page with beats but NO frames is a real page, not an empty one — see
+      // addDecodedPage. Only a page with neither is a raw-hex page.
+      if (frames.isNotEmpty || rr.isNotEmpty) {
         state.addDecodedPage(frames, rr);
         return;
       }
@@ -312,6 +314,15 @@ void derivationPrepareWorker(SendPort mainSendPort) {
   });
 }
 
+/// One decoded page + its beats through the accumulator, the way the worker
+/// feeds it. Exists so the page seam — the `beat_ts_ms` coalesce and the
+/// frame/beat union — is testable without spinning an isolate.
+@visibleForTesting
+Substrate substrateFromDecodedPage(
+  List<Map<String, dynamic>> frames,
+  List<Map<String, dynamic>> rrRows,
+) => (_PrepareAccumulator()..addDecodedPage(frames, rrRows)).buildSubstrate();
+
 @visibleForTesting
 PreparedDerivationPayload prepareDerivationPayload(
   Substrate sub, {
@@ -419,6 +430,24 @@ class _PrepareAccumulator {
   /// path) or more than one (the athlete changed straps inside this window) ⇒
   /// null, i.e. UNKNOWN, and per-family metrics refuse. Cheaper than a
   /// per-second array and it answers the only question anyone asks.
+  ///
+  /// WHAT THIS DOES NOT CATCH, and cannot today: a change of UNIT within one
+  /// family. A warranty-replacement WHOOP 4 stamps `gen4` exactly like the one
+  /// it replaced, so the singleton test passes and one thermistor calibration
+  /// is applied across two physical units' ADC counts — `skin_temp_raw` then
+  /// gets z-scored straight across the seam. Nothing on a `decoded_onehz` row
+  /// distinguishes two units: `counter` is flash-local and resets on reboot,
+  /// and the one real per-unit identifier the app holds (the HELLO serial, via
+  /// `PairedDevice.serial`) lives in SharedPreferences, not on the row and not
+  /// in this isolate.
+  ///
+  /// ponytail: family-level guard only; the unit-level guard needs the
+  /// per-row `device_id` from the phase-2 storage re-key (BANDAGNOSTIC B1/B2),
+  /// after which this set keys on `device_id` and a second unit refuses the
+  /// same way a second family does. Deliberately NOT approximated here — the
+  /// alternatives (refusing every family, or guessing a unit change from a
+  /// data gap) cost every user their skin-temp driver on every day, to catch
+  /// an event that happens at most a handful of times in a band's life.
   final Set<String> _families = {};
 
   void _noteFamily(Object? v) {
@@ -464,7 +493,7 @@ class _PrepareAccumulator {
     List<Map<String, dynamic>> frames,
     List<Map<String, dynamic>> rrRows,
   ) {
-    if (frames.isEmpty) return;
+    if (frames.isEmpty && rrRows.isEmpty) return;
     // Associate beats to frames by rec_ts (their shared key). The strap's counter
     // resets on reboot, so grouping by counter mis-joined two seconds that reused
     // one counter within a page.
@@ -474,12 +503,40 @@ class _PrepareAccumulator {
       if (recTs == null) continue;
       rrByRecTs.putIfAbsent(recTs, () => <Map<String, dynamic>>[]).add(row);
     }
+    // THE UNION OF FRAME SECONDS AND BEAT SECONDS, not just the frames.
+    //
+    // A beat can exist for a second that has NO `decoded_onehz` row, and the
+    // band produces those on purpose: gen4 historical R10-lite is hr-only, so
+    // `_queueDecodedOneHz` (db.dart) keeps it out of the 1 Hz store and banks
+    // its R-R block on its own. Walking only `frames` dropped every one of
+    // those beats on the floor — silently, and permanently once the record was
+    // acked and trimmed. The beat-only second still gets a 1 Hz slot so the
+    // positional arrays stay 1:1 with `tsSec`; its sensor channels land on the
+    // ABSENT sentinels (accel exactly (0,0,0), ADC 0, hr 0), never on a
+    // fabricated reading.
+    final frameByRecTs = <int, Map<String, dynamic>>{};
+    final seconds = <int>[];
     for (final row in frames) {
       final recTs = _num(row['rec_ts'])?.toInt();
       if (recTs == null || recTs <= 0) continue;
-      _noteFamily(row['device_family']);
+      if (frameByRecTs.containsKey(recTs)) continue;
+      frameByRecTs[recTs] = row;
+      seconds.add(recTs);
+    }
+    for (final recTs in rrByRecTs.keys) {
+      if (recTs > 0 && !frameByRecTs.containsKey(recTs)) seconds.add(recTs);
+    }
+    // Cheap when nothing was added (the page arrived sorted); required when it
+    // was, since every downstream slice assumes `tsSec` is ascending.
+    seconds.sort();
+    for (final recTs in seconds) {
+      final row = frameByRecTs[recTs];
+      _noteFamily(row?['device_family']);
       tsSec.add(recTs);
-      hr.add(plausibleHrOrZero(_num(row['hr'])?.toInt() ?? 0));
+      // NULL (absent), a beat-only second (no row at all) and an impossible
+      // byte all land on the same 0 — the array's one "no usable HR this
+      // second" value. It is NOT a wear verdict; see [Substrate.hr].
+      hr.add(plausibleHrOrNull(_num(row?['hr'])?.toInt() ?? 0) ?? 0);
       // The 1 Hz arrays are POSITIONAL — one entry per second, 1:1 with tsSec —
       // so a NULL sensor column (schema v39: absent, never coerced to a real
       // reading) must still occupy its slot. It lands as the array's ABSENT
@@ -488,11 +545,11 @@ class _PrepareAccumulator {
       //            (no real sensor reads 0 g on all three axes — see that doc)
       //   ADC    → 0, read back through the `v > 0` gate every ADC consumer uses
       // Same discipline as `stepCount`'s -1 below.
-      ax.add(_num(row['ax'])?.toDouble() ?? 0);
-      ay.add(_num(row['ay'])?.toDouble() ?? 0);
-      az.add(_num(row['az'])?.toDouble() ?? 0);
-      spo2Red.add(_num(row['spo2_red_raw'])?.toInt() ?? 0);
-      spo2Ir.add(_num(row['spo2_ir_raw'])?.toInt() ?? 0);
+      ax.add(_num(row?['ax'])?.toDouble() ?? 0);
+      ay.add(_num(row?['ay'])?.toDouble() ?? 0);
+      az.add(_num(row?['az'])?.toDouble() ?? 0);
+      spo2Red.add(_num(row?['spo2_red_raw'])?.toInt() ?? 0);
+      spo2Ir.add(_num(row?['spo2_ir_raw'])?.toInt() ?? 0);
       // gen4 stores skin temp as a raw ADC count (`skin_temp_raw`); gen5 v18
       // decodes it to °C and stores THAT (`skin_temp_c`), leaving skin_temp_raw
       // NULL on every row. Reading only the gen4 column meant a WHOLE gen5
@@ -502,8 +559,8 @@ class _PrepareAccumulator {
       // carry whichever the row has, in centi-°C to stay integral and positive
       // through the `v > 0` gate every ADC consumer uses. A user who swaps
       // gen4 → gen5 mid-history steps the baseline once; the z re-settles.
-      final tempRaw = _num(row['skin_temp_raw'])?.toInt();
-      final tempC = _num(row['skin_temp_c'])?.toDouble();
+      final tempRaw = _num(row?['skin_temp_raw'])?.toInt();
+      final tempC = _num(row?['skin_temp_c'])?.toDouble();
       skinTemp.add(tempRaw ?? (tempC == null ? 0 : (tempC * 100).round()));
       // NO skin contact on the decoded path, and no column to read: the byte the
       // name refers to is the sign+exponent half of a float32, never a contact
@@ -512,22 +569,39 @@ class _PrepareAccumulator {
       // `decoded_onehz.step_count` is NULL on every gen4 row and on any gen5
       // row decoded before schema v34. NULL is ABSENT (-1), not 0: 0 is a real
       // reading from a band that has not moved since its counter last wrapped.
-      stepCount.add(_num(row['step_count'])?.toInt() ?? -1);
+      stepCount.add(_num(row?['step_count'])?.toInt() ?? -1);
       // CV-04a — the band's own "this second's beat is valid" flag, the first
       // of the five write-only gen5 columns to reach Substrate.
       //
       // NULL IS ABSENT (-1), NOT FALSE. gen4's R24 has no such field, so every
       // gen4 row is NULL here, and a `?? 0` would tell every downstream reader
       // that a whole generation's beats were rejected BY THE BAND. 0 is a real
-      // reading and only gen5 can produce it. `Substrate.hrValidAt` gates the
-      // read on `device_family == 'gen5'` on top of this.
-      hrValid.add(_num(row['hr_valid'])?.toInt() ?? -1);
+      // reading and only a decoder that read the flag off the wire can produce
+      // it. `Substrate.hrValidAt` gates the read on THIS sentinel alone — the
+      // `device_family == 'gen5'` check that used to sit on top of it was a
+      // band id in the neutral layer (BANDAGNOSTIC C12).
+      hrValid.add(_num(row?['hr_valid'])?.toInt() ?? -1);
       final beats = rrByRecTs[recTs];
       if (beats == null) continue;
       for (final beat in beats) {
-        final rr = _num(beat['rr_ms'])?.toDouble();
-        if (rr == null || rr <= 0) continue;
-        rrTsMs.add(_num(beat['rr_ts_ms'])?.toDouble() ?? recTs * 1000.0);
+        // The SAME physiological bound the raw-replay path applies
+        // (`decodeSubstrate`), not just `> 0`: an interval outside
+        // kMinPlausibleRrMs..kMaxPlausibleRrMs is a missed or doubled beat
+        // detection, and it has to be refused on both ingest paths or the two
+        // disagree about the same band's beats.
+        final raw = _num(beat['rr_ms']);
+        final rr = raw == null ? null : plausibleRrOrNull(raw);
+        if (rr == null) continue;
+        // `beat_ts_ms` FIRST — it is where the beat actually was. `rr_ts_ms` is
+        // `rec_ts * 1000`, so every beat in a record shares one millisecond and
+        // the axis is a whole-second staircase: an inter-record gap shorter than
+        // a second is invisible to `_beatTimes`' re-anchor test and gets spliced
+        // out of the time base. COALESCE, never fabricate — the column is NULL
+        // for every row banked before it existed and for any source with no
+        // sub-second, and there the staircase is still the honest best answer.
+        rrTsMs.add(_num(beat['beat_ts_ms'])?.toDouble() ??
+            _num(beat['rr_ts_ms'])?.toDouble() ??
+            recTs * 1000.0);
         rrMs.add(rr);
       }
     }
diff --git a/lib/compute/onehz_pipeline.dart b/lib/compute/onehz_pipeline.dart
index 86522c78..407ef4d3 100644
--- a/lib/compute/onehz_pipeline.dart
+++ b/lib/compute/onehz_pipeline.dart
@@ -315,6 +315,10 @@ Map<String, dynamic> deriveDayBundle(Map<String, dynamic> inputJson) {
 
   // ── HR over the SLEEP WINDOW (RHR / dip night-side) ────────────────────────
   final sleepHr = [for (final h in d.sleepHr) h.toDouble()];
+  // The clock for that series — parallel by construction (both are `Substrate`
+  // columns, 1:1 with `tsSec`). Seconds as doubles because that is what the
+  // analytics window helpers take.
+  final sleepTs = [for (final t in d.sleepTsSec) t.toDouble()];
 
   // ── RR over the SLEEP WINDOW → cleaned NN → HRV (the V2 fix) ───────────────
   // HRV/RHR are rest/sleep-only per the catalog. Running correctRr+hrvTime over
@@ -384,14 +388,22 @@ Map<String, dynamic> deriveDayBundle(Map<String, dynamic> inputJson) {
   // heart rate at any tier — it is a different quantity wearing the label. The
   // only honest output is absence, so the card says why instead.
   //
-  // `sleepHr` must be a POSITIONALLY DENSE 1 Hz series where 0 means off-skin —
-  // `nocturnalRhr` slides its 30-minute window over wall-clock POSITIONS and
-  // enforces a minimum on-skin coverage per window. Passing a compacted series
-  // defeats that: with gaps squeezed out, 1800 consecutive entries could span
-  // many hours, so "lowest 30-minute mean" silently becomes "lowest mean over
-  // whatever 1800 samples happened to survive".
+  // THE 30 MINUTES ARE NOW 30 MINUTES. `nocturnalRhr` used to slide a window of
+  // 1800 POSITIONS, which is half an hour only where every position is exactly
+  // one second — so the series had to be positionally dense at 1 Hz or "the
+  // lowest 30-minute mean" quietly became "the lowest mean over whatever 1800
+  // samples survived". It is a real condition, not a hypothetical: the owner's
+  // own export has sleep windows missing 506 seconds of 25,262, and a 15 s band
+  // publishes a measured 59.7 bpm night as 66.4.
+  //
+  // Passing `sleepTs` moves the window onto the WALL CLOCK, so density stops
+  // being a precondition: 30 min is 30 min at any cadence, off-skin gaps are
+  // still never compacted away (a window must carry `minCoverage` of the
+  // samples it SHOULD hold at the stream's own measured cadence), and a stream
+  // with no measurable cadence yields ABSENCE rather than a guess. The
+  // no-sleep-no-RHR branch above is untouched by any of that.
   final rhr = (hasSleep && sleepHr.isNotEmpty)
-      ? nocturnalRhr(sleepHr)
+      ? nocturnalRhr(sleepHr, tsSec: sleepTs)
       : const Metric<NocturnalRhr>.absent(
           tier: Tier.high,
           inputs_used: ['hr_1hz', 'sleep_window'],
@@ -551,40 +563,42 @@ Map<String, dynamic> deriveDayBundle(Map<String, dynamic> inputJson) {
       settledFraction: skinTempSettledFrac,
     ),
   ]);
-  // Diagnostic only — populated when readiness comes back absent, so the main
-  // isolate can log WHY to Crashlytics instead of a bare null (this runs
-  // inside Isolate.run, so it can't call Firebase directly; it just returns
-  // data). Per-input value-presence + baseline length lets us distinguish
-  // "no value" / "baseline too short" from "everything present but MAD was
-  // degenerate" by elimination (readinessComposite doesn't surface the last
-  // case in its own note — see readiness_composite.dart's robustZ() null path).
-  // `baseline_sd` additionally distinguishes a TRULY zero-dispersion baseline
-  // (readinessComposite's documented, intentional "never fabricate against
-  // zero dispersion" abstain — see its rescue-vs-flat test) from some other,
-  // unexplained cause of a null z — so a future Crashlytics hit is diagnosable
-  // instead of another round of guessing from value/baseline_n alone.
+  // Populated when readiness comes back absent, so the main isolate can log WHY
+  // instead of a bare null (this runs inside Isolate.run, so it can't call
+  // Firebase directly; it just returns data). TWO consumers now, and the second
+  // is why the shape below is what it is: `readiness_detail.dart` renders these
+  // rows TO THE USER — "Measured · 6 nights of your own history" — so every key
+  // here is either something a person is owed or something a crash report needs.
+  //
+  // `baseline_sd` USED TO BE HERE and is gone. It existed to identify a
+  // degenerate-dispersion baseline BY ELIMINATION, back when readinessComposite
+  // abstained on that silently. It no longer does: the quantized inputs (RHR,
+  // temp) refuse by name with the number in the note —
+  // `baseline_dispersion_below_quantum:sd=…,quantum=…,n=…`. The two continuous
+  // inputs (lnRMSSD, resp) have no quantum and so still fall through to the
+  // mean/SD z, which only returns null on an EXACTLY constant baseline of
+  // doubles — a case that cannot be reached by real nightly values. So the
+  // field diagnosed nothing the note does not say, and shipped an unexplained
+  // number to a Crashlytics field that had to be read by someone who knew all
+  // of the above.
   Map<String, dynamic>? readinessAbsentDiag;
   if (!composite.present) {
     readinessAbsentDiag = {
       'hrv': {
         'value': lnToday != null,
         'baseline_n': d.lnRmssdHistory.length,
-        'baseline_sd': _stddev(d.lnRmssdHistory),
       },
       'rhr': {
         'value': rhrToday != null,
         'baseline_n': d.rhrHistory.length,
-        'baseline_sd': _stddev(d.rhrHistory),
       },
       'resp': {
         'value': respToday != null,
         'baseline_n': d.respHistory.length,
-        'baseline_sd': _stddev(d.respHistory),
       },
       'temp': {
         'value': skinTempAdc != null,
         'baseline_n': d.skinTempAdcHistory.length,
-        'baseline_sd': _stddev(d.skinTempAdcHistory),
         // The gate, not the value: a temp driver can be refused with a perfectly
         // good mean and a full baseline. Null = the fraction was unmeasurable.
         'settled_frac': skinTempSettledFrac,
@@ -1554,7 +1568,10 @@ Map<String, int> _wakeZoneMinutesFromSeries(
   final samples = <HrSample>[
     for (final p in wakeHr) HrSample(p.tsSec * 1000.0, p.hr),
   ];
-  return HeartRateZones.timeInZone(samples, zoneSet).toRoundedMinuteMap();
+  // Null = no cadence `sampleCadenceSeconds` will vouch for; `const {}` is the
+  // caller's existing absent state (see `hrZones` at its declaration).
+  return HeartRateZones.timeInZone(samples, zoneSet)?.toRoundedMinuteMap() ??
+      const {};
 }
 
 List<Map<String, num>> _zoneTimeline(
diff --git a/lib/compute/substrate.dart b/lib/compute/substrate.dart
index 032de077..51a3de92 100644
--- a/lib/compute/substrate.dart
+++ b/lib/compute/substrate.dart
@@ -29,21 +29,154 @@ const double kMinAccelCoverageForVanHees = 0.5;
 
 /// Physiological bound on a 1 Hz heart rate (bpm), inclusive.
 ///
-/// The gen4 TRUSTED decode path (v24 / v12) returns the HR byte verbatim with
-/// no bound — the protocol's `_physiologicallyPlausible` gate runs only on the
-/// best-effort versions, and gen5 v18 bounds it independently — so one
-/// corrupt-but-CRC-valid byte of 250 used to pass the `hr > 0` filter and land
-/// straight in the day's max HR. Applying this in the protocol would cost the
-/// WHOLE record (accel and RR with it); applied here it costs only the second.
+/// HUMAN PHYSIOLOGY, NOT A SENSOR PROPERTY, so it is the same number on every
+/// band: no heart beats 24 times a minute or 231 times a minute for a whole
+/// second. Nothing about the strap moves it, which is why it does not go
+/// through `calibrationFor` and why an unstamped record still gets it.
+///
+/// It exists because the gen4 TRUSTED decode path (v24 / v12) returns the HR
+/// byte verbatim with no bound — the protocol's `_physiologicallyPlausible`
+/// gate runs only on the best-effort versions, and gen5 v18 bounds it
+/// independently — so one corrupt-but-CRC-valid byte of 250 used to pass the
+/// `hr > 0` filter and land straight in the day's max HR. Applying it in the
+/// protocol would cost the WHOLE record (accel and RR with it); applied here it
+/// costs only the second.
 const int kMinPlausibleHr = 25;
 const int kMaxPlausibleHr = 230;
 
-/// The HR to store for second-level [raw]: itself when physiologically
-/// possible, else `0` — the substrate's existing "no usable HR this second"
-/// value, which every reader already filters on. Never clamped to the bound:
-/// a corrupt byte must not become a plausible reading.
-int plausibleHrOrZero(int raw) =>
-    (raw >= kMinPlausibleHr && raw <= kMaxPlausibleHr) ? raw : 0;
+/// [raw] when it is a heart rate a human can have, else NULL — the reading is
+/// refused, never clamped to the bound (a corrupt byte must not become a
+/// plausible reading) and never reported as a measurement of anything else.
+///
+/// Callers that must land it in the dense [Substrate.hr] array write
+/// `plausibleHrOrNull(raw) ?? 0`, 0 being that array's ONE "no usable HR this
+/// second" value — see [Substrate.hr] for why that is not a claim about wear.
+int? plausibleHrOrNull(int raw) =>
+    (raw >= kMinPlausibleHr && raw <= kMaxPlausibleHr) ? raw : null;
+
+/// Physiological bound on one R-R interval (ms), inclusive — the [kMinPlausibleHr]
+/// / [kMaxPlausibleHr] window expressed as the gap between two beats, widened
+/// at the long end because a single interval is not a rate: one dropped beat
+/// doubles the gap without the heart doing anything unusual, and 2,400 ms still
+/// sits inside the range an ordinary Malik/Lipponen ectopic filter is built to
+/// see and correct. Below 250 ms (240 bpm sustained across one beat) it is not
+/// a beat detection.
+const int kMinPlausibleRrMs = 250;
+const int kMaxPlausibleRrMs = 2400;
+
+/// [rrMs] when it is an interval a human heart can produce, else NULL.
+double? plausibleRrOrNull(num rrMs) =>
+    (rrMs >= kMinPlausibleRrMs && rrMs <= kMaxPlausibleRrMs)
+        ? rrMs.toDouble()
+        : null;
+
+/// The largest acceleration MAGNITUDE (g) a wrist can hold for a WHOLE SECOND.
+///
+/// These samples are one-second gravity vectors, not raw 100 Hz: an impact, a
+/// swing and a free-fall are all sub-second transients that average away before
+/// they get here, so this bounds a SUSTAINED magnitude, not a peak. Holding 4 g
+/// for a full second is ~3 g of net force for a second — aerobatics and
+/// centrifuges, not anything a band is worn through.
+///
+/// It is deliberately NOT the part's full-scale range: an FSR is an encoding
+/// choice, and a part configured to +/-2 g with a scale-error decoder sails
+/// through a +/-16 g test. It is also deliberately far above protocol's
+/// `_physiologicallyPlausible` gravity window (magSq 0.25..3.24, i.e. 0.5..1.8 g),
+/// which assumes a low-pass-filtered gravity vector and had to be dropped from
+/// the gen5 decoder in 539a97b because it rejected real workout seconds. There
+/// is no lower bound here for the same reason: sustained low-g seconds are real
+/// and only EXACT zero is evidence of a fill.
+const double kMaxSustainedAccelG = 4.0;
+
+/// Whether a 1 Hz gravity triplet is a MEASUREMENT.
+///
+/// Two rejections, both physical:
+///   * exact `(0, 0, 0)` — no accelerometer reads zero on all three axes at
+///     rest or in motion, so it is an all-zero payload (see
+///     [Substrate.accelPresentAt] for what that costs if it is trusted).
+///   * a magnitude above [kMaxSustainedAccelG] — see there.
+bool accelPlausible(double ax, double ay, double az) {
+  final magSq = ax * ax + ay * ay + az * az;
+  return magSq > 0 && magSq <= kMaxSustainedAccelG * kMaxSustainedAccelG;
+}
+
+/// Where each beat in one record actually sits, in absolute epoch ms — or
+/// null for a beat that cannot be placed. One entry per entry in [rrMs].
+///
+/// TWO PARTS, AND THEY ARE NOT EQUALLY SOLID. Read them separately.
+///
+/// THE ANCHOR IS MEASURED. `rec_ts + tsSubsec/32768` is the record's own
+/// timestamp, whole seconds and sub-second, exactly as the strap sent it.
+/// This app has dropped the second half of that since forever, pinning every
+/// record to a whole second. With no sub-second there is no anchor and every
+/// beat here is null; a whole second is NOT substituted for one, because the
+/// whole point of this column is to say something the old one could not.
+///
+/// THE PLACEMENT IS A MODEL, and it is one assumption wide: an R-R interval
+/// is the gap ENDING at its beat (that part is the definition), and the LAST
+/// beat a record reports sits at the record's timestamp. Everything else
+/// follows — beat i is the anchor minus the intervals after it. The direction
+/// is chosen because backwards is the only one that cannot place a beat in
+/// the future, i.e. after the moment we were told about it; a forward walk
+/// would also run every multi-beat record past its own second (the intervals
+/// sum to 1,426 ms on a 2-beat record and 2,594 ms on a 4-beat one, measured)
+/// and straight through the next record's.
+///
+/// WHAT THE INTERVALS DO NOT DO IS TILE THE SECOND. Over 81 uninterrupted
+/// runs of 300+ consecutive records in a real export, the intervals sum to
+/// 0.967 of the `rec_ts` span (0.960-0.990 across runs) — so the beat train is
+/// a CHAIN that runs a few percent short, which is what a handful of rejected
+/// beats looks like, and not a set of per-second buckets. Several of a
+/// record's intervals reach back out of its own second. Per-record placement
+/// is nevertheless what THIS path can do — records arrive batched, out of
+/// order and with gaps, so no cross-record chain is available at the write —
+/// and a consumer that wants the chain can walk `rr_ms` itself.
+///
+/// WHAT MOVES AND WHAT DOES NOT, now that `Substrate.rrTsMs` is fed from here
+/// rather than from the `rec_ts * 1000` staircase. The INTERVAL SERIES does
+/// not move at all — same values, same order — so `hrvTime(nn)` with no time
+/// axis is bit-identical, and so is SDNN, which never pairs. Everything that
+/// takes the axis does move: a Lomb-Scargle periodogram handed beats where
+/// they happened, a beat put on the same axis as a motion sample, a real
+/// inter-record gap. That includes RMSSD and pNNx as production calls them
+/// (`hrvTime(nn, nnTimesMs: …)`), because the axis decides which successive
+/// pairs count as CONTIGUOUS — measured at +0.03% RMSSD / +0.6% pNN50 over a
+/// real 6 h block of 27,114 beats.
+///
+/// A non-positive interval BREAKS THE CHAIN: the gap before that beat is
+/// unknown, so every EARLIER beat in the record becomes unplaceable and gets
+/// null rather than a position computed as if the missing gap were zero.
+List<int?> beatTimesMs(int recTs, int? tsSubsec, List<int> rrMs) {
+  final out = List<int?>.filled(rrMs.length, null);
+  if (tsSubsec == null || rrMs.isEmpty) return out;
+  // THE TICK COUNT IS BOUNDED, for the same reason [kMaxPlausibleHr] is: this
+  // is a u16 read straight off the wire, and a corrupt-but-CRC-valid one is
+  // still a number. Ticks are 1/32768 s, so only 0..32767 is a SUB-second;
+  // 40000 would put the anchor 1.22 s past the record it came from and walk
+  // every beat in it into the wrong second. `beat_ts_ms` is read now, and the
+  // axis is what decides which successive pairs count as contiguous for RMSSD
+  // and pNNx — so an out-of-range tick is refused, not clamped: null is this
+  // function's own word for "cannot be placed".
+  if (tsSubsec < 0 || tsSubsec >= 32768) return out;
+  final anchor = recTs * 1000 + (tsSubsec * 1000) ~/ 32768;
+  var back = 0;
+  for (var i = rrMs.length - 1; i >= 0; i--) {
+    // Beat i's OWN placement never depends on rrMs[i] — that interval is the
+    // gap BEFORE beat i, which only matters for placing beat i-1. Set first,
+    // using whatever `back` the beats after i already earned.
+    out[i] = anchor - back;
+    // Only a PLAUSIBLE interval may extend the chain past this beat. The
+    // caller drops an implausible-but-positive interval (`plausibleRrOrNull`
+    // in `decodeSubstrate`) exactly as it drops a non-positive one, so an
+    // interval outside kMinPlausibleRrMs..kMaxPlausibleRrMs must not still
+    // walk every EARLIER beat back by it — that would let a rejected reading
+    // silently displace a beat that is kept.
+    final rr = plausibleRrOrNull(rrMs[i]);
+    if (rr == null) break;
+    back += rr.toInt();
+  }
+  return out;
+}
 
 /// The decoded 1 Hz substrate — the only decoded form (ARCHITECTURE_V2).
 ///
@@ -54,7 +187,23 @@ class Substrate {
   /// Epoch seconds, 1 Hz, sorted ascending. One entry per R24 record.
   final List<int> tsSec;
 
-  /// 1 Hz HR (bpm). 0 = off-skin (never bradycardia). Parallel to [tsSec].
+  /// 1 Hz HR (bpm). Parallel to [tsSec]. **`0` means NO USABLE HEART RATE this
+  /// second — it is not a claim that the band was off your wrist.**
+  ///
+  /// The doc here used to say "0 = off-skin", and that was a second assertion
+  /// smuggled in beside the first. Three different facts land on this 0: the
+  /// record carried no HR field, the sensor found no beat, and the byte was
+  /// outside [kMinPlausibleHr]..[kMaxPlausibleHr]. Read as "off-skin" the last
+  /// of those censors a reading AND replaces it with a wear verdict, which
+  /// biases anything that counts on-skin seconds — nocturnal RHR most of all,
+  /// on exactly the calm nights that push HR toward the low bound.
+  ///
+  /// It is one value rather than two because the ledger has already collapsed
+  /// them: `decoded_onehz.hr` stores NULL for every record with no heart rate
+  /// (db.dart `_queueDecodedOneHz`, `decoded.hr > 0 ? decoded.hr : null`), so
+  /// "the band said zero" cannot reach this array as anything else. Every
+  /// reader gates `> 0`. Wear truth lives in the HELLO body, the wrist on/off
+  /// events and the record-presence runs (`_wearBlock`) — never here.
   final List<int> hr;
 
   /// Beat-to-beat RR: interval end time (epoch ms) + interval (ms). Sparse.
@@ -98,18 +247,19 @@ class Substrate {
   /// no such field, so every gen4 second reads -1, and reading that as `false`
   /// would turn "this band cannot say" into "the band said no".
   ///
-  /// GEN5 ONLY, and gated twice on purpose: the sentinel above, and
-  /// [deviceFamily]. A gen4 strap and a gen5 strap will tier DIFFERENTLY on
-  /// identical physiology because of exactly this kind of extra evidence, so a
-  /// reader that weights by it has to say so somewhere the user can see.
+  /// GATED ON THE SENTINEL ALONE — see [hrValidAt] for why the band-id check
+  /// that used to sit beside it is gone. A strap that reports this flag and a
+  /// strap that cannot will tier DIFFERENTLY on identical physiology because of
+  /// exactly this kind of extra evidence, so a reader that weights by it has to
+  /// say so somewhere the user can see.
   /// Same absent-marker discipline as [stepCount] and [accelPresentAt].
   final List<int> hrValid;
 
   /// WHICH STRAP MEASURED THIS SUBSTRATE — `'gen4'`, `'gen5'`, or null.
   ///
   /// Stamped at ingest into `decoded_onehz.device_family` and carried here so
-  /// the pure pipeline can dispatch on it (analytics: `deviceFamilyOf` →
-  /// `calibrationFor`). It is ONE value for the whole substrate, not a
+  /// the pure pipeline can dispatch on it (analytics: `calibrationFor`, whose
+  /// map of families is open — a stamp is a key or it is not). It is ONE value for the whole substrate, not a
   /// per-second array, because the question a metric asks is "which sensor
   /// package produced this window", and a window that mixes two answers has no
   /// single answer.
@@ -233,6 +383,11 @@ class Substrate {
   /// EXACTLY 0.0 is an all-zero payload, i.e. no measurement. Exact zero is
   /// therefore the ABSENT marker.
   ///
+  /// The upper end is [kMaxSustainedAccelG] — a second-long mean no wrist
+  /// holds — so a decoder whose scale factor is wrong by an order of magnitude
+  /// stops reading as violent movement and starts reading as absent. There is
+  /// no lower bound beyond exact zero; see [accelPlausible].
+  ///
   /// This used to rest on "every decoder gates on `magSq >= 0.25`", which is no
   /// longer true — protocol 539a97b dropped that gate from the gen5 v18 decoder
   /// (it is a bound on a NORMALISED gravity vector and gen5 emits per-axis raw
@@ -247,7 +402,7 @@ class Substrate {
   /// rule reads as PERFECT IMMOBILITY. Eight hours of missing accel scores
   /// 28 501 immobile seconds and yields a fabricated ~7.9 h sleep window,
   /// fully staged. Absent input must produce no claim, never a confident one.
-  bool accelPresentAt(int i) => !(ax[i] == 0 && ay[i] == 0 && az[i] == 0);
+  bool accelPresentAt(int i) => accelPlausible(ax[i], ay[i], az[i]);
 
   /// Fraction of [lo, hi) seconds carrying a real gravity vector (0..1).
   /// Returns 0 for an empty range — no evidence, not "all present".
@@ -280,9 +435,16 @@ class Substrate {
   /// ABSENT, NEVER FALSE. A gen4 strap has no such field and a NULL read as
   /// `false` would silently mark a whole generation's beats untrustworthy.
   bool? hrValidAt(int i) {
-    // Unknown provenance refuses outright: the column is gen5's, and a row with
-    // no device stamp cannot be shown to have come from one.
-    if (deviceFamily != 'gen5') return null;
+    // THE ROW ANSWERS FOR ITSELF. This used to also require
+    // `deviceFamily == 'gen5'` — a band id hardcoded inside the class whose
+    // whole job is to be neutral, which meant a second band that reports the
+    // same flag would have been silently ignored while its data sat right here.
+    // The sentinel is the evidence: only a decoder that read the flag off the
+    // wire writes a non-negative value into this column (db.dart writes NULL
+    // otherwise, and derive_prepare lands NULL on -1), so a value >= 0 IS a
+    // declaration by the source that produced the row. An unstamped substrate
+    // carrying real flags is a source that told us the flag and not the badge —
+    // refusing it discards a measurement to punish missing metadata.
     if (i < 0 || i >= hrValid.length) return null;
     final v = hrValid[i];
     return v < 0 ? null : v != 0;
@@ -514,7 +676,8 @@ Substrate decodeSubstrate(List<String> hexes) {
     final live = proto.realtimeRr(hex);
     if (live != null && live.ts > 0) {
       for (final v in live.rrMs) {
-        if (v > 0) looseRr.add(_Beat(live.ts * 1000.0, v.toDouble()));
+        final rr = plausibleRrOrNull(v);
+        if (rr != null) looseRr.add(_Beat(live.ts * 1000.0, rr));
       }
     }
   }
@@ -535,7 +698,7 @@ Substrate decodeSubstrate(List<String> hexes) {
   for (var i = 0; i < n; i++) {
     final r = recs[i].r;
     tsSec[i] = r.tsEpoch;
-    hr[i] = plausibleHrOrZero(r.hr);
+    hr[i] = plausibleHrOrNull(r.hr) ?? 0;
     if (r.accelG.length == 3) {
       ax[i] = r.accelG[0];
       ay[i] = r.accelG[1];
@@ -551,13 +714,24 @@ Substrate decodeSubstrate(List<String> hexes) {
     skinTemp[i] = r.skinTempRaw;
     // ignore: deprecated_member_use
     skinContact[i] = r.skinContact;
-    // RR beats: anchored at the record second (epoch ms). Beats within a record
-    // share its second; time order is preserved by the record sort above.
+    // RR beats: placed at their MEASURED instant (`beatTimesMs` — the record's
+    // own sub-second anchor, intervals walked backwards from it), falling back
+    // to the record second only when the record carries no sub-second. Beats
+    // used to all share the record's whole second here, which says two beats
+    // 800 ms apart happened at the same millisecond. Emission ORDER is
+    // unchanged (record order, then beat order) so no interval series moves —
+    // only where the beats sit on the clock.
     final t = r.tsEpoch * 1000.0;
-    for (final rr in r.rrIntervalsMs) {
-      if (rr > 0) {
-        rrMs.add(rr.toDouble());
-        rrTsMs.add(t);
+    final beatTs = beatTimesMs(r.tsEpoch, r.tsSubsec, r.rrIntervalsMs);
+    for (var b = 0; b < r.rrIntervalsMs.length; b++) {
+      // A non-positive interval was already dropped here; the bound only widens
+      // that to intervals no heart produces. It drops the BEAT, not the record:
+      // `beatTimesMs` has already placed the survivors, and an interval this
+      // far out is a missed or doubled detection, not a rhythm.
+      final rr = plausibleRrOrNull(r.rrIntervalsMs[b]);
+      if (rr != null) {
+        rrMs.add(rr);
+        rrTsMs.add(beatTs[b]?.toDouble() ?? t);
       }
     }
   }
@@ -607,9 +781,22 @@ Substrate decodeSubstrate(List<String> hexes) {
 /// since R24 has no pedometer field. Null means "this hardware cannot count
 /// steps", never "you took no steps".
 ///
-/// `stepMotionCounter` is a **cumulative u16** that wraps at 65536 and is also
-/// reset by a strap reboot/re-pair, so the day's total is the sum of positive
-/// per-record deltas, not `last - first`. Two hazards, both handled here:
+/// [cumulativeCounterModulus] IS A DECLARATION AND IT IS NOT OPTIONAL —
+/// null abstains. It says two things about the source's counter, and this
+/// function is only correct if both hold: it wraps at that modulus, and it is
+/// CUMULATIVE, i.e. it does not reset inside the window being summed. Both used
+/// to be assumed (`wrap = 65536`, hardcoded), and the second one is the
+/// expensive assumption: this reads DELTAS, so a counter that resets at
+/// midnight silently loses every step taken before the day's first synced
+/// record — 12,500 walked, 8,300 published, at tier HIGH and confidence 0.9,
+/// with nothing in the output saying so. Nothing on a record distinguishes a
+/// reset from a wrap after the fact, so an undeclared counter gets no number
+/// rather than a guessed one. The caller declares it because the caller knows
+/// which band stamped the rows; see `DerivationEngine._stepCounterModulus`.
+///
+/// The counter is also reset by a strap reboot/re-pair, so the total is the sum
+/// of positive per-record deltas, not `last - first`. Two hazards, both handled
+/// here (`wrap` below is [cumulativeCounterModulus]):
 ///
 ///   * **wrap** (65500 → 100): the raw delta is negative. Re-reading it modulo
 ///     65536 gives the true small delta, which passes the plausibility budget.
@@ -633,8 +820,13 @@ Substrate decodeSubstrate(List<String> hexes) {
 ///
 /// A delta is either credited in full or dropped in full, so this function can
 /// never return a negative or an absurd total, whatever the counter does.
-int? hardwareStepsFromCounter(Substrate sub, {int maxStepsPerSecond = 5}) {
-  const wrap = 65536;
+int? hardwareStepsFromCounter(
+  Substrate sub, {
+  required int? cumulativeCounterModulus,
+  int maxStepsPerSecond = 5,
+}) {
+  final wrap = cumulativeCounterModulus;
+  if (wrap == null || wrap <= 0) return null;
   const minGapSecForBudget = 60;
   const maxGapSecForBudget = 3600;
   int? prev;
diff --git a/lib/data/db.dart b/lib/data/db.dart
index 31c7f997..bd3fa6f0 100644
--- a/lib/data/db.dart
+++ b/lib/data/db.dart
@@ -19,6 +19,8 @@ import 'package:openstrap_protocol/openstrap_protocol.dart' as proto;
 import 'package:path/path.dart' as p;
 import 'package:path_provider/path_provider.dart';
 import 'package:sqflite/sqflite.dart';
+
+import '../compute/substrate.dart' show beatTimesMs;
 // The ONE thing this layer takes from compute/: the running build's algo
 // version, which every day_result read applies as a CEILING (see [dayResult]).
 // `show` keeps the rest of the engine out of this namespace.
@@ -31,6 +33,7 @@ import 'live_coverage_policy.dart';
 import 'med_store.dart';
 import 'models.dart';
 import 'nutrition_store.dart';
+import 'observation.dart';
 import 'series_codec.dart';
 
 /// The outcome of a database rebuild: why the old file would not open, where it
@@ -41,6 +44,90 @@ typedef DbRebuild = ({
   Map<String, int> salvaged,
 });
 
+// ── SUBSTRATE ADMISSION — the one predicate that decides what may become a
+//    number ───────────────────────────────────────────────────────────────────
+//
+// THE THREE PROVENANCE COLUMNS ON `decoded_onehz` / `decoded_rr`, AND THE RULE
+// THAT THEY DO NOT OVERLAP:
+//
+//   device_id      WHICH UNIT.       '' is the primary band, permanently
+//                                    (see [_createDecodedStore]); a real id
+//                                    belongs to a secondary.
+//   device_family  THE CALIBRATION KEY. Which sensor's constants a metric must
+//                                    look itself up under. NULL = unknown, and
+//                                    unknown is its own case, never gen4.
+//   source         THE ADMISSION FLAG. NULL = the primary band. Non-NULL names
+//                                    the adapter that wrote the row.
+//
+// None of the three is a stand-in for another. `source` in particular is NOT a
+// provenance id you may read to find out what a row came from — `device_id` and
+// `device_family` are — it exists so this file can answer ONE question in SQL:
+// may this row become a number?
+//
+// Why an adapter's rows are stored but not derived by default: correctness of a
+// community decoder cannot be enforced by review, and a decoder with a 2x scale
+// error reads a resting 50 bpm as 100 and passes every generic physiological
+// bound. So an unverified adapter's seconds bank, sync, back up and show up in
+// diagnostics — and produce no metric at all until the owner has held that
+// hardware in his own hands (ASSUMPTIONS R6/E5/E6). Silent, on purpose: the
+// alternative is a plausible wrong number, which is the one failure this
+// project treats as worse than an absent one.
+//
+// NOTE THE DIFFERENCE FROM MULTIBAND_PLAN §3.3, which said a verified adapter
+// would write `source IS NULL` and so need no read-side change. It is written
+// the other way round here — every non-band writer stamps its id, always, and
+// ADMISSION IS A READ-SIDE DECISION — for two reasons that only show up later:
+// verification is then REVOCABLE (a decoder bug found in v3 of an adapter is
+// one edit to [kDerivableSources], not a data migration over rows that can no
+// longer be told apart), and `source` keeps meaning something after a strap is
+// verified, which is what lets [kPrimaryBandSourceSql] below still exist.
+
+/// Non-NULL `source` values admitted to derivation: adapters the OWNER has
+/// personally held and cross-confirmed (ASSUMPTIONS R6).
+///
+/// EMPTY TODAY, AND CORRECTLY SO. The only owner-confirmed band is the WHOOP 4,
+/// which is the primary band and therefore writes `source IS NULL` — so the set
+/// of *non-NULL* sources that may be derived from is genuinely empty, and
+/// [derivableSourceSql] renders byte-identical SQL to the bare predicate it
+/// replaced. It becomes non-empty the first time a strap earns it.
+///
+/// NOT the same set as `kOwnerConfirmedBandIds` in `ui2/profile/devices.dart`,
+/// and deliberately not shared with it: that one holds BAND FAMILY ids
+/// (`device_family`) and decides whether a badge says EXPERIMENTAL; this one
+/// holds SOURCE values and decides whether a row may become a number. They
+/// answer different questions off different columns and will diverge the moment
+/// a family is decoded but its adapter is not yet trusted. Both are `ponytail:`
+/// placeholders for the CODEOWNERS-gated `_verified.dart` (ASSUMPTIONS E5) —
+/// when that lands it owns the owner-confirmation fact and BOTH of these read
+/// from it. It must never become a CI rule, which hands the key to the PR
+/// author.
+const Set<String> kDerivableSources = <String>{};
+
+/// SQL fragment for every read whose rows may become a NUMBER — a metric, a
+/// baseline, a session aggregate, a day that gets derived.
+///
+/// [col] is the column expression, so a joined query passes `'d.source'`.
+///
+/// Interpolates [kDerivableSources] directly rather than binding parameters:
+/// these are compile-time `const` identifiers from this repo's own source, and
+/// the callers are `rawQuery` strings assembled at every call site. The
+/// admission test pins the ids to `[a-z0-9_]` so this cannot become an
+/// injection seam by accident.
+String derivableSourceSql([String col = 'source']) => kDerivableSources.isEmpty
+    ? '$col IS NULL'
+    : '($col IS NULL OR $col IN '
+          "(${kDerivableSources.map((s) => "'$s'").join(', ')}))";
+
+/// SQL fragment for the reads that mean THE PRIMARY BAND SPECIFICALLY, not
+/// "admitted to derive" — they look identical today and they are not the same
+/// question, which is the whole reason both have names.
+///
+/// Three sites, one meaning each: where the band's own data starts and ends,
+/// how far the band has synced, and what we are willing to write into the
+/// operating system's health store under our name. A verified chest strap must
+/// widen [derivableSourceSql] and must NOT widen this one.
+const String kPrimaryBandSourceSql = 'source IS NULL';
+
 class LocalDb {
   static Database? _db;
   static String dbName = 'openstrap.db';
@@ -250,7 +337,7 @@ class LocalDb {
   /// pass it: sqflite throws `ArgumentError('onCreate must be null if no
   /// version is specified')` BEFORE opening anything when `onCreate` is given
   /// without `version` (sqflite_common database_mixin.dart).
-  static const int schemaVersion = 46;
+  static const int schemaVersion = 49;
 
   /// SQLite caps host parameters per statement (`SQLITE_MAX_VARIABLE_NUMBER` —
   /// only 999 on the builds shipped with older Android/iOS). Any `IN (?, ?, …)`
@@ -258,6 +345,20 @@ class LocalDb {
   /// `decoded_onehz` is 86 400 counters. Same reason `commitSyncBatch` chunks.
   static const int _maxSqlVars = 500;
 
+  /// THE PRIMARY BAND'S `device_id`, and it is reserved permanently.
+  ///
+  /// Not a migration default — a standing rule, load-bearing twice over:
+  ///  * The newest-wins dedupe on `decoded_onehz` only works while every row
+  ///    from the one physical band shares one key value, so a post-reboot
+  ///    counter reset and a re-drained record still collide.
+  ///  * A BLE `remoteId` is NOT a stable identity (per-app CBPeripheral UUID
+  ///    on iOS, a rotating RPA on Android). Letting one reach the key would
+  ///    fragment one band into N identities across reinstalls.
+  ///
+  /// A SECONDARY device gets a real id, issued by its adapter from something
+  /// the band emits across the handshake — never from the link.
+  static const String kPrimaryDeviceId = '';
+
   /// Split [items] into `_maxSqlVars`-sized chunks for `IN (…)` binding.
   static Iterable<List<T>> _sqlVarChunks<T>(List<T> items) sync* {
     for (var i = 0; i < items.length; i += _maxSqlVars) {
@@ -320,6 +421,7 @@ class LocalDb {
         await _createComputeState(db);
         await _createPrimitiveArtifacts(db);
         await _createLiveCoverage(db);
+        await _createDevice(db);
         await _createWorkoutSuggestions(db);
         await _createSleepOverride(db);
         await _createSleepNap(db);
@@ -774,6 +876,51 @@ class LocalDb {
           // _retireDisprovenOneHzColumns for the evidence.
           await _retireDisprovenOneHzColumns(db);
         }
+        if (oldV < 47) {
+          // Put `device_id` in front of the key of the three stores whose
+          // identity was a WHOOP-shaped quantity (a record second, the band's
+          // flash counter). The one item on the band-agnostic list that cannot
+          // be done after a second device has written — see
+          // [_rekeyStoresByDeviceId]. Rewrites no value and moves no derived
+          // number, so it ships without a kAlgoVersion bump.
+          //
+          // LAST on the ladder, after every ADD COLUMN above, because the
+          // rebuild reconstructs its DDL from `PRAGMA table_info` and so
+          // carries across exactly the columns that exist when it runs.
+          await _rekeyStoresByDeviceId(db);
+        }
+        if (oldV < 48) {
+          // The observation store — vendor-computed, typed-in and imported
+          // scalars. CREATE TABLE IF NOT EXISTS + two indexes and NOTHING
+          // else: no backfill, no rewrite, no ADD COLUMN, nothing read. It is
+          // a new empty table, so the CHECK and the UNIQUE index have no
+          // existing row to fail on — which matters, because a throw in here
+          // rolls the WHOLE ladder back and quarantines the user's database
+          // (invariant 11), and this rung runs after the v47 re-key that every
+          // upgrading install is already paying for on the launch path.
+          //
+          // Ships without a kAlgoVersion bump, deliberately: nothing writes
+          // this table, nothing reads it, and no derived number can move.
+          await _createObservation(db);
+        }
+        if (oldV < 49) {
+          // The device store, and the `live_coverage` column that lets the step
+          // ladder tell two sensors apart. CREATE TABLE IF NOT EXISTS + ONE
+          // guarded ADD COLUMN: no backfill, no rewrite, nothing read, and both
+          // are no-ops on a table this ladder has not created yet — which is
+          // what keeps it off the wrong side of invariant 11 (a throw in here
+          // rolls the WHOLE ladder back and quarantines the user's database).
+          //
+          // ADD COLUMN with a constant DEFAULT does not rewrite the table, so
+          // this rung is O(1) in `live_coverage` rows rather than O(n) — unlike
+          // the v47 re-key every upgrading install is already paying for.
+          //
+          // Ships without a kAlgoVersion bump: every existing row takes
+          // `device_id = ''`, one id is one sensor, and [resolveDaySteps]
+          // returns exactly the totals it returned yesterday.
+          await _createDevice(db);
+          await _ensureLiveCoverageDeviceId(db);
+        }
       },
       onOpen: (db) async {
         await _repairOpenSchema(db);
@@ -824,6 +971,8 @@ class LocalDb {
     }
     await _createLiveCoverage(db);
     await _ensureLiveCoverageSource(db);
+    await _ensureLiveCoverageDeviceId(db);
+    await _createDevice(db);
     await _createExternalHr(db);
     await _createImportedMeasurement(db);
     // CREATE TABLE IF NOT EXISTS on the every-open repair path, and NO schema
@@ -832,6 +981,7 @@ class LocalDb {
     // version number here would collide with the other branches reaching for
     // the next one, and buy nothing a no-op CREATE does not already do.
     await _createImportedWorkout(db);
+    await _createObservation(db);
     await _createCycleSymptom(db);
     await _ensureSessionSchema(db);
     await _ensureSyncStateSchema(db);
@@ -990,7 +1140,7 @@ class LocalDb {
   /// reading share `decoded_onehz`'s columns, so a wrong stamp is worse than no
   /// stamp. Existing rows — and anything imported, which came from no link at
   /// all — read NULL, meaning UNKNOWN PROVENANCE, which readers must treat as
-  /// its own case (analytics: `deviceFamilyOf` → null → refuse) rather than as
+  /// its own case (analytics: `calibrationFor` → null → refuse) rather than as
   /// gen4.
   ///
   /// Nullable TEXT, no DEFAULT, ever: a default would turn "we don't know" into
@@ -1015,9 +1165,15 @@ class LocalDb {
   /// change into every long-horizon number the app keeps, which surfaces to the
   /// user as readiness reading wrong with no visible cause and no way to find
   /// it. So every read that feeds a baseline, a derive page or the data edge
-  /// filters `source IS NULL`, and the filter is in place while the answer is
+  /// filters on provenance, and the filter is in place while the answer is
   /// still trivially "all of them".
   ///
+  /// THE COLUMN IS AN ADMISSION FLAG, NOT A PROVENANCE ID — see the
+  /// SUBSTRATE ADMISSION block at the top of this file, which states the
+  /// non-overlap rule for all three provenance columns and owns the two SQL
+  /// fragments ([derivableSourceSql], [kPrimaryBandSourceSql]) that every
+  /// reader must use instead of writing the predicate by hand.
+  ///
   /// Nullable TEXT, no DEFAULT: the same reason `device_family` has none.
   static Future<void> _ensureSourceColumns(Database db) async {
     for (final t in const ['decoded_onehz', 'decoded_rr']) {
@@ -1435,6 +1591,211 @@ class LocalDb {
     );
   }
 
+  // ── DEVICES (the things that measure) ─────────────────────────────────────
+  /// The devices this phone knows about, one row each.
+  ///
+  /// Until now a "device" was TWO SharedPreferences scalars (`paired_remote_id`
+  /// / `paired_serial`), which can hold exactly one band, carries no state
+  /// beside the id, and cannot be joined to anything. `decoded_onehz`,
+  /// `decoded_rr` and `samples` have been keyed by `device_id` since v47 with
+  /// nothing on the other end of that key — this is the other end.
+  ///
+  /// `id` IS the `device_id` those tables carry, so [kPrimaryDeviceId] (`''`)
+  /// is this table's primary row, permanently (ASSUMPTIONS A1). That is what
+  /// keeps an unstable BLE `remoteId` — a per-app CBPeripheral UUID on iOS, a
+  /// rotating RPA on Android — out of the key: it lives in `remote_id`, a plain
+  /// column that may change under the same row as often as the OS likes.
+  ///
+  ///  * `adapter_id` — the `BandEntry.id` from the registry (`gen4`/`gen5`), or
+  ///    NULL when the link has not said yet. NULL is a refusal, not a default:
+  ///    every metric that looks its constants up per family abstains on it
+  ///    rather than borrowing gen4's numbers, and the device screen says so.
+  ///  * `label` — the band's own advertising name / serial, already passed
+  ///    through `cleanDeviceLabel`. Never junk, never a placeholder.
+  ///  * `tier` — the `SourceTier` enum NAME (measurement quality, which is the
+  ///    only thing that decides precedence between two sources).
+  ///  * `first_seen` / `last_seen` — epoch seconds.
+  ///
+  /// ponytail: no `UPSERT`. `INSERT … ON CONFLICT DO UPDATE` needs SQLite 3.24
+  /// and minSdk 26 ships 3.18 (the same floor the `observation` index reasons
+  /// about), so [upsertDevice] is INSERT OR IGNORE + UPDATE.
+  static Future<void> _createDevice(Database db) async {
+    await db.execute('''
+      CREATE TABLE IF NOT EXISTS device (
+        id          TEXT PRIMARY KEY,
+        adapter_id  TEXT,
+        remote_id   TEXT,
+        label       TEXT,
+        tier        TEXT,
+        first_seen  INTEGER NOT NULL,
+        last_seen   INTEGER NOT NULL
+      )
+    ''');
+  }
+
+  /// Record that [id] exists and was seen now. Every field except [id] is
+  /// COALESCED, so a caller that only knows the remote id cannot blank out a
+  /// label or an adapter another caller already established.
+  static Future<void> upsertDevice({
+    String id = kPrimaryDeviceId,
+    String? adapterId,
+    String? remoteId,
+    String? label,
+    String? tier,
+  }) async {
+    final db = await instance;
+    final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
+    await db.insert('device', {
+      'id': id,
+      'adapter_id': adapterId,
+      'remote_id': remoteId,
+      'label': label,
+      'tier': tier,
+      'first_seen': now,
+      'last_seen': now,
+    }, conflictAlgorithm: ConflictAlgorithm.ignore);
+    await db.rawUpdate(
+      'UPDATE device SET adapter_id = COALESCE(?, adapter_id), '
+      'remote_id = COALESCE(?, remote_id), label = COALESCE(?, label), '
+      'tier = COALESCE(?, tier), last_seen = ? WHERE id = ?',
+      [adapterId, remoteId, label, tier, now, id],
+    );
+  }
+
+  /// One device row, or null when this phone has never seen it.
+  static Future<Map<String, Object?>?> deviceRow([
+    String id = kPrimaryDeviceId,
+  ]) async {
+    final db = await instance;
+    final r = await db.query('device', where: 'id = ?', whereArgs: [id]);
+    return r.isEmpty ? null : r.first;
+  }
+
+  /// Every device this phone knows about, most recently seen first.
+  static Future<List<Map<String, Object?>>> deviceRows() async {
+    final db = await instance;
+    return db.query('device', orderBy: 'last_seen DESC');
+  }
+
+  /// Forget one device. The MEASUREMENTS it wrote are untouched — "this
+  /// removes the source, not the data", which is what the forget dialog
+  /// promises and what `decoded_*` keeping its `device_id` makes possible.
+  static Future<void> deleteDevice([String id = kPrimaryDeviceId]) async {
+    final db = await instance;
+    await db.delete('device', where: 'id = ?', whereArgs: [id]);
+  }
+
+  // ── OBSERVATIONS (vendor-computed / typed-in / imported scalars) ───────────
+  /// Everything that is NOT a raw sensor sample and NOT computed by us:
+  /// a `reports` band's own conclusions, the user's typed-in numbers, and
+  /// another app's history. See docs/OBSERVATION_SPEC.md.
+  ///
+  /// THE SINGLE INVARIANT, and it is the whole safety story: **nothing reads
+  /// this table into a baseline, into a trend that also carries derived
+  /// values, or into any input to a derivation.** Held the same way
+  /// `imported_measurement` holds its own version of the rule — a SEPARATE
+  /// table, so the only way to violate it is to name it somewhere new, and
+  /// `observation_isolation_test.dart` fails the moment anyone does. If it is
+  /// ever violated the failure is SILENT: an unexplained step change in a
+  /// long-horizon number, months later, with no way to tell which day broke it.
+  ///
+  /// IDENTITY IS AN EXPRESSION INDEX, NOT A PRIMARY KEY, and that is not a
+  /// stylistic choice. The spec's key is
+  /// `(device_id, ts_ms, source_kind, COALESCE(vendor_key, key))`, and SQLite
+  /// takes no expression in a table-level PRIMARY KEY. The two obvious repairs
+  /// both fail:
+  ///
+  ///  * A `GENERATED ALWAYS AS (COALESCE(...)) STORED` column is rejected
+  ///    outright — "generated columns cannot be part of the PRIMARY KEY" — and
+  ///    generated columns need SQLite 3.31 (2020) besides, which minSdk 26
+  ///    (Android 8 ships 3.18) does not have.
+  ///  * A plain composite `PRIMARY KEY (…, vendor_key, key)` COMPILES AND IS
+  ///    WRONG. A PRIMARY KEY on a rowid table is a UNIQUE INDEX, and SQLite
+  ///    treats NULLs in one as DISTINCT — so two rows with the same
+  ///    `vendor_key` and a NULL `key` do not collide, `INSERT OR REPLACE` does
+  ///    not replace, and a re-import silently doubles every composite it
+  ///    carries. Proven, not assumed.
+  ///
+  /// A UNIQUE INDEX may hold an expression (SQLite 3.9, 2015 — safely below
+  /// the Android 8 floor), `INSERT OR REPLACE` resolves against it exactly as
+  /// it would against a PRIMARY KEY, and `COALESCE` is non-NULL whenever the
+  /// CHECK holds, so the NULL-distinctness trap never arms. The CHECK is what
+  /// makes that true, which is why it is a DB constraint and not a Dart assert.
+  ///
+  /// `device_id = ''` is the primary band, permanently — the standing rule
+  /// established for `decoded_onehz` at v47, and for the same reason: a BLE
+  /// remoteId is not a stable identity.
+  ///
+  /// ponytail: scalars only (`value REAL` + `unit TEXT`). A vendor hypnogram
+  /// or a vendor GPS track is not a scalar and has no consumer — give it a
+  /// table of its own when something is actually going to read it.
+  static Future<void> _createObservation(Database db) async {
+    await db.execute('''
+      CREATE TABLE IF NOT EXISTS observation (
+        device_id    TEXT NOT NULL DEFAULT '',
+        ts_ms        INTEGER NOT NULL,
+        date         TEXT NOT NULL,
+        source_kind  TEXT NOT NULL,
+        vendor_key   TEXT,
+        key          TEXT,
+        value        REAL,
+        unit         TEXT,
+        attribution  TEXT NOT NULL,
+        CHECK (vendor_key IS NOT NULL OR key IS NOT NULL)
+      )
+    ''');
+    await db.execute(
+      'CREATE UNIQUE INDEX IF NOT EXISTS idx_observation_identity '
+      'ON observation(device_id, ts_ms, source_kind, COALESCE(vendor_key, key))',
+    );
+    await db.execute(
+      'CREATE INDEX IF NOT EXISTS idx_observation_date '
+      'ON observation(date, source_kind)',
+    );
+  }
+
+  /// Upsert observations. Idempotent on `(device_id, ts_ms, source_kind, name)`
+  /// so re-running an import re-states rather than duplicates.
+  ///
+  /// `date` comes from [dayLabelOf] and nowhere else — the day model is LOCAL
+  /// calendar days, and a label computed any other way is wrong for 23 h/25 h
+  /// DST days and for every user whose local date differs from UTC's.
+  ///
+  /// There is deliberately NO reader here yet. Nothing writes observations
+  /// either: the adapter seam that will is phase 4, and wiring an existing
+  /// importer into this table today would move numbers users already see.
+  static Future<int> putObservations(
+    List<Observation> rows, {
+    String deviceId = kPrimaryDeviceId,
+  }) async {
+    if (rows.isEmpty) return 0;
+    final db = await instance;
+    await db.transaction((txn) async {
+      final batch = txn.batch();
+      for (final o in rows) {
+        batch.insert('observation', {
+          'device_id': deviceId,
+          'ts_ms': o.at.millisecondsSinceEpoch,
+          'date': o.date,
+          'source_kind': o.sourceKind.name,
+          'vendor_key': o.vendorKey,
+          'key': o.key,
+          'value': o.value.toDouble(),
+          'unit': o.unit,
+          'attribution': o.attribution,
+        }, conflictAlgorithm: ConflictAlgorithm.replace);
+      }
+      await batch.commit(noResult: true);
+    });
+    return rows.length;
+  }
+
+  /// One observation. [putObservations] is the batch this delegates to.
+  static Future<int> putObservation(
+    Observation o, {
+    String deviceId = kPrimaryDeviceId,
+  }) => putObservations([o], deviceId: deviceId);
+
   // ── IMPORTED WORKOUTS (Apple Health / Health Connect) ──────────────────────
   /// A workout some OTHER app recorded, held in its own table for the same
   /// reason `imported_measurement` is: so that it CANNOT become one of ours.
@@ -1616,7 +1977,8 @@ class LocalDb {
         end_ts INTEGER NOT NULL,
         steps INTEGER NOT NULL,
         day TEXT NOT NULL,
-        source TEXT NOT NULL DEFAULT '$kStepSourceBand'
+        source TEXT NOT NULL DEFAULT '$kStepSourceBand',
+        device_id TEXT NOT NULL DEFAULT '$kPrimaryDeviceId'
       )
     ''');
     await db.execute(
@@ -1637,6 +1999,24 @@ class LocalDb {
     );
   }
 
+  /// Ensure `live_coverage.device_id` exists (v49).
+  ///
+  /// WHICH SENSOR counted, not which KIND of sensor — `source` already says
+  /// band-or-phone. Without it two straps on the same 3,000-step walk both
+  /// rank 2 in [resolveDaySteps], skip each other's overlap subtraction, and
+  /// the day publishes 6,000: the resolver has handled that since the ladder
+  /// gained `CoverageSpan.deviceId`, and could never fire because this column
+  /// did not exist. Existing rows take the DEFAULT — the primary band — which
+  /// is exactly what they have always meant, so no day's total moves.
+  static Future<void> _ensureLiveCoverageDeviceId(Database db) async {
+    await _addColumnIfMissing(
+      db,
+      'live_coverage',
+      'device_id',
+      "TEXT NOT NULL DEFAULT '$kPrimaryDeviceId'",
+    );
+  }
+
   /// Step-count provenance for a `live_coverage` row.
   ///
   /// These are never summed together — see [liveStepsForDay].
@@ -1659,6 +2039,10 @@ class LocalDb {
     int steps,
     String day, {
     String source = kStepSourceBand,
+    // WHICH physical sensor counted (see [_ensureLiveCoverageDeviceId]). The
+    // phone is the primary device's own pedometer, so it keeps `''` too —
+    // `source` is what tells wrist from pocket.
+    String deviceId = kPrimaryDeviceId,
   }) async {
     final w = sanitizeCoverageWindow(startTs, endTs, steps);
     if (w == null) return;
@@ -1669,6 +2053,7 @@ class LocalDb {
       'steps': steps,
       'day': day,
       'source': source,
+      'device_id': deviceId,
     });
   }
 
@@ -1768,7 +2153,7 @@ class LocalDb {
     final db = await instance;
     final rows = await db.query(
       'live_coverage',
-      columns: ['start_ts', 'end_ts', 'steps', 'source'],
+      columns: ['start_ts', 'end_ts', 'steps', 'source', 'device_id'],
       where: 'day = ?',
       whereArgs: [day],
     );
@@ -1781,6 +2166,12 @@ class LocalDb {
           // Anything not explicitly 'phone' is band — pre-v27 rows default to
           // it, and relabelling them would suppress a real band count.
           fromBand: r['source'] != kStepSourcePhone,
+          // WHICH sensor, so two equal-ranked spans from two different straps
+          // compete instead of both being credited in full (see
+          // [_ensureLiveCoverageDeviceId]). Pre-v49 rows take the column
+          // default — the primary band — so a single-device install resolves
+          // exactly as it did before the column existed.
+          deviceId: (r['device_id'] as String?) ?? kPrimaryDeviceId,
         ),
     ]);
   }
@@ -2006,7 +2397,28 @@ class LocalDb {
     // service discovery). Null = the caller could not name it, which lands as
     // NULL = unknown provenance. Never defaulted to gen4.
     String? deviceFamily,
+    // WHICH PHYSICAL DEVICE these rows belong to (see [kPrimaryDeviceId]).
+    String deviceId = kPrimaryDeviceId,
   }) async {
+    // B4: `sync_cursor` is a SINGLE GLOBAL `name TEXT PRIMARY KEY` namespace
+    // shared with everything else that keeps a scalar (`frozen_headline`, …),
+    // and `band_backlog` carries `device_family` but no device id. So the trim
+    // token, `counter_hw`, `rec_ts_hw` and the data range of a SECOND
+    // offloading band would land on the first band's cursor and mis-trim its
+    // flash. Namespacing that key space is a phase-4 job (it needs the device
+    // table and a decision about which keys are per-device at all); refusing is
+    // the honest thing until then, and it refuses in the SAFE direction —
+    // nothing commits, so nothing is ACKed and the band keeps its data.
+    //
+    // ponytail: global cursor namespace, one offloading device. Per-device
+    // namespacing when a second adapter can actually offload.
+    if (deviceId != kPrimaryDeviceId) {
+      throw StateError(
+        'commitSyncBatch: sync_cursor is a single global namespace and cannot '
+        'hold a second offloading device (deviceId="$deviceId"). Namespace it '
+        'before enabling a non-primary offload path.',
+      );
+    }
     void checkpoint(String msg) {
       try {
         onCheckpoint?.call(msg);
@@ -2119,6 +2531,11 @@ class LocalDb {
           final sample = samples[i];
           if (sample != null) {
             batch.insert('samples', {
+              'device_id': deviceId,
+              // From `ts`, not `recTs`: `toDbMap` writes `ts: sample.tsEpoch`
+              // and the migration derives `ts_ms` from `ts`, so the key and the
+              // column it is built from must not be allowed to disagree.
+              'ts_ms': sample.tsEpoch * 1000,
               'counter': raw.counter,
               ...sample.toDbMap(),
             }, conflictAlgorithm: ConflictAlgorithm.ignore);
@@ -2129,6 +2546,7 @@ class LocalDb {
             raw,
             sample,
             deviceFamily: deviceFamily,
+            deviceId: deviceId,
           );
           if (raw.counter > maxCounter) maxCounter = raw.counter;
           if (recTs > maxRecTs) maxRecTs = recTs;
@@ -2261,6 +2679,28 @@ class LocalDb {
     } catch (_) {
       /* already present */
     }
+    // WHICH BAND'S UNITS this day's scalars are in (B5). Same table, same
+    // write, same read as `source` — and the same rules: nullable, no DEFAULT,
+    // NEVER retro-filled, because a guessed provenance is worse than none.
+    //
+    // This is live TODAY on a gen4→gen5 swap, with no second device involved:
+    // `skin_temp_adc` holds gen4 ADC COUNTS on one side of the swap and gen5
+    // CENTI-DEGREES on the other, under one `metric_series` key, feeding one
+    // 28-day baseline that every nightly z-score is taken against. The seam is
+    // a step change in the units, not in the person.
+    //
+    // NOT the same as [_importedDatesSql]'s question. Imported days are ANOTHER
+    // ALGORITHM'S OUTPUT and are masked out of every baseline. A foreign family
+    // is this app's own maths over a different sensor, so it is masked
+    // PER-METRIC — only where the seam makes the number WRONG (different
+    // units), never merely noisier. See [foreignFamilyDates].
+    try {
+      await db.execute(
+        'ALTER TABLE metric_series_version ADD COLUMN device_family TEXT',
+      );
+    } catch (_) {
+      /* already present */
+    }
   }
 
   /// Backfill the stamp from `day_result`, which has carried the version all
@@ -3221,12 +3661,22 @@ class LocalDb {
   // samples — LEGACY header-only record index (counter, ts, hr). Retained only
   // so pre-v11 databases stay readable if decoded_onehz backfill was partial.
   // New writes should go to decoded_onehz instead.
+  //
+  // v47: re-keyed off `counter` for the same reason decoded_onehz was re-keyed
+  // off it at v33 and off rec_ts now — `counter` is a WHOOP FLASH RECORD
+  // COUNTER, so a second offloading band's counter 500 is a different reading
+  // that collides with the first band's. The insert is IGNORE, so the collision
+  // DROPPED the newer row rather than replacing the older one, and
+  // [latestSample]'s fallback then served a stale second.
   static Future<void> _createSamples(Database db) async {
     await db.execute('''
       CREATE TABLE IF NOT EXISTS samples (
-        counter INTEGER PRIMARY KEY,
+        device_id TEXT NOT NULL DEFAULT '',
+        ts_ms INTEGER NOT NULL DEFAULT 0,
+        counter INTEGER,
         ts INTEGER NOT NULL,
-        hr INTEGER
+        hr INTEGER,
+        PRIMARY KEY (device_id, ts_ms)
       )
     ''');
   }
@@ -3245,9 +3695,40 @@ class LocalDb {
     // on rec_ts is safe. `counter` is demoted to a NOT NULL forensic column (also
     // the keyset-cursor tiebreak in decodedOneHzBatchByRecTsRange, which never
     // fires now that rec_ts is unique).
+    //
+    // v47: KEYED BY (device_id, ts_ms), NOT rec_ts alone. `rec_ts` stays as the
+    // indexed READ key — every query in this file and in health_export ranges
+    // over it — but it can no longer be the identity, because a second device
+    // measuring the same second is a DIFFERENT reading, and REPLACE on a
+    // shared rec_ts silently deletes the first one (raw prunes at 3 days, so
+    // that loss is permanent). See [_rekeyTableByDevice].
+    //
+    // `device_id = ''` IS RESERVED PERMANENTLY FOR THE PRIMARY BAND. Not a
+    // migration default — a standing rule, and it is load-bearing twice over:
+    //  * The newest-wins dedupe above only works if every row from the one
+    //    physical band shares one key value. A post-reboot counter reset and a
+    //    re-drained record must still collide on (device_id, ts_ms).
+    //  * A BLE `remoteId` is NOT STABLE (per-app CBPeripheral UUID on iOS, a
+    //    rotating RPA on Android). Letting one reach this column would
+    //    fragment one band into N identities across reinstalls, each with its
+    //    own baseline. Only a SECONDARY device gets a real id, and only one an
+    //    adapter issues from something the band emits across the handshake.
+    //
+    // `ts_ms` is `rec_ts * 1000` for every WHOOP row and for every row this
+    // migration rewrites, so the key is EXACTLY as unique as it was — no
+    // number moves. The millisecond resolution is there so a source faster
+    // than 1 Hz has somewhere to land instead of REPLACE-ing itself down to
+    // one row per second, which is the same defect in a different table.
     await db.execute('''
       CREATE TABLE IF NOT EXISTS decoded_onehz (
-        rec_ts INTEGER PRIMARY KEY,
+        device_id TEXT NOT NULL DEFAULT '',
+        ts_ms INTEGER NOT NULL DEFAULT 0,
+        -- NOT re-asserted NOT NULL, deliberately: [_rekeyTableByDevice] copies
+        -- this column verbatim out of a table where SQLite never enforced it
+        -- (a declared PRIMARY KEY on a legacy rowid table does not imply NOT
+        -- NULL), and a constraint failure inside onUpgrade's one exclusive
+        -- transaction quarantines the whole database (invariant 11).
+        rec_ts INTEGER,
         counter INTEGER NOT NULL,
         hr INTEGER,
         ax REAL,
@@ -3269,7 +3750,8 @@ class LocalDb {
         temp_ch2_c REAL,
         temp_ch3_c REAL,
         signal_quality_logvar REAL,
-        dyn_accel_g REAL
+        dyn_accel_g REAL,
+        PRIMARY KEY (device_id, ts_ms)
       )
     ''');
     // v43: `hr` IS NULLABLE TOO, and it is the last sensor column to get there.
@@ -3320,23 +3802,58 @@ class LocalDb {
     // and the inserts were NON-SEQUENTIAL because `counter` resets to ~0 on a
     // band reboot — so it was paying page splits on the ingest path for a
     // query nobody makes. Dropped for existing installs in _repairOpenSchema.
-    // decoded_rr shares the rec_ts key with its parent: PRIMARY KEY (rec_ts,
-    // beat_index). Parent and child now delete/replace by the SAME key, so no
-    // orphan guard is needed. rr_ts_ms (= rec_ts*1000) stays as the per-beat
-    // timestamp the compute worker reads. No secondary index: the rec_ts-range
-    // read path is served by the PK, and the old UNIQUE(rr_ts_ms, beat_index) is
-    // now implied by the PK (rr_ts_ms is rec_ts*1000).
+    // decoded_rr shares its parent's key EXACTLY, one level deeper: PRIMARY KEY
+    // (device_id, ts_ms, beat_index) against the parent's (device_id, ts_ms).
+    // Parent and child still delete/replace by the SAME key, so no orphan guard
+    // is needed — and that is the whole reason the two keys must move together.
+    // Before v47 `_queueRrBeats` cleared the second with an unscoped
+    // `DELETE ... WHERE rec_ts = ?`, which for a second device deleted the
+    // FIRST band's beats for that second and could not be undone.
+    // rr_ts_ms (= rec_ts*1000) stays as the per-beat timestamp the compute
+    // worker reads; `rec_ts` stays as the indexed range key.
     await db.execute('''
       CREATE TABLE IF NOT EXISTS decoded_rr (
+        device_id TEXT NOT NULL DEFAULT '',
+        ts_ms INTEGER NOT NULL DEFAULT 0,
         rec_ts INTEGER NOT NULL,
         beat_index INTEGER NOT NULL,
         rr_ts_ms INTEGER NOT NULL,
         rr_ms INTEGER NOT NULL,
         device_family TEXT,
         source TEXT,
-        PRIMARY KEY (rec_ts, beat_index)
+        PRIMARY KEY (device_id, ts_ms, beat_index)
       )
     ''');
+    // rec_ts USED TO BE THE KEY, and the key was the only index — every read in
+    // this file and in health_export ranges over it. Without these the v47
+    // re-key turns each of them into a full table scan.
+    //
+    // GUARDED ON THE COLUMN, not on IF NOT EXISTS. This helper runs MID-LADDER
+    // too (`_rekeyDecodedStoreByRecTs`, oldV<33), where `decoded_rr` is still
+    // the counter-keyed shape and has no `rec_ts` at all — and an index on a
+    // missing column throws inside onUpgrade's one exclusive transaction and
+    // quarantines the whole database (invariant 11).
+    //
+    // TWO COLUMNS EACH, matching each table's `ORDER BY` exactly — `rec_ts,
+    // counter` on the parent and `rec_ts, beat_index` on the child — so the
+    // ordering comes out of the index and the planner needs no temp b-tree.
+    //
+    // ponytail: rec_ts kept as a second, indexed time axis. `ts_ms` is
+    // `rec_ts * 1000` for every row this app writes, so these reads COULD range
+    // on ts_ms and ride the PK for free — measured ~4.5 MB per 3-day store per
+    // index, on the hottest write path. Not done here because ~20 call sites in
+    // this file plus health_export range on rec_ts, and phase 2 is meant to
+    // change no read. Fold it in when a reader is being touched anyway.
+    for (final t in const {
+      'decoded_onehz': 'rec_ts, counter',
+      'decoded_rr': 'rec_ts, beat_index',
+    }.entries) {
+      if ((await _columnsOf(db, t.key)).contains('rec_ts')) {
+        await db.execute(
+          'CREATE INDEX IF NOT EXISTS idx_${t.key}_rects ON ${t.key}(${t.value})',
+        );
+      }
+    }
     // Existing installs get these here (ADD COLUMN, idempotent).
     await _ensureDeviceFamilyColumns(db);
     await _ensureSourceColumns(db);
@@ -3524,6 +4041,143 @@ class LocalDb {
     await db.execute('ALTER TABLE _decoded_onehz_v39 RENAME TO decoded_onehz');
   }
 
+  /// One `CREATE TABLE (…)` body reconstructed from a live `PRAGMA
+  /// table_info`, for the rebuild-aside migrations in this file.
+  ///
+  /// DERIVED, NEVER HARDCODED. These tables' column sets are genuinely in flux
+  /// (`ambient_raw` v42, `device_family` v41, `source` + the MT-12 channels
+  /// v43, `ts_subsec` / `band_sleep_state` off-ladder), and a hardcoded list
+  /// silently DROPS every column added after it was written — data loss, in a
+  /// rung that runs once and cannot be re-run.
+  ///
+  /// THE PRIMARY KEY IS THE PART THAT NEEDS CARE. `PRAGMA table_info.pk` is a
+  /// 1-based POSITION, not a flag, so a composite key reports several columns.
+  /// A one-column key is emitted INLINE (`x INTEGER PRIMARY KEY`) because that
+  /// is the only spelling that keeps SQLite's rowid-alias behaviour; anything
+  /// wider must be a table-level `PRIMARY KEY (a, b)` clause, and emitting the
+  /// inline form for each of them instead throws "table has more than one
+  /// primary key".
+  ///
+  /// [prepend] columns are emitted first, verbatim, and are NOT in [info] — a
+  /// re-key adds its new key columns that way. [primaryKey] replaces the old
+  /// key entirely; omit it to carry the table's own key across.
+  /// [dropNotNull] relaxes named columns. Nothing here ever ADDS a constraint:
+  /// a constraint failure inside `onUpgrade`'s single exclusive transaction
+  /// rolls the whole ladder back and quarantines the database (invariant 11),
+  /// so a rebuild may only ever loosen.
+  static String _rebuildDdlBody(
+    List<Map<String, Object?>> info, {
+    Set<String> dropNotNull = const {},
+    List<String> prepend = const [],
+    List<String>? primaryKey,
+  }) {
+    final own = [
+      for (final c in info)
+        if ((((c['pk'] as num?)?.toInt()) ?? 0) > 0) c,
+    ]..sort(
+        (a, b) => ((a['pk'] as num).toInt()).compareTo((b['pk'] as num).toInt()),
+      );
+    final key = primaryKey ?? [for (final c in own) c['name'] as String];
+    final inline = key.length == 1 ? key.first : null;
+    final defs = <String>[...prepend];
+    for (final c in info) {
+      final name = c['name'] as String;
+      final dflt = c['dflt_value'];
+      final notNull =
+          (((c['notnull'] as num?)?.toInt()) ?? 0) == 1 &&
+          !dropNotNull.contains(name);
+      defs.add(
+        '$name ${(c['type'] as String?) ?? ''}'
+        '${name == inline ? ' PRIMARY KEY' : ''}'
+        '${notNull ? ' NOT NULL' : ''}'
+        '${dflt == null ? '' : ' DEFAULT $dflt'}',
+      );
+    }
+    if (inline == null && key.isNotEmpty) {
+      defs.add('PRIMARY KEY (${key.join(', ')})');
+    }
+    return defs.join(', ');
+  }
+
+  /// v47: put `device_id` in front of the key of every table whose identity was
+  /// a WHOOP-shaped quantity — a record second, or the band's flash counter.
+  ///
+  /// WHY THIS ONE IS NOT DEFERRABLE. `decoded_onehz` was `rec_ts INTEGER
+  /// PRIMARY KEY` written with REPLACE and `decoded_rr` was cleared by an
+  /// unscoped `DELETE … WHERE rec_ts = ?`, so a second device measuring the
+  /// same second did not merge with the first — it DELETED it, row and beats.
+  /// `raw_archive` prunes at `rawRetentionDays = 3`, so within three days the
+  /// bytes that could rebuild the evicted row are gone too. Every other item on
+  /// the band-agnostic roadmap can be done after a second device has written;
+  /// this one cannot.
+  ///
+  /// WHAT IT DOES NOT CHANGE. Every existing row is copied under
+  /// `device_id = ''` with `ts_ms = rec_ts * 1000`, which is exactly as unique
+  /// as `rec_ts` was — one row per second per device, same newest-wins REPLACE,
+  /// same dedupe. No stored value is rewritten and no derived number moves, so
+  /// there is no `kAlgoVersion` bump with it.
+  ///
+  /// Cheap enough for the launch-path CPU watchdog `onUpgrade` runs inside:
+  /// the decoded store is retention-capped at `rawRetentionDays`, ~260 k rows,
+  /// and every copy is a server-side `INSERT … SELECT` with zero host-bound
+  /// variables (so the iOS `SQLITE_MAX_VARIABLE_NUMBER` never applies and no
+  /// chunking is needed).
+  static Future<void> _rekeyStoresByDeviceId(Database db) async {
+    await _rekeyTableByDevice(db, 'decoded_onehz');
+    await _rekeyTableByDevice(db, 'decoded_rr', keyTail: const ['beat_index']);
+    await _rekeyTableByDevice(db, 'samples', timeCol: 'ts');
+  }
+
+  /// The rename-aside rebuild behind [_rekeyStoresByDeviceId], for one table.
+  ///
+  /// Self-skipping and idempotent: a table that already carries `device_id` is
+  /// left alone (so a fresh install at v47+ does no work at all), the temp
+  /// table is dropped up front so a crash mid-migration re-runs cleanly, and
+  /// the copy is keyed on identity.
+  static Future<void> _rekeyTableByDevice(
+    Database db,
+    String table, {
+    String timeCol = 'rec_ts',
+    List<String> keyTail = const [],
+  }) async {
+    final info = await db.rawQuery('PRAGMA table_info($table)');
+    // Table absent on this upgrade path ⇒ the current DDL already carries the
+    // new key and there is nothing to rebuild.
+    if (info.isEmpty) return;
+    final names = [for (final c in info) c['name'] as String];
+    if (names.contains('device_id')) return;
+    final tmp = '_${table}_v47';
+    await db.execute('DROP TABLE IF EXISTS $tmp');
+    await db.execute(
+      'CREATE TABLE $tmp (${_rebuildDdlBody(
+        info,
+        prepend: const [
+          "device_id TEXT NOT NULL DEFAULT ''",
+          'ts_ms INTEGER NOT NULL DEFAULT 0',
+        ],
+        primaryKey: ['device_id', 'ts_ms', ...keyTail],
+      )})',
+    );
+    final cols = names.join(', ');
+    // COALESCE because a declared PRIMARY KEY on a legacy rowid table does NOT
+    // enforce NOT NULL — a NULL time column would put a NULL in the new key,
+    // where it compares unequal to itself and escapes the retention prune
+    // forever. 0 is behind every cutoff, so such a row is pruned on the next
+    // pass instead of leaking.
+    await db.execute(
+      'INSERT OR REPLACE INTO $tmp (device_id, ts_ms, $cols) '
+      "SELECT '', COALESCE($timeCol, 0) * 1000, $cols "
+      'FROM $table ORDER BY $timeCol ASC',
+    );
+    // The COPIED column is normalised too, or the row escapes anyway:
+    // `pruneDecodedBeforeRecTs` and `deleteDays` both filter the ORIGINAL
+    // time column (`rec_ts < ?`), never the key, and `NULL < ?` is NULL.
+    // Without this the row is immortal AND invisible — every read gates > 0.
+    await db.execute('UPDATE $tmp SET $timeCol = 0 WHERE $timeCol IS NULL');
+    await db.execute('DROP TABLE IF EXISTS $table');
+    await db.execute('ALTER TABLE $tmp RENAME TO $table');
+  }
+
   /// v43 (SLP-05): drop `NOT NULL` from `decoded_onehz.hr`.
   ///
   /// See [_createDecodedStore] for WHY. This is the same rebuild shape as
@@ -3549,24 +4203,11 @@ class LocalDb {
     final hr = info.where((c) => c['name'] == 'hr');
     if (hr.isEmpty || (hr.first['notnull'] as num?)?.toInt() != 1) return;
 
-    String defOf(Map<String, Object?> c) {
-      final name = c['name'] as String;
-      final type = (c['type'] as String?) ?? '';
-      final dflt = c['dflt_value'];
-      // decoded_onehz's PK is the single column rec_ts, so the inline form is
-      // exact. `hr` is the one column that loses its NOT NULL.
-      final pk = ((c['pk'] as num?)?.toInt() ?? 0) > 0;
-      final notNull =
-          ((c['notnull'] as num?)?.toInt() ?? 0) == 1 && name != 'hr';
-      return '$name $type${pk ? ' PRIMARY KEY' : ''}'
-          '${notNull ? ' NOT NULL' : ''}'
-          '${dflt == null ? '' : ' DEFAULT $dflt'}';
-    }
-
     final names = [for (final c in info) c['name'] as String];
     await db.execute('DROP TABLE IF EXISTS _decoded_onehz_v43');
     await db.execute(
-      'CREATE TABLE _decoded_onehz_v43 (${info.map(defOf).join(', ')})',
+      'CREATE TABLE _decoded_onehz_v43 '
+      '(${_rebuildDdlBody(info, dropNotNull: const {'hr'})})',
     );
     final cols = names.join(', ');
     await db.execute(
@@ -3913,6 +4554,20 @@ class LocalDb {
     RawRecord raw,
     Sample? sample, {
     String? deviceFamily,
+    String deviceId = kPrimaryDeviceId,
+    // TRUE ONLY FROM A MID-LADDER REPLAY, and it is not a style choice. This
+    // map is also written by `_backfillDecodedStore` (rungs oldV<11 / oldV<20)
+    // and `redriveArchivedRecords` (rung oldV<44), both of which run BEFORE the
+    // v47 rung hands `device_id` / `ts_ms` back — and naming a column that does
+    // not exist yet throws inside onUpgrade's one exclusive transaction and
+    // quarantines the whole database. Their rows are re-keyed by
+    // [_rekeyTableByDevice] a few rungs later, from `rec_ts`, which is the same
+    // value this path would have written.
+    //
+    // The default is FALSE and the key columns are named, deliberately: the
+    // opposite default would let a forgotten argument write every row at
+    // ('', 0), where REPLACE collapses the entire store to ONE row.
+    bool preDeviceKey = false,
   }) {
     final decoded = _decodeOneHzSample(raw, preferred: sample);
     if (decoded == null) {
@@ -3929,6 +4584,8 @@ class LocalDb {
           _recTsFrom(raw, sample),
           sample,
           deviceFamily: deviceFamily,
+          deviceId: deviceId,
+          preDeviceKey: preDeviceKey,
         );
       }
       return 0;
@@ -3943,6 +4600,16 @@ class LocalDb {
     // can no longer make one second's record evict another's (the pre-fix
     // counter-PK eviction that silently, unrecoverably deleted 1 Hz rows).
     batch.insert('decoded_onehz', {
+      // v47: WHICH DEVICE, in front of the key. '' is the primary band and
+      // nothing else may ever use it — see _createDecodedStore for why an
+      // unstable BLE remoteId must never reach this column.
+      'device_id': ?(preDeviceKey ? null : deviceId),
+      // `rec_ts * 1000` EXACTLY, never `+ tsSubsec`. The key has to stay as
+      // unique as `rec_ts` was or the newest-wins dedupe splits into one row
+      // per sub-second and every count in the app changes. The millisecond
+      // resolution is headroom for a faster-than-1-Hz source, not a place to
+      // put this record's own sub-second (which already has `ts_subsec`).
+      'ts_ms': ?(preDeviceKey ? null : recTs * 1000),
       'rec_ts': recTs,
       'counter': raw.counter,
       // v43: ABSENCE IS NULL HERE TOO. `hr == 0` is the off-skin sentinel, so
@@ -4009,7 +4676,14 @@ class LocalDb {
       'device_family': ?deviceFamily,
     }, conflictAlgorithm: ConflictAlgorithm.replace);
     return 1 /* the decoded_onehz insert */ +
-        _queueRrBeats(batch, recTs, decoded, deviceFamily: deviceFamily);
+        _queueRrBeats(
+          batch,
+          recTs,
+          decoded,
+          deviceFamily: deviceFamily,
+          deviceId: deviceId,
+          preDeviceKey: preDeviceKey,
+        );
   }
 
   /// `rec_ts` for one raw+decoded pair.
@@ -4026,61 +4700,6 @@ class LocalDb {
     return (rawRecTs != null && rawRecTs > 0) ? rawRecTs : decoded.tsEpoch;
   }
 
-  /// Where each beat in one record actually sits, in absolute epoch ms — or
-  /// null for a beat that cannot be placed. One entry per entry in [rrMs].
-  ///
-  /// TWO PARTS, AND THEY ARE NOT EQUALLY SOLID. Read them separately.
-  ///
-  /// THE ANCHOR IS MEASURED. `rec_ts + tsSubsec/32768` is the record's own
-  /// timestamp, whole seconds and sub-second, exactly as the strap sent it.
-  /// This app has dropped the second half of that since forever, pinning every
-  /// record to a whole second. With no sub-second there is no anchor and every
-  /// beat here is null; a whole second is NOT substituted for one, because the
-  /// whole point of this column is to say something the old one could not.
-  ///
-  /// THE PLACEMENT IS A MODEL, and it is one assumption wide: an R-R interval
-  /// is the gap ENDING at its beat (that part is the definition), and the LAST
-  /// beat a record reports sits at the record's timestamp. Everything else
-  /// follows — beat i is the anchor minus the intervals after it. The direction
-  /// is chosen because backwards is the only one that cannot place a beat in
-  /// the future, i.e. after the moment we were told about it; a forward walk
-  /// would also run every multi-beat record past its own second (the intervals
-  /// sum to 1,426 ms on a 2-beat record and 2,594 ms on a 4-beat one, measured)
-  /// and straight through the next record's.
-  ///
-  /// WHAT THE INTERVALS DO NOT DO IS TILE THE SECOND. Over 81 uninterrupted
-  /// runs of 300+ consecutive records in a real export, the intervals sum to
-  /// 0.967 of the `rec_ts` span (0.960-0.990 across runs) — so the beat train is
-  /// a CHAIN that runs a few percent short, which is what a handful of rejected
-  /// beats looks like, and not a set of per-second buckets. Several of a
-  /// record's intervals reach back out of its own second. Per-record placement
-  /// is nevertheless what THIS path can do — records arrive batched, out of
-  /// order and with gaps, so no cross-record chain is available at the write —
-  /// and a consumer that wants the chain can walk `rr_ms` itself.
-  ///
-  /// WHAT MOVES AND WHAT DOES NOT. Nothing shipped changes: time-domain HRV
-  /// (RMSSD, SDNN, pNNx) is built out of interval VALUES, which were always
-  /// right, and no reader of this column exists. What it makes possible is
-  /// anything needing absolute placement — a Lomb-Scargle periodogram handed
-  /// beats where they happened instead of a staircase, a beat put on the same
-  /// axis as a motion sample, a real inter-record gap.
-  ///
-  /// A non-positive interval BREAKS THE CHAIN: the gap before that beat is
-  /// unknown, so every EARLIER beat in the record becomes unplaceable and gets
-  /// null rather than a position computed as if the missing gap were zero.
-  @visibleForTesting
-  static List<int?> beatTimesMs(int recTs, int? tsSubsec, List<int> rrMs) {
-    final out = List<int?>.filled(rrMs.length, null);
-    if (tsSubsec == null || rrMs.isEmpty) return out;
-    final anchor = recTs * 1000 + (tsSubsec * 1000) ~/ 32768;
-    var back = 0;
-    for (var i = rrMs.length - 1; i >= 0; i--) {
-      out[i] = anchor - back;
-      if (rrMs[i] <= 0) break;
-      back += rrMs[i];
-    }
-    return out;
-  }
 
   /// Replaces this second's RR beats. Returns the ops queued.
   ///
@@ -4092,14 +4711,31 @@ class LocalDb {
     int recTs,
     Sample decoded, {
     String? deviceFamily,
+    String deviceId = kPrimaryDeviceId,
+    bool preDeviceKey = false,
   }) {
-    batch.rawDelete('DELETE FROM decoded_rr WHERE rec_ts = ?', [recTs]);
+    // SCOPED TO THE WRITING DEVICE (v47). Unscoped, this cleared every device's
+    // beats for the second — so a second band writing one row deleted the
+    // first band's R-R for that second, permanently (raw prunes at 3 days).
+    // Same key prefix as the parent row, so the PK serves the delete.
+    if (preDeviceKey) {
+      batch.rawDelete('DELETE FROM decoded_rr WHERE rec_ts = ?', [recTs]);
+    } else {
+      batch.rawDelete(
+        'DELETE FROM decoded_rr WHERE device_id = ? AND ts_ms = ?',
+        [deviceId, recTs * 1000],
+      );
+    }
     final beatTs = beatTimesMs(recTs, decoded.tsSubsec, decoded.rrIntervalsMs);
     var ops = 1;
     for (var i = 0; i < decoded.rrIntervalsMs.length; i++) {
       final rr = decoded.rrIntervalsMs[i];
       if (rr <= 0) continue;
       batch.insert('decoded_rr', {
+        // Same key prefix as the parent row — see _createDecodedStore. Omitted
+        // on the mid-ladder replay for the reason _queueDecodedOneHz gives.
+        'device_id': ?(preDeviceKey ? null : deviceId),
+        'ts_ms': ?(preDeviceKey ? null : recTs * 1000),
         'rec_ts': recTs,
         'beat_index': i,
         // UNCHANGED, DELIBERATELY. `rr_ts_ms` stays `rec_ts * 1000` and
@@ -4112,9 +4748,10 @@ class LocalDb {
         // NULL is "we did not keep the sub-second for this beat", which is
         // exactly the case for every row written before today.
         //
-        // It is also the column the compute layer reads (substrate.dart,
-        // derive_prepare.dart), and this change is deliberately invisible to
-        // it — see beatTimesMs on why no shipped number moves.
+        // The compute layer (substrate.dart, derive_prepare.dart) now prefers
+        // `beat_ts_ms` and falls back to this column, so `rr_ts_ms` stays the
+        // honest answer for every row that has no sub-second — which is every
+        // row written before the column existed.
         'rr_ts_ms': recTs * 1000,
         'rr_ms': rr,
         // Omitted when null — see _queueDecodedOneHz. Also newer than the
@@ -4167,7 +4804,9 @@ class LocalDb {
           capturedAt: (row['captured_at'] as num?)?.toInt() ?? 0,
           recTs: (row['rec_ts'] as num?)?.toInt(),
         );
-        _queueDecodedOneHz(batch, raw, null);
+        // MID-LADDER: `device_id` / `ts_ms` do not exist yet (v47 rung). See
+        // _queueDecodedOneHz's `preDeviceKey`.
+        _queueDecodedOneHz(batch, raw, null, preDeviceKey: true);
       }
       await batch.commit(noResult: true);
       afterCounter = (rows.last['counter'] as num?)?.toInt() ?? afterCounter;
@@ -4729,6 +5368,12 @@ class LocalDb {
       );
       if (present.isEmpty) return 0;
     }
+    // SELF-DETECTING, because this runs from BOTH sides of the v47 rung: from
+    // the oldV<44 ladder step, where `decoded_onehz` is still keyed by rec_ts
+    // alone and naming `device_id` would throw inside onUpgrade (quarantining
+    // the database), and from the app/tests on a re-keyed table. One PRAGMA.
+    final preDeviceKey =
+        !(await _columnsOf(db, 'decoded_onehz')).contains('device_id');
 
     final marks = List.filled(redrivableArchiveReasons.length, '?').join(',');
     // Paged on `hex`, which is the table's PRIMARY KEY — a stable, total order
@@ -4793,7 +5438,13 @@ class LocalDb {
         // `sample` is handed back as `preferred` so the hex is decoded once,
         // not twice; `_queueDecodedOneHz` returns it straight back out.
         // `deviceFamily` is deliberately omitted — see the doc comment.
-        if (_queueDecodedOneHz(batch, raw, sample) > 0) {
+        if (_queueDecodedOneHz(
+              batch,
+              raw,
+              sample,
+              preDeviceKey: preDeviceKey,
+            ) >
+            0) {
           queued++;
           recovered++;
         }
@@ -5117,12 +5768,19 @@ class LocalDb {
     'hr_alt',
   ];
 
+  /// [kPrimaryBandSourceSql], and the `samples` fallback below is why: that
+  /// table has no `source` column at all, so it can only ever hold the band's
+  /// rows. Returning gated decoded rows from one branch and ungated legacy rows
+  /// from the other under one [Sample] type would make the provenance of the
+  /// result depend on which branch fired. (No production caller today — only
+  /// tests reach this; gated with its sibling rather than left as the one
+  /// decoded read whose answer changes when a strap is paired.)
   static Future<List<Sample>> samplesInRange(int fromTs, int toTs) async {
     final db = await instance;
     final decodedRows = await db.query(
       'decoded_onehz',
       columns: _decodedSampleColumns,
-      where: 'rec_ts >= ? AND rec_ts <= ?',
+      where: 'rec_ts >= ? AND rec_ts <= ? AND $kPrimaryBandSourceSql',
       whereArgs: [fromTs, toTs],
       orderBy: 'rec_ts ASC, counter ASC',
     );
@@ -5138,11 +5796,17 @@ class LocalDb {
     return rows.map(Sample.fromDbMap).toList();
   }
 
+  /// [kPrimaryBandSourceSql], for the [samplesInRange] reason above AND for its
+  /// own: its one caller keeps this as `lastSynced`, whose `tsEpoch` is the
+  /// fallback frontier behind the `rec_ts_hw` cursor — i.e. "how fresh is the
+  /// BAND". A peripheral sensor's second would make a band that has not synced
+  /// in two days read as current.
   static Future<Sample?> latestSample() async {
     final db = await instance;
     final decodedRows = await db.query(
       'decoded_onehz',
       columns: _decodedSampleColumns,
+      where: kPrimaryBandSourceSql,
       orderBy: 'rec_ts DESC, counter DESC',
       limit: 1,
     );
@@ -5174,9 +5838,14 @@ class LocalDb {
   }
 
   /// `(firstRecTs, lastRecTs)` in unix seconds over canonical decoded 1 Hz rows,
-  /// or `(null, null)` when nothing has been decoded yet. Used by the onboarding
-  /// "collecting your data" state to show a real progress bar (last record ts
-  /// vs. now, against a first-record anchor) instead of a bare raw-record count.
+  /// or `(null, null)` when nothing has been decoded yet.
+  ///
+  /// Its ONE production caller is [decodedRecTsMaxByDay], which uses it purely
+  /// as the span to walk — so this is an ADMISSION read ([derivableSourceSql]),
+  /// not a band-edge one. Band-only here would clip a verified second source's
+  /// days out of derivation entirely, before any of them reached the day walk.
+  /// (The old doc comment claimed the onboarding progress bar; that call site
+  /// is gone.)
   static Future<(int?, int?)> firstAndLastRecordTs() async {
     final db = await instance;
     final rows = await db.rawQuery(
@@ -5184,10 +5853,8 @@ class LocalDb {
       // row (e.g. via _queueDecodedOneHz's `raw.recTs ?? decoded.tsEpoch`,
       // which only substitutes on null, not on an explicit 0) would otherwise
       // make MIN(rec_ts) return 0 and render "Data from Jan 1" (1970 epoch).
-      // `source IS NULL` — the band's own rows. A chest-strap second is not
-      // "when your data starts" and must not move the onboarding anchor.
       'SELECT MIN(rec_ts) AS lo, MAX(rec_ts) AS hi FROM decoded_onehz '
-      'WHERE rec_ts > 0 AND source IS NULL',
+      'WHERE rec_ts > 0 AND ${derivableSourceSql()}',
     );
     if (rows.isEmpty) return (null, null);
     final lo = (rows.first['lo'] as num?)?.toInt();
@@ -5227,7 +5894,8 @@ class LocalDb {
       if (end == null) break;
       final rows = await db.rawQuery(
         'SELECT MAX(rec_ts) AS mx FROM decoded_onehz '
-        'WHERE rec_ts > 0 AND source IS NULL AND rec_ts >= ? AND rec_ts < ?',
+        'WHERE rec_ts > 0 AND ${derivableSourceSql()} '
+        'AND rec_ts >= ? AND rec_ts < ?',
         [localDayStartSec(day) ?? 0, end],
       );
       final mx = rows.isEmpty ? null : (rows.first['mx'] as num?)?.toInt();
@@ -5258,7 +5926,7 @@ class LocalDb {
         'step_count, step_cadence, activity_class, skin_temp_c, '
         'on_wrist, hr_valid, hr_alt, device_family '
         'FROM decoded_onehz '
-        'WHERE rec_ts >= ? AND rec_ts <= ? AND source IS NULL '
+        'WHERE rec_ts >= ? AND rec_ts <= ? AND ${derivableSourceSql()} '
         'ORDER BY rec_ts ASC, counter ASC LIMIT ?',
         [fromRecTs, toRecTs, limit],
       );
@@ -5269,7 +5937,7 @@ class LocalDb {
       'step_count, step_cadence, activity_class, skin_temp_c, '
       'on_wrist, hr_valid, hr_alt, device_family '
       'FROM decoded_onehz '
-      'WHERE rec_ts >= ? AND rec_ts <= ? AND source IS NULL '
+      'WHERE rec_ts >= ? AND rec_ts <= ? AND ${derivableSourceSql()} '
       'AND (rec_ts > ? OR (rec_ts = ? AND counter > ?)) '
       'ORDER BY rec_ts ASC, counter ASC LIMIT ?',
       [fromRecTs, toRecTs, afterRecTs, afterRecTs, afterCounter, limit],
@@ -5293,8 +5961,13 @@ class LocalDb {
     final lo = fromRecTs <= toRecTs ? fromRecTs : toRecTs;
     final hi = fromRecTs <= toRecTs ? toRecTs : fromRecTs;
     return db.rawQuery(
-      'SELECT rec_ts, beat_index, rr_ts_ms, rr_ms FROM decoded_rr '
-      'WHERE rec_ts >= ? AND rec_ts <= ? AND source IS NULL '
+      // `beat_ts_ms` is the MEASURED beat instant (`beatTimesMs`); `rr_ts_ms` is
+      // `rec_ts * 1000`, a whole-second staircase that says every beat inside
+      // one record happened at the same millisecond. Both are returned because
+      // `beat_ts_ms` is NULL on every row banked before the column existed and
+      // on every source that carries no sub-second — the reader coalesces.
+      'SELECT rec_ts, beat_index, rr_ts_ms, rr_ms, beat_ts_ms FROM decoded_rr '
+      'WHERE rec_ts >= ? AND rec_ts <= ? AND ${derivableSourceSql()} '
       'ORDER BY rec_ts ASC, beat_index ASC',
       [lo, hi],
     );
@@ -5331,6 +6004,11 @@ class LocalDb {
     // the column is that a guessed provenance is worse than none. See
     // [_createMetricSeriesVersion].
     String? source,
+    // WHICH BAND'S UNITS these scalars are in — the substrate's own
+    // `device_family` stamp, which is already null when the window spans two
+    // straps or carries no stamp at all. Same rule as [source]: never guessed.
+    // See [_createMetricSeriesVersion] and [foreignFamilyDates].
+    String? deviceFamily,
   }) async {
     final db = await instance;
     final now = DateTime.now().millisecondsSinceEpoch;
@@ -5385,6 +6063,7 @@ class LocalDb {
             // included, so a caller that does not know its own writes NULL
             // here rather than inheriting the previous writer's claim.
             'source': source,
+            'device_family': deviceFamily,
           }, conflictAlgorithm: ConflictAlgorithm.replace);
         }
       }
@@ -5657,7 +6336,7 @@ class LocalDb {
       'COUNT(*) AS raw_count, '
       'MIN(rec_ts) AS min_rec_ts, '
       'MAX(rec_ts) AS max_rec_ts '
-      'FROM decoded_onehz WHERE rec_ts > 0 AND source IS NULL '
+      'FROM decoded_onehz WHERE rec_ts > 0 AND ${derivableSourceSql()} '
       'GROUP BY day_id ORDER BY day_id DESC',
     );
     final derivedRows = await db.rawQuery(
@@ -6207,6 +6886,45 @@ class LocalDb {
     };
   }
 
+  /// The `metric_series` keys whose stored VALUES ARE IN THE BAND'S OWN UNITS,
+  /// so a day measured by a different band family is not on the same scale as
+  /// today's and must not sit in the same baseline.
+  ///
+  /// DELIBERATELY SHORT, and it is a list of UNIT MISMATCHES, not of things
+  /// that got noisier. `skin_temp_adc` is a gen4 thermistor ADC COUNT on one
+  /// side of a strap swap and a gen5 CENTI-DEGREE reading on the other — the
+  /// same key holding two different quantities, which is a wrong number, not a
+  /// less precise one. `rhr` and `rmssd` off a different wrist sensor are the
+  /// same quantity measured slightly differently: masking those would delete
+  /// the user's history from their own baseline to fix a bias smaller than the
+  /// window it is measured over. Nothing joins this set without a measured unit
+  /// difference behind it.
+  static const Set<String> familySeamKeys = {'skin_temp_adc'};
+
+  /// Day labels whose scalars were measured by a DIFFERENT band family than the
+  /// most recent stamped day — the mask for [familySeamKeys] baselines.
+  ///
+  /// Two properties that make this safe to apply unconditionally:
+  ///  * A NULL stamp is never foreign. Unknown provenance is its own case (see
+  ///    [_createMetricSeriesVersion]); every day written before the column
+  ///    existed reads NULL, and dropping those would delete a real user's whole
+  ///    history from their own baseline.
+  ///  * A single-family user gets the EMPTY SET, because nothing differs from
+  ///    the newest stamp. So this changes no number until a strap actually
+  ///    changes generation.
+  static Future<Set<String>> foreignFamilyDates() async {
+    final db = await instance;
+    final rows = await db.rawQuery(
+      'SELECT date FROM metric_series_version '
+      'WHERE date IS NOT NULL AND device_family IS NOT NULL '
+      'AND device_family <> ('
+      '  SELECT device_family FROM metric_series_version '
+      '  WHERE device_family IS NOT NULL ORDER BY date DESC LIMIT 1'
+      ')',
+    );
+    return {for (final r in rows) r['date'] as String};
+  }
+
   /// Import another device's exported OpenStrap DB ([path], from [exportCopy] +
   /// share) by MERGING its rows into this one (INSERT-OR-REPLACE). Covers derived
   /// results, the metric series, user data, and the raw ledger so the receiving
@@ -6287,6 +7005,11 @@ class LocalDb {
       'cycle_log',
       'cycle_symptom',
       'breathing_session',
+      // Vendor-computed, typed-in and imported scalars. In the hand-entered
+      // block because a third of it IS hand-entered and nothing regenerates
+      // any of it — a `reports` band trims its own history, and the app whose
+      // export the imported rows came from may be uninstalled by now.
+      'observation',
       'workout_route',
       'workout_split',
       // The user's sleep corrections. These are the ONLY copy of them — the
@@ -6324,6 +7047,11 @@ class LocalDb {
       'sessions',
       'notifications',
       'baselines',
+      // The devices this phone knows about — so a SECONDARY device's identity
+      // survives a backup/restore round trip rather than leaving its rows in
+      // `decoded_onehz` pointing at a `device_id` nothing can name. The PRIMARY
+      // row is deliberately skipped on the way in; see the guard below.
+      'device',
       'sync_cursor',
     ];
     // Columns this app's schema actually has, per table — so a row from a NEWER
@@ -6463,6 +7191,17 @@ class LocalDb {
                   final st = row['skin_temp_c'];
                   if (st is num && st <= -49.995) row['skin_temp_c'] = null;
                 }
+                // THE PRIMARY DEVICE IS NOT PORTABLE. Its `remote_id` is a
+                // per-install handle — a CBPeripheral UUID that is unique to
+                // the phone AND the app install on iOS, a rotating RPA on
+                // Android — so a foreign export's copy names a peripheral this
+                // phone cannot connect to. Importing it would REPLACE the local
+                // pairing (id `''` is the primary, permanently) and leave the
+                // app claiming a band that is not there. A restore onto the
+                // same install needs nothing from here: the row is already
+                // present, and the SharedPreferences mirror re-establishes it
+                // if the database was rebuilt.
+                if (t == 'device' && row['id'] == kPrimaryDeviceId) continue;
                 if (t == 'day_result') {
                   if (protectedKeys.contains(
                     '${row['day_id']}|${row['algo_version']}',
@@ -6490,6 +7229,30 @@ class LocalDb {
                   }
                   row['rec_ts'] = rrTsMs.toInt() ~/ 1000;
                 }
+                // A PRE-v47 EXPORT CARRIES NO `device_id` / `ts_ms`. Left
+                // alone they take the column DEFAULTS — ('', 0) — so every
+                // imported row would collide on ONE primary key and REPLACE
+                // the whole table down to a single row. Derive the key exactly
+                // as [_rekeyTableByDevice] does: the primary band, and the
+                // row's own time in ms. AFTER the rec_ts recovery above, which
+                // is what decoded_rr's key is built from.
+                // NAMED, not sniffed off `ts_ms`: `workout_route` declares that
+                // column too and is in the merge list, but it was never re-keyed —
+                // it has no `device_id` and no `rec_ts`, so a null `ts_ms` there
+                // falls to the `t0 is! num` drop below and the route point vanishes
+                // without a word. NOT NULL keeps that unreachable from a database
+                // this app wrote; the table NAME is what keeps it unreachable after
+                // the next schema change.
+                const deviceKeyed = {'samples', 'decoded_onehz', 'decoded_rr'};
+                if (deviceKeyed.contains(t) && row['ts_ms'] == null) {
+                  row['device_id'] ??= kPrimaryDeviceId;
+                  final t0 = row[t == 'samples' ? 'ts' : 'rec_ts'];
+                  // Non-numeric (storage classes are per VALUE in a foreign
+                  // export) ⇒ drop the one row rather than key it at 0, where
+                  // it would REPLACE another row that genuinely belongs there.
+                  if (t0 is! num) continue;
+                  row['ts_ms'] = t0.toInt() * 1000;
+                }
                 rows.add(row);
               }
               // REPLACE the beat set for a colliding second, don't patch it.
@@ -6509,7 +7272,10 @@ class LocalDb {
               // clears >1; page 2 inserts 2,3 and clears >3 — and beat_index is
               // dense by construction, so "everything past the last one" is
               // exactly the stale local tail.
-              final highestBeat = <Object, int>{};
+              // v47: keyed on (device_id, ts_ms), the beat's real key — so the
+              // tail sweep can only ever clear the WRITING device's stale
+              // beats, never the other band's for the same second.
+              final highestBeat = <(Object?, Object?), int>{};
               for (final row in rows) {
                 batch.insert(
                   t,
@@ -6518,12 +7284,12 @@ class LocalDb {
                 );
                 copied++;
                 if (t == 'decoded_rr') {
-                  final recTs = row['rec_ts'];
                   final idx = row['beat_index'];
-                  if (recTs != null && idx is num) {
+                  final key = (row['device_id'], row['ts_ms']);
+                  if (key.$2 != null && idx is num) {
                     final n = idx.toInt();
-                    final prev = highestBeat[recTs];
-                    if (prev == null || n > prev) highestBeat[recTs] = n;
+                    final prev = highestBeat[key];
+                    if (prev == null || n > prev) highestBeat[key] = n;
                   }
                 }
                 if (++ops >= chunkOps) await flush();
@@ -6531,8 +7297,8 @@ class LocalDb {
               for (final e in highestBeat.entries) {
                 batch.delete(
                   'decoded_rr',
-                  where: 'rec_ts = ? AND beat_index > ?',
-                  whereArgs: [e.key, e.value],
+                  where: 'device_id = ? AND ts_ms = ? AND beat_index > ?',
+                  whereArgs: [e.key.$1, e.key.$2, e.value],
                 );
                 if (++ops >= chunkOps) await flush();
               }
@@ -6753,6 +7519,8 @@ class LocalDb {
       'external_hr',
       'imported_measurement',
       'imported_workout',
+      'observation',
+      'device',
     ];
 
     final missingTables = <String>[];
@@ -8315,6 +9083,13 @@ class LocalDb {
 
   /// 1 Hz heart-rate samples in [fromTs, toTs] (epoch SECONDS), ascending, used
   /// to colour a route and average HR per split. Only worn seconds (hr > 0).
+  ///
+  /// Admitted rows only ([derivableSourceSql]), for the same reason
+  /// [sessionHrStats] states below: an unverified adapter writes its own
+  /// seconds into this table with `source` set, and averaging the two together
+  /// reports a session HR that is neither sensor's. Today nothing writes a
+  /// non-null source, so this filter is a no-op — it is here so the six call
+  /// sites are already correct on the day one does.
   static Future<List<Map<String, dynamic>>> hrSamplesInRange(
     int fromTs,
     int toTs,
@@ -8323,7 +9098,8 @@ class LocalDb {
     return db.query(
       'decoded_onehz',
       columns: ['rec_ts', 'hr'],
-      where: 'rec_ts >= ? AND rec_ts <= ? AND hr > 0',
+      where:
+          'rec_ts >= ? AND rec_ts <= ? AND hr > 0 AND ${derivableSourceSql()}',
       whereArgs: [fromTs, toTs],
       orderBy: 'rec_ts ASC',
     );
@@ -8355,10 +9131,10 @@ class LocalDb {
       'FROM sessions s '
       'JOIN decoded_onehz d ON d.rec_ts >= s.start_ts '
       '  AND d.rec_ts <= COALESCE(s.end_ts, s.start_ts) AND d.hr > 0 '
-      // Band rows only. A paired chest strap writes its own seconds into this
-      // table with `source` set; averaging the two together would report a
+      // Admitted rows only. An unverified adapter writes its own seconds into
+      // this table with `source` set; averaging the two together would report a
       // session HR that is neither sensor's.
-      '  AND d.source IS NULL '
+      '  AND ${derivableSourceSql('d.source')} '
       'WHERE s.start_ts >= ? AND s.start_ts <= ? '
       'GROUP BY s.id',
       [fromTs, toTs],
@@ -8391,10 +9167,10 @@ class LocalDb {
       'FROM sessions s '
       'JOIN decoded_onehz d ON d.rec_ts >= s.start_ts '
       '  AND d.rec_ts <= COALESCE(s.end_ts, s.start_ts) AND d.hr > 0 '
-      // Band rows only. A paired chest strap writes its own seconds into this
-      // table with `source` set; averaging the two together would report a
+      // Admitted rows only. An unverified adapter writes its own seconds into
+      // this table with `source` set; averaging the two together would report a
       // session HR that is neither sensor's.
-      '  AND d.source IS NULL '
+      '  AND ${derivableSourceSql('d.source')} '
       'WHERE s.start_ts >= ? AND s.start_ts <= ? '
       'ORDER BY s.id, d.rec_ts ASC',
       [fromTs, toTs],
@@ -8659,10 +9435,20 @@ class LocalDb {
     final db = await instance;
     return Sqflite.firstIntValue(
       await db.rawQuery(
-        // The data edge is the BAND's edge: a peripheral sensor's second is not
-        // evidence the strap synced, and letting it move this would tell the
-        // sync engine it made progress it did not make.
-        'SELECT MAX(rec_ts) FROM decoded_onehz WHERE rec_ts > 0 AND source IS NULL',
+        // [kPrimaryBandSourceSql], NOT [derivableSourceSql]: the data edge is
+        // the BAND's edge. A peripheral sensor's second is not evidence the
+        // strap synced, and letting it move this would tell the sync engine it
+        // made progress it did not make.
+        //
+        // ponytail: the derive engine reads this as "now, in data time" (its
+        // finalization anchor, and `dataNowSec <= 0` short-circuits the whole
+        // pass), which is a DIFFERENT question — an install with a verified
+        // strap and no band would derive nothing. The upgrade is a sibling
+        // `lastAdmittedRecTs()` on [derivableSourceSql] for the derive callers,
+        // added when a second admitted source actually exists; splitting it now
+        // would be two names for one query.
+        'SELECT MAX(rec_ts) FROM decoded_onehz '
+        'WHERE rec_ts > 0 AND $kPrimaryBandSourceSql',
       ),
     );
   }
diff --git a/lib/data/live_coverage_policy.dart b/lib/data/live_coverage_policy.dart
index 2da4c907..f3549e8c 100644
--- a/lib/data/live_coverage_policy.dart
+++ b/lib/data/live_coverage_policy.dart
@@ -186,6 +186,7 @@ class CoverageSpan {
     required this.endTs,
     required this.steps,
     required this.fromBand,
+    this.deviceId = '',
   });
 
   final int startTs;
@@ -194,6 +195,15 @@ class CoverageSpan {
 
   /// `source != 'phone'` — the band's own 100 Hz pedometer, live or imported.
   final bool fromBand;
+
+  /// WHICH PHYSICAL SENSOR counted these steps. `''` is permanently reserved
+  /// for the primary band (and for the phone, which is likewise one of it),
+  /// so a single-device install is entirely `''` and behaves exactly as it did
+  /// before this field existed.
+  ///
+  /// It exists because two sensors that are not the same sensor can produce
+  /// two spans of the same rank over the same walk — see [resolveDaySteps].
+  final String deviceId;
 }
 
 /// A day's steps after the ladder has run, split by the sensor that counted.
@@ -235,10 +245,12 @@ class ResolvedDaySteps {
 }
 
 class _Ranked {
-  _Ranked(this.startTs, this.endTs, this.steps, this.rank, this.fromBand);
+  _Ranked(this.startTs, this.endTs, this.steps, this.rank, this.fromBand,
+      this.deviceId);
   final int startTs, endTs, rank;
   final double steps;
   final bool fromBand;
+  final String deviceId;
   double credited = 0;
 }
 
@@ -263,10 +275,26 @@ ResolvedDaySteps resolveDaySteps(Iterable<CoverageSpan> rows) {
     // 2 = band that looks like gait, 1 = phone, 0 = band that does not.
     final rank = r.fromBand ? (spm >= kBandSpanMinSpm ? 2 : 0) : 1;
     spans.add(
-      _Ranked(w.startTs, w.endTs, r.steps.toDouble(), rank, r.fromBand),
+      _Ranked(w.startTs, w.endTs, r.steps.toDouble(), rank, r.fromBand,
+          r.deviceId),
     );
   }
-  spans.sort((a, b) => b.rank.compareTo(a.rank));
+  // Rank first, then start time — `List.sort` is NOT stable in Dart, and once
+  // equal-ranked spans from different devices compete (below) the winner is
+  // whichever is resolved first, so the tie needs a rule of its own or the
+  // day's total depends on the order SQLite happened to return the rows in.
+  // Earliest span wins; it is arbitrary but it is the same arbitrary answer
+  // every run, which is what a re-derive needs — and that only holds if the
+  // keys reach a TOTAL order. Two devices can share rank AND start, so end and
+  // then `deviceId` finish it; without them the claim above was still an
+  // unstable sort's answer. Same-device ties need no rule: equal rank within
+  // one device is summed, not competed (see the loop below).
+  spans.sort((a, b) {
+    if (b.rank != a.rank) return b.rank.compareTo(a.rank);
+    if (a.startTs != b.startTs) return a.startTs.compareTo(b.startTs);
+    if (a.endTs != b.endTs) return a.endTs.compareTo(b.endTs);
+    return a.deviceId.compareTo(b.deviceId);
+  });
 
   var strap = 0.0;
   var phone = 0.0;
@@ -275,10 +303,17 @@ ResolvedDaySteps resolveDaySteps(Iterable<CoverageSpan> rows) {
     var alreadyCounted = 0.0;
     for (var j = 0; j < i; j++) {
       final h = spans[j];
-      // EQUAL RANK IS NOT COMPETITION. Two band rows, or two phone rows, are
-      // the same sensor reporting twice and are summed — which is what the
-      // table has always meant and what re-import idempotency relies on.
-      if (h.rank <= s.rank) continue;
+      // EQUAL RANK IS NOT COMPETITION *WITHIN ONE DEVICE*. Two band rows, or
+      // two phone rows, from the SAME `device_id` are the same sensor reporting
+      // twice and are summed — which is what the table has always meant and
+      // what re-import idempotency relies on.
+      //
+      // Two DIFFERENT devices are not that. Rank is a property of the SPAN
+      // (band-that-looks-like-gait / phone / band-that-does-not), so two straps
+      // on the same 3,000-step walk both rank 2, skipped each other here, and
+      // the day published 6,000. Different id ⇒ they compete like any other
+      // pair, and the tie is broken by start time (see the sort above).
+      if (h.rank <= s.rank && h.deviceId == s.deviceId) continue;
       final ov = math.min(s.endTs, h.endTs) - math.max(s.startTs, h.startTs);
       if (ov <= 0) continue;
       alreadyCounted += h.credited * ov / (h.endTs - h.startTs);
@@ -301,6 +336,7 @@ ResolvedDaySteps resolveDaySteps(Iterable<CoverageSpan> rows) {
             endTs: s.endTs,
             steps: s.credited.round(),
             fromBand: s.fromBand,
+            deviceId: s.deviceId,
           ),
     ]..sort((a, b) => a.startTs.compareTo(b.startTs)),
   );
diff --git a/lib/data/local_repository_impl.dart b/lib/data/local_repository_impl.dart
index 212f0604..eac6cdbb 100644
--- a/lib/data/local_repository_impl.dart
+++ b/lib/data/local_repository_impl.dart
@@ -3771,7 +3771,8 @@ class LocalRepositoryImpl extends LocalRepository {
     // enough heart rate" — and offered "wear the band for your normal hard
     // sessions". Measured on all three real databases, both are false: every
     // row is unstamped (`unknown_device_family:id=none` on `hr_ceiling`).
-    final ceilingNote = ceiling == null && ana.deviceFamilyOf(family) == null
+    final ceilingNote = ceiling == null &&
+            ana.calibrationFor(ana.hrCeilingMotionGateG, family) == null
         ? ana.unknownFamilyNote(family)
         : null;
     final set = trainingZones(
diff --git a/lib/data/models.dart b/lib/data/models.dart
index cce9a7c6..0d67a791 100644
--- a/lib/data/models.dart
+++ b/lib/data/models.dart
@@ -208,7 +208,6 @@ class Sample {
     bandSleepState: bandSleepState,
   );
 
-  bool get wristOn => hr > 0;
   bool get hasDecodedOneHz =>
       ax != null &&
       ay != null &&
diff --git a/lib/data/observation.dart b/lib/data/observation.dart
new file mode 100644
index 00000000..25f92749
--- /dev/null
+++ b/lib/data/observation.dart
@@ -0,0 +1,95 @@
+// observation.dart — the type for a number OpenStrap did not compute.
+//
+// Deliberately NOT `Metric`. `Metric` carries `tier`, `confidence` and
+// `inputs_used`, and every one of those is a statement about OUR method: which
+// published algorithm ran, over which inputs, with how much of the window
+// present. A vendor's Body Battery has no method we can describe, a typed-in
+// mood has none at all, and an Apple Health step count has someone else's.
+// Giving any of them a tier would be inventing a provenance claim.
+//
+// Lives in `edge/` on purpose. `analytics/` never sees this type — it stays
+// device-blind and computes only from raw signal (OBSERVATION_SPEC §4).
+//
+// NAME COLLISION, on purpose and worth knowing about: `ui2/grammar.dart` also
+// declares an `Observation` — the clinician-worthy-pattern CARD. No file
+// imports both today. A file that ever needs both must prefix one import;
+// renaming either would be worse, because both names are the right word for
+// what they are.
+
+import 'day_label.dart' show dayLabelOf;
+
+/// Where an observation came from — the `observation.source_kind` column.
+///
+/// An enum rather than a bare string because this value is part of the row's
+/// identity (it is in the unique index), so a typo does not fail, it forks the
+/// row into a second one that never collides with the first.
+///
+/// NOT derivable from the other fields, which is why it is carried explicitly:
+/// an imported Apple Health step count and a typed-in mood both fill [key] and
+/// leave [vendorKey] null, and they are not the same kind of thing.
+enum ObservationSource {
+  /// The band computed it on-device and shipped the conclusion.
+  vendor,
+
+  /// The user typed it in — food, a workout, mood, water.
+  entered,
+
+  /// Another app's history, adopted wholesale (Apple Health, a Takeout).
+  imported,
+}
+
+/// One scalar OpenStrap stores but did not derive.
+///
+/// Exactly one of [key] and [vendorKey] identifies the row, and at least one
+/// MUST be set — the storage layer's unique index is built on
+/// `COALESCE(vendor_key, key)` and a row with neither has no identity at all.
+///
+/// The split is the whole point, and it is the rule that stops `readiness`
+/// meaning three different algorithms depending on which band was worn:
+///
+///  * [key] — OUR vocabulary, and ONLY for a **comparable quantity**: the same
+///    physical thing measured a different way (steps, sleep duration, resting
+///    HR).
+///  * [vendorKey] — THEIR name, verbatim, forever, for a **proprietary
+///    composite** (Body Battery, PAI, Recovery %, a sleep score). Mapping one
+///    of those onto one of our keys is the worst available mistake here.
+class Observation {
+  const Observation({
+    required this.sourceKind,
+    required this.value,
+    required this.attribution,
+    required this.at,
+    this.key,
+    this.vendorKey,
+    this.unit,
+  }) : assert(
+         key != null || vendorKey != null,
+         'an observation with neither key nor vendorKey has no identity',
+       );
+
+  /// Our vocabulary — comparable quantities only. Null for a composite.
+  final String? key;
+
+  /// Their name, verbatim. Null for anything that is not a vendor's own.
+  final String? vendorKey;
+
+  final num value;
+
+  /// Free text, as the vendor states it ('%', 'steps', 'bpm'). Null when the
+  /// number is unitless — a sleep score out of 100 is not a measurement of
+  /// anything and inventing a unit for it would imply it was.
+  final String? unit;
+
+  /// What the user sees next to the number: 'Amazfit', 'you', 'Apple Health'.
+  /// A value without this is not renderable — the whole product posture for a
+  /// `reports` device is that their number is shown as theirs.
+  final String attribution;
+
+  final DateTime at;
+
+  /// The LOCAL calendar day this observation belongs to — the same day model
+  /// every other table is keyed by, via the one helper that gets DST right.
+  String get date => dayLabelOf(at);
+
+  final ObservationSource sourceKind;
+}
diff --git a/lib/health/health_export.dart b/lib/health/health_export.dart
index a9609565..874a7158 100644
--- a/lib/health/health_export.dart
+++ b/lib/health/health_export.dart
@@ -1009,9 +1009,30 @@ class HealthExporter {
       hrRows = await db.rawQuery(
         'SELECT (rec_ts / 60) * 60 AS minute_ts, AVG(hr) as avg_hr '
         'FROM decoded_onehz '
-        // Band rows only (`source IS NULL`): what we write to HealthKit as
-        // OpenStrap's measurement must be OpenStrap's measurement.
-        'WHERE rec_ts >= ? AND rec_ts < ? AND hr > 0 AND source IS NULL '
+        // THE BAND'S OWN SECONDS, AND DELIBERATELY NOT `derivableSourceSql()`.
+        //
+        // This is the one read in the app where a wider predicate would be
+        // wrong even for a VERIFIED sensor, and it is the same argument the
+        // steps block below makes: a sample that lands in Apple Health or
+        // Health Connect carries no qualifier, no source seam and no way for
+        // the user to unpick it later. Every other app on the device then
+        // treats it as one continuous series measured one way.
+        //
+        // A chest strap's HR under the same identity as the wrist's is exactly
+        // the systematic-difference blending this project refuses everywhere
+        // else (ASSUMPTIONS D2) — except that here the blend happens inside a
+        // system store we do not own and cannot correct. Deleting our prior
+        // samples for the window (which this exporter already does on every
+        // re-derive) is the only reversal available, and it is ours to run, not
+        // the user's.
+        //
+        // So: no external sensor's HR is written to the OS health store, ever,
+        // whatever its verification tier. If a sensor's readings should reach
+        // HealthKit, that sensor's own app is the honest writer of them. A
+        // separate per-source export identity is the only thing that would
+        // change this call, and it needs a decision (F5-shaped) rather than a
+        // predicate.
+        'WHERE rec_ts >= ? AND rec_ts < ? AND hr > 0 AND $kPrimaryBandSourceSql '
         'GROUP BY minute_ts',
         [startTs, endTs],
       );
diff --git a/lib/state/app_state.dart b/lib/state/app_state.dart
index bd345238..53087434 100644
--- a/lib/state/app_state.dart
+++ b/lib/state/app_state.dart
@@ -32,7 +32,7 @@ import '../models/app_status.dart';
 import '../ble/accessory_setup.dart';
 import '../ble/android_background.dart';
 import '../ble/ble_engine.dart';
-import '../ble/hr_sensor.dart';
+import '../ble/hrs_link.dart';
 import '../ble/live_cadence.dart';
 import '../ble/live_step_runs.dart';
 import '../ble/ble_state.dart'
@@ -246,6 +246,10 @@ class AppState extends ChangeNotifier {
   /// cleanDeviceLabel/Prefs work in [_onEngineState].
   String? _lastSeenStrapNameRaw;
 
+  /// Band id last seen from the engine — change-gates the `device.adapter_id`
+  /// write in [_onEngineState].
+  String? _lastSeenGeneration;
+
   /// Minute-of-day last checked by [_maybeWarnOvernightBattery]'s clock
   /// pre-gate (it runs off the ~1 Hz engine-state pipeline).
   int? _lastForecastGateMin;
@@ -274,6 +278,29 @@ class AppState extends ChangeNotifier {
 
   bool get isPaired => paired != null;
 
+  /// Sensors paired ALONGSIDE the primary band — a chest strap, a ring.
+  ///
+  /// Raw `device` rows, minus the primary. Not `PairedDevice`: that type is the
+  /// one band the offload engine drives, and it holds a serial, a trim cursor
+  /// and a restore identity none of which a notify-class sensor has. These rows
+  /// are the whole of what a sensor is (`id`, `adapter_id`, `remote_id`,
+  /// `label`, `tier`), and `id` is the `device_id` its measurements carry.
+  ///
+  /// Read once at startup and after a pair or a forget — a `device` row only
+  /// changes when the user changes it, so nothing polls this.
+  List<Map<String, Object?>> _sensors = const [];
+  List<Map<String, Object?>> get sensors => _sensors;
+
+  /// Re-read the sensor rows. Call after pairing or forgetting one.
+  Future<void> refreshSensors() async {
+    final rows = await LocalDb.deviceRows();
+    _sensors = [
+      for (final r in rows)
+        if (r['id'] != LocalDb.kPrimaryDeviceId) r,
+    ];
+    notifyListeners();
+  }
+
   static const Duration _backfillInterval = Duration(minutes: 10);
 
   // ── local profile (was server-side; now device-local) ───────────────────────
@@ -2089,6 +2116,7 @@ class AppState extends ChangeNotifier {
 
   Future<void> _initSteps() async {
     paired = await PairedDevice.load();
+    await refreshSensors();
     await _loadProfile();
     await _refreshNightlyRhr();
     await _deriveScheduler.init();
@@ -3287,6 +3315,16 @@ class AppState extends ChangeNotifier {
     // _widgetBattName below): this handler fires ~1 Hz during live HR, and
     // cleanDeviceLabel's regex work per tick is pure waste when the name
     // hasn't moved.
+    // WHICH band this is, the moment the link says so — service discovery is
+    // the only place it is ever known, and `_persistPaired` runs before any
+    // session exists. Without this `device.adapter_id` (schema 49) is
+    // structurally blank for everyone who paired once, and every per-family
+    // metric abstains for a reason that is our bookkeeping, not the band's.
+    // Change-gated: this handler fires ~1 Hz during live HR.
+    if (s.generation != null && s.generation != _lastSeenGeneration) {
+      _lastSeenGeneration = s.generation;
+      unawaited(LocalDb.upsertDevice(adapterId: s.generation));
+    }
     if (s.strapName != _lastSeenStrapNameRaw) {
       _lastSeenStrapNameRaw = s.strapName;
       final nm = cleanDeviceLabel(s.strapName);
@@ -3699,7 +3737,18 @@ class AppState extends ChangeNotifier {
   }
 
   Future<void> _persistPaired(String remoteId, String? serial) async {
-    await PairedDevice.save(remoteId, serial ?? device.serial);
+    // Which band this is, if the link has already said. Passed HERE and not at
+    // the two call sites (`pairWith`, `pairViaAccessorySetup`) so neither can
+    // forget it — and COALESCE'd inside `upsertDevice`, so a null leaves
+    // whatever the row already knows.
+    //
+    // It is null on a FIRST pair, always: `DeviceState.generation` is only set
+    // at service discovery and pairing runs before any session exists. That is
+    // why `_onEngineState` stamps it too — this line alone would leave
+    // `device.adapter_id` blank on every install that pairs once and never
+    // re-pairs.
+    await PairedDevice.save(remoteId, serial ?? device.serial,
+        adapterId: device.generation);
     paired = await PairedDevice.load();
     // Now that there's a band to alert about, ask for notification permission
     // (a natural moment; battery/charging alerts depend on it). Best-effort.
@@ -3754,6 +3803,15 @@ class AppState extends ChangeNotifier {
     // inherits the forgotten one's name, serial, generation and bond verdicts.
     device.reset();
     Prefs.setString(_kStrapName, '');
+    // AND THE CHANGE GATES THAT GUARD WHAT THOSE TWO LINES JUST CLEARED. Both
+    // are per-tick caches in [_onEngineState], and both compare against the
+    // OLD band: pair a second band that reports the same generation and the
+    // `device.adapter_id` write is skipped, leaving the new pairing's adapter
+    // structurally blank (schema 49) and every per-family metric abstaining for
+    // a reason that is our bookkeeping. Same for a same-named band and the
+    // strap-name pref this method just emptied.
+    _lastSeenGeneration = null;
+    _lastSeenStrapNameRaw = null;
     paired = null;
     notifyListeners();
   }
@@ -5110,7 +5168,7 @@ class AppState extends ChangeNotifier {
     unawaited(_maybeStartRouteTracking(id, type));
     // A paired heart-rate sensor is armed by a workout and only by a workout —
     // the same rule GPS follows. No-op when nothing is paired.
-    unawaited(HrSensorLink.instance.arm(id));
+    unawaited(HrsLink.instance.arm());
   }
 
   /// Why route tracking is NOT running for the current route-eligible workout
@@ -5295,7 +5353,7 @@ class AppState extends ChangeNotifier {
           // rows (`id` is unchanged), so the pre-restart part of the route is
           // kept and the gap shows honestly as a segment break.
           unawaited(_maybeStartRouteTracking(id, activeWorkout!.type));
-          unawaited(HrSensorLink.instance.arm(id));
+          unawaited(HrsLink.instance.arm());
           _deriveScheduler.setWorkoutActive(true);
           ScreenWake.enable();
         } else {
@@ -5332,7 +5390,7 @@ class AppState extends ChangeNotifier {
     // would otherwise leave the screen pinned awake until the app is killed.
     // AWAITED, like the route tail: an unawaited disarm races the finish screen
     // and the last buffered batch of sensor beats never reaches the database.
-    await HrSensorLink.instance.disarm();
+    await HrsLink.instance.disarm();
     ScreenWake.release();
     _deriveScheduler.setWorkoutActive(false);
     final w = activeWorkout!;
@@ -5447,7 +5505,7 @@ class AppState extends ChangeNotifier {
     }
     // AWAITED, like the route tail: an unawaited disarm races the finish screen
     // and the last buffered batch of sensor beats never reaches the database.
-    await HrSensorLink.instance.disarm();
+    await HrsLink.instance.disarm();
     ScreenWake.release();
     _deriveScheduler.setWorkoutActive(false);
     activeWorkout = null;
diff --git a/lib/sync/background_sync.dart b/lib/sync/background_sync.dart
index 5ede10cf..9c6d8793 100644
--- a/lib/sync/background_sync.dart
+++ b/lib/sync/background_sync.dart
@@ -18,6 +18,7 @@ import 'package:flutter/widgets.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 
 import '../ble/ble_engine.dart';
+import '../ble/oura_link.dart';
 import '../compute/derivation_engine.dart';
 import '../compute/profile.dart';
 import '../data/db.dart';
@@ -145,6 +146,17 @@ Future<bool> runHeadlessSync({BandLease? lease}) async {
       '(${BandOwnership.debugState})',
     );
     BandOwnership.release(ownedLease);
+    // Piggyback the ring on the same OS wake window, after the band work is
+    // fully done so it can never delay or interfere with WHOOP's own timing.
+    // OuraLink.sync() already no-ops when nothing is paired and never throws,
+    // but this is the one shared headless entry point (every wake source
+    // funnels through runHeadlessSync via HeadlessSyncGate) so a failure here
+    // must not be allowed to escape and mark the WHOOP cycle as errored.
+    try {
+      await OuraLink.instance.sync();
+    } catch (e) {
+      debugPrint('[bgsync] oura sync skipped: $e');
+    }
   }
 }
 
diff --git a/lib/sync/paired_device.dart b/lib/sync/paired_device.dart
index a82d43b7..408be6da 100644
--- a/lib/sync/paired_device.dart
+++ b/lib/sync/paired_device.dart
@@ -1,12 +1,38 @@
-// PairedDevice — the LOCAL record of the band the user paired (BLE remote id +
-// optional serial). Persisted so we auto-reconnect on every launch.
+// PairedDevice — the LOCAL record of the band the user paired.
 //
-// LOCAL ONLY — there is no server, no device table. This survived the cloud
-// excision (it used to live alongside BackendConfig/Session in sync/config.dart,
-// both of which were deleted).
+// LOCAL ONLY — there is no server. This survived the cloud excision (it used to
+// live alongside BackendConfig/Session in sync/config.dart, both deleted).
+//
+// IT IS A TABLE NOW, not two SharedPreferences scalars. Prefs could hold
+// exactly one band, carried no state beside the id, and could not be joined to
+// anything — while `decoded_onehz` / `decoded_rr` / `samples` have been keyed
+// by `device_id` since schema 47 with nothing on the other end of that key.
+// The `device` table (schema 49) is that other end, and it can hold N rows.
+//
+// THE PREFS PAIR IS KEPT AS A MIRROR OF THE PRIMARY BAND, deliberately:
+//  * The table lives in a database that can be quarantined and rebuilt
+//    (`_openOrRebuild`) and that "Delete everything" empties. Losing a band's
+//    identity to either of those means the user has to re-pair for no reason
+//    they can see.
+//  * `load()` is the FIRST line of app start-up, so the fallback is also the
+//    thing that heals it: a table with no primary row and a mirror that has one
+//    puts the row back.
+// The table WINS whenever it has the row, so there is no ambiguity about which
+// is authoritative — the mirror only ever answers when the table is silent.
+//
+// ponytail: the mirror carries the PRIMARY only. A second device lives in the
+// table alone and does not survive a rebuild; give it its own mirror the day
+// one can actually be paired, or stop rebuilding databases.
 
 import 'package:shared_preferences/shared_preferences.dart';
 
+import '../data/db.dart';
+
+/// The `SourceTier` a wrist band sits on (the enum name in
+/// `ui2/profile/devices.dart` — measurement quality, which is the only thing
+/// that decides precedence between two sources).
+const String kBandSourceTier = 'wristOptical';
+
 /// The band the user paired. Persisted so we auto-reconnect on every launch.
 class PairedDevice {
   static const String _kRemoteId = 'paired_remote_id';
@@ -17,18 +43,48 @@ class PairedDevice {
   PairedDevice(this.remoteId, this.serial);
 
   static Future<PairedDevice?> load() async {
+    final row = await LocalDb.deviceRow();
+    final id = row?['remote_id'] as String?;
+    if (id != null && id.isNotEmpty) {
+      // Sanitize on read: drop any garbled value (e.g. "?*" junk persisted by
+      // an older build's HELLO content-scan) so it can never reach the UI.
+      return PairedDevice(id, cleanDeviceLabel(row?['label'] as String?));
+    }
+    // No row: either this install predates the table, or the database was
+    // rebuilt/wiped under a band that is still paired. Same repair either way —
+    // the prefs mirror is the only other copy, and putting it back IS the
+    // migration. A user mid-upgrade never re-pairs.
     final prefs = await SharedPreferences.getInstance();
-    final id = prefs.getString(_kRemoteId);
-    if (id == null || id.isEmpty) return null;
-    // Sanitize on read: drop any garbled value (e.g. "?*" junk persisted by an
-    // older build's HELLO content-scan) so it can never reach the UI.
-    return PairedDevice(id, cleanDeviceLabel(prefs.getString(_kSerial)));
+    final mirrored = prefs.getString(_kRemoteId);
+    if (mirrored == null || mirrored.isEmpty) return null;
+    final serial = cleanDeviceLabel(prefs.getString(_kSerial));
+    await LocalDb.upsertDevice(
+      remoteId: mirrored,
+      label: serial,
+      tier: kBandSourceTier,
+    );
+    return PairedDevice(mirrored, serial);
   }
 
-  static Future<void> save(String remoteId, String? serial) async {
+  /// Persist the primary band. [adapterId] is the registry's `BandEntry.id`
+  /// (`gen4` / `gen5`) when the link has said which band this is — omitted, it
+  /// leaves whatever the row already knows rather than blanking it, and a row
+  /// that has never been told keeps NULL, which every per-family metric reads
+  /// as a refusal instead of assuming gen4.
+  static Future<void> save(
+    String remoteId,
+    String? serial, {
+    String? adapterId,
+  }) async {
+    final clean = cleanDeviceLabel(serial);
+    await LocalDb.upsertDevice(
+      adapterId: adapterId,
+      remoteId: remoteId,
+      label: clean,
+      tier: kBandSourceTier,
+    );
     final prefs = await SharedPreferences.getInstance();
     await prefs.setString(_kRemoteId, remoteId);
-    final clean = cleanDeviceLabel(serial);
     if (clean != null) {
       await prefs.setString(_kSerial, clean);
     } else {
@@ -36,7 +92,11 @@ class PairedDevice {
     }
   }
 
+  /// Forget the primary band. BOTH copies, or the mirror puts it straight back
+  /// on the next launch — and the measurements it wrote are untouched, which is
+  /// what the forget dialog promises.
   static Future<void> clear() async {
+    await LocalDb.deleteDevice();
     final prefs = await SharedPreferences.getInstance();
     await prefs.remove(_kRemoteId);
     await prefs.remove(_kSerial);
diff --git a/lib/sync/sync_policy.dart b/lib/sync/sync_policy.dart
index 9a49c8c5..00aaccfc 100644
--- a/lib/sync/sync_policy.dart
+++ b/lib/sync/sync_policy.dart
@@ -16,7 +16,52 @@ import 'dart:math' as math;
 const int kBackfillIntervalSeconds = 900; // re-offload every 15 min (periodic)
 const int kKeepAliveIntervalSeconds =
     30; // re-arm realtime, poll battery, watchdog
+/// How long an open offload burst may sit silent before its un-committed chunk
+/// is abandoned (`BleEngine._armIdleWatchdog` → `DrainController.discardOpenChunk`).
+///
+/// ASSUMES: a healthy transfer never pauses this long, and abandoning the open
+/// chunk costs nothing because the band re-delivers it on the next offload.
+/// Both halves are WHOOP's flash-and-trim model — a draining band emits records
+/// back-to-back, and un-ACKed flash is kept by contract.
+/// FALSIFIED BY: any source whose NORMAL transfer pauses longer — a
+/// fetch-by-range device answering one page per request, a rate-limited
+/// transport, a band that idles between stored sessions inside one transfer.
+/// WHEN WRONG: every attempt discards its own work and restarts, so the device
+/// makes ZERO forward progress, permanently. The per-session retry cap
+/// (`_maxHistoricalRetriesPerSession`) only hands the same loop to the
+/// reconnect path; nothing counts it across sessions and nothing tells the
+/// user. It is at least LOUD — `[SYNC] idle watchdog` is logged on every
+/// expiry — so it is a stall findable in a log, not a silent one.
+/// HOW TO CHECK: two `[SYNC] idle watchdog` lines with no durable commit
+/// between them, repeating across reconnects.
+// ponytail: one timeout for every source, sized for WHOOP's continuous drain.
+// Upgrade path = the adapter declares its own maximum healthy inter-frame pause
+// AND whether an abandoned chunk is re-delivered at all. The cross-session
+// escalation to hang the "this keeps happening" report on already exists
+// ([NoDurableProgressEscalation]); the discard path just does not feed it.
+// Until both exist, do not point a slower source at this drain.
 const int kBackfillIdleTimeoutSeconds = 60; // strap went silent mid-offload
+
+/// Silence past which an ACTIVE session tears itself down (`_keepAliveFire`).
+///
+/// ASSUMES: a healthy link always produces inbound traffic inside two minutes.
+/// On WHOOP that holds only because WE manufacture the traffic — the 30 s
+/// keep-alive forces a GET_BATTERY_LEVEL once silence passes
+/// [kNoStreamPollSilenceSeconds] (or half this fuse, with a live stream armed).
+/// So the fuse measures "did our own poll come back", not "is this band alive".
+/// FALSIFIED BY: a source with no cheap pollable characteristic, or one that
+/// legitimately says nothing between readings — a fetch-by-range band, a sensor
+/// that notifies only on a detected beat.
+/// WHEN WRONG: the link is bounced every two minutes forever, each bounce
+/// costing a reconnect and re-handshake, so the device may never stay up long
+/// enough to transfer anything.
+/// HOW TO CHECK: `No data for >120s — bouncing the link.` repeating on a ~2 min
+/// cadence with no error between the bounces.
+// ponytail: the fuse and the keep-alive poll that satisfies it are ONE
+// mechanism, and both are WHOOP-shaped. Upgrade path = the adapter declares the
+// interval at which a healthy link of its kind produces inbound traffic (none =
+// no fuse) and what to poll to provoke it. [isLinkStale] already has the right
+// shape — one bar per traffic mode — it just cannot know a second band's modes.
 const int kLivenessFuseSeconds = 120; // no data for >fuse ⇒ bounce the link
 // Every existing RTC recheck is symptom-triggered (drift detected on the ONE
 // GET_CLOCK read at connect, or a defensive SET_CLOCK on StuckStrapDetector
@@ -70,6 +115,22 @@ bool isLinkStale(Duration sinceLastRx, {bool liveStreamArmed = true}) =>
     (liveStreamArmed ? kLinkFreshnessSeconds : kLinkFreshnessNoStreamSeconds);
 
 // ── plausibility gates (unix seconds) ────────────────────────────────────────
+/// ASSUMES: every source stamps records with an ABSOLUTE wall-clock epoch, so a
+/// value under the 2023-11 floor is junk — an unset RTC, a previous owner's
+/// garbage, a misread offset. True of WHOOP, which carries a settable RTC.
+/// FALSIFIED BY: a source whose time base is uptime-since-boot, a sequence
+/// number, or milliseconds — each lands permanently under the floor.
+/// WHEN WRONG: every record is refused. Nothing is LOST (`TrimAckPolicy`
+/// correctly refuses the trim on a drop-only burst, so the band keeps its
+/// flash) but nothing is stored either, and the same chunk is re-delivered
+/// forever. [RecordGate.timeBaseNotWallClock] is what makes that case tellable
+/// from a transient wandering clock, which looks identical at the gate.
+/// HOW TO CHECK: `gate_dropped_total` climbing while `records_seen` stays flat,
+/// with `RecordGate.droppedBelowFloor == RecordGate.dropped`.
+// ponytail: an absolute floor, so a relative time base cannot be rescued here
+// at all. Upgrade path = the adapter supplies an epoch ANCHOR (the wall time
+// its zero corresponds to) and converts BEFORE the gate; the gate itself stays
+// absolute, which is the only reason it can still reject a wandering RTC.
 const int kMinPlausibleUnix = 1700000000; // 2023-11 floor
 const int kFutureMargin = 86400; // +1 day
 const int kSessionRangeMargin =
diff --git a/lib/ui2/profile/devices.dart b/lib/ui2/profile/devices.dart
index 1daa90f0..41c48268 100644
--- a/lib/ui2/profile/devices.dart
+++ b/lib/ui2/profile/devices.dart
@@ -10,15 +10,30 @@
 // recency only breaks a tie within a tier. There is no user preference and the
 // screen no longer claims one — no control ever set an order.
 //
-// A tier is drawn when something in it exists or could be paired today. Tier 1
-// is neither: there is no BLE Heart Rate Service client anywhere in the tree,
-// so drawing an empty "beat-to-beat" rung sent people hunting for a chest
-// strap pairing path that does not exist.
+// TWO BUCKETS AND ONLY TWO: what is measuring, and what is NOT YET — the
+// second with a reason and a PERMANENCE beside it. "Not yet" without a
+// permanence becomes a lie by slow motion: "no, an iPhone has no ANT radio" is
+// a different statement from "not yet, a few weeks". There is deliberately no
+// third "imported" tier; bringing a history in is data adoption, not device
+// support, and it never appears on a compatibility list.
+//
+// A tier rung is drawn when something in it exists. Tier 1 is now reachable —
+// a standard Bluetooth heart-rate sensor can be paired from this screen — so it
+// is no longer named in the NOT YET list. What it CANNOT do is stated on the
+// sensor's own row instead: it captures beats during a workout and nothing
+// derives from it yet, because no one on this project has held one
+// (ASSUMPTIONS R6).
 
 import 'package:flutter/material.dart';
+import 'package:flutter_blue_plus/flutter_blue_plus.dart'
+    show BluetoothDevice;
 import 'package:lucide_icons_flutter/lucide_icons.dart';
 import 'package:provider/provider.dart';
 
+import '../../ble/adapters/_registry.dart'
+    show BandEntry, kBandRegistry, kBleHrs, kOura;
+import '../../ble/hrs_link.dart' show HrsLink, HrsReading;
+import '../../ble/oura_link.dart' show OuraLink, pairOuraRing;
 import '../../ble/ble_state.dart' show BandStatus;
 import '../../data/db.dart' show LocalDb;
 import '../../notify/battery_forecast.dart';
@@ -27,6 +42,7 @@ import '../../state/app_state.dart';
 import '../onboarding/pairing.dart';
 import '../onboarding/profile_setup.dart' show formatDay;
 import '../ui2.dart';
+import 'pair_sensor.dart' show PairSensorScreen;
 import 'profile.dart';
 import 'settings.dart' show backToRoot;
 
@@ -65,10 +81,85 @@ enum SourceTier {
   final Color accent;
 }
 
+/// This band's name, from the registry entry that decodes it — never asserted.
+///
+/// The two call sites here and in `day_steps.dart` both used to be
+/// `generation == 'gen5' ? 'WHOOP 5' : 'WHOOP 4'`, which does not name a band,
+/// it ASSERTS one: every future adapter, every imported day and every row
+/// banked before the family stamp existed was published as a WHOOP 4. Null is
+/// the honest answer for all of those, and every caller has a word for it.
+String? bandLabelFor(String? adapterId) {
+  if (adapterId == null || adapterId.isEmpty) return null;
+  for (final e in kBandRegistry) {
+    if (e.id == adapterId) return e.label;
+  }
+  return null;
+}
+
+/// Bands the owner has personally held and cross-confirmed. Everything else is
+/// publicly EXPERIMENTAL, however well its fixtures pass — a fixture proves
+/// determinism and physiological sanity, never correctness, and a decoder with
+/// a 2× scale error reads a resting 50 bpm as 100 and passes every generic
+/// bound. Hardware in his hands is the only promotion path.
+///
+/// ponytail: a const set here until the CODEOWNERS-gated `_verified.dart`
+/// exists (ASSUMPTIONS E5). Move it there and delete this — it must never
+/// become a CI rule, which would hand the key to the PR author.
+const Set<String> kOwnerConfirmedBandIds = {'gen4', 'gen5'};
+// gen5 promoted 2026-08-23: WHOOP 5 worn by the owner, paired, connected,
+// live HR streaming, and a full historical drain completed (the trim token
+// reached `sync_cursor`, so the band was told it may release that flash).
+// 249,596 decoded seconds and 151,595 beats stamped `device_family='gen5'`
+// on his own export. That is the promotion path in ASSUMPTIONS E5 — hardware
+// in his hands — not a fixture passing.
+
+/// A device family this app does NOT speak today, and why.
+///
+/// [permanence] is the load-bearing half. It is a plain phrase, never a date —
+/// "being built" and "not a matter of time" are different promises and a user
+/// is owed the difference.
+class NotYet {
+  final String name, reason, permanence;
+  final IconData icon;
+  const NotYet(this.name, this.reason, this.permanence, this.icon);
+}
+
+/// The honest other half of this screen.
+///
+/// Short on purpose: a list gets checked, and every row on it is a claim
+/// someone can hold us to. These three are the ones already decided.
+const List<NotYet> kNotYet = [
+  NotYet(
+    'Polar 360 and Loop',
+    'Screenless, no subscription, worn around the clock, with beat-to-beat '
+        'intervals the vendor documents. Nobody has written the driver.',
+    'Planned',
+    LucideIcons.watch,
+  ),
+  NotYet(
+    'Fitbit, Withings, Xiaomi and Zepp bands',
+    'Their pairing key is issued by the vendor’s own server. A driver would '
+        'work only while their app stayed installed and signed in, and would '
+        'stop the day they changed it — so the band would be ours to support '
+        'and theirs to switch off.',
+    'Not a matter of time',
+    LucideIcons.cloudOff,
+  ),
+];
+
 /// One thing that can produce measurements.
 class HealthSource {
   final String name, kind;
-  final SourceTier tier;
+
+  /// Where this source sits on the quality ladder, or NULL when it has no
+  /// place on it.
+  ///
+  /// Null is not "unknown", it is "none". The Oura ring is the case: it holds
+  /// a pairing key, drains history and banks every frame it is sent, and it
+  /// supplies no decoded signal at all (`OuraAdapter.signals` is `const {}`),
+  /// so there is no measurement quality to rank. Filing it under the phone's
+  /// rung would have told someone their ring was reporting steps.
+  final SourceTier? tier;
   final IconData icon;
   final bool connected;
 
@@ -79,14 +170,37 @@ class HealthSource {
   final bool charging;
   final DateTime? lastData;
 
-  /// True for the paired band — the only source with device controls.
+  /// True for the PRIMARY band — the only source the offload engine drives,
+  /// and the only one with band controls (rename, find, battery forecast).
+  ///
+  /// FALSE for a paired sensor, deliberately. A chest strap is a better beat
+  /// detector than the band and a worse everything-else: it measures nothing
+  /// while a workout is not running. Letting one satisfy `hasBand` would take
+  /// the "No band is paired" card off a screen belonging to someone whose
+  /// sleep, recovery and temperature are all still abstaining.
   final bool isBand;
 
+  /// The `device` row this source is, for a paired sensor. Null for the
+  /// primary band (whose row is `LocalDb.kPrimaryDeviceId`, `''`) and for the
+  /// phone. It is the `device_id` every measurement this source wrote carries,
+  /// which is what makes forgetting it possible without touching the data.
+  final String? deviceId;
+
   /// The ingest-stamped sensor family (`'gen4'` / `'gen5'`), or null when the
   /// link has not said yet. Not cosmetic: it is the key every sensor-dependent
   /// metric looks its own constants up under, and null is a refusal.
   final String? family;
 
+  /// Publicly EXPERIMENTAL — this band is decoded but the owner has never held
+  /// one (see [kOwnerConfirmedBandIds]). Not a quality tier and not a
+  /// confidence: it says who has checked, not how good the numbers are.
+  /// NOT gated on [isBand]. A paired sensor is the case this exists for — it
+  /// is the one nobody here has held — and requiring `isBand` would have hidden
+  /// the label on exactly those rows while showing it on the band the owner
+  /// wears daily.
+  bool get experimental =>
+      family != null && !kOwnerConfirmedBandIds.contains(family);
+
   const HealthSource({
     required this.name,
     required this.kind,
@@ -98,6 +212,7 @@ class HealthSource {
     this.charging = false,
     this.lastData,
     this.isBand = false,
+    this.deviceId,
     this.family,
   });
 }
@@ -114,40 +229,66 @@ class HealthSource {
 /// is calibrated per sensor.
 (String value, String sub)? calibrationDisclosure(HealthSource s) {
   if (!s.isBand) return null;
-  return switch (s.family) {
-    'gen4' => (
-        'WHOOP 4',
-        'Metrics that depend on the sensor use this band’s own constants, so '
-            'a WHOOP 4 and a WHOOP 5 can land on different tiers for the same '
-            'physiology.'
-      ),
-    'gen5' => (
-        'WHOOP 5',
-        'Metrics that depend on the sensor use this band’s own constants, so '
-            'a WHOOP 5 and a WHOOP 4 can land on different tiers for the same '
-            'physiology.'
-      ),
-    // Null is the honest majority case, not an error: every row banked before
-    // the stamp existed, every import and every raw replay carries no family,
-    // and those metrics abstain rather than borrow gen4's numbers.
-    _ => (
-        'Not stated yet',
-        'This band has not said which generation it is, and imported or older '
-            'days never will. Metrics that depend on the sensor abstain rather '
-            'than borrow another band’s numbers.'
-      ),
-  };
+  final label = bandLabelFor(s.family);
+  if (label != null) {
+    return (
+      label,
+      'Metrics that depend on the sensor use this band’s own constants, so two '
+          'different bands can land on different tiers for the same physiology.'
+    );
+  }
+  // Null is the honest majority case, not an error: every row banked before
+  // the stamp existed, every import and every raw replay carries no family,
+  // and those metrics abstain rather than borrow gen4's numbers. A family this
+  // build has no registry entry for lands here too — an unknown band is not a
+  // WHOOP 4.
+  return (
+    'Not stated yet',
+    'This band has not said which generation it is, and imported or older '
+        'days never will. Metrics that depend on the sensor abstain rather '
+        'than borrow another band’s numbers.'
+  );
+}
+
+/// The glyph for a paired sensor. A ring is not a chest strap and the row is
+/// the only place a user can tell two paired sensors apart at a glance.
+IconData sensorIcon(String? adapterId) => switch (adapterId) {
+      'oura' => LucideIcons.circleDot,
+      _ => LucideIcons.heartPulse,
+    };
+
+/// The tier named by a `device.tier` column, or null when the column is blank
+/// or holds a name this build does not have.
+///
+/// Null is a refusal, the same way a null `adapter_id` is: a row written by a
+/// future version naming a rung this build cannot draw must not be quietly
+/// filed under the nearest one it knows.
+SourceTier? tierNamed(Object? name) {
+  for (final t in SourceTier.values) {
+    if (t.name == name) return t;
+  }
+  return null;
 }
 
 /// The sources that actually exist right now. Nothing is listed that cannot
-/// produce a number today.
-List<HealthSource> liveSources(AppState app) => [
+/// produce a number today — everything else is in [kNotYet], with its reason.
+///
+/// [sensorLive] is whether a paired sensor's link is up THIS INSTANT. It is
+/// passed in rather than read off `HrsLink` here because it changes on every
+/// beat: routing it through [AppState] would notify every listener in the app
+/// at 1 Hz for the duration of a workout, which is the rebuild storm this
+/// screen has already been fixed for once.
+List<HealthSource> liveSources(AppState app, {bool sensorLive = false}) => [
       if (app.isPaired)
         HealthSource(
-          name: app.strapName ?? 'WHOOP band',
-          kind: app.device.generation == 'gen5'
-              ? 'WHOOP 5 · wrist optical'
-              : 'WHOOP 4 · wrist optical',
+          name: app.strapName ?? 'Your band',
+          // The registry's own word for this band, or just what it is when the
+          // link has not said. Never an assertion that an unnamed band is a
+          // WHOOP 4.
+          kind: [
+            ?bandLabelFor(app.device.generation),
+            'wrist optical',
+          ].join(' · '),
           tier: SourceTier.wristOptical,
           icon: LucideIcons.watch,
           connected: app.isConnected,
@@ -158,6 +299,31 @@ List<HealthSource> liveSources(AppState app) => [
           isBand: true,
           family: app.device.generation,
         ),
+      // Sensors paired alongside the band. One row each, ranked by their own
+      // tier like everything else — a beat-to-beat strap sorts ABOVE the wrist
+      // band, which is the whole point of the ladder being quality-first.
+      for (final r in app.sensors)
+        HealthSource(
+          // The advertised name the user picked, then the registry's word for
+          // what it is. Never a placeholder — `cleanDeviceLabel` already
+          // refused anything junk at pairing.
+          name: (r['label'] as String?) ??
+              bandLabelFor(r['adapter_id'] as String?) ??
+              'Paired sensor',
+          kind: bandLabelFor(r['adapter_id'] as String?) ?? 'Unknown sensor',
+          // Null when the column is blank (a source with nothing to rank) or
+          // names a rung this build does not have. Either way it is a refusal,
+          // never the nearest rung we happen to know.
+          tier: tierNamed(r['tier']),
+          icon: sensorIcon(r['adapter_id'] as String?),
+          // `sensorLive` reflects HrsLink.reading ONLY — a live HRS session
+          // must not mark an unrelated paired Oura row as connected just
+          // because some sensor happens to be live right now.
+          connected: sensorLive && r['adapter_id'] == kBleHrs.id,
+          isBand: false,
+          deviceId: r['id'] as String?,
+          family: r['adapter_id'] as String?,
+        ),
       if (app.phoneStepsEnabled)
         HealthSource(
           name: 'This phone',
@@ -182,7 +348,9 @@ List<HealthSource> liveSources(AppState app) => [
 List<HealthSource> rankSources(List<HealthSource> sources) {
   final out = [...sources];
   out.sort((a, b) {
-    final byTier = a.tier.rank.compareTo(b.tier.rank);
+    // An unranked source sorts BELOW every ranked one — it is not competing
+    // for precedence, because it supplies nothing to compete with.
+    final byTier = (a.tier?.rank ?? 99).compareTo(b.tier?.rank ?? 99);
     if (byTier != 0) return byTier;
     final at = a.lastData, bt = b.lastData;
     if (at != null && bt != null && at != bt) return bt.compareTo(at);
@@ -201,8 +369,18 @@ class MyDevices extends StatelessWidget {
   @override
   Widget build(BuildContext c) {
     final app = c.watch<AppState>();
+    // The live reading is subscribed HERE and nowhere higher. It moves on every
+    // beat, so a listener on AppState would rebuild the whole app at 1 Hz for
+    // the length of a workout; this rebuilds one screen.
+    return ValueListenableBuilder<HrsReading?>(
+      valueListenable: HrsLink.instance.reading,
+      builder: (c, reading, _) => _build(c, app, reading != null),
+    );
+  }
+
+  Widget _build(BuildContext c, AppState app, bool sensorLive) {
     return MyDevicesView(
-      sources: rankSources(liveSources(app)),
+      sources: rankSources(liveSources(app, sensorLive: sensorLive)),
       // The band row's dot says connected or not. That covers six different
       // problems with six different fixes, and a user cannot fix a problem the
       // app will not name — so the engine's own verdict rides alongside it.
@@ -215,10 +393,74 @@ class MyDevices extends StatelessWidget {
       // months of data behind an onboarding screen), which makes this the only
       // way back to pairing. So push it.
       onPair: () => goto(c, const RePair()),
+      onAddSensor: () => addSensor(c),
     );
   }
 }
 
+/// Every sensor that can be paired from this screen — a second device
+/// alongside the band, never a replacement for it.
+///
+/// Data, not a switch statement, because the ONLY thing that differs between
+/// them is which entry the picker filters on and what has to happen once the
+/// user taps one. `PairSensorScreen` is generic over exactly that.
+final List<({BandEntry entry, String blurb, Future<String?> Function(BluetoothDevice)? pick})>
+    kPairableSensors = [
+  (
+    entry: kBleHrs,
+    blurb: 'A chest strap or armband. Beat timing measured electrically, '
+        'which a wrist pulse cannot match. Runs during a workout.',
+    // Null means the plain notify-class pairing, which is the whole of what a
+    // heart-rate sensor needs.
+    pick: null,
+  ),
+  (
+    entry: kOura,
+    blurb: 'Reads the ring directly, with no Oura account and no subscription. '
+        'The ring must be factory reset FIRST — one that is already set up in '
+        'the Oura app cannot be re-keyed.',
+    pick: pairOuraRing,
+  ),
+];
+
+/// Choose which kind of sensor to pair, then hand off to the pairing screen.
+Future<void> addSensor(BuildContext c) async {
+  final p = P.of(c);
+  final choice = await showModalBottomSheet<int>(
+    context: c,
+    backgroundColor: p.bg,
+    builder: (d) => SafeArea(
+      child: Column(mainAxisSize: MainAxisSize.min, children: [
+        const SizedBox(height: S.x4),
+        Padding(
+          padding: const EdgeInsets.symmetric(horizontal: S.x4),
+          child: Row(children: [
+            Text('Add a sensor', style: F.t2.copyWith(color: p.ink)),
+          ]),
+        ),
+        const SizedBox(height: S.x3),
+        for (var i = 0; i < kPairableSensors.length; i++)
+          SetRow(
+            sensorIcon(kPairableSensors[i].entry.id),
+            C.green,
+            kPairableSensors[i].entry.label,
+            sub: kPairableSensors[i].blurb,
+            onTap: () => Navigator.of(d).pop(i),
+          ),
+        const SizedBox(height: S.x4),
+      ]),
+    ),
+  );
+  if (choice == null || !c.mounted) return;
+  final sensor = kPairableSensors[choice];
+  await goto(
+    c,
+    PairSensorScreen(entry: sensor.entry, onPicked: sensor.pick),
+  );
+  // The screen writes a `device` row; nothing tells AppState that happened.
+  if (c.mounted) await c.read<AppState>().refreshSensors();
+}
+
 /// Pairing, pushed rather than gated.
 ///
 /// The onboarding gate is what used to take the pairing screen away once a
@@ -241,13 +483,18 @@ class RePair extends StatelessWidget {
 
 class MyDevicesView extends StatelessWidget {
   final List<HealthSource> sources;
-  final VoidCallback? onPair;
+  final VoidCallback? onPair, onAddSensor;
 
   /// The band's own state, from `bandStatusFor`. Null when nothing is paired.
   final BandStatus? status;
 
-  const MyDevicesView(
-      {super.key, this.sources = const [], this.onPair, this.status});
+  const MyDevicesView({
+    super.key,
+    this.sources = const [],
+    this.onPair,
+    this.onAddSensor,
+    this.status,
+  });
 
   @override
   Widget build(BuildContext c) {
@@ -299,6 +546,13 @@ class MyDevicesView extends StatelessWidget {
                   ),
                   if (sources.isNotEmpty) const SizedBox(height: S.x3),
                 ],
+                // LIVE — the first of the two buckets. Only drawn when there is
+                // something in it: a heading over nothing is the empty rung
+                // problem again, one level up.
+                if (sources.isNotEmpty) ...[
+                  Text('LIVE', style: F.over.copyWith(color: p.ink3)),
+                  const SizedBox(height: S.x3),
+                ],
                 for (final s in sources) ...[
                   SourceRow(s, onTap: () => goto(c, DeviceDetail(s))),
                   if (s.isBand && fault != null) ...[
@@ -309,16 +563,45 @@ class MyDevicesView extends StatelessWidget {
                   ],
                   const SizedBox(height: S.x3),
                 ],
+                // At the foot of LIVE, because that is what it adds to. Not
+                // gated on having a band: a sensor is a second source, and
+                // someone with no band at all is exactly who benefits most
+                // from being able to pair one.
+                if (onAddSensor != null)
+                  Surface(
+                    pad: const EdgeInsets.symmetric(horizontal: S.x4),
+                    child: SetRow(LucideIcons.plus, C.green, 'Add a sensor',
+                        sub: 'A heart-rate strap or a ring, alongside the band',
+                        onTap: onAddSensor),
+                  ),
+                // NOT YET — with a reason and a permanence on every row. The
+                // reason is the honest part; the permanence is the part that
+                // stops "not yet" quietly meaning "no" for two years.
+                const SizedBox(height: S.x5),
+                Text('NOT YET', style: F.over.copyWith(color: p.ink3)),
+                const SizedBox(height: S.x3),
+                Surface(
+                  pad: const EdgeInsets.symmetric(horizontal: S.x4),
+                  child: Column(children: [
+                    for (final n in kNotYet) ...[
+                      if (n != kNotYet.first) Divider(color: p.line, height: 1),
+                      SetRow(n.icon, C.orange, n.name,
+                          value: n.permanence, sub: n.reason, chevron: false),
+                    ],
+                  ]),
+                ),
                 const SizedBox(height: S.x5),
                 Text('THE QUALITY LADDER',
                     style: F.over.copyWith(color: p.ink3)),
                 const SizedBox(height: S.x3),
                 for (final t in SourceTier.values)
-                  // An empty rung is information only while the rung is
-                  // reachable. Nothing in this build can produce a tier-1
-                  // source, so it is drawn only if one somehow exists.
-                  if (t != SourceTier.beatToBeat ||
-                      sources.any((s) => s.tier == t)) ...[
+                  // Every rung is drawn now, filled or not. The tier-1 rung
+                  // used to be hidden because nothing could reach it and an
+                  // unreachable empty rung is just something to go hunting
+                  // for; "Add a sensor" above is how it is reached, so an
+                  // empty one is now a genuine invitation rather than a dead
+                  // end.
+                  ...[
                     TierRow(t, filled: sources.any((s) => s.tier == t)),
                     const SizedBox(height: S.x3),
                   ],
@@ -337,6 +620,18 @@ class MyDevicesView extends StatelessWidget {
 /// it is either handing steps over or it is not, which is exactly the failure
 /// the row used to hide behind a hardcoded "Connected".
 String sourceState(HealthSource s) {
+  // A PAIRED SENSOR IS TESTED FOR FIRST, before the tier is consulted at all.
+  // It is armed by a workout and only by a workout, so "not connected" is its
+  // resting state and not a fault — and a sensor whose tier could not be named
+  // falls back to the phone's rung, where this function would otherwise have
+  // told the user their chest strap was reporting steps.
+  if (s.deviceId != null) {
+    if (s.connected) return 'Streaming beats';
+    // A source with no rung supplies no signal, so there is nothing for a
+    // workout to arm and nothing being derived. Say that, rather than promise
+    // a stream that will never start.
+    return s.tier == null ? 'Paired · storing what it sends' : 'Waiting for a workout';
+  }
   if (s.tier == SourceTier.phone) {
     return s.connected ? 'Reporting steps' : 'No steps arriving';
   }
@@ -406,11 +701,18 @@ class SourceRow extends StatelessWidget {
                   Text('${battery.round()}%',
                       style: F.over.copyWith(color: p.ink3)),
                 ]),
+              // IN THE WRAP, not a second trailing pill: this line already
+              // wraps at accessibility sizes, and a pill column beside it does
+              // not. The band's own page carries the explanation.
+              if (s.experimental)
+                Text('Experimental',
+                    style: F.over.copyWith(color: p.on(C.orange))),
             ]),
           ]),
         ),
         const SizedBox(width: S.x2),
-        Pill('Tier ${s.tier.rank}', s.tier.accent),
+        // No pill for an unranked source. A blank one reads as tier zero.
+        if (s.tier case final t?) Pill('Tier ${t.rank}', t.accent),
       ]),
     );
   }
@@ -527,16 +829,73 @@ class _DeviceDetailState extends State<DeviceDetail> {
       onRename: (app != null && app.isConnected)
           ? () => _renameBand(c, app, s.name)
           : null,
-      onForget: app == null ? null : () => _confirmForget(c, app, s.name),
+      // A sensor is forgotten through its own path: `unpair()` tears down the
+      // primary band's link, its restore identity and its trim cursor, none of
+      // which a sensor has — pointing this at it would have unpaired the
+      // WHOOP from a chest strap's page.
+      onSync: s.family == 'oura' ? () => _syncRing(c) : null,
+      onForget: s.deviceId != null
+          ? () => _confirmForgetSensor(c, s)
+          : app == null
+              ? null
+              : () => _confirmForget(c, app, s.name),
     );
   }
 }
 
+/// Drain the ring, now, because the user asked. The result is a sentence
+/// either way: a sync that silently did nothing is indistinguishable from a
+/// ring that had nothing to give, and those need different remedies.
+Future<void> _syncRing(BuildContext c) async {
+  final messenger = ScaffoldMessenger.maybeOf(c);
+  messenger?.showSnackBar(const SnackBar(content: Text('Syncing the ring…')));
+  final ok = await OuraLink.instance.sync();
+  if (!c.mounted) return;
+  messenger?.showSnackBar(SnackBar(
+    content: Text(ok
+        ? 'Synced.'
+        : 'Could not reach the ring. It has to be nearby, and not connected '
+            'to another app.'),
+  ));
+}
+
+/// Forget a paired sensor. Same promise as forgetting the band — the source
+/// goes, the measurements stay — and it is true for the same reason: every row
+/// the sensor wrote keeps its own `device_id`, and nothing here touches them.
+Future<void> _confirmForgetSensor(BuildContext c, HealthSource s) async {
+  final id = s.deviceId;
+  if (id == null) return;
+  final app = c.read<AppState>();
+  final ok = await showDialog<bool>(
+    context: c,
+    builder: (d) => AlertDialog(
+      title: Text('Forget ${s.name}?'),
+      content: const Text(
+        'It stops being used during workouts and has to be paired again. '
+        'Everything already banked on this phone is kept — this removes the '
+        'source, not the data.',
+      ),
+      actions: [
+        TextButton(
+            onPressed: () => Navigator.of(d).pop(false),
+            child: const Text('Keep it paired')),
+        TextButton(
+            onPressed: () => Navigator.of(d).pop(true),
+            child: const Text('Forget it')),
+      ],
+    ),
+  );
+  if (ok != true) return;
+  await HrsLink.forgetDevice(id);
+  await app.refreshSensors();
+  if (c.mounted) backToRoot(c);
+}
+
 /// Rename the strap.
 ///
 /// This was in the old UI and did not survive the rebuild, which left the
 /// advertising name readable and not writable — and it is the one label a user
-/// with two straps needs, since both otherwise read "WHOOP band".
+/// with two straps needs, since both otherwise read "Your band".
 ///
 /// The band's own limits are the field's limits, checked here so a refusal is
 /// immediate instead of a silent truncation 20 characters in: 20 ASCII
@@ -560,7 +919,7 @@ Future<void> _renameBand(BuildContext c, AppState app, String current) async {
             autofocus: true,
             maxLength: 20,
             decoration: InputDecoration(
-              hintText: 'WHOOP band',
+              hintText: 'Your band',
               errorText: e,
               helperText: "Letters, numbers, space, and ' . _ -",
             ),
@@ -634,7 +993,7 @@ Future<void> _confirmForget(BuildContext c, AppState app, String name) async {
 
 class DeviceDetailView extends StatelessWidget {
   final HealthSource s;
-  final VoidCallback? onFind, onForget;
+  final VoidCallback? onFind, onForget, onSync;
 
   /// The beat arriving right now, or null when nothing fresh is streaming.
   /// Passed IN rather than read from a provider here: this view is rendered in
@@ -662,6 +1021,7 @@ class DeviceDetailView extends StatelessWidget {
       {super.key,
       this.onFind,
       this.onForget,
+      this.onSync,
       this.onRename,
       this.liveHr,
       this.status,
@@ -713,8 +1073,56 @@ class DeviceDetailView extends StatelessWidget {
                       fix: fault.fix ?? '', icon: LucideIcons.bluetoothOff),
                   const SizedBox(height: S.x5),
                 ],
-                TierRow(s.tier, filled: true),
-                const SizedBox(height: S.x5),
+                if (s.tier case final t?) ...[
+                  TierRow(t, filled: true),
+                  const SizedBox(height: S.x5),
+                ],
+                // A PAIRED SENSOR'S OWN CARD, not the band block below. It has
+                // no advertising name it owns, no battery this app reads and
+                // nothing to buzz — and it has the one thing a user needs
+                // before they trust the row at all: what is captured, and what
+                // is calculated from it. Today the answer to the second is
+                // NOTHING, for every sensor, and that has to be on the screen
+                // rather than inferred from a metric quietly still abstaining.
+                if (!s.isBand && s.deviceId != null) ...[
+                  Surface(
+                    pad: const EdgeInsets.symmetric(horizontal: S.x4),
+                    child: Column(children: [
+                      SetRow(LucideIcons.flaskConical, C.orange, 'Support',
+                          value: 'Experimental',
+                          sub: 'Decoded from the protocol, never checked '
+                              'against the hardware — nobody here owns one.',
+                          chevron: false),
+                      Divider(color: p.line, height: 1),
+                      SetRow(LucideIcons.database, C.teal, 'What it does',
+                          sub: s.tier == null
+                              ? 'Everything it sends is stored and attributed '
+                                  'to it. Nothing in the app is calculated '
+                                  'from it yet.'
+                              : 'Beat timing is stored and attributed to it '
+                                  'during a workout. Nothing in the app is '
+                                  'calculated from it yet.',
+                          chevron: false),
+                      Divider(color: p.line, height: 1),
+                      SetRow(LucideIcons.refreshCw, C.purple, 'Last data',
+                          value: last == null ? '' : formatDayTime(last),
+                          sub: last == null ? 'Nothing banked yet' : '',
+                          chevron: false),
+                      // MANUAL, and only for a sensor that holds history.
+                      // A strap has no flash and nothing to fetch; a ring
+                      // does, and putting it on a schedule would have it
+                      // contending for the radio with the band's own link
+                      // for no reason a user asked for.
+                      if (onSync != null) ...[
+                        Divider(color: p.line, height: 1),
+                        SetRow(LucideIcons.downloadCloud, C.blue, 'Sync now',
+                            sub: 'Fetch whatever it has been holding',
+                            onTap: onSync),
+                      ],
+                    ]),
+                  ),
+                  const SizedBox(height: S.x5),
+                ],
                 // Band rows only. The phone has no radio link and no battery
                 // this app can read, so "Not reported since the last
                 // connection" named a connection it does not have — on the
@@ -780,6 +1188,19 @@ class DeviceDetailView extends StatelessWidget {
                             sub: calibration.$2,
                             chevron: false),
                       ],
+                      // WHO HAS CHECKED, not how good the numbers are. Said
+                      // here rather than only as a word on the list row,
+                      // because "experimental" without the reason reads as a
+                      // disclaimer instead of a fact about this band.
+                      if (s.experimental) ...[
+                        Divider(color: p.line, height: 1),
+                        SetRow(LucideIcons.flaskConical, C.orange, 'Support',
+                            value: 'Experimental',
+                            sub: 'This band is decoded but nobody here has worn '
+                                'one. Its numbers have not been checked against '
+                                'the hardware, only against the protocol.',
+                            chevron: false),
+                      ],
                       if (onFind != null) ...[
                         Divider(color: p.line, height: 1),
                         SetRow(LucideIcons.bellRing, C.orange, 'Buzz the band',
diff --git a/lib/ui2/profile/pair_sensor.dart b/lib/ui2/profile/pair_sensor.dart
new file mode 100644
index 00000000..840df683
--- /dev/null
+++ b/lib/ui2/profile/pair_sensor.dart
@@ -0,0 +1,397 @@
+// Pair a second sensor: scan, pick one, write the `device` row.
+//
+// WHY THIS EXISTS. The whole decode-and-store path for a standard Bluetooth
+// heart-rate sensor shipped, tested, and unreachable: `HrsLink.arm()` reads a
+// `device` row and nothing ever created one, so every call returned false and
+// the feature was a library with no door. This is the door.
+//
+// WHY IT IS GENERIC OVER A [BandEntry] AND NOT ABOUT STRAPS. The scan filter,
+// the candidate list, the picking, the characteristic check and the `device`
+// row are the same work for every notify-class band; the only part that
+// differs is what happens between "user tapped a row" and "the row is
+// written" — for a strap, nothing, and for a ring, a key exchange against a
+// factory-reset device. So that step is the ONE injected parameter
+// ([onPicked]) and everything else is shared. A second copy of this screen per
+// band is how the copy, the honesty rules and the iOS gate below drift apart.
+//
+// WHAT IT DELIBERATELY DOES NOT DO.
+//  * Not a background scan. It scans while it is on screen and stops.
+//  * Not a connection owner. The pairing connect is dropped as soon as the row
+//    is written; `HrsLink.arm` opens the real session when a workout starts.
+//  * Not a promise that anything derives from the sensor. `kDerivableSources`
+//    is empty (ASSUMPTIONS R6): a paired sensor CAPTURES, and its seconds bank
+//    and sync and appear in diagnostics while producing no metric at all. The
+//    copy on this screen says so rather than implying a recovery score.
+//
+// THE iOS GATE is the part worth reading twice — see
+// `HrsLink.scanHeldBackReason`, which carries the evidence. Starting a scan on
+// an iPhone whose WHOOP is not yet paired creates a `CBCentralManager`, and
+// AccessorySetupKit's picker refuses to open while one exists. That is
+// recoverable by restarting the app and by nothing else, so the screen says it
+// out loud BEFORE scanning and lets the user decide, rather than discovering it
+// later as a WHOOP that cannot be paired for no visible reason.
+
+import 'dart:async' show unawaited;
+
+import 'package:flutter/material.dart';
+import 'package:flutter_blue_plus/flutter_blue_plus.dart'
+    show BluetoothDevice, FlutterBluePlus;
+import 'package:lucide_icons_flutter/lucide_icons.dart';
+import 'package:provider/provider.dart';
+
+import '../../ble/adapters/_registry.dart';
+import '../../ble/ble_state.dart'
+    show BleUnavailableException, bandStatusFor, classifyBleBlocker;
+import '../../ble/hrs_link.dart';
+import '../../state/app_state.dart';
+import '../ui2.dart';
+import 'profile.dart';
+
+/// A sensor this phone already has a `device` row for.
+typedef PairedSensor = ({String id, String? label});
+
+class PairSensorScreen extends StatefulWidget {
+  /// Which band to look for. Its `service` is the scan filter and its
+  /// `requiredCharacteristics` are what a candidate has to actually expose.
+  final BandEntry entry;
+
+  /// Called with the picked peripheral. Returns null on success, or a
+  /// user-facing reason on failure. This is where a band that needs a key
+  /// exchange does it.
+  ///
+  /// NULL means the plain notify-class pairing — connect, discover, check the
+  /// required characteristics, write the row — which is the whole of what a
+  /// heart-rate strap needs. Making it the default is what keeps the common
+  /// case out of every caller.
+  final Future<String?> Function(BluetoothDevice)? onPicked;
+
+  const PairSensorScreen({super.key, required this.entry, this.onPicked});
+
+  @override
+  State<PairSensorScreen> createState() => _PairSensorScreenState();
+}
+
+class _PairSensorScreenState extends State<PairSensorScreen> {
+  List<BandCandidate> _found = const [];
+  bool _scanning = false;
+
+  /// Why a scan should not start yet (the iOS gate), or null. Cleared — not
+  /// re-checked — once the user has chosen to scan anyway: it is their call to
+  /// make once, not a question to re-ask every time the list refreshes.
+  String? _heldBack;
+
+  /// The last failure, in a sentence. Never "Something went wrong".
+  String? _problem;
+
+  /// Remote id of the peripheral being paired, so its row can say so and the
+  /// rest of the list can stop accepting taps.
+  String? _busy;
+
+  PairedSensor? _paired;
+
+  @override
+  void initState() {
+    super.initState();
+    unawaited(_load());
+  }
+
+  @override
+  void dispose() {
+    // `HrsLink._scanFor` awaits the scan's OWN timeout with nothing this
+    // screen can cancel through the API it exposes — the scan keeps the
+    // process-wide radio lock for the rest of that window even after this
+    // screen is gone. `stopScan()` flips `isScanningNow` false, which is
+    // exactly the condition `_scanFor` is already awaiting, so this ends it
+    // early instead of leaving a dismissed screen's scan blocking whoever
+    // asks for the radio next (a re-opened pairing screen, the band's own
+    // scan). Harmless if nothing is scanning.
+    if (_scanning) unawaited(FlutterBluePlus.stopScan());
+    super.dispose();
+  }
+
+  Future<void> _load() async {
+    final row = await HrsLink.pairedSensorRow();
+    final held = await HrsLink.scanHeldBackReason();
+    if (!mounted) return;
+    setState(() {
+      _paired = row == null
+          ? null
+          : (id: row['id'] as String, label: row['label'] as String?);
+      _heldBack = held;
+    });
+  }
+
+  Future<void> _scan() async {
+    setState(() {
+      _scanning = true;
+      _problem = null;
+      _heldBack = null;
+      _found = const [];
+    });
+    try {
+      await HrsLink.scanFor(
+        widget.entry,
+        onResults: (c) {
+          if (mounted) setState(() => _found = c);
+        },
+      );
+    } catch (e) {
+      // A phone-level blocker has copy of its own, written once and shared by
+      // every surface that shows the link — home, devices, pairing, and now
+      // this. Anything else is reported as itself.
+      final blocker =
+          e is BleUnavailableException ? e.blocker : classifyBleBlocker(error: e);
+      if (!mounted) return;
+      setState(() => _problem = blocker != null
+          ? bandStatusFor(connection: 'disconnected', blocker: blocker).reason
+          : 'The scan did not run: $e');
+    } finally {
+      if (mounted) setState(() => _scanning = false);
+    }
+  }
+
+  Future<void> _pick(BandCandidate c) async {
+    setState(() {
+      _busy = c.device.remoteId.str;
+      _problem = null;
+    });
+    // The injected callback (a ring's key exchange) is not this file's code
+    // and can throw — a `BluetoothDevice.connect` timeout, a keychain error,
+    // anything the callback itself does not already turn into a returned
+    // sentence. An uncaught throw here skips the `setState` below entirely,
+    // which leaves `_busy` set and every row permanently un-tappable until
+    // the screen is torn down and rebuilt — the same "stuck busy" failure
+    // mode a returned failure string already has a real answer for.
+    String? failure;
+    try {
+      failure = widget.onPicked != null
+          ? await widget.onPicked!(c.device)
+          : await HrsLink.pairNotifySensor(
+              widget.entry,
+              c.device,
+              label: c.label,
+            );
+    } catch (e) {
+      failure = 'Could not pair that device: $e';
+    }
+    if (!mounted) return;
+    setState(() {
+      _busy = null;
+      _problem = failure;
+      // On success the list has done its job; keeping it would invite a second
+      // pair of a device that is now the paired one.
+      if (failure == null) _found = const [];
+    });
+    if (failure == null) await _load();
+  }
+
+  Future<void> _forget(String id) async {
+    await HrsLink.forgetDevice(id);
+    if (!mounted) return;
+    // `_load()` refreshes only THIS screen's own `_paired` field.
+    // `AppState.sensors` is a separate, shared copy of the same device rows
+    // — `devices.dart` reads it directly — and nothing else refreshes it on
+    // this path, so a forget from here would leave that other screen showing
+    // a sensor that no longer exists until something unrelated happened to
+    // reload it.
+    await context.read<AppState>().refreshSensors();
+    if (mounted) await _load();
+  }
+
+  @override
+  Widget build(BuildContext c) => PairSensorView(
+        entryLabel: widget.entry.label,
+        candidates: _found,
+        scanning: _scanning,
+        heldBack: _heldBack,
+        problem: _problem,
+        paired: _paired,
+        busyRemoteId: _busy,
+        onScan: _scan,
+        onPick: _pick,
+        onForget: _forget,
+      );
+}
+
+/// The pure half — everything this screen draws, from values, so a test can
+/// render every state without a radio.
+class PairSensorView extends StatelessWidget {
+  final String entryLabel;
+  final List<BandCandidate> candidates;
+  final bool scanning;
+
+  /// The iOS gate's sentence, or null when a scan may just run.
+  final String? heldBack;
+
+  final String? problem;
+  final PairedSensor? paired;
+  final String? busyRemoteId;
+
+  final VoidCallback? onScan;
+  final void Function(BandCandidate)? onPick;
+  final void Function(String id)? onForget;
+
+  const PairSensorView({
+    super.key,
+    required this.entryLabel,
+    this.candidates = const [],
+    this.scanning = false,
+    this.heldBack,
+    this.problem,
+    this.paired,
+    this.busyRemoteId,
+    this.onScan,
+    this.onPick,
+    this.onForget,
+  });
+
+  @override
+  Widget build(BuildContext c) {
+    final p = P.of(c);
+    final busy = busyRemoteId != null;
+    return Scaffold(
+      backgroundColor: p.bg,
+      body: SafeArea(
+        child: Column(children: [
+          Padding(
+            padding: const EdgeInsets.symmetric(horizontal: S.x4),
+            child: NavBar('Add a sensor', sub: entryLabel),
+          ),
+          Expanded(
+            child: ListView(
+              padding: const EdgeInsets.fromLTRB(S.x4, 0, S.x4, S.x10),
+              children: [
+                if (paired != null) ..._pairedSection(c, paired!),
+                Section(
+                  paired == null ? 'What this adds' : 'Pair another',
+                  Surface(
+                    child: Text(
+                      'A sensor is used only while a workout is running, and '
+                      'only for heart rate and beat timing. It does not '
+                      'replace your band, it is never used overnight, and '
+                      'nothing it records feeds a score yet — its readings are '
+                      'stored and shown, and that is all.',
+                      style: F.cap.copyWith(color: p.ink3, height: 1.5),
+                    ),
+                  ),
+                ),
+                if (heldBack != null) ...[
+                  const SizedBox(height: S.x4),
+                  StatusCard(
+                    'Searching would hide the WHOOP pairing sheet',
+                    heldBack!,
+                    fix: 'Search anyway',
+                    icon: LucideIcons.triangleAlert,
+                    onFix: busy ? null : onScan,
+                  ),
+                ] else ...[
+                  const SizedBox(height: S.x6),
+                  BigButton(
+                    scanning ? 'Searching…' : 'Search for sensors',
+                    icon: LucideIcons.bluetooth,
+                    color: C.blue,
+                    onTap: scanning || busy ? null : onScan,
+                  ),
+                ],
+                if (problem != null) ...[
+                  const SizedBox(height: S.x4),
+                  StatusCard(
+                    'That did not work',
+                    problem!,
+                    icon: LucideIcons.circleAlert,
+                  ),
+                ],
+                if (candidates.isNotEmpty)
+                  Section(
+                    'In range',
+                    Surface(
+                      pad: const EdgeInsets.symmetric(horizontal: S.x4),
+                      child: Column(children: [
+                        for (var i = 0; i < candidates.length; i++) ...[
+                          _candidateRow(c, candidates[i], busy),
+                          if (i < candidates.length - 1)
+                            Divider(color: p.line, height: 1),
+                        ],
+                      ]),
+                    ),
+                  )
+                else if (scanning)
+                  const Padding(
+                    padding: EdgeInsets.only(top: S.x6),
+                    child: Center(
+                      child: NoData(message: 'Listening for sensors…'),
+                    ),
+                  )
+                else if (heldBack == null && problem == null)
+                  const Padding(
+                    padding: EdgeInsets.only(top: S.x6),
+                    child: StatusCard(
+                      'Nothing found yet',
+                      'A sensor answers a search only while it is awake, worn '
+                          'or damp, and not already connected to another phone '
+                          'or app.',
+                      icon: LucideIcons.searchX,
+                    ),
+                  ),
+              ],
+            ),
+          ),
+        ]),
+      ),
+    );
+  }
+
+  List<Widget> _pairedSection(BuildContext c, PairedSensor s) => [
+        Section(
+          'Paired',
+          Surface(
+            pad: const EdgeInsets.symmetric(horizontal: S.x4),
+            child: Column(children: [
+              SetRow(
+                LucideIcons.heartPulse,
+                C.green,
+                // A sensor that advertised no name is shown as what it is, not
+                // as an invented one.
+                s.label ?? entryLabel,
+                sub: 'Used during workouts',
+                chevron: false,
+                onTap: null,
+              ),
+              SetRow(
+                LucideIcons.trash2,
+                C.red,
+                'Forget this sensor',
+                sub: 'Removes the source. The readings it already took stay.',
+                danger: true,
+                chevron: false,
+                onTap: onForget == null ? null : () => onForget!(s.id),
+              ),
+            ]),
+          ),
+        ),
+      ];
+
+  Widget _candidateRow(BuildContext c, BandCandidate cand, bool busy) {
+    final id = cand.device.remoteId.str;
+    // The signal strength as the radio reported it, in its own unit. Not a bar
+    // count: three bars is a judgement about distance nobody measured.
+    //
+    // An UNNAMED sensor also gets the tail of its remote id, because without a
+    // name two of them are the same row twice and the user has no way to say
+    // which one they meant. A named one does not — the id is machine plumbing
+    // and putting it on every row is noise.
+    final tail = id.length <= 5 ? id : id.substring(id.length - 5);
+    return SetRow(
+      LucideIcons.heartPulse,
+      C.blue,
+      cand.label ?? entryLabel,
+      sub: busyRemoteId == id
+          ? 'Pairing…'
+          : cand.label == null
+              ? '…$tail · ${cand.rssi} dBm'
+              : '${cand.rssi} dBm',
+      chevron: !busy,
+      onTap: busy || onPick == null ? null : () => onPick!(cand),
+    );
+  }
+}
diff --git a/lib/ui2/screens/day_steps.dart b/lib/ui2/screens/day_steps.dart
index c7dbbc21..998a06f2 100644
--- a/lib/ui2/screens/day_steps.dart
+++ b/lib/ui2/screens/day_steps.dart
@@ -35,6 +35,7 @@ import '../../data/day_label.dart';
 import '../../data/local_repository.dart';
 import '../../models/metric.dart' show whyFromNote;
 import '../activity/catalogue.dart' show activityByName;
+import '../profile/devices.dart' show bandLabelFor;
 import '../ui2.dart';
 import 'home_screen.dart' show clockOfTs, prettyDay, repoOf, thousands;
 import 'metric_detail.dart'
@@ -100,8 +101,8 @@ class DayStepsData {
   /// here.
   final String? note;
 
-  /// 'WHOOP 4' / 'WHOOP 5' / [_defaultBand] — the paired band, in the same
-  /// words the Devices screen uses.
+  /// The paired band's name, in the same words the Devices screen uses —
+  /// or [_defaultBand] when nothing has told us which band it is.
   final String bandLabel;
 
   bool get mixed => strap > 0 && phone > 0;
@@ -454,11 +455,10 @@ String bandLabel(BuildContext c) {
   try {
     final app = c.read<AppState>();
     if (!app.isPaired) return DayStepsData._defaultBand;
-    return switch (app.device.generation) {
-      'gen4' => 'WHOOP 4',
-      'gen5' => 'WHOOP 5',
-      _ => DayStepsData._defaultBand,
-    };
+    // The registry's own label for the band that is paired. A family with no
+    // entry — an import, a pre-stamp row, an adapter this build does not carry
+    // — is NOT a WHOOP 4, which is what the ternary here used to publish.
+    return bandLabelFor(app.device.generation) ?? DayStepsData._defaultBand;
   } catch (_) {
     return DayStepsData._defaultBand;
   }
diff --git a/lib/ui2/screens/readiness_detail.dart b/lib/ui2/screens/readiness_detail.dart
index 37cb88cf..7c986f6a 100644
--- a/lib/ui2/screens/readiness_detail.dart
+++ b/lib/ui2/screens/readiness_detail.dart
@@ -24,7 +24,7 @@ class ReadinessData {
   final int inputsUsed;
 
   /// `readiness_absent_diag` off the stored bundle — per input `{value,
-  /// baseline_n, baseline_sd}` plus the composite's own `note`. Produced on
+  /// baseline_n}` plus the composite's own `note`. Produced on
   /// EVERY day readiness comes back absent, and until now its only destination
   /// was a Firebase breadcrumb: the app told its developer why the number was
   /// missing and never told the person looking at the gap.
diff --git a/pubspec.lock b/pubspec.lock
index 712b1376..f5f8bc27 100644
--- a/pubspec.lock
+++ b/pubspec.lock
@@ -924,8 +924,8 @@ packages:
     dependency: "direct main"
     description:
       path: "."
-      ref: d9362a66fbeac326d5d7d7b1fe27b28e41169a79
-      resolved-ref: d9362a66fbeac326d5d7d7b1fe27b28e41169a79
+      ref: "353c6bc30f56b936c450e25a3759e5572b164bd8"
+      resolved-ref: "353c6bc30f56b936c450e25a3759e5572b164bd8"
       url: "https://github.com/OpenStrap/analytics.git"
     source: git
     version: "1.0.0"
@@ -933,8 +933,8 @@ packages:
     dependency: "direct main"
     description:
       path: "."
-      ref: "4ce8f021568a4cd9a1d86c91004f91c6b21980da"
-      resolved-ref: "4ce8f021568a4cd9a1d86c91004f91c6b21980da"
+      ref: "19d72919ecc0cbca518e0fdbbe2f6f9dc7ffe265"
+      resolved-ref: "19d72919ecc0cbca518e0fdbbe2f6f9dc7ffe265"
       url: "https://github.com/OpenStrap/protocol.git"
     source: git
     version: "1.0.0"
diff --git a/pubspec.yaml b/pubspec.yaml
index 0d745879..89a8b0df 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -6,7 +6,7 @@ publish_to: 'none'
 # Watch App" targets in ios/Runner.xcodeproj/project.pbxproj — they aren't wired
 # to FLUTTER_BUILD_NAME/FLUTTER_BUILD_NUMBER. See guides/IOS_INSTALLATION.md
 # "Version Numbers".
-version: 0.9.28+60
+version: 0.9.29+61
 
 environment:
   sdk: ^3.11.4
@@ -80,13 +80,24 @@ dependencies:
       # record field map this branch's decoders need. main's pre-gen5 pin is
       # deliberate THERE; this is the branch that wants gen5.
       #
-      # REPIN (this branch): protocol #33 head @ 4ce8f02, which is b7990e1
-      # (everything above) rebased under #33's one commit — alarmRev1Payload,
-      # the single home of the rev-1 9-byte SET_ALARM_TIME layout this branch
-      # arms gen4 with. b7990e1 itself does NOT export the symbol, so the old
-      # pin failed analysis on a fresh checkout. #33 is unmerged, so this is a
-      # PR-branch-head pin; repin to the main merge commit when it lands.
-      ref: 4ce8f021568a4cd9a1d86c91004f91c6b21980da
+      # REPIN (this branch): protocol #34 head @ 19d7291, on top of 4ce8f02
+      # (everything above). Carries the oura ring and generic bluetooth HR
+      # wire format in from edge — pure decode/encode functions with no BLE
+      # or db dependency, so they belong with the rest of the bytes-in-
+      # records-out code rather than beside the session that drives them.
+      # `parseFrame`/`parseEvent` on the whoop side are unchanged; the moved
+      # functions are `parseOuraFrame`/`parseOuraEvent` to avoid a barrel
+      # collision. No stored WHOOP number moves.
+      #
+      # Repinned again after that branch's own review pass: a truncated HRS
+      # notification (energy-expended flag set but the field cut off, or an
+      # odd-length RR remainder) now refuses instead of silently parsing what
+      # fit; `ouraCmdAuthenticate` rejects a wrong-size cipher instead of
+      # emitting a malformed frame; `ouraCmdSyncTime` no longer calls
+      # `ByteData.setUint64`, which throws on dart2js. None of the three touch
+      # a WHOOP code path. #34 is unmerged, so this is a PR-branch-head pin;
+      # repin to the main merge commit when it lands.
+      ref: 19d72919ecc0cbca518e0fdbbe2f6f9dc7ffe265
   openstrap_analytics:
     git:
       url: https://github.com/OpenStrap/analytics.git
@@ -210,7 +221,19 @@ dependencies:
       # abstains rather than billing every waking minute as active when the
       # anchors are unusable — which is source-breaking here, not
       # number-changing (see `onehz_pipeline` and `_dailyEnergy`).
-      ref: d9362a66fbeac326d5d7d7b1fe27b28e41169a79
+      #
+      # REPIN: analytics @ 353c6bc, on top of d6ba41c. FOUR output changes,
+      # kAlgoVersion bumped for this hop — see its own changelog entry:
+      # nocturnalRhr(minCoverage: 0) could reach a NaN trough; the cadence
+      # rescale in the sleep stager was double-applying an already
+      # cadence-invariant factor; cardio_stager's epoch grid could silently
+      # drift from its own reported length; readiness's sub-quantum
+      # dispersion guard only ran when robustZ came back null, missing a
+      # nonzero-MAD-but-still-quantized baseline. WHOOP-cadence output is
+      # unaffected by the first three (1 Hz is the case each already handled
+      # correctly); the quantum-guard fix can change a WHOOP readiness score
+      # when a baseline happens to sit in that gap.
+      ref: 353c6bc30f56b936c450e25a3759e5572b164bd8
 
   # BLE — flutter_blue_plus is the maintained cross-platform GATT client.
   flutter_blue_plus: ^1.36.8
diff --git a/test/absence_and_offload_guards_test.dart b/test/absence_and_offload_guards_test.dart
index a5d24d6d..527e7a4c 100644
--- a/test/absence_and_offload_guards_test.dart
+++ b/test/absence_and_offload_guards_test.dart
@@ -70,25 +70,25 @@ void main() {
     });
   });
 
-  group('plausibleHrOrZero — the gen4 trusted path had no upper bound', () {
+  group('plausibleHrOrNull — the gen4 trusted path had no upper bound', () {
     test('a physiological HR passes through untouched', () {
-      expect(plausibleHrOrZero(60), 60);
-      expect(plausibleHrOrZero(kMinPlausibleHr), kMinPlausibleHr);
-      expect(plausibleHrOrZero(kMaxPlausibleHr), kMaxPlausibleHr);
+      expect(plausibleHrOrNull(60), 60);
+      expect(plausibleHrOrNull(kMinPlausibleHr), kMinPlausibleHr);
+      expect(plausibleHrOrNull(kMaxPlausibleHr), kMaxPlausibleHr);
     });
 
     test('an impossible HR reads ABSENT, and is never clamped into range', () {
       // 250 used to pass the `hr > 0` filter and become the displayed max HR.
-      expect(plausibleHrOrZero(250), 0);
-      expect(plausibleHrOrZero(255), 0);
-      expect(plausibleHrOrZero(7), 0);
+      expect(plausibleHrOrNull(250), isNull);
+      expect(plausibleHrOrNull(255), isNull);
+      expect(plausibleHrOrNull(7), isNull);
       // Clamping would have produced a plausible-looking 230/25 — a number the
       // wrist never reported.
-      expect(plausibleHrOrZero(250), isNot(kMaxPlausibleHr));
+      expect(plausibleHrOrNull(250), isNot(kMaxPlausibleHr));
     });
 
-    test('the off-skin sentinel is preserved', () {
-      expect(plausibleHrOrZero(0), 0);
+    test('a zero reading is not a heart rate either', () {
+      expect(plausibleHrOrNull(0), isNull);
     });
   });
 
diff --git a/test/adapters/ble_hrs_adapter_test.dart b/test/adapters/ble_hrs_adapter_test.dart
new file mode 100644
index 00000000..f93843a3
--- /dev/null
+++ b/test/adapters/ble_hrs_adapter_test.dart
@@ -0,0 +1,107 @@
+// The mandatory adapter test (MULTIBAND_PLAN §3.3.3): replay a fixture through
+// a [ReplayBandLink] and assert that every signal the adapter DECLARES really
+// appears in what it EMITS.
+//
+// Why this one and not a decode test: a declared-but-absent signal is worse
+// than a missing one. A missing signal deletes its card through the absence
+// contract; a declared one that never arrives leaves a card permanently empty
+// with nothing to point at. The decode itself is pinned in `hrs_link_test.dart`
+// against the SIG layout.
+//
+// This is also the worked example a contributor copies —
+// `test/adapters/<id>_test.dart`, ~40 lines, no hardware, no mocks.
+
+import 'dart:async';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_edge/ble/adapters/_registry.dart';
+import 'package:openstrap_edge/ble/adapters/adapter.dart';
+import 'package:openstrap_edge/ble/adapters/ble_hrs.dart';
+import 'package:openstrap_edge/ble/adapters/signals.dart';
+
+/// uint8 HR + contact supported/detected + RR present; 500 and 512 ticks.
+const List<int> kHrWithTwoRr = <int>[0x16, 120, 0xF4, 0x01, 0x00, 0x02];
+
+/// flags 0x00 — the RR bit CLEAR, which plenty of optical armbands never set.
+const List<int> kBpmOnly = <int>[0x00, 61];
+
+/// Drive [BleHrsAdapter] over recorded bytes and collect what it yields.
+Future<List<BandEvent>> replay(List<(int, List<int>)> arrivals) async {
+  final link = ReplayBandLink();
+  final events = <BandEvent>[];
+  final done = Completer<void>();
+  // onDone is wired BEFORE anything is fed: `run()` finishing is what we wait
+  // on, and guessing at a delay instead is how a test drops the tail.
+  final sub = kBleHrsAdapter.run(link).listen(events.add, onDone: done.complete);
+  for (final (sec, value) in arrivals) {
+    link.feed(kHeartRateMeasurementUuid, value, atSec: sec);
+  }
+  await link.close();
+  await done.future;
+  await sub.cancel();
+  return events;
+}
+
+void main() {
+  test('every declared InputSignal actually appears in an emitted sample',
+      () async {
+    final events = await replay(const [
+      (1_800_000_000, kHrWithTwoRr),
+      (1_800_000_001, kBpmOnly),
+    ]);
+    final samples = [
+      for (final e in events)
+        if (e is SampleBatch) ...e.samples,
+    ];
+    expect(samples, isNotEmpty);
+
+    final seen = <InputSignal>{
+      if (samples.any((s) => s.hr != null)) InputSignal.hrSparse,
+      if (samples.any((s) => s.rrMs.isNotEmpty)) InputSignal.rrIntervals,
+    };
+    expect(seen, containsAll(kBleHrsAdapter.signals.keys),
+        reason: 'a declared signal that never arrives leaves a permanently '
+            'empty card instead of no card');
+    // And the converse: nothing UNDECLARED is emitted either. Declaring I3+I1
+    // is what makes every sleep, temperature, step and SpO2 card delete itself.
+    expect(kBleHrsAdapter.signals.keys.toSet(), seen);
+  });
+
+  test('cadence is roughly what the adapter declared', () async {
+    final events = await replay([
+      for (var i = 0; i < 10; i++) (1_800_000_000 + i, kHrWithTwoRr),
+    ]);
+    final ts = [
+      for (final e in events)
+        if (e is SampleBatch) ...e.samples.map((s) => s.tsEpoch),
+    ];
+    expect(ts, hasLength(10));
+    final span = ts.last - ts.first;
+    expect(span / (ts.length - 1),
+        closeTo(kBleHrsAdapter.signals[InputSignal.hrSparse]!.inSeconds, 0.5));
+  });
+
+  test('arrival time comes from the LINK, never from a clock in the adapter',
+      () async {
+    // The whole point of stamping arrival on the packet: a fixture replays
+    // deterministically. If the adapter read `DateTime.now()` this would be
+    // today's epoch, and `TimeAnchor.arrival` would be untestable.
+    final events = await replay(const [(1_800_000_000, kHrWithTwoRr)]);
+    final s = (events.single as SampleBatch).samples.single;
+    expect(s.tsEpoch, 1_800_000_000);
+    expect(s.anchor, TimeAnchor.arrival);
+  });
+
+  test('a strap stores nothing, so it never emits an OffloadCheckpoint',
+      () async {
+    final events = await replay(const [
+      (1_800_000_000, kHrWithTwoRr),
+      (1_800_000_001, <int>[0x04, 45]), // contact bits 0b10 = off the chest
+    ]);
+    expect(events.whereType<OffloadCheckpoint>(), isEmpty);
+    // An off-chest reading is refused outright, not stored as a low HR.
+    expect(events, hasLength(1));
+    // Nothing is written back to a sensor that has no command characteristic.
+    expect(kBleHrsAdapter.entry.isFramed, isFalse);
+  });
+}
diff --git a/test/adapters/gatt_link_write_test.dart b/test/adapters/gatt_link_write_test.dart
new file mode 100644
index 00000000..398a0f42
--- /dev/null
+++ b/test/adapters/gatt_link_write_test.dart
@@ -0,0 +1,150 @@
+// ASSUMPTIONS G5: `GattBandLink.write` shipped without the two wire guards
+// `BleEngine._write` has had since the batch-ACK path was written — write-chain
+// serialisation, and the staleness guard that stops a write queued by a dead
+// session landing on a live one. Both are silent when they are missing: the
+// frame is simply dropped, reordered, or written to the wrong connection.
+//
+// `flutter_blue_plus` has no simulator path, so this drives the link with NO
+// services and its `debugWriteHook` — which is why that hook exists. The guards
+// are checked BEFORE the hook, so what is asserted here is the real path.
+
+import 'dart:async';
+
+import 'package:flutter_blue_plus/flutter_blue_plus.dart' show Guid;
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_edge/ble/adapters/_registry.dart';
+import 'package:openstrap_edge/ble/adapters/gatt_link.dart';
+import 'package:openstrap_edge/ble/ble_state.dart';
+import 'package:openstrap_protocol/openstrap_protocol.dart';
+
+GattBandLink _link() => GattBandLink(
+      entry: kWhoopGen4,
+      services: const [],
+      onLog: (_) {},
+    );
+
+void main() {
+  test('WriteChain runs one op at a time, in order', () async {
+    final chain = WriteChain();
+    final order = <String>[];
+    var inFlight = 0;
+    var maxInFlight = 0;
+
+    Future<int> op(String name, int ms) => chain.add<int>(() async {
+          inFlight++;
+          maxInFlight = inFlight > maxInFlight ? inFlight : maxInFlight;
+          await Future<void>.delayed(Duration(milliseconds: ms));
+          order.add(name);
+          inFlight--;
+          return ms;
+        });
+
+    // The long one is queued FIRST: without serialisation the short one
+    // finishes first and both are in flight together.
+    final results = await Future.wait([op('slow', 40), op('fast', 1)]);
+
+    expect(maxInFlight, 1);
+    expect(order, <String>['slow', 'fast']);
+    expect(results, <int>[40, 1]);
+  });
+
+  test('a failing op does not wedge the writes behind it', () async {
+    final chain = WriteChain();
+    await expectLater(
+      chain.add<int>(() async => throw StateError('boom')),
+      throwsStateError,
+    );
+    expect(await chain.add<int>(() async => 7), 7);
+  });
+
+  test('the link serialises its writes onto one chain', () async {
+    final link = _link();
+    final order = <int>[];
+    var inFlight = 0;
+    var maxInFlight = 0;
+    link.debugWriteHook = (value) async {
+      inFlight++;
+      maxInFlight = inFlight > maxInFlight ? inFlight : maxInFlight;
+      await Future<void>.delayed(Duration(milliseconds: value.first));
+      order.add(value.first);
+      inFlight--;
+      return true;
+    };
+
+    await Future.wait([
+      link.write(kWhoopGen4.gatt!.cmdTo, const [40]),
+      link.write(kWhoopGen4.gatt!.cmdTo, const [1]),
+    ]);
+
+    expect(maxInFlight, 1);
+    expect(order, <int>[40, 1]);
+  });
+
+  test('a write queued before close() never reaches the radio after it',
+      () async {
+    // The shipped hazard: `flutter_blue_plus` resolves a characteristic against
+    // whatever connection is live NOW, so a stale adapter's queued ACK writes
+    // onto a brand-new link with a re-used sequence number.
+    final link = _link();
+    final written = <List<int>>[];
+    final gate = Completer<void>();
+    link.debugWriteHook = (value) async {
+      written.add(value);
+      await gate.future;
+      return true;
+    };
+
+    final first = link.write(kWhoopGen4.gatt!.cmdTo, const [1]);
+    final queued = link.write(kWhoopGen4.gatt!.cmdTo, const [2]);
+    // Let the first write actually reach the hook. The guard is judged when a
+    // write DEQUEUES, not when it is submitted — which is the whole point: a
+    // write parked behind a long commit is judged against the link that will
+    // carry it, not the one that queued it.
+    await Future<void>.delayed(Duration.zero);
+    // The host tears the link down while the first write is still in flight.
+    link.close();
+    gate.complete();
+
+    expect(await first, isTrue);
+    expect(await queued, isFalse, reason: 'refused on a link that is gone');
+    expect(written, <List<int>>[
+      const [1],
+    ]);
+  });
+
+  test('close() does not weaken the dangerous-opcode block', () {
+    // The block sits BEFORE the chain, so a destructive opcode is refused
+    // without waiting behind a parked write — and it is still refused.
+    final link = _link();
+    var reached = false;
+    link.debugWriteHook = (_) async {
+      reached = true;
+      return true;
+    };
+    final frame = buildCommand(7, Cmd.forceTrim, const <int>[0x01],
+        kWhoopGen4.wire!);
+    expect(link.write(kWhoopGen4.gatt!.cmdTo, frame), completion(isFalse));
+    expect(reached, isFalse);
+  });
+
+  group('gattUuidMatches', () {
+    test('a SIG 16-bit characteristic matches its registry entry', () {
+      // `Guid.str` for `00002a37-0000-1000-8000-00805f9b34fb` is `2a37` — the
+      // SHORTEST form, not the platform's whim — so a `00002a37` prefix match
+      // against it fails on EVERY platform. `HrsLink.arm` then reported the
+      // heart-rate measurement characteristic missing and aborted, which reads
+      // as "the adapter doesn't work" and is four characters of comparison.
+      expect(Guid(kHeartRateMeasurementUuid).str, '2a37');
+      expect(gattUuidMatches(kHeartRateMeasurementUuid,
+          Guid(kHeartRateMeasurementUuid)), isTrue);
+      expect(gattUuidMatches(kHeartRateServiceUuid, Guid('180d')), isTrue);
+    });
+
+    test('WHOOP 128-bit uuids are unaffected, and a mismatch still misses', () {
+      final cmdTo = kWhoopGen4.gatt!.cmdTo;
+      expect(gattUuidMatches(cmdTo, Guid(cmdTo)), isTrue);
+      expect(gattUuidMatches(cmdTo, Guid(kWhoopGen4.gatt!.cmdFrom)), isFalse);
+      expect(gattUuidMatches(kHeartRateMeasurementUuid, Guid('2a38')), isFalse);
+    });
+  });
+}
diff --git a/test/adapters/oura_adapter_test.dart b/test/adapters/oura_adapter_test.dart
new file mode 100644
index 00000000..49efd629
--- /dev/null
+++ b/test/adapters/oura_adapter_test.dart
@@ -0,0 +1,351 @@
+// The Oura session, replayed through [ReplayBandLink].
+//
+// WHAT THIS EXISTS TO PROVE, and it is not the decode — that is proven with
+// the wire format itself, in the protocol package. It is the SHAPE of the
+// offload, which is the question that decided
+// whether this band belongs behind the adapter seam at all:
+//
+//   * the ring never trims, so `confirm()` moves a cursor rather than
+//     authorising a delete, and a host that never confirms costs a re-read
+//     rather than a record;
+//   * the cursor does not advance until the host has confirmed — the same
+//     commit-then-confirm ordering the safe-trim invariant runs on, expressed
+//     in the one currency this band has;
+//   * every event frame reaches `raw`, including the ones nothing decodes,
+//     because the beat intervals and the hypnogram are in there and a decoder
+//     for them does not exist yet.
+//
+// Nothing here has met hardware. It proves the state machine, not the ring.
+
+import 'dart:async';
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_edge/ble/adapters/_registry.dart';
+import 'package:openstrap_edge/ble/adapters/adapter.dart';
+import 'package:openstrap_edge/ble/adapters/oura.dart';
+import 'package:openstrap_protocol/openstrap_protocol.dart';
+
+/// Short enough that a deliberately-unanswered wait does not stall CI. The
+/// shipped values are 5 s and 30 s; only their length is being shortened here,
+/// never which one guards what.
+const Duration _kFast = Duration(milliseconds: 50);
+
+/// The key the challenge vector below is answered with.
+final List<int> _kKey = _hex('4431967d8bacc2659743142b68391d9a');
+
+OuraAdapter _adapter({int startCursorDs = 0}) => OuraAdapter(
+      key: _kKey,
+      startCursorDs: startCursorDs,
+      confirmTimeout: _kFast,
+      replyTimeout: _kFast,
+    );
+
+List<int> _hex(String s) => [
+      for (var i = 0; i + 1 < s.length; i += 2)
+        int.parse(s.substring(i, i + 2), radix: 16),
+    ];
+
+/// A frame, header included, ready to feed as one notification.
+List<int> _frame(int tag, List<int> payload) => <int>[tag, payload.length, ...payload];
+
+/// A history event: envelope timestamp in deciseconds, then the body.
+List<int> _event(int tag, int tsDs, List<int> body) => _frame(tag, <int>[
+      tsDs & 0xff,
+      (tsDs >> 8) & 0xff,
+      (tsDs >> 16) & 0xff,
+      (tsDs >> 24) & 0xff,
+      ...body,
+    ]);
+
+/// The ring's reply to a nonce request, and to a correct answer.
+final List<int> _nonceReply =
+    _frame(0x2f, _hex('2c') + _hex('0e2d6a0a08c99b4365f458e6e97382'));
+final List<int> _authOk = _frame(0x2f, _hex('2e00'));
+final List<int> _authBad = _frame(0x2f, _hex('2e01'));
+
+List<int> _summary(int received, int bytesLeft) => _frame(0x11, <int>[
+      received,
+      0,
+      bytesLeft & 0xff,
+      (bytesLeft >> 8) & 0xff,
+      (bytesLeft >> 16) & 0xff,
+      (bytesLeft >> 24) & 0xff,
+    ]);
+
+/// Drive [adapter] over a replay link, answering each write as the ring would.
+///
+/// A replay link records writes but cannot react to them, and this session is a
+/// conversation — so the script below waits for the write count to grow and
+/// then feeds the reply that write earned. That is the smallest thing that
+/// exercises the real `run()` rather than a re-implementation of it.
+Future<(List<BandEvent>, ReplayBandLink)> _drive(
+  OuraAdapter adapter,
+  List<List<int>> Function(int writeIndex, List<int> value) reply, {
+  bool confirmBatches = true,
+}) async {
+  final link = ReplayBandLink();
+  final events = <BandEvent>[];
+  final done = Completer<void>();
+  final sub = adapter.run(link).listen(
+        (e) async {
+          events.add(e);
+          if (e is OffloadCheckpoint && confirmBatches) await e.confirm();
+        },
+        onDone: () => done.complete(),
+      );
+  var served = 0;
+  for (var spin = 0; spin < 400 && !done.isCompleted; spin++) {
+    await Future<void>.delayed(Duration.zero);
+    while (served < link.writes.length) {
+      final w = link.writes[served];
+      for (final f in reply(served, w.$2)) {
+        link.feed(kOuraNotifyChar, f, atSec: 1786000000);
+      }
+      served++;
+    }
+  }
+  await link.close();
+  await done.future.timeout(const Duration(seconds: 2), onTimeout: () {});
+  await sub.cancel();
+  return (events, link);
+}
+
+void main() {
+  /// One battery event and one temperature event, then the batch is done.
+  List<List<int>> ringWithOneBatch(int i, List<int> v) {
+    if (v.first == 0x2f && v[2] == 0x2b) return [_nonceReply];
+    if (v.first == 0x2f && v[2] == 0x2d) return [_authOk];
+    if (v.first == 0x10) {
+      // A resumed request must not be answered with the same batch again.
+      final cursor = v[2] | (v[3] << 8) | (v[4] << 16) | (v[5] << 24);
+      if (cursor > 0) return [_summary(0, 0)];
+      return [
+        _event(kOuraEvtDebugData, 100, _hex('2456c80f00')),
+        _event(kOuraEvtTempPeriod, 200, _hex('6c0d')),
+        // Nothing decodes this one. It must still reach `raw`.
+        _event(0x60, 300, _hex('0102030405060708090a0b0c0d0e')),
+        // Bytes still on the ring, so the drain asks again with the new cursor.
+        _summary(3, 512),
+      ];
+    }
+    return const [];
+  }
+
+  test('authenticates before it asks for anything', () async {
+    final (_, link) = await _drive(_adapter(), ringWithOneBatch);
+    expect(link.writes.first.$2, ouraCmdAuthNonce());
+    // The answer is the challenge under our key, one AES block, and it goes out
+    // before the first history request.
+    final answer = link.writes[1].$2;
+    expect(answer.first, 0x2f);
+    expect(answer.sublist(3),
+        ouraAuthResponse(_kKey, _hex('0e2d6a0a08c99b4365f458e6e97382')));
+    final firstHistory = link.writes.indexWhere((w) => w.$2.first == 0x10);
+    expect(firstHistory, greaterThan(1));
+  });
+
+  test('a refused key ends the session without asking for history', () async {
+    final (events, link) = await _drive(_adapter(), (i, v) {
+      if (v.first == 0x2f && v[2] == 0x2b) return [_nonceReply];
+      if (v.first == 0x2f && v[2] == 0x2d) return [_authBad];
+      return const [];
+    });
+    expect(link.writes.any((w) => w.$2.first == 0x10), isFalse);
+    expect(events, isEmpty);
+    expect(link.logs.any((l) => l.contains('authentication refused')), isTrue);
+  });
+
+  test('every event frame reaches raw, decoded or not', () async {
+    final (events, _) = await _drive(_adapter(), ringWithOneBatch);
+    final batches = events.whereType<SampleBatch>().toList();
+    expect(batches, hasLength(1));
+    expect(batches.first.raw, hasLength(3),
+        reason: 'the undecoded 0x60 frame must be banked too');
+    // Verbatim, header included, so a later decoder sees what the radio saw.
+    expect(batches.first.raw!.last,
+        Uint8List.fromList(_event(0x60, 300, _hex('0102030405060708090a0b0c0d0e'))));
+    // Not ephemeral: history is exactly what is meant to be persisted.
+    expect(batches.first.ephemeral, isFalse);
+  });
+
+  test('no origin means no sample — the frames are still handed over', () async {
+    // The ring stamps on a counter with no documented epoch, and there is no
+    // command anywhere that reads its clock back. With neither a stored origin
+    // nor a `time_sync` in the drain there is no honest second to put on a
+    // reading, and the arrival of the notification is NOT one: it moves by the
+    // delivery jitter on every connect, so the same physiological second would
+    // be written twice under two keys REPLACE can never collapse.
+    final (events, _) = await _drive(_adapter(), ringWithOneBatch);
+    final batch = events.whereType<SampleBatch>().first;
+    expect(batch.samples, isEmpty);
+    expect(batch.raw, hasLength(3), reason: 'the bytes are banked regardless');
+  });
+
+  test('an injected origin stamps a session that measures none', () async {
+    // 1000 ds = 1782043215, so the reading at 200 ds is 80 seconds earlier.
+    final (events, _) = await _drive(
+      OuraAdapter(
+        key: _kKey,
+        anchor: (1000, 1782043215),
+        confirmTimeout: _kFast,
+        replyTimeout: _kFast,
+      ),
+      ringWithOneBatch,
+    );
+    final samples = events.whereType<SampleBatch>().first.samples;
+    expect(samples, hasLength(1));
+    expect(samples.first.tsEpoch, 1782043215 - 80);
+    expect(samples.first.skinTempC, closeTo(34.36, 0.001));
+    // A ring second that carried a temperature carried no heart rate. Absent is
+    // null; a 0 here would read as the off-skin sentinel downstream.
+    expect(samples.first.hr, isNull);
+    expect(samples.first.rrMs, isEmpty);
+  });
+
+  test('a bookmark past the end of the ring is reported, not mistaken for '
+      'an empty ring', () async {
+    // The decisecond counter is an uptime, so a ring that reboots restarts it
+    // below a bookmark taken before the reboot. Every request from there matches
+    // nothing, forever, while the ring quietly fills up — and with no signal it
+    // reads exactly like "no new data". `bytesLeft` is what separates them.
+    final (events, _) = await _drive(_adapter(startCursorDs: 9391523), (i, v) {
+      if (v.first == 0x2f && v[2] == 0x2b) return [_nonceReply];
+      if (v.first == 0x2f && v[2] == 0x2d) return [_authOk];
+      if (v.first == 0x10) return [_summary(0, 4096)];
+      return const [];
+    });
+    expect(
+      events.whereType<BandNote>().any((n) => n.key == 'oura_cursor_stranded'),
+      isTrue,
+    );
+  });
+
+  test('battery reaches the host as a note, never as a sample', () async {
+    final (events, _) = await _drive(_adapter(), ringWithOneBatch);
+    final notes = events.whereType<BandNote>().toList();
+    expect(notes.any((n) => n.key == 'battery' && n.value == 86), isTrue);
+    expect(notes.any((n) => n.key == 'battery_mv' && n.value == 4040), isTrue);
+  });
+
+  test('the checkpoint advances a cursor — it does not authorise a delete',
+      () async {
+    final (events, link) = await _drive(_adapter(), ringWithOneBatch);
+    expect(events.whereType<OffloadCheckpoint>(), hasLength(1));
+    // The cursor the host is told to persist is the highest envelope stamp in
+    // the batch plus one.
+    final cursor = events
+        .whereType<BandNote>()
+        .firstWhere((n) => n.key == 'oura_cursor_ds');
+    expect(cursor.value, 301);
+    // And the next request actually carries it. Advancing by a flat step
+    // instead would strand the drain inside a busy decisecond.
+    final requests = link.writes.where((w) => w.$2.first == 0x10).toList();
+    expect(requests, hasLength(2));
+    expect(requests.last.$2.sublist(2, 6), <int>[301 & 0xff, 1, 0, 0]);
+    // Nothing that could delete anything was ever written. There is no such
+    // command on this path, and that is the whole reason the seam fits.
+    expect(link.writes.any((w) => w.$2.first == 0x1a), isFalse,
+        reason: 'factory reset');
+    expect(link.writes.any((w) => w.$2.first == 0x03), isFalse,
+        reason: 'the RData channel, whose clear op erases flash');
+  });
+
+  test('a FULL batch re-reads its last decisecond rather than skipping it',
+      () async {
+    // The cursor is a timestamp and the cap is a record count, so a full batch
+    // may have been cut inside a decisecond that held more records than fitted.
+    // Jumping past it would drop the remainder with no gap anything downstream
+    // could see. 255 events all stamped 700, then a short batch at 700.
+    final (events, link) = await _drive(_adapter(), (i, v) {
+      if (v.first == 0x2f && v[2] == 0x2b) return [_nonceReply];
+      if (v.first == 0x2f && v[2] == 0x2d) return [_authOk];
+      if (v.first != 0x10) return const [];
+      final cursor = v[2] | (v[3] << 8) | (v[4] << 16) | (v[5] << 24);
+      if (cursor == 0) {
+        return [
+          for (var n = 0; n < 255; n++)
+            _event(kOuraEvtTempPeriod, 700, _hex('6c0d')),
+          _summary(255, 4096),
+        ];
+      }
+      return [_event(kOuraEvtTempPeriod, 700, _hex('6c0d')), _summary(1, 0)];
+    });
+    final cursors = events
+        .whereType<BandNote>()
+        .where((n) => n.key == 'oura_cursor_ds')
+        .map((n) => n.value)
+        .toList();
+    // 700, not 701 — the boundary decisecond is read again. Then 701 once the
+    // batch came back short, which is what ends the drain.
+    expect(cursors, <Object?>[700, 701]);
+    expect(link.writes.where((w) => w.$2.first == 0x10), hasLength(2));
+    // The cap is on the wire, not left to a default that could drift from the
+    // number the advance compares against.
+    expect(link.writes.firstWhere((w) => w.$2.first == 0x10).$2[6], 255);
+  });
+
+  test('an unconfirmed batch leaves the cursor where it was', () async {
+    // The host committing nothing is the same outcome as the host being slow:
+    // the ring keeps everything and the batch is re-read next time. This is the
+    // safe half of commit-then-confirm, in the only currency this band has.
+    final (events, link) = await _drive(
+      _adapter(),
+      ringWithOneBatch,
+      confirmBatches: false,
+    );
+    expect(events.whereType<OffloadCheckpoint>(), hasLength(1));
+    expect(events.whereType<BandNote>().any((n) => n.key == 'oura_cursor_ds'),
+        isFalse);
+    expect(link.writes.where((w) => w.$2.first == 0x10), hasLength(1));
+  });
+
+  test('a resumed session asks from the bookmark it was given', () async {
+    final (_, link) = await _drive(
+      _adapter(startCursorDs: 9391523),
+      (i, v) {
+        if (v.first == 0x2f && v[2] == 0x2b) return [_nonceReply];
+        if (v.first == 0x2f && v[2] == 0x2d) return [_authOk];
+        if (v.first == 0x10) return [_summary(0, 0)];
+        return const [];
+      },
+    );
+    final first = link.writes.firstWhere((w) => w.$2.first == 0x10);
+    expect(first.$2.sublist(2, 6), _hex('a34d8f00'));
+  });
+
+  test('a time_sync event re-anchors the batch that carries it', () async {
+    // The ring stamps records on a decisecond counter with no documented epoch.
+    // A `time_sync` event is the only record carrying both clocks, so it is the
+    // only measured bridge — without one the origin is the arrival second.
+    const syncUnix = 1782043215;
+    final (events, _) = await _drive(_adapter(), (i, v) {
+      if (v.first == 0x2f && v[2] == 0x2b) return [_nonceReply];
+      if (v.first == 0x2f && v[2] == 0x2d) return [_authOk];
+      if (v.first == 0x10) {
+        final cursor = v[2] | (v[3] << 8) | (v[4] << 16) | (v[5] << 24);
+        if (cursor > 0) return [_summary(0, 0)];
+        return [
+          _event(kOuraEvtTimeSync, 1000, _hex('4fd2376a')),
+          // 200 deciseconds — 20 seconds — after the sync.
+          _event(kOuraEvtTempPeriod, 1200, _hex('6c0d')),
+          _summary(2, 0),
+        ];
+      }
+      return const [];
+    });
+    final s = events.whereType<SampleBatch>().first.samples.single;
+    expect(s.tsEpoch, syncUnix + 20);
+    expect(s.skinTempC, closeTo(34.36, 0.001));
+    // And the origin is handed back out, so the host persists the one this
+    // session measured instead of deriving a second one of its own.
+    expect(
+      events.whereType<BandNote>().firstWhere((n) => n.key == 'oura_anchor').value,
+      '1000,$syncUnix',
+    );
+    // Still declared as arrival-anchored: one measured bridge in one session
+    // does not make the origin stable across sessions, and the time-axis
+    // metrics must keep refusing until it is.
+    expect(kOura.timeAnchor, TimeAnchor.arrival);
+  });
+}
diff --git a/test/adapters/oura_auth_crypto_test.dart b/test/adapters/oura_auth_crypto_test.dart
new file mode 100644
index 00000000..49b4e439
--- /dev/null
+++ b/test/adapters/oura_auth_crypto_test.dart
@@ -0,0 +1,87 @@
+// Independent confirmation of the Oura auth-proof cryptography — the one
+// piece of the Oura wire format that stays in this repo rather than the
+// protocol package, because it needs a cipher implementation
+// (`package:pointycastle`) that package deliberately has none of.
+//
+// EVERY EXPECTED VALUE BELOW WAS COMPUTED, NOT COPIED: the AES vector is the
+// standard textbook AES-128 encryption of one fixed plaintext block under one
+// fixed key (any conformant AES-128/ECB implementation reproduces it — that
+// is what "independent" means for a block cipher), verified by hand from the
+// algorithm rather than by trusting this file's own encoder to check itself.
+
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_edge/ble/adapters/oura.dart';
+
+Uint8List _hex(String s) => Uint8List.fromList([
+      for (var i = 0; i + 1 < s.length; i += 2)
+        int.parse(s.substring(i, i + 2), radix: 16),
+    ]);
+
+String _toHex(List<int> b) =>
+    b.map((x) => x.toRadixString(16).padLeft(2, '0')).join();
+
+void main() {
+  group('AES-128/ECB auth proof — algorithmic cross-check', () {
+    test('one fixed 16-byte key + 15-byte nonce encrypts to one fixed block',
+        () {
+      // Any conformant AES-128 single-block ECB encryption of this exact
+      // 16-byte plaintext (the 15-byte nonce padded with one PKCS#7 byte of
+      // value 0x01) under this exact key produces this exact ciphertext —
+      // there is nothing ring-specific or capture-specific about it. This is
+      // the same check `ouraAuthResponse`'s own doc comment invites: "the
+      // test can pin it against a known vector without a radio."
+      final key = _hex('4431967d8bacc2659743142b68391d9a');
+      final nonce = _hex('0e2d6a0a08c99b4365f458e6e97382');
+      expect(nonce.length, 15);
+      final out = ouraAuthResponse(key, nonce);
+      expect(_toHex(out), 'a38a8772d3acb6db5c2b516dd56987c8');
+    });
+
+    test('PKCS#7 padding on a 15-byte block is exactly one byte of value 1',
+        () {
+      // A second, independent way to state the same fact: for a 15-byte
+      // input into a 16-byte block, PKCS#7's pad length is 16-15=1 and the
+      // pad byte's VALUE equals the pad length — so the padded block is
+      // `nonce ++ [0x01]`, never `nonce ++ [0x00]` or a full extra block.
+      // Two nonces differing only in their last byte must therefore encrypt
+      // to two DIFFERENT ciphertexts (the padding is not swallowing the
+      // nonce's own final byte).
+      final key = _hex('000102030405060708090a0b0c0d0e0f');
+      final a = ouraAuthResponse(key, _hex('0102030405060708090a0b0c0d0e0e'));
+      final b = ouraAuthResponse(key, _hex('0102030405060708090a0b0c0d0e0f'));
+      expect(_toHex(a), isNot(_toHex(b)));
+    });
+
+    test('the challenge answer is one AES-128-ECB block', () {
+      // Padding a 15-byte nonce to a block adds exactly one 0x01, so this is a
+      // single block encryption and the ciphertext is 16 bytes.
+      final out = ouraAuthResponse(
+        _hex('4431967d8bacc2659743142b68391d9a'),
+        _hex('0e2d6a0a08c99b4365f458e6e97382'),
+      );
+      expect(out.length, 16);
+      // Deterministic: the same key and nonce must always answer the same way,
+      // or a working pairing would break at random.
+      expect(
+        ouraAuthResponse(_hex('4431967d8bacc2659743142b68391d9a'),
+            _hex('0e2d6a0a08c99b4365f458e6e97382')),
+        out,
+      );
+      // A different key must not answer the same way.
+      expect(
+        ouraAuthResponse(_hex('00000000000000000000000000000000'),
+            _hex('0e2d6a0a08c99b4365f458e6e97382')),
+        isNot(out),
+      );
+    });
+
+    test('a wrong-sized key or nonce is refused rather than padded', () {
+      expect(() => ouraAuthResponse(List.filled(8, 0), List.filled(15, 0)),
+          throwsArgumentError);
+      expect(() => ouraAuthResponse(List.filled(16, 0), List.filled(16, 0)),
+          throwsArgumentError);
+    });
+  });
+}
diff --git a/test/ai_briefing_test.dart b/test/ai_briefing_test.dart
index b2fcfb14..2e1afa6d 100644
--- a/test/ai_briefing_test.dart
+++ b/test/ai_briefing_test.dart
@@ -120,6 +120,10 @@ void main() {
       // Evening-only metrics never leak into a morning snapshot.
       expect(inp.containsKey('strain_0_21'), isFalse);
       expect(inp.containsKey('steps'), isFalse);
+      // This night carries no onset/wake. They are NAMED rather than silently
+      // dropped — the prompt's refusal rule is keyed off this list, so a field
+      // that is absent from both is one the model may invent.
+      expect(inp[kWithheldKey], containsAll(<String>['bedtime', 'wake_time']));
     });
 
     test('evening carries findings — never the day read back', () async {
@@ -171,6 +175,106 @@ void main() {
     });
   });
 
+  // A metric the honesty layer REFUSED must not reach the prompt as a value,
+  // and must not reach it as a silence either — a silence is the shape the
+  // model fills in from whatever else it was handed (see kWithheldKey).
+  group('refused metrics', () {
+    test('a refusal is stated with its reason, never sent as a value',
+        () async {
+      final repo = _FakeRepo(
+        today: {
+          'daily': {
+            // Exactly what local_repository_impl._scalarMetric writes for an
+            // absent metric: the em-dash placeholder plus the machine note.
+            'readiness': {
+              'value': '—',
+              'confidence': 0,
+              'tier': 'HIGH',
+              'note': 'need_baseline:have=6,need=14',
+            },
+            'resting_hr': {
+              'value': '—',
+              'confidence': 0,
+              'tier': 'HIGH',
+              'note': 'need_input:name=scored_night',
+            },
+          },
+          'hrv': {'rmssd': 61.2},
+          'status': {'overnight_day': todayLabel()},
+        },
+        daySleep: {'has_sleep': true, 'duration_min': 445},
+      );
+      final inp = await collectBriefingInputs(repo, BriefingPeriod.morning);
+      expect(inp.containsKey('readiness'), isFalse);
+      expect(inp.containsKey('resting_hr'), isFalse);
+      expect(inp['hrv_rmssd'], 61.2);
+      final w = (inp[kWithheldKey] as List).cast<String>();
+      expect(w, contains('readiness (Need 8 more nights)'));
+      expect(
+          w,
+          contains('resting_hr (There is no scored night to read this '
+              'from.)'));
+      // A night with no deep/REM behind it is refused per field, not silently
+      // dropped — that is the one the model narrates from total sleep time.
+      expect(w, contains('deep_min'));
+      expect(w, contains('rem_min'));
+
+      final p = buildBriefingUserPrompt(
+          BriefingPeriod.morning, '2026-07-04', inp, 'morning');
+      expect(p, contains('withheld (refused'));
+      expect(p, contains('- readiness (Need 8 more nights)'));
+      // The refused number never appears as data.
+      expect(p, isNot(contains('readiness: ')));
+      expect(p, isNot(contains('resting_hr: ')));
+      expect(p, contains('hrv_rmssd: 61.2'));
+    });
+
+    test('a whole missing night is one refusal, not five', () async {
+      final repo = _FakeRepo(today: {'daily': {}});
+      final inp = await collectBriefingInputs(repo, BriefingPeriod.morning);
+      final w = (inp[kWithheldKey] as List).cast<String>();
+      expect(w, contains('sleep (no scored night)'));
+      expect(w.where((e) => e.startsWith('deep_min')), isEmpty);
+      // Nothing measured, so the prompt still says so — the refusals are not
+      // mistaken for a payload.
+      final p = buildBriefingUserPrompt(
+          BriefingPeriod.morning, '2026-07-04', inp, 'morning');
+      expect(p, contains('no metrics available'));
+      expect(p, contains('withheld (refused'));
+    });
+
+    test('an absent value can never render as prose, whoever built the map',
+        () {
+      // The structural half of the gate: `\$v` would print these as the word
+      // "null" and as an em dash, both of which read as a reading.
+      final p = buildBriefingUserPrompt(
+        BriefingPeriod.morning,
+        '2026-07-04',
+        {'readiness': null, 'resting_hr': '—', 'hrv_rmssd': 61.2},
+        'morning',
+      );
+      expect(p, isNot(contains('null')));
+      expect(p, isNot(contains('—')));
+      expect(p, contains('hrv_rmssd: 61.2'));
+    });
+
+    test('the system prompt forbids inferring a withheld metric', () {
+      final m = briefingSystemPrompt(BriefingPeriod.morning);
+      expect(m, contains('withheld'));
+      expect(m, contains('REFUSED'));
+      expect(m, contains('reasoned out of the numbers you WERE given'));
+    });
+
+    test('the evening sweep never carries a withheld list', () async {
+      final repo = _FakeRepo(
+        today: _sampleToday(),
+        charts: {'resting_hr': _series(_steady(54, 45), 68)},
+      );
+      final inp = await collectBriefingInputs(repo, BriefingPeriod.evening);
+      expect(inp.containsKey(kWithheldKey), isFalse);
+    });
+  });
+
   group('prompt building (pure)', () {
     test('system prompt scopes by period and forbids invention', () {
       final m = briefingSystemPrompt(BriefingPeriod.morning);
diff --git a/test/band_registry_test.dart b/test/band_registry_test.dart
new file mode 100644
index 00000000..96dd7c9e
--- /dev/null
+++ b/test/band_registry_test.dart
@@ -0,0 +1,149 @@
+// The band registry is the ONE place the BLE engine's device-specific facts
+// live (change-list D1/D2/D3). Every value here used to be a literal in
+// `ble_engine.dart`, so this pins them at exactly what the engine did before —
+// a wrong offset does not throw, it silently reads the wrong byte.
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_edge/ble/adapters/_registry.dart';
+import 'package:openstrap_protocol/openstrap_protocol.dart';
+
+void main() {
+  test('ids are unique and stable — they are stamped as device_family', () {
+    expect(kBandRegistry.map((e) => e.id).toList(),
+        <String>['gen4', 'gen5', 'ble_hrs', 'oura']);
+  });
+
+  test('D1 — the scan service list is exactly the two WHOOP services', () {
+    // [kFramedBands], not the whole registry: the scan filter and the
+    // discovery match are about the band the OFFLOAD ENGINE drives. A
+    // notify-only sensor matching there would be handed to `_doConnect`.
+    expect(kFramedBands.map((e) => e.service).toList(), <String>[
+      GattProfile.gen4.service,
+      GattProfile.gen5.service,
+    ]);
+    expect(kFramedBands.map((e) => e.servicePrefix).toList(),
+        <String>['61080001', 'fd4b0001']);
+  });
+
+  test('D2 — a WHOOP link requires its four command/notify characteristics',
+      () {
+    for (final e in kFramedBands) {
+      expect(e.requiredCharacteristics, <String>[
+        e.gatt!.cmdTo,
+        e.gatt!.cmdFrom,
+        e.gatt!.events,
+        e.gatt!.data,
+      ]);
+    }
+  });
+
+  test('D10 — a generic HRS entry has one service and one notify char', () {
+    expect(kBleHrs.isFramed, isFalse);
+    expect(kBleHrs.service, kHeartRateServiceUuid);
+    expect(kBleHrs.servicePrefix, '0000180d');
+    expect(kBleHrs.requiredCharacteristics, [kHeartRateMeasurementUuid]);
+    // The two halves that could NOT be expressed — see the registry header.
+    expect(kBleHrs.gatt, isNull, reason: 'GattProfile is six WHOOP UUIDs');
+    expect(kBleHrs.wire, isNull, reason: 'BandProfile is a framed envelope');
+  });
+
+  test('D3 — frameOpcodeIndex lands on the opcode of a real built frame', () {
+    // This is the byte the dangerous-opcode block reads. If it moves, the
+    // block silently stops blocking.
+    for (final e in kFramedBands) {
+      final raw = buildCommand(7, Cmd.rebootStrap, const <int>[0x01], e.wire!);
+      expect(raw[e.frameOpcodeIndex], Cmd.rebootStrap, reason: e.id);
+    }
+    expect(kWhoopGen4.frameOpcodeIndex, 6); // 4-byte header + 2
+    expect(kWhoopGen5.frameOpcodeIndex, 10); // 8-byte header + 2
+  });
+
+  test('D3 — historical inner offsets are unchanged from the old literals',
+      () {
+    for (final e in kFramedBands) {
+      expect(e.innerVersionOffset, 1, reason: e.id); // inner[1]
+      expect(e.innerCounterOffset, 3, reason: e.id); // u32(inner, 3)
+    }
+    // A band with no envelope has no inner payload, and -1 throws rather than
+    // reading a plausible-looking wrong byte.
+    expect(kBleHrs.innerVersionOffset, -1);
+    expect(kBleHrs.innerCounterOffset, -1);
+  });
+
+  test('a band declares what its timestamps ARE', () {
+    // Not cosmetic: the frequency-domain and per-hour metrics have to refuse
+    // on an arrival anchor, and this is the fact they refuse on.
+    expect(kWhoopGen4.timeAnchor, TimeAnchor.measured);
+    expect(kWhoopGen5.timeAnchor, TimeAnchor.measured);
+    expect(kBleHrs.timeAnchor, TimeAnchor.arrival);
+  });
+
+  test('bandEntryFor maps a wire profile back to its entry', () {
+    expect(bandEntryFor(BandProfile.gen4).id, 'gen4');
+    expect(bandEntryFor(BandProfile.gen5).id, 'gen5');
+  });
+
+  // ── the isGen5 split (D4/D9) ────────────────────────────────────────────
+  // Each expectation below is the LITERAL that used to sit in the matching arm
+  // of an `if (session.band.isGen5)` in `ble_engine.dart`. Nothing here is
+  // derived: a wrong entry does not throw, it sends the wrong bytes to a band
+  // nobody can test against.
+
+  test('D9 — the gen4 arm of every branch that moved, transcribed', () {
+    final c = kWhoopGen4.commands;
+    expect(c.hello, Cmd.getHelloHarvard); //  getHello()
+    expect(c.helloBody, const <int>[0x00]); //  getHello()
+    expect(c.getAdvertisingName, Cmd.getAdvertisingNameHarvard);
+    expect(c.getAdvertisingNameBody, const <int>[0x00]);
+    expect(c.setAdvertisingName, Cmd.setAdvertisingNameHarvard);
+    expect(c.r10R11Realtime, Cmd.sendR10R11Realtime); //  live on/off/re-arm
+    expect(c.opticalDataIsLiveToggle, isTrue); //  enableLiveStreams()
+    expect(c.offloadBody, const <int>[0x00]); //  _offloadPayload
+    expect(kWhoopGen4.preRegistrationDelay, Duration.zero);
+    expect(kWhoopGen4.postRegistrationDelay, Duration.zero);
+    expect(kWhoopGen4.setClockDriftGated, isFalse); //  unconditional SET_CLOCK
+    expect(kWhoopGen4.burstCountGateEnforced, isFalse); //  advisory only
+    expect(kWhoopGen4.logsConsoleOutput, isFalse);
+  });
+
+  test('D9 — the gen5 arm of every branch that moved, transcribed', () {
+    final c = kWhoopGen5.commands;
+    expect(c.hello, Cmd.getHello);
+    expect(c.helloBody, const <int>[0x01]);
+    expect(c.getAdvertisingName, Cmd.getCustomAdvertisingName);
+    expect(c.getAdvertisingNameBody, const <int>[revision1]);
+    expect(c.setAdvertisingName, Cmd.setCustomAdvertisingName);
+    // NULL, not 0x3F: a WHOOP 5 answers Unknown/Unhandled, and null is what
+    // the four live-stream paths read to omit the toggle entirely.
+    expect(c.r10R11Realtime, isNull);
+    // FALSE is the safety boundary: the same opcode is the SAVE-to-history
+    // toggle here, so arming it for live writes a persistent save-enable.
+    expect(c.opticalDataIsLiveToggle, isFalse);
+    expect(c.offloadBody, const <int>[]);
+    expect(kWhoopGen5.preRegistrationDelay, kGen5PreRegistrationDelay);
+    expect(kWhoopGen5.postRegistrationDelay, kGen5PostRegistrationDelay);
+    expect(kWhoopGen5.setClockDriftGated, isTrue);
+    expect(kWhoopGen5.burstCountGateEnforced, isTrue);
+    expect(kWhoopGen5.logsConsoleOutput, isTrue);
+  });
+
+  test('the two bands genuinely differ everywhere the branch said they did',
+      () {
+    // The failure this catches is a copy-paste row: a gen5 entry that silently
+    // carries gen4's opcodes still compiles and still passes every "is it the
+    // right value" assertion written against ONE band.
+    final a = kWhoopGen4.commands;
+    final b = kWhoopGen5.commands;
+    expect(a.hello, isNot(b.hello));
+    expect(a.getAdvertisingName, isNot(b.getAdvertisingName));
+    expect(a.setAdvertisingName, isNot(b.setAdvertisingName));
+    expect(a.r10R11Realtime, isNot(b.r10R11Realtime));
+    expect(a.offloadBody, isNot(b.offloadBody));
+  });
+
+  test('a notify-only sensor has no command table at all', () {
+    // Same rule as the -1 offsets: throwing beats answering with a
+    // plausible-looking WHOOP default that would be written to a chest strap.
+    expect(() => kBleHrs.commands, throwsA(isA<TypeError>()));
+  });
+}
diff --git a/test/band_step_counter_test.dart b/test/band_step_counter_test.dart
index 7a0aa6c3..3644fd9c 100644
--- a/test/band_step_counter_test.dart
+++ b/test/band_step_counter_test.dart
@@ -38,22 +38,22 @@ void main() {
     test('gen4 (no counter on any record) returns NULL, not zero', () {
       // The distinction the whole feature rests on: "this hardware cannot count
       // steps" must not render as "you took no steps".
-      expect(hardwareStepsFromCounter(_sub([-1, -1, -1, -1])), isNull);
-      expect(hardwareStepsFromCounter(Substrate.empty), isNull);
+      expect(hardwareStepsFromCounter(_sub([-1, -1, -1, -1]), cumulativeCounterModulus: 65536), isNull);
+      expect(hardwareStepsFromCounter(Substrate.empty, cumulativeCounterModulus: 65536), isNull);
     });
 
     test('a counter that never moves is a real, confident ZERO', () {
-      expect(hardwareStepsFromCounter(_sub([4000, 4000, 4000])), 0);
+      expect(hardwareStepsFromCounter(_sub([4000, 4000, 4000]), cumulativeCounterModulus: 65536), 0);
     });
 
     test('sums positive deltas, not last minus first', () {
-      expect(hardwareStepsFromCounter(_sub([100, 102, 105, 105, 109])), 9);
+      expect(hardwareStepsFromCounter(_sub([100, 102, 105, 105, 109]), cumulativeCounterModulus: 65536), 9);
     });
 
     test('a u16 WRAP is recovered, not lost and never negative', () {
       // 65530 -> 3 is a 9-step delta through the wrap. Read naively it is
       // -65527, which would drive the total negative.
-      final steps = hardwareStepsFromCounter(_sub([65520, 65530, 3, 6]));
+      final steps = hardwareStepsFromCounter(_sub([65520, 65530, 3, 6]), cumulativeCounterModulus: 65536);
       expect(steps, 10 + 9 + 3);
       expect(steps, isNonNegative);
     });
@@ -62,32 +62,33 @@ void main() {
       // Reboot mid-day: 40000 -> 0. Modulo 65536 that reads as 25536 steps in
       // one second, which fails the plausibility budget and is dropped whole.
       // The steps after the reset still count.
-      expect(hardwareStepsFromCounter(_sub([39998, 40000, 0, 5, 9])), 2 + 5 + 4);
+      expect(hardwareStepsFromCounter(_sub([39998, 40000, 0, 5, 9]), cumulativeCounterModulus: 65536), 2 + 5 + 4);
     });
 
     test('a reset after a LONG unsynced gap still fails the budget', () {
       // The gap is what buys budget, so it is capped: without the cap a 6-hour
       // hole would license 108000 steps and a reset would look like a wrap.
       final s = _sub([40000, 0, 4], startTs: 1_700_000_000, step: 21600);
-      expect(hardwareStepsFromCounter(s), 4);
+      expect(hardwareStepsFromCounter(s, cumulativeCounterModulus: 65536), 4);
     });
 
     test('an implausible forward jump is dropped, not credited', () {
       // The per-step budget floors at 300 (the counter's update cadence is not
       // verified on hardware, so bursty reporting must survive); 9000 steps
       // between two 1 Hz records is a decode artefact, not a sprint.
-      expect(hardwareStepsFromCounter(_sub([100, 9100, 9104])), 4);
+      expect(hardwareStepsFromCounter(_sub([100, 9100, 9104]), cumulativeCounterModulus: 65536), 4);
     });
 
     test('records with no counter are skipped without breaking the chain', () {
       // A mixed page (some records decoded without the field) must not restart
       // the accumulation or double-count across the hole.
-      expect(hardwareStepsFromCounter(_sub([10, -1, -1, 16, 18])), 8);
+      expect(hardwareStepsFromCounter(_sub([10, -1, -1, 16, 18]), cumulativeCounterModulus: 65536), 8);
     });
 
     test('a total is never negative under any counter behaviour', () {
       final adversarial = [65535, 0, 65535, 0, 12, 3, 60000, 1, 1, 65000];
-      final steps = hardwareStepsFromCounter(_sub(adversarial));
+      final steps = hardwareStepsFromCounter(_sub(adversarial),
+          cumulativeCounterModulus: 65536);
       expect(steps, isNotNull);
       expect(steps!, isNonNegative);
     });
@@ -99,19 +100,19 @@ void main() {
       final cut = s.slice(1002, 1004);
       expect(cut.tsSec, [1002, 1003]);
       expect(cut.stepCount, [3, 4]);
-      expect(hardwareStepsFromCounter(cut), 1);
+      expect(hardwareStepsFromCounter(cut, cumulativeCounterModulus: 65536), 1);
     });
 
     test('an absent counter round-trips as ABSENT, never as 0', () {
       final back = Substrate.fromJson(_sub([-1, -1, -1]).toJson());
       expect(back.stepCounterAt(0), isNull);
-      expect(hardwareStepsFromCounter(back), isNull);
+      expect(hardwareStepsFromCounter(back, cumulativeCounterModulus: 65536), isNull);
     });
 
     test('a present counter round-trips by value', () {
       final back = Substrate.fromJson(_sub([7, 9, 9, 20]).toJson());
       expect(back.stepCount, [7, 9, 9, 20]);
-      expect(hardwareStepsFromCounter(back), 13);
+      expect(hardwareStepsFromCounter(back, cumulativeCounterModulus: 65536), 13);
     });
 
     test('a legacy substrate with no step array reads ABSENT everywhere', () {
@@ -132,7 +133,7 @@ void main() {
         skinContact: [0, 0, 0],
       );
       expect(legacy.stepCounterAt(0), isNull);
-      expect(hardwareStepsFromCounter(legacy), isNull);
+      expect(hardwareStepsFromCounter(legacy, cumulativeCounterModulus: 65536), isNull);
       expect(legacy.slice(1, 3).stepCount, isEmpty);
     });
   });
diff --git a/test/bandagnostic_c10_c15_test.dart b/test/bandagnostic_c10_c15_test.dart
new file mode 100644
index 00000000..7e43018d
--- /dev/null
+++ b/test/bandagnostic_c10_c15_test.dart
@@ -0,0 +1,217 @@
+// BANDAGNOSTIC group C, wave 2 — the five changes that stop a band id or a
+// gen4 constant standing in for evidence. One group per item; every case is
+// pure (no DB, no BLE), because every rule under test is.
+
+import 'package:openstrap_analytics/onehz.dart' as ana;
+import 'package:openstrap_edge/compute/substrate.dart';
+import 'package:openstrap_edge/data/live_coverage_policy.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+Substrate _sub({
+  required List<int> hr,
+  List<double>? ax,
+  List<double>? ay,
+  List<double>? az,
+  List<int> stepCount = const [],
+  String? family,
+}) {
+  final n = hr.length;
+  return Substrate(
+    tsSec: [for (var i = 0; i < n; i++) 1_700_000_000 + i],
+    hr: hr,
+    rrTsMs: const [],
+    rrMs: const [],
+    ax: ax ?? List<double>.filled(n, 0.0),
+    ay: ay ?? List<double>.filled(n, 0.0),
+    az: az ?? List<double>.filled(n, 1.0),
+    spo2Red: List<int>.filled(n, 0),
+    spo2Ir: List<int>.filled(n, 0),
+    skinTemp: List<int>.filled(n, 0),
+    skinContact: List<int>.filled(n, 0),
+    stepCount: stepCount,
+    deviceFamily: family,
+  );
+}
+
+void main() {
+  group('C11 — a plausibility bound refuses a reading, it does not replace it',
+      () {
+    test('the HR window is human physiology, so it is band-independent', () {
+      // Not a sensor property: nothing about the strap moves 25 or 230, which
+      // is why this does not go through calibrationFor and an unstamped record
+      // still gets it.
+      expect(plausibleHrOrNull(24), isNull);
+      expect(plausibleHrOrNull(25), 25);
+      expect(plausibleHrOrNull(230), 230);
+      expect(plausibleHrOrNull(231), isNull);
+    });
+
+    test('R-R is bounded as an INTERVAL, not as a rate', () {
+      expect(plausibleRrOrNull(249), isNull);
+      expect(plausibleRrOrNull(250), 250.0);
+      // 2,400 ms is 25 bpm only if you read one gap as a rate. One dropped
+      // beat doubles a gap without the heart doing anything unusual, and the
+      // ectopic filters downstream are built to see exactly this.
+      expect(plausibleRrOrNull(2400), 2400.0);
+      expect(plausibleRrOrNull(2401), isNull);
+      expect(plausibleRrOrNull(0), isNull);
+      expect(plausibleRrOrNull(-800), isNull);
+    });
+
+    test('accel is bounded on what a wrist SUSTAINS, not on the FSR', () {
+      // Exact zero is a fill, not a reading.
+      expect(accelPlausible(0, 0, 0), isFalse);
+      // Ordinary wear and real movement both pass, including well past
+      // protocol's gravity window (magSq 0.25..3.24) that 539a97b had to drop
+      // from the gen5 decoder for rejecting real workout seconds.
+      expect(accelPlausible(0, 0, 1.0), isTrue);
+      expect(accelPlausible(0.1, 0.2, 0.95), isTrue);
+      expect(accelPlausible(2.0, 2.0, 1.0), isTrue); // |a| = 3 g
+      // A second-long mean above 4 g is not a wrist.
+      expect(accelPlausible(0, 0, 4.0), isTrue);
+      expect(accelPlausible(0, 0, 4.01), isFalse);
+      // THE POINT OF NOT USING THE FSR: a decoder that is off by 10x on scale
+      // reads as absent instead of as violent movement. A +/-16 g test would
+      // have passed this.
+      expect(accelPlausible(0, 0, 10.0), isFalse);
+    });
+
+    test('an implausible second is absent, and absent is not "not worn"', () {
+      // A gravity vector out of range no longer counts as a present sample, so
+      // van Hees cannot score it as perfect immobility.
+      final s = _sub(
+        hr: const [60, 60, 60],
+        ax: const [0, 0, 0],
+        ay: const [0, 0, 0],
+        az: const [1.0, 0.0, 9.9],
+      );
+      expect(s.accelPresentAt(0), isTrue);
+      expect(s.accelPresentAt(1), isFalse); // all-zero fill
+      expect(s.accelPresentAt(2), isFalse); // impossible magnitude
+      expect(s.accelPresentFraction(0, 3), closeTo(1 / 3, 1e-12));
+    });
+  });
+
+  group('C12 — the flag is the row\'s own, not the badge\'s', () {
+    test('a real flag is believed whatever the stamp says', () {
+      for (final family in [null, 'gen5', 'gen6', '']) {
+        final s = Substrate(
+          tsSec: const [1, 2],
+          hr: const [60, 60],
+          rrTsMs: const [],
+          rrMs: const [],
+          ax: const [0.0, 0.0],
+          ay: const [0.0, 0.0],
+          az: const [1.0, 1.0],
+          spo2Red: const [0, 0],
+          spo2Ir: const [0, 0],
+          skinTemp: const [0, 0],
+          skinContact: const [0, 0],
+          hrValid: const [1, 0],
+          deviceFamily: family,
+        );
+        expect(s.hrValidAt(0), isTrue, reason: 'family=$family');
+        expect(s.hrValidAt(1), isFalse, reason: 'family=$family');
+      }
+    });
+  });
+
+  group('C13 — an undeclared counter gets no number', () {
+    List<int> counters(List<int> v) => v;
+
+    test('abstains rather than assume the counter never resets', () {
+      final s = _sub(
+        hr: List<int>.filled(4, 60),
+        stepCount: counters([4200, 4260, 4300, 4340]),
+      );
+      // The whole failure this replaces: sum-of-deltas over a MIDNIGHT-RESET
+      // counter publishes 140 for a morning that started at 4,200, at tier
+      // HIGH. Undeclared behaviour ⇒ no claim.
+      expect(
+        hardwareStepsFromCounter(s, cumulativeCounterModulus: null),
+        isNull,
+      );
+      // Declared ⇒ the deltas, exactly as before.
+      expect(
+        hardwareStepsFromCounter(s, cumulativeCounterModulus: 65536),
+        140,
+      );
+    });
+
+    test('the modulus is the source\'s, not a constant in the function', () {
+      // A u8 counter wrapping 250 -> 10 is a delta of 16, and only a caller
+      // that declares 256 can say so. Read as u16 it is 65,296 and dropped.
+      final s = _sub(hr: const [60, 60], stepCount: counters([250, 10]));
+      expect(hardwareStepsFromCounter(s, cumulativeCounterModulus: 256), 16);
+      expect(hardwareStepsFromCounter(s, cumulativeCounterModulus: 65536), 0);
+    });
+  });
+
+  group('C15 — equal rank competes ACROSS devices, sums within one', () {
+    CoverageSpan span(int from, int to, int steps,
+            {bool band = true, String id = ''}) =>
+        CoverageSpan(
+          startTs: from,
+          endTs: to,
+          steps: steps,
+          fromBand: band,
+          deviceId: id,
+        );
+
+    test('two straps on one walk report the walk once', () {
+      // Both spans look like gait (100 spm), so both rank 2 — which is exactly
+      // the pair that used to skip overlap subtraction and publish 6,000.
+      final r = resolveDaySteps([
+        span(0, 1800, 3000, id: 'A'),
+        span(0, 1800, 3000, id: 'B'),
+      ]);
+      expect(r.total, 3000);
+    });
+
+    test('partial overlap is pro-rated, not all-or-nothing', () {
+      final r = resolveDaySteps([
+        span(0, 1800, 3000, id: 'A'),
+        span(900, 2700, 3000, id: 'B'),
+      ]);
+      // B keeps the half of its span A did not cover.
+      expect(r.total, 4500);
+    });
+
+    test('SAME device still sums — this is what re-import relies on', () {
+      final r = resolveDaySteps([
+        span(0, 1800, 3000),
+        span(0, 1800, 3000),
+      ]);
+      expect(r.total, 6000);
+    });
+
+    test('the result does not depend on the order the rows came back in', () {
+      final a = span(0, 1800, 3000, id: 'A');
+      final b = span(600, 2400, 2500, id: 'B');
+      expect(resolveDaySteps([a, b]).total, resolveDaySteps([b, a]).total);
+    });
+
+    test('two devices tied on rank AND start still answer the same way', () {
+      // The pair the rank/start keys cannot separate, so the sort was free to
+      // order it either way — and here the answer really does depend on that
+      // order: B is the denser span, so crediting A first leaves B a remainder
+      // and crediting B first does not. 2,100 or 1,800, by whatever order
+      // SQLite happened to return the rows in.
+      final a = span(0, 1800, 1800, id: 'A'); // 60 spm
+      final b = span(0, 900, 1200, id: 'B'); //  80 spm, same start
+      expect(resolveDaySteps([a, b]).total, resolveDaySteps([b, a]).total);
+    });
+  });
+
+  group('C10 — the family list is open', () {
+    test('a band gets constants per METRIC, not per enum entry', () {
+      const gate = ana.hrCeilingMotionGateG;
+      expect(ana.calibrationFor(gate, 'gen4'), 0.10);
+      expect(ana.calibrationFor(gate, 'gen6'), isNull);
+      // The refusal note's grammar is parsed by the UI — pinned here because
+      // this is the one thing C10 was not allowed to move.
+      expect(ana.unknownFamilyNote('gen6'), 'unknown_device_family:id=gen6');
+      expect(ana.unknownFamilyNote(null), 'unknown_device_family:id=none');
+    });
+  });
+}
diff --git a/test/beat_clock_read_path_test.dart b/test/beat_clock_read_path_test.dart
new file mode 100644
index 00000000..f4d1d70c
--- /dev/null
+++ b/test/beat_clock_read_path_test.dart
@@ -0,0 +1,150 @@
+// The beat clock, end to end through the read path.
+//
+// `decoded_rr` carries two time columns. `rr_ts_ms` is `rec_ts * 1000` — a
+// whole-second staircase that says every beat inside one record happened at the
+// same millisecond. `beat_ts_ms` is where the beat actually was. Until now the
+// read path took the staircase and the measured column was write-only.
+//
+// The contract this file pins:
+//   1. The INTERVAL series does not move — same values, same order — so
+//      `hrvTime(nn)` with no time axis is bit-identical. If THAT moves,
+//      something other than the clock changed. (RMSSD/pNNx as production calls
+//      them, `hrvTime(nn, nnTimesMs: …)`, DO shift a little: the axis decides
+//      which successive pairs count as contiguous. Measured at +0.03% RMSSD /
+//      +0.6% pNN50 over a real 6 h block. SDNN never pairs, so it never moves.)
+//   2. The TIME AXIS does move — that is the whole point.
+//   3. A NULL `beat_ts_ms` (every row banked before the column existed, every
+//      source with no sub-second) falls back to the staircase. Never fabricated.
+//   4. A beat whose second has no `decoded_onehz` row still reaches the
+//      substrate, on a second of its own with ABSENT sensors.
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_analytics/onehz.dart';
+import 'package:openstrap_edge/compute/derive_prepare.dart';
+
+const _t0 = 1780000000;
+
+Map<String, dynamic> _frame(int recTs) => {
+  'rec_ts': recTs,
+  'hr': 58,
+  'ax': 0.0,
+  'ay': 0.0,
+  'az': 1.0,
+  'spo2_red_raw': 1000,
+  'spo2_ir_raw': 1000,
+  'skin_temp_raw': 2000,
+  'device_family': 'gen4',
+};
+
+Map<String, dynamic> _beat(int recTs, int index, int rrMs, {int? beatTsMs}) => {
+  'rec_ts': recTs,
+  'beat_index': index,
+  'rr_ts_ms': recTs * 1000,
+  'rr_ms': rrMs,
+  'beat_ts_ms': beatTsMs,
+};
+
+/// A minute of records with two beats each, placed by the strap's own
+/// sub-second anchor — which drifts, the way a real 32 kHz RTC does, so the
+/// gap between one record's last beat and the next record's first is a real
+/// sub-second quantity and not a multiple of 1,000 ms.
+({List<Map<String, dynamic>> frames, List<Map<String, dynamic>> beats})
+_night() {
+  final frames = <Map<String, dynamic>>[];
+  final beats = <Map<String, dynamic>>[];
+  for (var s = 0; s < 60; s++) {
+    final recTs = _t0 + s;
+    frames.add(_frame(recTs));
+    // The record's own sub-second (32 kHz RTC), drifting the way a real one
+    // does rather than sitting on the whole second.
+    final anchorMs = recTs * 1000 + (s * 37) % 1000;
+    // Two beats: the last at the anchor, the earlier one its interval before.
+    final rrLate = 900 + (s % 5) * 10;
+    final rrEarly = 920 + (s % 3) * 10;
+    beats.add(_beat(recTs, 0, rrEarly, beatTsMs: anchorMs - rrLate));
+    beats.add(_beat(recTs, 1, rrLate, beatTsMs: anchorMs));
+  }
+  return (frames: frames, beats: beats);
+}
+
+void main() {
+  test('beat_ts_ms reaches the substrate and rr_ms is untouched', () {
+    final n = _night();
+    final measured = substrateFromDecodedPage(n.frames, n.beats);
+    final staircase = substrateFromDecodedPage(n.frames, [
+      for (final b in n.beats) {...b}..['beat_ts_ms'] = null,
+    ]);
+
+    // 1. INTERVALS ARE IDENTICAL — same values, same order.
+    expect(measured.rrMs, staircase.rrMs);
+    final mc = correctRr(measured.rrMs, rrTsMs: measured.rrTsMs);
+    final sc = correctRr(staircase.rrMs, rrTsMs: staircase.rrTsMs);
+    // The CLEANED interval series too — the Lipponen-Tarvainen correction
+    // rejects on interval shape, not on where the beat sits.
+    expect(mc.nn, sc.nn);
+    // …so time-domain HRV off the intervals alone is bit-identical. SDNN stays
+    // identical even WITH the axis, because it never pairs.
+    final mHrv = hrvTime(mc.nn), sHrv = hrvTime(sc.nn);
+    expect(mHrv.value?.rmssd, sHrv.value?.rmssd);
+    expect(mHrv.value?.pnn50, sHrv.value?.pnn50);
+    expect(
+      hrvTime(mc.nn, nnTimesMs: mc.nnTimesMs).value?.sdnn,
+      hrvTime(sc.nn, nnTimesMs: sc.nnTimesMs).value?.sdnn,
+    );
+
+    // 2. THE AXIS MOVED. The staircase pins both beats of a record to the same
+    //    millisecond; the measured clock separates them by their own interval.
+    expect(staircase.rrTsMs[0], staircase.rrTsMs[1]);
+    expect(
+      measured.rrTsMs[1] - measured.rrTsMs[0],
+      measured.rrMs[1],
+      reason: 'the spacing IS the interval',
+    );
+    expect(measured.rrTsMs, isNot(staircase.rrTsMs));
+
+    // EVERY inter-record gap is a whole second on the staircase — which is the
+    // reason a sub-second dropout is unrepresentable there, not merely
+    // undetected. On the measured clock the same gaps are real.
+    final crossings = [for (var r = 1; r < 60; r++) r * 2]; // first beat of r
+    for (final i in crossings) {
+      expect(staircase.rrTsMs[i] - staircase.rrTsMs[i - 1], 1000);
+    }
+    expect(
+      crossings
+          .where((i) => measured.rrTsMs[i] - measured.rrTsMs[i - 1] != 1000)
+          .length,
+      crossings.length,
+      reason: 'no measured crossing lands on a whole second by accident',
+    );
+  });
+
+  test('a NULL beat_ts_ms falls back to rr_ts_ms — never fabricated', () {
+    final sub = substrateFromDecodedPage(
+      [_frame(_t0)],
+      [_beat(_t0, 0, 900), _beat(_t0, 1, 910)],
+    );
+    expect(sub.rrTsMs, [_t0 * 1000.0, _t0 * 1000.0]);
+  });
+
+  test('a beat with no 1 Hz frame still becomes a second, sensors absent', () {
+    // Exactly what gen4 historical R10-lite writes: an R-R block with no
+    // decoded_onehz row (db.dart _queueDecodedOneHz). It used to be dropped.
+    final sub = substrateFromDecodedPage(
+      [_frame(_t0), _frame(_t0 + 2)],
+      [
+        _beat(_t0, 0, 900, beatTsMs: _t0 * 1000 + 400),
+        _beat(_t0 + 1, 0, 910, beatTsMs: (_t0 + 1) * 1000 + 300),
+        _beat(_t0 + 2, 0, 905, beatTsMs: (_t0 + 2) * 1000 + 200),
+      ],
+    );
+    expect(sub.tsSec, [_t0, _t0 + 1, _t0 + 2], reason: 'union, still ascending');
+    expect(sub.rrMs.length, 3, reason: 'the orphan beat survived');
+    // The beat-only second carries no measurement — the absent sentinels only.
+    expect(sub.accelPresentAt(1), isFalse);
+    expect(sub.hr[1], 0);
+    expect(sub.skinTemp[1], 0);
+    // …and the frame-backed seconds are untouched.
+    expect(sub.accelPresentAt(0), isTrue);
+    expect(sub.hr[0], 58);
+  });
+}
diff --git a/test/beat_timestamps_test.dart b/test/beat_timestamps_test.dart
index 678949d5..e5ee2f65 100644
--- a/test/beat_timestamps_test.dart
+++ b/test/beat_timestamps_test.dart
@@ -10,6 +10,7 @@
 
 import 'package:flutter_test/flutter_test.dart';
 import 'package:sqflite_common_ffi/sqflite_ffi.dart';
+import 'package:openstrap_edge/compute/substrate.dart' show beatTimesMs;
 import 'package:openstrap_edge/data/db.dart';
 import 'package:openstrap_edge/data/models.dart';
 
@@ -18,17 +19,26 @@ void main() {
     test('no sub-second means no beat time — never a whole second instead', () {
       // The state of every row written before this column existed. NULL says
       // "we did not keep it"; rec_ts * 1000 would say "the beat was here".
-      expect(LocalDb.beatTimesMs(1000, null, [800, 810]), [null, null]);
+      expect(beatTimesMs(1000, null, [800, 810]), [null, null]);
     });
 
     test('the anchor is the strap sub-second, not a rounded second', () {
       // 16384 ticks = exactly half a second on the 32 kHz RTC.
-      expect(LocalDb.beatTimesMs(1000, 16384, [800]), [1000500]);
-      expect(LocalDb.beatTimesMs(1000, 0, [800]), [1000000]);
+      expect(beatTimesMs(1000, 16384, [800]), [1000500]);
+      expect(beatTimesMs(1000, 0, [800]), [1000000]);
       // A tick is ~30 us, so the conversion floors rather than pretending to
       // resolve below a millisecond.
-      expect(LocalDb.beatTimesMs(1000, 1, [800]), [1000000]);
-      expect(LocalDb.beatTimesMs(1000, 32767, [800]), [1000999]);
+      expect(beatTimesMs(1000, 1, [800]), [1000000]);
+      expect(beatTimesMs(1000, 32767, [800]), [1000999]);
+    });
+
+    test('a tick count that is not a sub-second places nothing', () {
+      // A u16 off the wire can hold 40000; a 1/32768 s tick count cannot. It
+      // would anchor 1.22 s past the record it came from and walk every beat
+      // in that record into the wrong second.
+      expect(beatTimesMs(1000, 32768, [800]), [null]);
+      expect(beatTimesMs(1000, 40000, [800, 810]), [null, null]);
+      expect(beatTimesMs(1000, -1, [800]), [null]);
     });
 
     test('beats are spaced by their own intervals, walking backwards', () {
@@ -36,17 +46,17 @@ void main() {
       // after it away. Backwards is the only direction that cannot place a beat
       // AFTER the moment the strap told us about it.
       expect(
-        LocalDb.beatTimesMs(1000, 0, [700, 726]),
+        beatTimesMs(1000, 0, [700, 726]),
         [1000000 - 726, 1000000],
       );
       expect(
-        LocalDb.beatTimesMs(1000, 0, [650, 640, 660, 644]),
+        beatTimesMs(1000, 0, [650, 640, 660, 644]),
         [1000000 - 1944, 1000000 - 1304, 1000000 - 644, 1000000],
       );
     });
 
     test('the spacing IS the interval — the whole point of the column', () {
-      final t = LocalDb.beatTimesMs(1000, 12345, [700, 726, 690]);
+      final t = beatTimesMs(1000, 12345, [700, 726, 690]);
       expect(t[1]! - t[0]!, 726);
       expect(t[2]! - t[1]!, 690);
     });
@@ -56,13 +66,27 @@ void main() {
       // everything earlier in the record is unplaceable. Treating the missing
       // gap as zero would stack two beats on one instant and call it measured.
       expect(
-        LocalDb.beatTimesMs(1000, 0, [700, 0, 690]),
+        beatTimesMs(1000, 0, [700, 0, 690]),
+        [null, 1000000 - 690, 1000000],
+      );
+    });
+
+    test(
+        'an implausible-but-positive interval nulls the beats BEFORE it '
+        'without moving the ones after', () {
+      // 9000 ms is a positive interval `decodeSubstrate` still drops
+      // (kMaxPlausibleRrMs = 2400), so it must be treated exactly like the
+      // non-positive case above: the gap it claims is not trusted, so the
+      // chain stops there. Beat 2 (690 after it) still places correctly —
+      // its own placement never depended on the rejected interval.
+      expect(
+        beatTimesMs(1000, 0, [700, 9000, 690]),
         [null, 1000000 - 690, 1000000],
       );
     });
 
     test('an empty record produces nothing', () {
-      expect(LocalDb.beatTimesMs(1000, 500, const []), isEmpty);
+      expect(beatTimesMs(1000, 500, const []), isEmpty);
     });
   });
 
diff --git a/test/ble_state_test.dart b/test/ble_state_test.dart
index 7938c837..d4cd2576 100644
--- a/test/ble_state_test.dart
+++ b/test/ble_state_test.dart
@@ -3,6 +3,7 @@
 // engine — the backoff schedule, the seq allocator, the drain stop conditions,
 // and the phase→legacy-string projection — none of which need a real band.
 
+import 'dart:async';
 import 'dart:math';
 
 import 'package:flutter_test/flutter_test.dart';
@@ -217,6 +218,32 @@ void main() {
       expect(g.dropped, 1);
     });
 
+    test('a below-floor time base is tellable from a wandering clock', () {
+      // Uptime-since-boot: every stamp is under kMinPlausibleUnix, forever.
+      final uptime = RecordGate();
+      expect(uptime.admit(3600, wallNow: wall), isFalse);
+      expect(uptime.admit(7200, wallNow: wall), isFalse);
+      expect(uptime.droppedBelowFloor, 2);
+      expect(uptime.timeBaseNotWallClock, isTrue);
+
+      // A wandering/future RTC drops too, but NOT below the floor — the case
+      // a reconnect or SET_CLOCK can still resolve.
+      final wandering = RecordGate();
+      expect(wandering.admit(wall + 10 * 86400, wallNow: wall), isFalse);
+      expect(wandering.dropped, 1);
+      expect(wandering.droppedBelowFloor, 0);
+      expect(wandering.timeBaseNotWallClock, isFalse);
+
+      // One below-floor drop among others is not a verdict about the source.
+      final mixed = RecordGate();
+      expect(mixed.admit(1000000000, wallNow: wall), isFalse);
+      expect(mixed.admit(wall + 10 * 86400, wallNow: wall), isFalse);
+      expect(mixed.timeBaseNotWallClock, isFalse);
+
+      // Never a verdict on a gate that has rejected nothing.
+      expect(RecordGate().timeBaseNotWallClock, isFalse);
+    });
+
     test('frontier seed from the durable cursor is honoured', () {
       final g = RecordGate(frontierTs: wall - 50);
       expect(g.frontierTs, wall - 50);
@@ -686,4 +713,40 @@ void main() {
       expect(isTimeoutDisconnect(null), isFalse);
     });
   });
+
+  group('withScanLock (process-wide scan mutex)', () {
+    test('a queued scan does not start until the running one finishes', () async {
+      // The bug this exists for: two overlapping scan bodies share ONE radio
+      // scanner, so the second one's `stopScan` ends the first scan early and
+      // the first reports "found nothing" with no error anywhere.
+      final order = <String>[];
+      final holdA = Completer<void>();
+      final a = withScanLock(() async {
+        order.add('a-start');
+        await holdA.future;
+        order.add('a-end');
+        return 'a';
+      });
+      final b = withScanLock(() async {
+        order.add('b-start');
+        return 'b';
+      });
+      await Future<void>.delayed(Duration.zero);
+      expect(order, ['a-start']); // b is queued, NOT running alongside a
+      holdA.complete();
+      expect(await a, 'a');
+      expect(await b, 'b');
+      expect(order, ['a-start', 'a-end', 'b-start']);
+    });
+
+    test('a scan that throws releases the lock', () async {
+      // A blocker (revoked permission, adapter off) throws out of the band
+      // scan; the next scan must still run rather than wait on a dead chain.
+      await expectLater(
+        withScanLock<void>(() async => throw StateError('adapter off')),
+        throwsStateError,
+      );
+      expect(await withScanLock(() async => 7), 7);
+    });
+  });
 }
diff --git a/test/cadence_decimation_rig_test.dart b/test/cadence_decimation_rig_test.dart
new file mode 100644
index 00000000..9d17ada1
--- /dev/null
+++ b/test/cadence_decimation_rig_test.dart
@@ -0,0 +1,504 @@
+// THE DECIMATION RIG — measure what a slower band's cadence does to a metric,
+// against the only ground truth we have: the same real night at 1 Hz.
+//
+// The premise: OpenStrap holds real 1 Hz WHOOP data, so the true answer for any
+// window-based metric is already known. Take every Nth REAL sample of that same
+// data, run the metric again, and compare. A cadence-aware metric converges on
+// the 1 Hz answer. Most of ours do not, and this file is where that stops being
+// an assertion and becomes a number.
+//
+// IT DOES NOT ASSERT CORRECTNESS. Today's numbers are wrong on purpose — the
+// job right now is to RECORD the baseline error so the group-C agents have
+// something to diff against. The only thing asserted here is the decimator
+// itself (see the pure-unit test at the bottom, which runs with no database).
+//
+// Source data: `OPENSTRAP_TEST_DBS=/path/export.db` — same env-var idiom as
+// `db_migration_ladder_test.dart` / `db_v42_retention_and_provenance_test.dart`.
+// Skipped entirely when unset, because that file is personal and can never be
+// committed. The database is opened READ-ONLY and never migrated: the rig reads
+// `decoded_onehz` / `decoded_rr`, which have carried those column names since
+// well before the v47 re-key, so no ladder is needed and nothing is written.
+//
+// DECIMATION DOES NOT FABRICATE. Every cadence keeps every Nth real record and
+// the RR beats attached to it — no interpolation, no bucket averaging. That is
+// also the physically honest model: a 60 s band emits fewer records, it does
+// not emit averages of the records it skipped. Per-metric notes below say where
+// a metric's own contract would have justified averaging (none of the twelve
+// declare a mean input; `relative_odi` computes its own AC/DC windows and
+// `cardio_stager` its own epoch means, both from raw samples).
+//
+// Run:
+//   OPENSTRAP_TEST_DBS=~/Documents/openstrap/openstrap_export_1786730410696.db \
+//     flutter test test/cadence_decimation_rig_test.dart --concurrency=1
+//
+// Writes `build/cadence_baseline.json` (gitignored) and prints the same table.
+
+import 'dart:convert';
+import 'dart:io';
+import 'dart:math' as math;
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:path/path.dart' as p;
+import 'package:sqflite_common_ffi/sqflite_ffi.dart';
+import 'package:openstrap_analytics/onehz.dart';
+
+/// Cadences under test, seconds per record. 1 is the ground truth.
+///
+/// 301 is not a typo and not decoration: the median-interval helpers in
+/// `load_trimp` / `hr_zones` gate on `<= 300`, so a 300 s device is fine and a
+/// 301 s device falls off a cliff. `advanced_stager` gates on `< 300`, so it
+/// falls one second earlier. Both edges have to be on the table.
+///
+/// 15 s is here because it is where a POSITIONAL window metric does its worst
+/// damage, and it is a cadence real bands actually ship (Fitbit/Garmin publish
+/// 15 s HR). `nocturnalRhr` needs 1800 positions; over an 8 h night that holds
+/// down to 16 s and abstains below it. So the wrong-NUMBER band is roughly
+/// 2–16 s, and the top of it — where "the lowest 30-min mean" has quietly
+/// become "the whole-night mean" — is the ceiling C1 has to clear. Below that
+/// band the metric already fails safe.
+const _cadences = <int>[1, 5, 15, 60, 300, 301];
+
+/// One `decoded_onehz` row, exactly as stored.
+class _Row {
+  final int recTs;
+  final int hr;
+  final double ax, ay, az;
+  final int red, ir, temp;
+  const _Row(this.recTs, this.hr, this.ax, this.ay, this.az, this.red, this.ir,
+      this.temp);
+
+  /// Exact (0,0,0) is the documented "never decoded" sentinel, not a reading.
+  bool get accelPresent => !(ax == 0 && ay == 0 && az == 0);
+}
+
+/// One RR beat, carrying the `rec_ts` of the record that delivered it — which
+/// is what decimation acts on. A band that reports every 60 s hands over the
+/// beats inside the records it sends and none of the ones it skips.
+class _Beat {
+  final int recTs;
+  final double tsMs;
+  final double rrMs;
+  const _Beat(this.recTs, this.tsMs, this.rrMs);
+}
+
+/// Keep every Nth REAL sample, phase-locked to the first row's second.
+///
+/// Not a resample: no value is interpolated, averaged or invented. `everyN <= 1`
+/// is the identity. Non-divisor cadences (301) are honoured exactly — the point
+/// of the 301 case is that it is NOT 300.
+List<T> decimateEveryNth<T>(
+    List<T> rows, int Function(T) secOf, int everyN) {
+  if (everyN <= 1 || rows.isEmpty) return rows;
+  final t0 = secOf(rows.first);
+  return [
+    for (final r in rows)
+      if ((secOf(r) - t0) % everyN == 0) r
+  ];
+}
+
+/// One measured cell of the table.
+class _Cell {
+  final String metric;
+  final int cadence;
+  final double? value;
+  final double? truth;
+  final bool absent;
+  final String unit;
+  final String note;
+  const _Cell(this.metric, this.cadence, this.value, this.truth, this.absent,
+      this.unit, this.note);
+
+  double? get absErr =>
+      (value == null || truth == null) ? null : (value! - truth!).abs();
+  double? get relErr => (absErr == null || truth == null || truth == 0)
+      ? null
+      : absErr! / truth!.abs();
+
+  Map<String, dynamic> toJson() => {
+        'metric': metric,
+        'cadence_s': cadence,
+        'value': value,
+        'truth_1hz': truth,
+        'abs_err': absErr,
+        'rel_err': relErr,
+        'absent': absent,
+        'unit': unit,
+        if (note.isNotEmpty) 'note': note,
+      };
+}
+
+// ── window pickers ──────────────────────────────────────────────────────────
+// Both are one deterministic pass over the record, so the rig picks the same
+// window every run without a hand-tuned constant in it.
+
+/// The [spanSec] window with the LOWEST mean valid HR. Physiologically that is
+/// the night, and it needs no timezone, no staging and no threshold.
+(int, int) _lowestHrWindow(List<_Row> all, int spanSec) =>
+    _extremeHrWindow(all, spanSec, lowest: true);
+
+/// The [spanSec] window with the HIGHEST mean valid HR — the day's hardest
+/// effort, which is what the workout metrics want.
+(int, int) _highestHrWindow(List<_Row> all, int spanSec) =>
+    _extremeHrWindow(all, spanSec, lowest: false);
+
+(int, int) _extremeHrWindow(List<_Row> all, int spanSec,
+    {required bool lowest}) {
+  final t0 = all.first.recTs, t1 = all.last.recTs;
+  final n = t1 - t0 + 1;
+  // Second-indexed prefix sums so every candidate window is O(1).
+  final sum = List<double>.filled(n + 1, 0);
+  final cnt = List<int>.filled(n + 1, 0);
+  final hrAt = List<double>.filled(n, 0);
+  for (final r in all) {
+    if (r.hr > 0) hrAt[r.recTs - t0] = r.hr.toDouble();
+  }
+  for (var i = 0; i < n; i++) {
+    sum[i + 1] = sum[i] + hrAt[i];
+    cnt[i + 1] = cnt[i] + (hrAt[i] > 0 ? 1 : 0);
+  }
+  var bestStart = t0;
+  double? bestMean;
+  // 10-min steps: fine enough to land on the night, coarse enough to be free.
+  for (var s = 0; s + spanSec <= n; s += 600) {
+    final c = cnt[s + spanSec] - cnt[s];
+    // Demand real coverage — an empty window has a mean of nothing, and a
+    // sparsely-covered one is not the window we mean by "the night".
+    if (c < spanSec * 0.8) continue;
+    final m = (sum[s + spanSec] - sum[s]) / c;
+    if (bestMean == null || (lowest ? m < bestMean : m > bestMean)) {
+      bestMean = m;
+      bestStart = t0 + s;
+    }
+  }
+  return (bestStart, bestStart + spanSec);
+}
+
+// ── metric adapters ─────────────────────────────────────────────────────────
+// Each returns ONE scalar plus an absent flag. Absent is a first-class result
+// here: "the metric refused at this cadence" is exactly as informative as a
+// wrong number, and considerably more honest.
+
+typedef _Probe = (double?, bool); // (scalar, absent)
+
+_Probe _nocturnalRhrProbe(List<_Row> rows) {
+  // Fed EXACTLY as the app feeds it: the surviving samples, compacted. That
+  // compaction is the C1 defect — `windowSamples = 1800` counts positions, so
+  // 1800 positions is 30 min at 1 Hz and 2.5 h at 5 s.
+  final m = nocturnalRhr([for (final r in rows) r.hr.toDouble()]);
+  return (m.value?.low30Mean, !m.present);
+}
+
+_Probe _vanHeesProbe(List<_Row> rows) {
+  final m = vanHeesSleepWindow([
+    for (final r in rows)
+      AccelSample(r.recTs * 1000.0, r.ax, r.ay, r.az, valid: r.accelPresent)
+  ]);
+  return (m.value?.sptSec.toDouble(), !m.present);
+}
+
+_Probe _relativeOdiProbe(List<_Row> rows) {
+  final m = relativeOdi(
+    [for (final r in rows) r.red.toDouble()],
+    [for (final r in rows) r.ir.toDouble()],
+    [for (final r in rows) r.recTs.toDouble()],
+  );
+  return (m.value?.odiPerHour, !m.present);
+}
+
+_Probe _cardioStagerProbe(List<_Row> rows, List<_Beat> beats) {
+  final r = cardioStager(
+    [for (final x in rows) x.hr.toDouble()],
+    [
+      for (final x in rows)
+        AccelSample(x.recTs * 1000.0, x.ax, x.ay, x.az, valid: x.accelPresent)
+    ],
+    rrMs: [for (final b in beats) b.rrMs],
+    rrTsMs: [for (final b in beats) b.tsMs],
+  );
+  // wakePct is the Cole-Kripke spine's own output and the number a cadence
+  // error moves first.
+  return (r.base.wakePct, r.base.stages.isEmpty);
+}
+
+_Probe _hrRecoveryProbe(List<_Row> rows) {
+  if (rows.isEmpty) return (null, true);
+  var peak = 0;
+  for (var i = 0; i < rows.length; i++) {
+    if (rows[i].hr > rows[peak].hr) peak = i;
+  }
+  final m = hrRecovery(
+    [for (final r in rows) r.hr],
+    endIndex: peak,
+    tsSec: [for (final r in rows) r.recTs],
+  );
+  return (m.value?.dropBpm, !m.present);
+}
+
+_Probe _hrZonesProbe(List<_Row> rows) {
+  // Total accounted seconds. At any cadence a correct implementation reports
+  // roughly the window span; this is the C9 headline, and 301 s is where it
+  // stops doing that.
+  final t = HeartRateZones.timeInZone(
+    [for (final r in rows) HrSample(r.recTs * 1000.0, r.hr.toDouble())],
+    HeartRateZones.zonesFromMaxHr(190, source: 'rig'),
+  );
+  return (t?.total, t == null);
+}
+
+_Probe _loadTrimpProbe(List<_Row> rows) {
+  final valid = [for (final r in rows) if (r.hr > 0) r];
+  final m = trimpStrain(
+    [for (final r in valid) r.hr.toDouble()],
+    [for (final r in valid) r.recTs.toDouble()],
+    // Fixed anchors: the rig compares a metric against ITSELF at 1 Hz, so the
+    // anchors only have to be constant across cadences, not personal.
+    maxHr: 190,
+    restingHr: 50,
+  );
+  return (m.value, !m.present);
+}
+
+_Probe _orientationProbe(List<_Row> rows) {
+  final tilts = positionSeries([
+    for (final r in rows)
+      AccelSample(r.recTs * 1000.0, r.ax, r.ay, r.az, valid: r.accelPresent)
+  ], epochSec: 30);
+  return (tilts.length.toDouble(), tilts.isEmpty);
+}
+
+_Probe _cyclesProbe(List<_Beat> beats, int onset, int offset) {
+  final m = sleepCyclesMetric(
+    [for (final b in beats) b.rrMs],
+    [for (final b in beats) b.tsMs],
+    onset,
+    offset,
+  );
+  return (m.value?.n.toDouble(), !m.present);
+}
+
+_Probe _riivProbe(List<_Row> rows) {
+  final m = riivRespRate(
+    [for (final r in rows) r.ir.toDouble()],
+    [for (final r in rows) r.recTs.toDouble()],
+  );
+  return (m.value?.brpm, !m.present);
+}
+
+_Probe _rsaProbe(List<_Beat> beats) {
+  final m = rsaRespRate(
+    [for (final b in beats) b.rrMs],
+    [for (final b in beats) b.tsMs],
+    artifactFraction: 0.0,
+  );
+  return (m.value?.brpm, !m.present);
+}
+
+_Probe _advancedStagerProbe(List<_Row> rows, List<_Beat> beats) {
+  final sessions = AdvancedSleepStager.detectSleep(
+    [
+      for (final r in rows)
+        GravTs(r.recTs, r.ax, r.ay, r.az, valid: r.accelPresent)
+    ],
+    [for (final r in rows) HrTs(r.recTs, r.hr.toDouble())],
+    rr: [for (final b in beats) RrTs((b.tsMs / 1000).round(), b.rrMs)],
+  );
+  if (sessions.isEmpty) return (null, true);
+  var best = sessions.first;
+  for (final s in sessions) {
+    if (s.end - s.start > best.end - best.start) best = s;
+  }
+  return ((best.end - best.start).toDouble(), false);
+}
+
+// ── reporting ───────────────────────────────────────────────────────────────
+
+String _fmt(double? v) {
+  if (v == null) return '—';
+  if (v.abs() >= 1000) return v.toStringAsFixed(0);
+  if (v.abs() >= 10) return v.toStringAsFixed(1);
+  return v.toStringAsFixed(3);
+}
+
+String _pct(double? v) => v == null ? '—' : '${(v * 100).toStringAsFixed(1)}%';
+
+String _renderTable(List<_Cell> cells) {
+  final b = StringBuffer();
+  final head = ['metric', 'unit', 'cad', '1 Hz truth', 'value', 'abs err',
+    'rel err', 'absent'];
+  final rows = <List<String>>[
+    head,
+    for (final c in cells)
+      [
+        c.metric,
+        c.unit,
+        '${c.cadence}s',
+        _fmt(c.truth),
+        c.absent ? 'ABSENT' : _fmt(c.value),
+        _fmt(c.absErr),
+        _pct(c.relErr),
+        c.absent ? 'yes' : '',
+      ],
+  ];
+  final w = List<int>.generate(head.length,
+      (i) => rows.map((r) => r[i].length).reduce(math.max));
+  for (var ri = 0; ri < rows.length; ri++) {
+    b.writeln([
+      for (var i = 0; i < head.length; i++) rows[ri][i].padRight(w[i])
+    ].join('  ').trimRight());
+    if (ri == 0) b.writeln(List.generate(w.length, (i) => '-' * w[i]).join('  '));
+  }
+  return b.toString();
+}
+
+void main() {
+  sqfliteFfiInit();
+  databaseFactory = databaseFactoryFfi;
+
+  // The decimator is the one piece of logic in this file that could be
+  // silently wrong, so it gets the one check that runs without a database.
+  test('decimateEveryNth takes every Nth REAL sample, phase-locked, no interp',
+      () {
+    final rows = [for (var t = 100; t < 130; t++) t];
+    int at(int v) => v;
+    expect(decimateEveryNth(rows, at, 1), rows);
+    expect(decimateEveryNth(rows, at, 0), rows);
+    expect(decimateEveryNth(rows, at, 5), [100, 105, 110, 115, 120, 125]);
+    // Phase-locked to the FIRST row, not to the epoch.
+    expect(
+        decimateEveryNth(rows.sublist(3), at, 5), [103, 108, 113, 118, 123, 128]);
+    // Non-divisor cadence: exact, not rounded to a divisor.
+    expect(decimateEveryNth(rows, at, 7), [100, 107, 114, 121, 128]);
+    // Holes survive as holes — nothing is filled in.
+    expect(decimateEveryNth([100, 101, 107, 110], at, 5), [100, 110]);
+    expect(decimateEveryNth(<int>[], at, 5), isEmpty);
+  });
+
+  final real = (Platform.environment['OPENSTRAP_TEST_DBS'] ?? '')
+      .split(',')
+      .where((s) => s.trim().isNotEmpty)
+      .toList();
+
+  for (final src in real) {
+    test('cadence baseline over ${p.basename(src)}', () async {
+      final db = await databaseFactory.openDatabase(src,
+          options: OpenDatabaseOptions(readOnly: true));
+
+      final all = <_Row>[
+        for (final r in await db.query('decoded_onehz',
+            columns: [
+              'rec_ts', 'hr', 'ax', 'ay', 'az',
+              'spo2_red_raw', 'spo2_ir_raw', 'skin_temp_raw'
+            ],
+            orderBy: 'rec_ts'))
+          _Row(
+            r['rec_ts'] as int,
+            r['hr'] as int,
+            (r['ax'] as num).toDouble(),
+            (r['ay'] as num).toDouble(),
+            (r['az'] as num).toDouble(),
+            (r['spo2_red_raw'] as num).toInt(),
+            (r['spo2_ir_raw'] as num).toInt(),
+            (r['skin_temp_raw'] as num).toInt(),
+          )
+      ];
+      expect(all.length, greaterThan(1000),
+          reason: 'need a real 1 Hz record to decimate');
+
+      final (nightA, nightB) = _lowestHrWindow(all, 8 * 3600);
+      final (dayA, dayB) = _highestHrWindow(all, 90 * 60);
+
+      List<_Row> slice(int a, int b) =>
+          [for (final r in all) if (r.recTs >= a && r.recTs < b) r];
+      final night = slice(nightA, nightB);
+      final day = slice(dayA, dayB);
+
+      Future<List<_Beat>> beatsIn(int a, int b) async => [
+            for (final r in await db.rawQuery(
+                'SELECT o.rec_ts AS rec_ts, r.rr_ts_ms AS ts, r.rr_ms AS rr '
+                'FROM decoded_rr r JOIN decoded_onehz o ON o.counter = r.counter '
+                'WHERE o.rec_ts >= ? AND o.rec_ts < ? ORDER BY r.rr_ts_ms',
+                [a, b]))
+              _Beat(r['rec_ts'] as int, (r['ts'] as num).toDouble(),
+                  (r['rr'] as num).toDouble())
+          ];
+      final nightBeats = await beatsIn(nightA, nightB);
+      await db.close();
+
+      // ignore: avoid_print
+      print('[rig] ${p.basename(src)}  rows=${all.length}\n'
+          '[rig] night window $nightA..$nightB  '
+          'rows=${night.length} beats=${nightBeats.length}\n'
+          '[rig] day window   $dayA..$dayB  rows=${day.length}');
+
+      final cells = <_Cell>[];
+      final truth = <String, double?>{};
+
+      void run(String metric, String unit, int cadence, _Probe probe,
+          {String note = ''}) {
+        final (v, absent) = probe;
+        if (cadence == 1) truth[metric] = v;
+        cells.add(
+            _Cell(metric, cadence, v, truth[metric], absent, unit, note));
+      }
+
+      for (final n in _cadences) {
+        final nRows = decimateEveryNth(night, (r) => r.recTs, n);
+        final dRows = decimateEveryNth(day, (r) => r.recTs, n);
+        // A beat rides its record: keep the beats whose parent second survived.
+        final keptSec = {for (final r in nRows) r.recTs};
+        final nBeats = [
+          for (final b in nightBeats)
+            if (keptSec.contains(b.recTs)) b
+        ];
+
+        run('nocturnalRhr', 'bpm', n, _nocturnalRhrProbe(nRows));
+        run('vanHees.sptSec', 's', n, _vanHeesProbe(nRows));
+        run('relativeOdi.perHour', '/h', n, _relativeOdiProbe(nRows));
+        run('cardioStager.wakePct', '%', n, _cardioStagerProbe(nRows, nBeats));
+        run('hrRecovery.dropBpm', 'bpm', n, _hrRecoveryProbe(dRows));
+        run('hrZones.totalSec', 's', n, _hrZonesProbe(dRows));
+        run('loadTrimp.strain', '0-100', n, _loadTrimpProbe(dRows));
+        run('orientation.epochs', 'n', n, _orientationProbe(nRows));
+        run('cycles.n', 'n', n, _cyclesProbe(nBeats, nightA, nightB));
+        run('respRate.riiv', 'brpm', n, _riivProbe(nRows));
+        run('respRate.rsa', 'brpm', n, _rsaProbe(nBeats));
+        run('advancedStager.tstSec', 's', n, _advancedStagerProbe(nRows, nBeats));
+      }
+
+      // `steps` is in the group-C list and CANNOT be measured here. The
+      // pedometer's cadence defect (C7) lives at 50–100 Hz; the only accel this
+      // project ever persists is the 1 Hz substrate (invariant 1 keeps the
+      // 0x2B/0x33 high-rate streams RAM-only), so there is no faster source to
+      // decimate DOWN from. Decimating 1 Hz cannot reach it. Recorded as an
+      // explicit hole rather than silently dropped from the table.
+      cells.add(const _Cell('steps.pedometer', 0, null, null, true, 'steps',
+          'NOT MEASURABLE BY DECIMATION — needs a >=50 Hz source; the 1 Hz '
+          'substrate is the fastest thing persisted. C7 needs a synthetic '
+          'rate sweep, not this rig.'));
+
+      final table = _renderTable(cells);
+      // ignore: avoid_print
+      print('\n$table');
+
+      final out = File(p.join(Directory.current.path, 'build',
+          'cadence_baseline.json'));
+      await out.parent.create(recursive: true);
+      await out.writeAsString(const JsonEncoder.withIndent('  ').convert({
+        'source': p.basename(src),
+        'rows': all.length,
+        'night_window': [nightA, nightB],
+        'day_window': [dayA, dayB],
+        'cadences_s': _cadences,
+        'decimation': 'every Nth real sample, phase-locked to window start; '
+            'no interpolation, no bucket averaging; RR beats ride their record',
+        'cells': [for (final c in cells) c.toJson()],
+      }));
+      // ignore: avoid_print
+      print('[rig] wrote ${out.path}');
+
+      // NO correctness assertions. Only that the rig produced a full grid —
+      // if a probe starts throwing, this is what notices.
+      expect(cells.length, _cadences.length * 12 + 1);
+    }, timeout: const Timeout(Duration(minutes: 10)));
+  }
+}
diff --git a/test/cadence_group_c_nocturnal_rig_test.dart b/test/cadence_group_c_nocturnal_rig_test.dart
new file mode 100644
index 00000000..06dfbe9a
--- /dev/null
+++ b/test/cadence_group_c_nocturnal_rig_test.dart
@@ -0,0 +1,168 @@
+// GROUP C1 ON REAL DATA — what `nocturnalRhr` does at a slower cadence once it
+// is given the clock.
+//
+// `cadence_decimation_rig_test.dart` measures the DEFECT: its probe feeds the
+// bare HR list, which is exactly how the app feeds it today, so the cell it
+// reports is the positional-window error (59.7 → 66.4 bpm at 15 s). That probe
+// must keep doing that — it is the baseline everything else diffs against — so
+// the fix is measured here instead, on the same night of the same export, with
+// `tsSec` supplied.
+//
+// Run:
+//   OPENSTRAP_TEST_DBS=~/Documents/openstrap/openstrap_export_1786730410696.db \
+//     flutter test test/cadence_group_c_nocturnal_rig_test.dart --concurrency=1
+//
+// Skips cleanly with no export, and reads the night window the rig already
+// picked out of `build/cadence_baseline.json` rather than re-deriving it —
+// same window, no second copy of the picker.
+
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_analytics/onehz.dart';
+import 'package:openstrap_edge/compute/substrate.dart' show plausibleHrOrNull;
+import 'package:path/path.dart' as p;
+import 'package:sqflite_common_ffi/sqflite_ffi.dart';
+
+const _cadences = <int>[1, 5, 15, 60, 300, 301];
+
+void main() {
+  sqfliteFfiInit();
+  databaseFactory = databaseFactoryFfi;
+
+  final src = (Platform.environment['OPENSTRAP_TEST_DBS'] ?? '')
+      .split(',')
+      .map((s) => s.trim())
+      .where((s) => s.isNotEmpty)
+      .toList();
+
+  if (src.isEmpty) {
+    test('C1 real-data measurement', () {}, skip: 'set OPENSTRAP_TEST_DBS');
+  }
+
+  for (final path in src) {
+    test('C1 nocturnalRhr with a clock, over ${p.basename(path)}', () async {
+      final baseline =
+          File(p.join(Directory.current.path, 'build', 'cadence_baseline.json'));
+      if (!baseline.existsSync()) {
+        markTestSkipped('run cadence_decimation_rig_test.dart first');
+        return;
+      }
+      final meta = jsonDecode(await baseline.readAsString()) as Map;
+      final win = (meta['night_window'] as List).cast<int>();
+
+      final db = await databaseFactory
+          .openDatabase(path, options: OpenDatabaseOptions(readOnly: true));
+      final rows = await db.query('decoded_onehz',
+          columns: ['rec_ts', 'hr'],
+          where: 'rec_ts >= ? AND rec_ts < ?',
+          whereArgs: [win[0], win[1]],
+          orderBy: 'rec_ts');
+      await db.close();
+
+      final ts = [for (final r in rows) (r['rec_ts'] as int).toDouble()];
+      final hr = [for (final r in rows) (r['hr'] as int).toDouble()];
+      expect(hr.length, greaterThan(1000));
+
+      double? truth;
+      for (final n in _cadences) {
+        final dts = <double>[], dhr = <double>[];
+        for (var i = 0; i < ts.length; i++) {
+          if ((ts[i] - ts.first) % n == 0) {
+            dts.add(ts[i]);
+            dhr.add(hr[i]);
+          }
+        }
+        final blind = nocturnalRhr(dhr); // what the app does today
+        final timed = nocturnalRhr(dhr, tsSec: dts); // what C1 adds
+        truth ??= timed.value?.low30Mean;
+        String f(double? v) => v == null ? 'ABSENT' : v.toStringAsFixed(2);
+        String err(double? v) => (v == null || truth == null)
+            ? '—'
+            : '${((v - truth) / truth * 100).toStringAsFixed(1)}%';
+        // ignore: avoid_print
+        print('[C1] ${n.toString().padLeft(3)}s  '
+            'no-ts ${f(blind.value?.low30Mean).padLeft(6)} ${err(blind.value?.low30Mean).padLeft(7)}   '
+            'ts ${f(timed.value?.low30Mean).padLeft(6)} ${err(timed.value?.low30Mean).padLeft(7)}   '
+            'conf ${timed.confidence.toStringAsFixed(2)}');
+
+        if (n == 1) {
+          // THE GATE: 1 Hz is bit-identical with and without the clock, and
+          // identical to the rig's recorded truth.
+          expect(timed.value!.low30Mean, blind.value!.low30Mean);
+          expect(timed.confidence, blind.confidence);
+          final cell = (meta['cells'] as List).firstWhere((c) =>
+              c['metric'] == 'nocturnalRhr' && c['cadence_s'] == 1) as Map;
+          expect(timed.value!.low30Mean, cell['value']);
+        } else if (n <= 300) {
+          // Every cadence a real band ships lands on the 1 Hz trough, or says
+          // nothing. A number within 2% is the bar; 15 s was +11.2% before.
+          expect(timed.present, isTrue, reason: '${n}s: ${timed.note}');
+          expect((timed.value!.low30Mean - truth!) / truth, closeTo(0, 0.02),
+              reason: '${n}s');
+        } else {
+          // Past what `sampleCadenceSeconds` will vouch for: absent, always.
+          expect(timed.present, isFalse, reason: '${n}s: ${timed.value}');
+        }
+      }
+    }, timeout: const Timeout(Duration(minutes: 5)));
+
+    // WHAT THE WIRING ACTUALLY MOVES. The test above decimates one night to
+    // show the defect at other cadences; this one asks the only question that
+    // decides whether shipping `tsSec` changes a published number TODAY, at
+    // 1 Hz, on this owner's own nights: for every real sleep window the app
+    // scored, is `nocturnalRhr(hr)` the same value as `nocturnalRhr(hr, tsSec)`?
+    //
+    // The windows come from `day_result.window_json` (the segmentation the app
+    // already ran — C1 does not move it) and the HR is read exactly as
+    // `derive_prepare` builds `Substrate.hr`, so the pair of numbers printed
+    // here is the pair the pipeline would publish. Days whose decoded rows have
+    // been pruned past the retention edge have no substrate to re-score and are
+    // skipped, which on a 3-day-retention export is most of them.
+    test('C1 wired: real sleep windows, blind vs timed, over '
+        '${p.basename(path)}', () async {
+      final db = await databaseFactory
+          .openDatabase(path, options: OpenDatabaseOptions(readOnly: true));
+      final days = await db.query('day_result',
+          columns: ['day_id', 'algo_version', 'rhr', 'window_json'],
+          orderBy: 'day_id, algo_version');
+      var scored = 0;
+      for (final d in days) {
+        final w = jsonDecode((d['window_json'] as String?) ?? '{}');
+        if (w is! Map || w['onset_ms'] == null || w['offset_ms'] == null) {
+          continue;
+        }
+        final on = ((w['onset_ms'] as num) / 1000).round();
+        final off = ((w['offset_ms'] as num) / 1000).round();
+        final rows = await db.query('decoded_onehz',
+            columns: ['rec_ts', 'hr'],
+            where: 'rec_ts >= ? AND rec_ts < ?',
+            whereArgs: [on, off],
+            orderBy: 'rec_ts');
+        if (rows.isEmpty) continue;
+        scored++;
+        final ts = [for (final r in rows) (r['rec_ts'] as int).toDouble()];
+        final hr = [
+          for (final r in rows)
+            (plausibleHrOrNull((r['hr'] as num?)?.toInt() ?? 0) ?? 0).toDouble(),
+        ];
+        final blind = nocturnalRhr(hr);
+        final timed = nocturnalRhr(hr, tsSec: ts);
+        String f(double? v) => v == null ? 'ABSENT' : v.toStringAsFixed(3);
+        final b = blind.value?.low30Mean, t = timed.value?.low30Mean;
+        final delta = (b == null || t == null) ? '—' : (t - b).toStringAsFixed(3);
+        // ignore: avoid_print
+        print('[C1-wired] ${d['day_id']} v${d['algo_version']}  '
+            'span ${off - on}s rows ${rows.length} (holes ${off - on - rows.length})  '
+            'stored ${f((d['rhr'] as num?)?.toDouble())}  '
+            'blind ${f(b)}  timed ${f(t)}  Δ $delta');
+      }
+      await db.close();
+      // Not an assertion about the values — this rig exists to REPORT them. The
+      // only thing it guards is that it actually measured something.
+      expect(scored, greaterThan(0),
+          reason: 'no scored sleep window still has decoded rows');
+    }, timeout: const Timeout(Duration(minutes: 5)));
+  }
+}
diff --git a/test/db_integrity_test.dart b/test/db_integrity_test.dart
index dbf510d9..27a4885d 100644
--- a/test/db_integrity_test.dart
+++ b/test/db_integrity_test.dart
@@ -106,12 +106,15 @@ void main() {
     // Written straight in: nothing in the app writes a non-NULL source to
     // these tables today, and that is exactly the state the filter guards.
     await db.insert('decoded_onehz', {
+      // v47 key — see _createDecodedStore.
+      'ts_ms': (ts + 1) * 1000,
       'counter': 701,
       'rec_ts': ts + 1,
       'hr': 155,
       'source': 'Chest strap',
     });
     await db.insert('decoded_rr', {
+      'ts_ms': (ts + 1) * 1000,
       'rec_ts': ts + 1,
       'beat_index': 0,
       'rr_ts_ms': (ts + 1) * 1000,
@@ -144,6 +147,7 @@ void main() {
     // An old beat (its owning row absent — e.g. a leftover) is still deleted by
     // the plain rec_ts-range prune; no counter subquery, no orphan sweep needed.
     await db.insert('decoded_rr', {
+      'ts_ms': oldTs * 1000,
       'rec_ts': oldTs,
       'beat_index': 0,
       'rr_ts_ms': oldTs * 1000,
diff --git a/test/db_migration_ladder_test.dart b/test/db_migration_ladder_test.dart
index 5f164eac..2e85d7fd 100644
--- a/test/db_migration_ladder_test.dart
+++ b/test/db_migration_ladder_test.dart
@@ -25,6 +25,8 @@ import 'package:sqflite_common_ffi/sqflite_ffi.dart';
 import 'package:openstrap_edge/data/db.dart';
 import 'package:openstrap_edge/data/journal_fields.dart';
 import 'package:openstrap_edge/data/models.dart';
+import 'package:openstrap_edge/sync/paired_device.dart';
+import 'package:shared_preferences/shared_preferences.dart';
 
 /// The pre-v3 raw_records shape: keyed by frame hex, NO rec_ts column.
 const _legacyRawDdl = '''
@@ -72,6 +74,46 @@ const _counterKeyedDecodedDdl = [
       'ON decoded_rr(rr_ts_ms, beat_index)',
 ];
 
+/// The PRE-v47 decoded store, exactly as a user on v43..46 has it: `rec_ts` is
+/// the whole primary key of `decoded_onehz`, `decoded_rr` hangs off it by
+/// `(rec_ts, beat_index)`, and `samples` is keyed by the band's flash counter.
+/// This is the shape the device re-key rebuilds, and the one every 3-day
+/// retention window of real 1 Hz data sits in.
+const _preDeviceKeyDecodedDdl = [
+  '''
+  CREATE TABLE decoded_onehz (
+    rec_ts INTEGER PRIMARY KEY,
+    counter INTEGER NOT NULL,
+    hr INTEGER, ax REAL, ay REAL, az REAL,
+    spo2_red_raw INTEGER, spo2_ir_raw INTEGER, skin_temp_raw INTEGER,
+    device_family TEXT, source TEXT, ts_subsec INTEGER)
+''',
+  '''
+  CREATE TABLE decoded_rr (
+    rec_ts INTEGER NOT NULL, beat_index INTEGER NOT NULL,
+    rr_ts_ms INTEGER NOT NULL, rr_ms INTEGER NOT NULL,
+    device_family TEXT, source TEXT, beat_ts_ms INTEGER,
+    PRIMARY KEY (rec_ts, beat_index))
+''',
+  '''
+  CREATE TABLE samples (
+    counter INTEGER PRIMARY KEY, ts INTEGER NOT NULL, hr INTEGER)
+''',
+];
+
+/// The PRE-v49 `live_coverage`, exactly as a user on v27..48 has it: `source`
+/// says band-or-phone and NOTHING says WHICH band, which is why two straps on
+/// one walk could both be credited in full.
+const _preDeviceLiveCoverageDdl = '''
+  CREATE TABLE live_coverage (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    start_ts INTEGER NOT NULL,
+    end_ts INTEGER NOT NULL,
+    steps INTEGER NOT NULL,
+    day TEXT NOT NULL,
+    source TEXT NOT NULL DEFAULT 'band')
+''';
+
 /// The v5-era derived tables, so step 9's derived_day → day_result copy is real.
 const _v5DerivedDdl = [
   '''
@@ -170,6 +212,9 @@ Future<int> _openThroughLocalDb(String name) async {
 }
 
 void main() {
+  // SharedPreferences' mock needs a binding, and the pairing migration below
+  // reads it.
+  TestWidgetsFlutterBinding.ensureInitialized();
   final created = <String>[];
 
   setUpAll(() async {
@@ -570,10 +615,17 @@ void main() {
       expect([for (final r in oh) r['rec_ts']],
           [1785000000, 1785000001, 1785000002]);
       expect([for (final r in oh) r['counter']], [100, 101, 102]);
-      // PK is now rec_ts, not counter.
+      // The key is no longer `counter` (v33) and, since v47, no longer rec_ts
+      // alone either: (device_id, ts_ms), with rec_ts demoted to the indexed
+      // range column and ts_ms carrying the same value it always had.
       final ohInfo = await db.rawQuery('PRAGMA table_info(decoded_onehz)');
-      expect(ohInfo.firstWhere((c) => c['name'] == 'rec_ts')['pk'], 1);
+      expect(ohInfo.firstWhere((c) => c['name'] == 'device_id')['pk'], 1);
+      expect(ohInfo.firstWhere((c) => c['name'] == 'ts_ms')['pk'], 2);
+      expect(ohInfo.firstWhere((c) => c['name'] == 'rec_ts')['pk'], 0);
       expect(ohInfo.firstWhere((c) => c['name'] == 'counter')['pk'], 0);
+      expect([for (final r in oh) r['device_id']], ['', '', '']);
+      expect([for (final r in oh) r['ts_ms']],
+          [1785000000000, 1785000001000, 1785000002000]);
 
       // Beats re-home onto their real second; decoded_rr loses its counter col.
       final rr =
@@ -849,4 +901,358 @@ void main() {
       expect(health['ok'], isTrue, reason: '$health');
     },
   );
+
+  test(
+    'v47 re-keys decoded_onehz / decoded_rr / samples onto (device_id, ts_ms) '
+    'without losing or rewriting a row',
+    () async {
+      const name = 'migrate_v46_device_key_test.db';
+      created.add(name);
+      await _seedOldDb(
+        name,
+        46,
+        [
+          ..._preDeviceKeyDecodedDdl,
+          ..._v5DerivedDdl,
+        ],
+        seedRows: (db) async {
+          for (var i = 0; i < 3; i++) {
+            await db.insert('decoded_onehz', {
+              'rec_ts': 1786000000 + i,
+              'counter': 500 + i,
+              'hr': 60 + i,
+              'ax': 0.1,
+              'ay': 0.2,
+              'az': 0.9,
+              'device_family': 'gen4',
+              'ts_subsec': 16384,
+            });
+            await db.insert('samples', {
+              'counter': 500 + i,
+              'ts': 1786000000 + i,
+              'hr': 60 + i,
+            });
+          }
+          for (var b = 0; b < 2; b++) {
+            await db.insert('decoded_rr', {
+              'rec_ts': 1786000000,
+              'beat_index': b,
+              'rr_ts_ms': 1786000000 * 1000,
+              'rr_ms': 800 + b,
+            });
+          }
+        },
+      );
+
+      expect(await _openThroughLocalDb(name), LocalDb.schemaVersion);
+      final db = await LocalDb.instance;
+
+      // NOTHING IS LOST AND NOTHING IS REWRITTEN. Same rows, same values, plus
+      // a key that can tell two devices apart.
+      final oh = await db.query('decoded_onehz', orderBy: 'rec_ts ASC');
+      expect([for (final r in oh) r['rec_ts']],
+          [1786000000, 1786000001, 1786000002]);
+      expect([for (final r in oh) r['hr']], [60, 61, 62]);
+      expect([for (final r in oh) r['counter']], [500, 501, 502]);
+      // Columns added off-ladder survive the PRAGMA-derived rebuild — the whole
+      // reason the DDL is reconstructed instead of hardcoded.
+      expect([for (final r in oh) r['ts_subsec']], [16384, 16384, 16384]);
+      expect([for (final r in oh) r['device_family']], ['gen4', 'gen4', 'gen4']);
+      // '' is the primary band, reserved permanently; ts_ms is rec_ts*1000
+      // EXACTLY, so the key is as unique as rec_ts was.
+      expect([for (final r in oh) r['device_id']], ['', '', '']);
+      expect([for (final r in oh) r['ts_ms']],
+          [1786000000000, 1786000001000, 1786000002000]);
+
+      for (final t in const ['decoded_onehz', 'decoded_rr', 'samples']) {
+        final info = await db.rawQuery('PRAGMA table_info($t)');
+        expect(info.firstWhere((c) => c['name'] == 'device_id')['pk'], 1,
+            reason: t);
+        expect(info.firstWhere((c) => c['name'] == 'ts_ms')['pk'], 2,
+            reason: t);
+      }
+      // decoded_rr's key is its parent's, one level deeper.
+      final rrInfo = await db.rawQuery('PRAGMA table_info(decoded_rr)');
+      expect(rrInfo.firstWhere((c) => c['name'] == 'beat_index')['pk'], 3);
+      final rr =
+          await db.query('decoded_rr', orderBy: 'ts_ms ASC, beat_index ASC');
+      expect([for (final r in rr) r['rr_ms']], [800, 801]);
+      expect([for (final r in rr) r['ts_ms']],
+          [1786000000000, 1786000000000]);
+
+      // `samples` was keyed by the WHOOP flash counter; it is keyed by time now
+      // and `counter` is demoted to a plain column.
+      final sm = await db.query('samples', orderBy: 'ts ASC');
+      expect([for (final r in sm) r['ts_ms']],
+          [1786000000000, 1786000001000, 1786000002000]);
+      expect([for (final r in sm) r['counter']], [500, 501, 502]);
+
+      // rec_ts stops being the key, so it MUST become an index — every read in
+      // db.dart ranges over it and would otherwise scan the whole table.
+      final ix = await db.rawQuery(
+        "SELECT name FROM sqlite_master WHERE type = 'index' "
+        "AND tbl_name IN ('decoded_onehz', 'decoded_rr')",
+      );
+      final ixNames = {for (final r in ix) r['name']};
+      expect(ixNames, contains('idx_decoded_onehz_rects'));
+      expect(ixNames, contains('idx_decoded_rr_rects'));
+
+      // No leaked temp tables.
+      expect(
+        await db.rawQuery(
+          "SELECT name FROM sqlite_master WHERE name LIKE '%\\_v47' ESCAPE '\\'",
+        ),
+        isEmpty,
+      );
+
+      final health = await LocalDb.schemaHealth();
+      expect(health['ok'], isTrue, reason: '$health');
+    },
+  );
+
+  test(
+    'THE DEDUPE REGRESSION: re-ingesting an already-migrated second leaves '
+    'EXACTLY ONE row — it fires on the next sync, not at migration time',
+    () async {
+      // The v47 re-key is only correct if `ts_ms = rec_ts * 1000` keeps the key
+      // exactly as unique as `rec_ts` was. Widen it by one sub-second and the
+      // band's post-reboot counter reset, a re-drained flash region and a
+      // re-delivered batch each start writing a SECOND row for a second that
+      // already has one — silently doubling the substrate. A ladder test cannot
+      // see that: it only shows up the next time the writer runs.
+      const name = 'v47_dedupe_test.db';
+      created.add(name);
+      await _seedOldDb(name, 46, [..._preDeviceKeyDecodedDdl, ..._v5DerivedDdl],
+          seedRows: (db) async {
+        await db.insert('decoded_onehz', {
+          'rec_ts': 1786000000,
+          'counter': 900,
+          'hr': 55,
+          'ts_subsec': 100,
+        });
+        await db.insert('decoded_rr', {
+          'rec_ts': 1786000000,
+          'beat_index': 0,
+          'rr_ts_ms': 1786000000 * 1000,
+          'rr_ms': 1000,
+        });
+      });
+      expect(await _openThroughLocalDb(name), LocalDb.schemaVersion);
+
+      // The SAME second re-offloaded under a DIFFERENT counter (what a band
+      // reboot produces) and with a different sub-second and a shrinking beat
+      // set — the three things that used to fight over the key.
+      await LocalDb.insertRecordsBatch(
+        [
+          RawRecord(
+            counter: 7,
+            packetType: 47,
+            hex: _v24RecordHex(
+              counter: 7,
+              tsEpoch: 1786000000,
+              hr: 58,
+              rrMs: 950,
+            ),
+            capturedAt: 1786000000 * 1000,
+            recTs: 1786000000,
+          ),
+        ],
+        [null],
+      );
+
+      final db = await LocalDb.instance;
+      final oh = await db.query('decoded_onehz');
+      expect(oh.length, 1, reason: 'newest-wins dedupe must survive the re-key');
+      expect(oh.first['hr'], 58, reason: 'the fresher offload wins');
+      expect(oh.first['ts_ms'], 1786000000000);
+      // The beat set is REPLACED, not merged — and the delete that does it is
+      // now scoped to the writing device.
+      final rr = await db.query('decoded_rr');
+      expect(rr.length, 1);
+      expect(rr.first['rr_ms'], 950);
+    },
+  );
+
+  test(
+    'THE POINT OF THE WHOLE PHASE: a primary row and a secondary row at the '
+    'SAME instant both survive',
+    () async {
+      // Before v47 this was impossible by construction: `decoded_onehz` was
+      // `rec_ts INTEGER PRIMARY KEY` written with REPLACE and `decoded_rr` was
+      // cleared by an unscoped `DELETE ... WHERE rec_ts = ?`, so the second
+      // device did not merge with the first — it DELETED it, row and beats, and
+      // raw_archive prunes at 3 days.
+      const name = 'v47_two_devices_test.db';
+      created.add(name);
+      await _seedOldDb(name, 46, [..._preDeviceKeyDecodedDdl, ..._v5DerivedDdl],
+          seedRows: (db) async {
+        await db.insert('decoded_onehz',
+            {'rec_ts': 1786000000, 'counter': 1, 'hr': 61});
+        await db.insert('decoded_rr', {
+          'rec_ts': 1786000000,
+          'beat_index': 0,
+          'rr_ts_ms': 1786000000 * 1000,
+          'rr_ms': 980,
+        });
+      });
+      expect(await _openThroughLocalDb(name), LocalDb.schemaVersion);
+      final db = await LocalDb.instance;
+
+      await db.insert(
+        'decoded_onehz',
+        {
+          'device_id': 'polar-h10:AABBCC',
+          'ts_ms': 1786000000 * 1000,
+          'rec_ts': 1786000000,
+          'counter': 1,
+          'hr': 59,
+          'source': 'polar_h10',
+        },
+        conflictAlgorithm: ConflictAlgorithm.replace,
+      );
+      await db.insert(
+        'decoded_rr',
+        {
+          'device_id': 'polar-h10:AABBCC',
+          'ts_ms': 1786000000 * 1000,
+          'rec_ts': 1786000000,
+          'beat_index': 0,
+          'rr_ts_ms': 1786000000 * 1000,
+          'rr_ms': 1010,
+          'source': 'polar_h10',
+        },
+        conflictAlgorithm: ConflictAlgorithm.replace,
+      );
+
+      final oh = await db.query('decoded_onehz', orderBy: 'device_id ASC');
+      expect(oh.length, 2);
+      expect([for (final r in oh) r['device_id']], ['', 'polar-h10:AABBCC']);
+      expect([for (final r in oh) r['hr']], [61, 59]);
+
+      final rr = await db.query('decoded_rr', orderBy: 'device_id ASC');
+      expect(rr.length, 2);
+      expect([for (final r in rr) r['rr_ms']], [980, 1010]);
+
+      // And the primary band writing that same second again clears only ITS OWN
+      // beats — the unscoped delete is what made a second device destructive.
+      await LocalDb.insertRecordsBatch(
+        [
+          RawRecord(
+            counter: 2,
+            packetType: 47,
+            hex: _v24RecordHex(
+              counter: 2,
+              tsEpoch: 1786000000,
+              hr: 62,
+              rrMs: 970,
+            ),
+            capturedAt: 1786000000 * 1000,
+            recTs: 1786000000,
+          ),
+        ],
+        [null],
+      );
+      final after = await db.query('decoded_rr', orderBy: 'device_id ASC');
+      expect(after.length, 2);
+      expect([for (final r in after) r['rr_ms']], [970, 1010]);
+      expect(
+        (await db.query('decoded_onehz')).length,
+        2,
+        reason: 'the strap must never evict the other device',
+      );
+    },
+  );
+
+  test(
+    'v49 adds the device store and live_coverage.device_id without moving a '
+    'single day\'s step total',
+    () async {
+      const name = 'migrate_v48_device_table_test.db';
+      created.add(name);
+      await _seedOldDb(
+        name,
+        48,
+        [_preDeviceLiveCoverageDdl, ..._v5DerivedDdl],
+        seedRows: (db) async {
+          // Two band rows over the SAME walk, which is what a re-import
+          // produces. One device ⇒ they sum, and that is what the table has
+          // always meant.
+          for (var i = 0; i < 2; i++) {
+            await db.insert('live_coverage', {
+              'start_ts': 1786000000,
+              'end_ts': 1786001800,
+              'steps': 3000,
+              'day': '2026-08-06',
+              'source': 'band',
+            });
+          }
+        },
+      );
+
+      expect(await _openThroughLocalDb(name), LocalDb.schemaVersion);
+      final db = await LocalDb.instance;
+
+      // The rows are untouched and every one belongs to the primary band —
+      // which is exactly what a pre-v49 row has always meant, so no total moves.
+      final rows = await db.query('live_coverage', orderBy: 'id ASC');
+      expect([for (final r in rows) r['steps']], [3000, 3000]);
+      expect([for (final r in rows) r['device_id']], ['', '']);
+      expect((await LocalDb.resolvedStepsForDay('2026-08-06')).total, 6000);
+
+      // And THE POINT: a second strap over the same walk now competes instead
+      // of being credited in full. This could not fire before the column
+      // existed — the resolver had handled it since the ladder gained
+      // `CoverageSpan.deviceId` and never saw a second id.
+      await LocalDb.addLiveCoverage(
+        1786000000,
+        1786001800,
+        3000,
+        '2026-08-06',
+        deviceId: 'second-strap',
+      );
+      expect((await LocalDb.resolvedStepsForDay('2026-08-06')).total, 6000,
+          reason: 'the walk is counted once more, not twice more');
+
+      // The device store exists, is empty, and is not silently absent from the
+      // health check — the observation table's rung is the worked example.
+      expect(await LocalDb.deviceRow(), isNull);
+      expect(await LocalDb.deviceRows(), isEmpty);
+      final health = await LocalDb.schemaHealth();
+      expect(health['ok'], isTrue, reason: '$health');
+    },
+  );
+
+  test(
+    'the paired band survives the upgrade: the prefs pair migrates into the '
+    'device table on first load',
+    () async {
+      const name = 'migrate_v48_paired_device_test.db';
+      created.add(name);
+      await _seedOldDb(name, 48, [_preDeviceLiveCoverageDdl, ..._v5DerivedDdl]);
+      SharedPreferences.setMockInitialValues({
+        'paired_remote_id': 'AA:BB:CC:DD:EE:FF',
+        'paired_serial': '4C2248092',
+      });
+      expect(await _openThroughLocalDb(name), LocalDb.schemaVersion);
+
+      // A user mid-upgrade must not have to re-pair.
+      final paired = await PairedDevice.load();
+      expect(paired?.remoteId, 'AA:BB:CC:DD:EE:FF');
+      expect(paired?.serial, '4C2248092');
+      // …and the migration is a WRITE, not a read-through: the row is there for
+      // everything that joins on `device_id` from here on.
+      final row = await LocalDb.deviceRow();
+      expect(row?['remote_id'], 'AA:BB:CC:DD:EE:FF');
+      expect(row?['label'], '4C2248092');
+      expect(row?['id'], LocalDb.kPrimaryDeviceId);
+      // The link has not said which band it is, and NULL is that refusal —
+      // never a defaulted 'gen4'.
+      expect(row?['adapter_id'], isNull);
+
+      // Forgetting clears BOTH copies, or the mirror puts it straight back.
+      await PairedDevice.clear();
+      expect(await PairedDevice.load(), isNull);
+      expect(await LocalDb.deviceRow(), isNull);
+    },
+  );
 }
diff --git a/test/db_serve_version_and_reads_test.dart b/test/db_serve_version_and_reads_test.dart
index 21a8d530..ab2584b5 100644
--- a/test/db_serve_version_and_reads_test.dart
+++ b/test/db_serve_version_and_reads_test.dart
@@ -180,6 +180,8 @@ void main() {
         final end = localDayEndSec(label)!;
         for (final ts in [start + 60, end - 90]) {
           await db.insert('decoded_onehz', {
+            // v47 key — see _createDecodedStore.
+            'ts_ms': ts * 1000,
             'rec_ts': ts,
             'counter': ts,
             'hr': 60,
diff --git a/test/db_storage_hygiene_test.dart b/test/db_storage_hygiene_test.dart
index 16e980d5..c3999944 100644
--- a/test/db_storage_hygiene_test.dart
+++ b/test/db_storage_hygiene_test.dart
@@ -1,6 +1,7 @@
 // Storage hygiene:
-//  1. decoded_rr is keyed (rec_ts, beat_index) and carries no redundant
-//     secondary index; rec_ts-range reads are served by the PK auto-index.
+//  1. decoded_rr is keyed (device_id, ts_ms, beat_index) since v47, so the
+//     rec_ts-range derive read is served by ONE secondary index on
+//     (rec_ts, beat_index) — seek, not scan, and no sort.
 //  2. Superseded generations of the recomputable per-day intermediates are
 //     pruned. They are keyed (day_id, algo_version), so every kAlgoVersion
 //     bump wrote a whole new generation beside the old one and nothing
@@ -27,21 +28,25 @@ void main() {
     await databaseFactory.deleteDatabase(p.join(dir, LocalDb.dbName));
   });
 
-  test('decoded_rr carries no redundant secondary index', () async {
+  test('decoded_rr carries exactly ONE secondary index', () async {
     final db = await LocalDb.instance;
     final idx = await _rrIndexes(db);
-    // The (rec_ts, beat_index) PRIMARY KEY auto-indexes; nothing else should be
-    // maintained on this hot insert path.
+    // Since v47 the key is (device_id, ts_ms, beat_index), so the PK auto-index
+    // no longer starts with rec_ts and CANNOT serve the derive read path. One
+    // index on (rec_ts, beat_index) buys it back — and it is the ONLY one this
+    // hot insert path may carry.
     expect(
       idx.where((n) => !n.startsWith('sqlite_autoindex')),
-      isEmpty,
+      ['idx_decoded_rr_rects'],
       reason: 'unexpected secondary index on decoded_rr: $idx',
     );
   });
 
-  test('rec_ts-range reads on decoded_rr are served by the PK auto-index', () async {
-    // decoded_rr shares the rec_ts key with decoded_onehz, so the derive read
-    // path (decodedRrByRecTsRange) is a PK range scan — never a full-table read.
+  test('rec_ts-range reads on decoded_rr seek, and sort from the index',
+      () async {
+    // decoded_rr still shares its RANGE key with decoded_onehz, so the derive
+    // read path (decodedRrByRecTsRange) is an index range scan — never a
+    // full-table read, and never a sort.
     final db = await LocalDb.instance;
     final detail = (await db.rawQuery(
       'EXPLAIN QUERY PLAN SELECT * FROM decoded_rr WHERE rec_ts BETWEEN 1 AND 9 '
@@ -60,7 +65,7 @@ void main() {
     expect(
       plan,
       isNot(contains('USE TEMP B-TREE')),
-      reason: 'ordering should come from the PK: $detail',
+      reason: 'ordering should come from the index: $detail',
     );
   });
 
diff --git a/test/db_v42_retention_and_provenance_test.dart b/test/db_v42_retention_and_provenance_test.dart
index 10e15e85..4a355fd2 100644
--- a/test/db_v42_retention_and_provenance_test.dart
+++ b/test/db_v42_retention_and_provenance_test.dart
@@ -187,6 +187,66 @@ void main() {
     expect(rows.last['source'], isNull);
   });
 
+  test('a strap swap is masked PER-METRIC, and only where the units differ',
+      () async {
+    await _useFreshDb('family_seam_test.db');
+    // Three gen4 nights, then the athlete swaps to a gen5. `skin_temp_adc` is
+    // ADC COUNTS on one side of that seam and CENTI-DEGREES on the other,
+    // under one key, feeding one baseline — this is live today with no second
+    // device involved.
+    for (final d in const [
+      ('2026-03-01', 'gen4'),
+      ('2026-03-02', 'gen4'),
+      ('2026-03-03', 'gen5'),
+    ]) {
+      await LocalDb.putDayResult(
+        dayId: d.$1,
+        algoVersion: 76,
+        payloadJson: '{}',
+        windowJson: '{}',
+        source: 'band',
+        deviceFamily: d.$2,
+        series: {'rhr': 55, 'skin_temp_adc': 30000},
+      );
+    }
+    // Foreign = not the newest stamped family. The gen5 night is the CURRENT
+    // one, so the two gen4 nights are what a skin-temp baseline must drop.
+    expect(await LocalDb.foreignFamilyDates(), {'2026-03-01', '2026-03-02'});
+    // ...and only skin temp. RHR off a different WHOOP is the same quantity
+    // measured slightly differently — masking it would delete real history to
+    // fix a bias smaller than the window it is measured over.
+    expect(LocalDb.familySeamKeys, {'skin_temp_adc'});
+
+    // A day with NO stamp is UNKNOWN, never foreign — every day written before
+    // the column existed reads NULL, and dropping those would empty a real
+    // user's baseline.
+    await LocalDb.putDayResult(
+      dayId: '2026-03-04',
+      algoVersion: 76,
+      payloadJson: '{}',
+      windowJson: '{}',
+      series: {'rhr': 56},
+    );
+    expect(await LocalDb.foreignFamilyDates(), isNot(contains('2026-03-04')));
+  });
+
+  test('one family is never foreign to itself — the mask moves no number today',
+      () async {
+    await _useFreshDb('family_seam_single_test.db');
+    for (final d in const ['2026-04-01', '2026-04-02']) {
+      await LocalDb.putDayResult(
+        dayId: d,
+        algoVersion: 76,
+        payloadJson: '{}',
+        windowJson: '{}',
+        source: 'band',
+        deviceFamily: 'gen4',
+        series: {'skin_temp_adc': 30000},
+      );
+    }
+    expect(await LocalDb.foreignFamilyDates(), isEmpty);
+  });
+
   test('the 3-day prune keeps wear/charge transitions and drops the rest',
       () async {
     await _useFreshDb('v42_band_events_test.db');
@@ -315,6 +375,94 @@ void main() {
       .where((s) => s.trim().isNotEmpty)
       .toList();
   for (final src in real) {
+    test(
+      're-keys ${p.basename(src)} onto (device_id, ts_ms) — and how long the '
+      'launch-path ladder takes to do it',
+      () async {
+        // `onUpgrade` runs inside openDatabase, on iOS's launch-path CPU
+        // watchdog. The v47 rebuild is bounded by `rawRetentionDays` (~3 days
+        // of 1 Hz), which is what makes it safe to run there — this test is
+        // where that claim gets a number instead of an assurance.
+        final name = 'v47_${p.basenameWithoutExtension(src)}.db';
+        await _useFreshDb(name);
+        final dir = await databaseFactory.getDatabasesPath();
+        await File(src).copy(p.join(dir, name));
+
+        // EVERY day_result BEFORE the ladder runs. Phase 2 must not move a
+        // single computed number — no kAlgoVersion bump ships with it — so the
+        // payloads have to come back byte-identical. Opened with NO version so
+        // sqflite does not migrate it out from under the snapshot.
+        final plain = await databaseFactory.openDatabase(
+          p.join(dir, name),
+          options: OpenDatabaseOptions(readOnly: true),
+        );
+        final beforeDays = {
+          for (final r in await plain.query('day_result'))
+            '${r['day_id']}|${r['algo_version']}': r['payload_json'],
+        };
+        await plain.close();
+        expect(beforeDays, isNotEmpty);
+
+        final sw = Stopwatch()..start();
+        final db = await LocalDb.instance;
+        sw.stop();
+        final afterDays = {
+          for (final r in await db.query('day_result'))
+            '${r['day_id']}|${r['algo_version']}': r['payload_json'],
+        };
+        expect(afterDays, beforeDays,
+            reason: 'the re-key must not touch a derived number');
+        final before = <String, int>{};
+        for (final t in const ['decoded_onehz', 'decoded_rr', 'samples']) {
+          before[t] = await _count('SELECT COUNT(*) FROM $t');
+        }
+        // ignore: avoid_print
+        print('[v47] ${p.basename(src)} whole ladder open: '
+            '${sw.elapsedMilliseconds} ms  rows=$before');
+
+        for (final t in const ['decoded_onehz', 'decoded_rr', 'samples']) {
+          final info = await db.rawQuery('PRAGMA table_info($t)');
+          expect(info.firstWhere((c) => c['name'] == 'device_id')['pk'], 1,
+              reason: t);
+          expect(info.firstWhere((c) => c['name'] == 'ts_ms')['pk'], 2,
+              reason: t);
+          // Every migrated row belongs to the primary band and carries the
+          // time it always had. Nothing is rewritten, nothing is dropped.
+          expect(
+            await _count("SELECT COUNT(*) FROM $t WHERE device_id <> ''"),
+            0,
+            reason: t,
+          );
+        }
+        expect(
+          await _count(
+            'SELECT COUNT(*) FROM decoded_onehz WHERE ts_ms <> rec_ts * 1000',
+          ),
+          0,
+        );
+        expect(
+          await _count(
+            'SELECT COUNT(*) FROM decoded_rr WHERE ts_ms <> rec_ts * 1000',
+          ),
+          0,
+        );
+        expect(await _count('SELECT COUNT(*) FROM samples WHERE ts_ms <> ts * 1000'), 0);
+
+        // Re-opening is a no-op: the rung self-skips on a table that already
+        // carries device_id, so a second launch pays nothing.
+        await LocalDb.close();
+        final sw2 = Stopwatch()..start();
+        await LocalDb.instance;
+        sw2.stop();
+        // ignore: avoid_print
+        print('[v47] ${p.basename(src)} second open (no ladder): '
+            '${sw2.elapsedMilliseconds} ms');
+
+        final health = await LocalDb.schemaHealth();
+        expect(health['ok'], isTrue, reason: '$src $health');
+      },
+      timeout: const Timeout(Duration(minutes: 15)),
+    );
     test(
       'migrates ${p.basename(src)} to v42',
       () async {
diff --git a/test/db_v43_nullable_hr_test.dart b/test/db_v43_nullable_hr_test.dart
index 9afe59a2..92f2d896 100644
--- a/test/db_v43_nullable_hr_test.dart
+++ b/test/db_v43_nullable_hr_test.dart
@@ -116,7 +116,10 @@ void main() {
     //    always used for "no heart rate this second" — never as a throw.
     final samples = await LocalDb.samplesInRange(2000, 2002);
     expect(samples.map((s) => s.hr), [60, 0, 80]);
-    expect(samples[1].wristOn, isFalse);
+    // `Sample.wristOn` (`hr > 0`) is GONE — BANDAGNOSTIC C11. It was the one
+    // reader in the app that turned "no usable heart rate this second" into
+    // "the band was off your wrist", and it had no callers. Wear truth is the
+    // HELLO body, the wrist on/off events and record presence.
 
     // 2. Every SQL read is gated `hr > 0`, which NULL fails — so the
     //    heart-rate readers simply do not see the second, rather than
diff --git a/test/device_sources_test.dart b/test/device_sources_test.dart
new file mode 100644
index 00000000..ceba2f6c
--- /dev/null
+++ b/test/device_sources_test.dart
@@ -0,0 +1,101 @@
+// THE SOURCES SCREEN, once a sensor can be paired.
+//
+// What is pinned here is the set of claims the screen makes ABOUT a paired
+// sensor, because every one of them was true of the band and is false of a
+// strap:
+//
+//   * a sensor is not a band. `isBand` gates the "No band is paired" card, the
+//     rename/find/battery controls, and `unpair()`. A strap satisfying it
+//     would have taken that card off the screen of someone whose sleep,
+//     recovery and temperature are all still abstaining — and pointed a
+//     chest strap's Forget button at the WHOOP.
+//   * EXPERIMENTAL has to reach it. The label exists for exactly the bands
+//     nobody here has held, and it used to be gated on `isBand`, which is the
+//     one flag a sensor does not have.
+//   * "Reporting steps" is the phone's sentence. A sensor whose tier cannot be
+//     named falls back to the phone's rung, and the state line must not
+//     inherit the phone's words with it.
+
+import 'package:flutter/material.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_edge/ui2/profile/devices.dart';
+import 'package:openstrap_edge/ui2/ui2.dart';
+
+HealthSource _sensor({String? tier = 'beatToBeat', bool connected = false}) =>
+    HealthSource(
+      name: 'Polar H10',
+      kind: 'Bluetooth heart rate sensor',
+      tier: tierNamed(tier) ?? SourceTier.phone,
+      icon: Icons.favorite,
+      connected: connected,
+      isBand: false,
+      deviceId: 'ble_hrs-0a1b2c3d',
+      family: 'ble_hrs',
+    );
+
+void main() {
+  test('a paired sensor is experimental — the label is not gated on isBand',
+      () {
+    expect(_sensor().experimental, isTrue);
+    // The phone has no family and must not pick the label up.
+    expect(
+      const HealthSource(
+        name: 'This phone',
+        kind: 'Motion coprocessor',
+        tier: SourceTier.phone,
+        icon: Icons.phone_android,
+      ).experimental,
+      isFalse,
+    );
+  });
+
+  test('a sensor is never described in the phone\'s words', () {
+    // Its own state line, whatever rung it landed on.
+    expect(sourceState(_sensor()), 'Waiting for a workout');
+    expect(sourceState(_sensor(connected: true)), 'Streaming beats');
+    // The case that made this necessary: an unnameable tier falls back to the
+    // phone's rung, and used to inherit "No steps arriving" with it.
+    final unknown = _sensor(tier: 'someFutureRung');
+    expect(unknown.tier, SourceTier.phone);
+    expect(sourceState(unknown), 'Waiting for a workout');
+  });
+
+  test('tierNamed refuses a rung this build does not have', () {
+    expect(tierNamed('beatToBeat'), SourceTier.beatToBeat);
+    expect(tierNamed(null), isNull);
+    expect(tierNamed(''), isNull);
+    expect(tierNamed('someFutureRung'), isNull);
+  });
+
+  testWidgets('the tier-1 rung is drawn even when empty, now that it is '
+      'reachable', (t) async {
+    // Tall surface: the ladder sits at the foot of a ListView, and an
+    // offscreen row is simply not built.
+    t.view.physicalSize = const Size(390 * 3, 2400 * 3);
+    t.view.devicePixelRatio = 3;
+    addTearDown(t.view.reset);
+    await t.pumpWidget(MaterialApp(
+      theme: buildTheme(Brightness.light),
+      home: MyDevicesView(sources: const [], onAddSensor: () {}),
+    ));
+    await t.pumpAndSettle();
+    expect(find.text('Add a sensor'), findsOneWidget);
+    const t1 = SourceTier.beatToBeat;
+    final rung = find.text('Tier ${t1.rank} · ${t1.label}');
+    await t.scrollUntilVisible(rung, 300, scrollable: find.byType(Scrollable).first);
+    expect(rung, findsOneWidget);
+    // Empty, and saying so — the rung is an invitation now, not a dead end.
+    expect(find.text('Nothing here yet'), findsWidgets);
+  });
+
+  testWidgets('a paired strap does not satisfy "a band is paired"', (t) async {
+    await t.pumpWidget(MaterialApp(
+      theme: buildTheme(Brightness.light),
+      home: MyDevicesView(sources: [_sensor()], onPair: () {}, onAddSensor: () {}),
+    ));
+    await t.pumpAndSettle();
+    // The card that offers to pair a BAND is still there, because one is not.
+    expect(find.text('Pair a band'), findsOneWidget);
+    expect(find.text('Polar H10'), findsOneWidget);
+  });
+}
diff --git a/test/gen5_wiring_test.dart b/test/gen5_wiring_test.dart
index aef2bfc8..0a6d670c 100644
--- a/test/gen5_wiring_test.dart
+++ b/test/gen5_wiring_test.dart
@@ -15,6 +15,7 @@ import 'dart:typed_data';
 
 import 'package:fake_async/fake_async.dart';
 import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_edge/ble/adapters/_registry.dart';
 import 'package:openstrap_edge/ble/ble_engine.dart';
 import 'package:openstrap_edge/ble/ble_state.dart';
 import 'package:openstrap_edge/data/models.dart';
@@ -750,10 +751,15 @@ void _bootstrap() {
     });
 
     test('the delays are the observed 600/500 ms and gen5-only', () {
-      expect(BleEngine.kGen5PreRegistrationDelay,
+      // Read off the band table now, which is what the bootstrap reads. The
+      // gen4 row is asserted here too: "gen5-only" is no longer a branch in
+      // the engine, it is WHOOP 4 declaring zero.
+      expect(kWhoopGen5.preRegistrationDelay,
           const Duration(milliseconds: 600));
-      expect(BleEngine.kGen5PostRegistrationDelay,
+      expect(kWhoopGen5.postRegistrationDelay,
           const Duration(milliseconds: 500));
+      expect(kWhoopGen4.preRegistrationDelay, Duration.zero);
+      expect(kWhoopGen4.postRegistrationDelay, Duration.zero);
       fakeAsync((async) {
         final link = _BootstrapLink(band: BandProfile.gen4);
         link.engine.debugBootstrapAfterRegistration();
diff --git a/test/hr_sensor_parse_test.dart b/test/hr_sensor_parse_test.dart
deleted file mode 100644
index f18156be..00000000
--- a/test/hr_sensor_parse_test.dart
+++ /dev/null
@@ -1,69 +0,0 @@
-import 'package:flutter_test/flutter_test.dart';
-import 'package:openstrap_edge/ble/hr_sensor.dart';
-
-// 0x2A37 Heart Rate Measurement. The parser is the whole load-bearing piece of
-// the external-sensor path: everything after it is transport.
-void main() {
-  test('uint8 HR, no RR', () {
-    final s = parseHeartRateMeasurement([0x00, 72])!;
-    expect(s.hr, 72);
-    expect(s.rrMs, isEmpty);
-    expect(s.contact, isNull); // contact not supported → absent, not "false"
-  });
-
-  test('uint16 HR reads little-endian', () {
-    final s = parseHeartRateMeasurement([0x01, 0x2C, 0x01])!; // 300
-    expect(s.hr, 300);
-  });
-
-  test('RR intervals convert from 1/1024 s to ms', () {
-    // 1024 ticks = 1000 ms; 512 = 500 ms.
-    final s = parseHeartRateMeasurement([0x10, 60, 0x00, 0x04, 0x00, 0x02])!;
-    expect(s.rrMs, [1000, 500]);
-  });
-
-  test('energy-expended field is skipped, not read as an RR interval', () {
-    // flags 0x18 = RR present + energy expended present. The 2-byte energy
-    // field sits BETWEEN hr and the RR list; reading it as RR is the classic
-    // bug and would yield a bogus first interval.
-    final s = parseHeartRateMeasurement([
-      0x18, 60, //
-      0xE8, 0x03, // energy expended = 1000 kJ
-      0x00, 0x04, // RR = 1024 ticks = 1000 ms
-    ])!;
-    expect(s.rrMs, [1000]);
-  });
-
-  test('contact bits: reported false is distinguishable from unsupported', () {
-    expect(parseHeartRateMeasurement([0x04, 60])!.contact, isFalse); // 0b10
-    expect(parseHeartRateMeasurement([0x06, 60])!.contact, isTrue); // 0b11
-    expect(parseHeartRateMeasurement([0x02, 60])!.contact, isNull); // 0b01
-  });
-
-  test('implausible beat intervals are dropped, not clamped', () {
-    // 8 ticks ≈ 8 ms and 4096 ticks = 4 s: neither is a beat. A clamped value
-    // would be a fabricated one.
-    final s = parseHeartRateMeasurement([
-      0x10, 60, //
-      0x08, 0x00, // 8 ms
-      0x00, 0x10, // 4000 ms
-      0x00, 0x04, // 1000 ms — the only real one
-    ])!;
-    expect(s.rrMs, [1000]);
-  });
-
-  test('a searching sensor reporting 0 bpm is not a measurement', () {
-    expect(parseHeartRateMeasurement([0x00, 0]), isNull);
-  });
-
-  test('truncated values are dropped rather than patched up', () {
-    expect(parseHeartRateMeasurement([0x00]), isNull);
-    expect(parseHeartRateMeasurement([]), isNull);
-    expect(parseHeartRateMeasurement([0x01, 0x48]), isNull); // uint16, 1 byte
-  });
-
-  test('a trailing odd byte does not read past the buffer', () {
-    final s = parseHeartRateMeasurement([0x10, 60, 0x00, 0x04, 0x7F])!;
-    expect(s.rrMs, [1000]);
-  });
-}
diff --git a/test/hrs_link_test.dart b/test/hrs_link_test.dart
new file mode 100644
index 00000000..d8e94c7e
--- /dev/null
+++ b/test/hrs_link_test.dart
@@ -0,0 +1,154 @@
+// The standard Bluetooth heart-rate sensor path: 0x2A37 in, `decoded_onehz` /
+// `decoded_rr` out.
+//
+// THE DECODE ITSELF (`parseHeartRateMeasurement`) IS NOT PINNED HERE — it is
+// pure protocol and its own tests live with it in the protocol package. This
+// file is the WRITE half: given already-decoded bytes, do they land in the
+// substrate correctly attributed. Still EXPERIMENTAL (ASSUMPTIONS R6) —
+// nobody on this project owns a strap and `flutter_blue_plus` has no
+// simulator path, so this proves the write is correct, not that any real
+// strap sends these exact bytes.
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:path/path.dart' as p;
+import 'package:sqflite_common_ffi/sqflite_ffi.dart';
+import 'package:openstrap_edge/ble/adapters/_registry.dart';
+import 'package:openstrap_edge/ble/hrs_link.dart';
+import 'package:openstrap_edge/data/db.dart';
+
+/// Frames as the three common flag shapes put them on the wire.
+///
+/// The RR-Interval flag (bit 4) is OPTIONAL in the spec, and [bpmOnly] is the
+/// case that matters most: plenty of optical armbands never set it, and the
+/// parser has to degrade to "HR, no beats" rather than assume beats are there.
+const List<int> kBpmOnly = <int>[0x00, 61]; // flags 0x00 — RR bit CLEAR
+const List<int> kBpmOnlyWithContact = <int>[0x06, 61]; // contact reported
+const List<int> kHrWithTwoRr = <int>[
+  0x16, // uint8 HR + contact supported/detected + RR present
+  120,
+  0xF4, 0x01, // 500 ticks = 488 ms
+  0x00, 0x02, // 512 ticks = 500 ms
+];
+
+void main() {
+  group('substrate write', () {
+    const deviceId = 'hrs-0a1b2c3d';
+
+    setUpAll(() {
+      sqfliteFfiInit();
+      databaseFactory = databaseFactoryFfi;
+    });
+
+    setUp(() async {
+      await LocalDb.close();
+      LocalDb.dbName = 'hrs_link_test.db';
+      final dir = await databaseFactory.getDatabasesPath();
+      await databaseFactory.deleteDatabase(p.join(dir, LocalDb.dbName));
+    });
+
+    tearDown(() async => LocalDb.close());
+
+    test('HR and beats land in the real substrate, attributed', () async {
+      await HrsLink.instance.ingestForTest(deviceId, const [
+        (1_800_000_000, kHrWithTwoRr),
+        (1_800_000_001, kBpmOnly),
+      ]);
+
+      final db = await LocalDb.instance;
+      final onehz = await db.query('decoded_onehz', orderBy: 'ts_ms');
+      expect(onehz, hasLength(2));
+      expect(onehz.first['device_id'], deviceId);
+      expect(onehz.first['device_id'], isNot(LocalDb.kPrimaryDeviceId));
+      expect(onehz.first['ts_ms'], 1_800_000_000 * 1000);
+      expect(onehz.first['rec_ts'], 1_800_000_000);
+      expect(onehz.first['hr'], 120);
+      expect(onehz.first['source'], 'ble_hrs');
+      expect(onehz.first['device_family'], 'ble_hrs');
+      // A strap has no accelerometer, no optical block and no thermistor.
+      // Absent is NULL — never a measurement of zero.
+      for (final c in ['ax', 'ay', 'az', 'spo2_red_raw', 'skin_temp_raw']) {
+        expect(onehz.first[c], isNull, reason: c);
+      }
+      // The RR-bit-clear second is still a heart rate.
+      expect(onehz.last['hr'], 61);
+
+      final rr = await db.query('decoded_rr', orderBy: 'ts_ms, beat_index');
+      expect(rr, hasLength(2), reason: 'only the first second carried beats');
+      expect(rr.map((r) => r['rr_ms']), [488, 500]);
+      expect(rr.map((r) => r['beat_index']), [0, 1]);
+      expect(rr.first['device_id'], deviceId);
+      expect(rr.first['source'], 'ble_hrs');
+      // THE LOAD-BEARING ONE. `beat_ts_ms` means "where the beat actually
+      // was"; this source has no clock, so we do not know. An arrival anchor
+      // written there would be a measured claim we cannot make.
+      expect(rr.first['beat_ts_ms'], isNull);
+      expect(rr.first['rr_ts_ms'], 1_800_000_000 * 1000,
+          reason: 'the arrival second, which is all the anchor there is');
+    });
+
+    test('two notifications in one second do not evict each other', () async {
+      // The failure this prevents: writing the second twice restarts
+      // `beat_index` at 0 and REPLACE deletes the beats already stored.
+      await HrsLink.instance.ingestForTest(deviceId, const [
+        (1_800_000_000, kHrWithTwoRr),
+        (1_800_000_000, kHrWithTwoRr),
+      ]);
+      final db = await LocalDb.instance;
+      expect(await db.query('decoded_onehz'), hasLength(1));
+      final rr = await db.query('decoded_rr', orderBy: 'beat_index');
+      expect(rr.map((r) => r['beat_index']), [0, 1, 2, 3]);
+    });
+
+    test('an off-chest reading is refused, not stored as a low HR', () async {
+      await HrsLink.instance.ingestForTest(deviceId, const [
+        (1_800_000_000, <int>[0x04, 45]), // contact bits 0b10 = no contact
+      ]);
+      final db = await LocalDb.instance;
+      expect(await db.query('decoded_onehz'), isEmpty);
+    });
+
+    test('the band-only readers cannot see a strap row', () async {
+      await HrsLink.instance.ingestForTest(deviceId, const [
+        (1_800_000_000, kHrWithTwoRr),
+      ]);
+      final db = await LocalDb.instance;
+      final banded = await db.rawQuery(
+        'SELECT COUNT(*) c FROM decoded_onehz WHERE source IS NULL',
+      );
+      expect(banded.first['c'], 0,
+          reason: 'every derive/export read filters `source IS NULL`');
+    });
+
+    test('the primary device id is refused outright', () async {
+      // `''` is the primary band, permanently (ASSUMPTIONS A1). A sensor
+      // writing under it would interleave with the band's own seconds in a
+      // REPLACE-keyed table, unrecoverably.
+      await LocalDb.upsertDevice(
+        adapterId: kBleHrs.id,
+        remoteId: 'AA:BB:CC:DD:EE:FF',
+      );
+      expect(await HrsLink.instance.arm(), isFalse);
+    });
+
+    test('nothing paired means nothing armed', () async {
+      expect(await HrsLink.instance.arm(), isFalse);
+      expect(await HrsLink.pairedSensorRow(), isNull);
+    });
+
+    test('two arms in flight are ONE arm', () async {
+      // Every caller fires this `unawaited`, and the body awaits a database
+      // read, a 12 s connect and discovery before it publishes anything. A
+      // second call used to walk straight past the `_armed` check and overwrite
+      // the first one's `_device`, `_link`, `_runSub` and `_flushTimer` — the
+      // originals then ran on with nothing holding them. Same future, one
+      // attempt.
+      final a = HrsLink.instance.arm();
+      final b = HrsLink.instance.arm();
+      expect(identical(a, b), isTrue);
+      expect(await a, isFalse);
+      expect(await b, isFalse);
+      // And the memo clears, so a later arm is a real attempt again.
+      expect(identical(HrsLink.instance.arm(), a), isFalse);
+    });
+  });
+}
diff --git a/test/ios_ask_plist_test.dart b/test/ios_ask_plist_test.dart
new file mode 100644
index 00000000..918ef084
--- /dev/null
+++ b/test/ios_ask_plist_test.dart
@@ -0,0 +1,49 @@
+// The iOS AccessorySetupKit block in Info.plist is DERIVED from kFramedBands.
+//
+// kFramedBands and not the whole registry: ASK provisions the PRIMARY band —
+// the one that holds a link and gets its flash trimmed. A notify-only sensor
+// is connected straight from its stored remote id during a workout, so its
+// service in this array would only put chest straps in the WHOOP picker.
+//
+// This is the enforcement half of tool/gen_ios_ask_plist.dart: `flutter test`
+// runs on every PR, so a band added to the registry and forgotten in the plist
+// fails CI. It has to fail loudly, because the symptom otherwise is invisible —
+// on iOS 18+ the ASK picker is the pairing path, so an undeclared service just
+// means that band never appears in the picker.
+//
+// Same shape as telemetry_consent_default_test.dart, which already asserts
+// platform config from Dart.
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_edge/ble/adapters/_registry.dart';
+
+import '../tool/gen_ios_ask_plist.dart';
+
+void main() {
+  final plist = File(kPlistPath).readAsStringSync();
+
+  test('Info.plist ASK block is in sync with kFramedBands', () {
+    expect(
+      applyBlocks(plist, kFramedBands),
+      plist,
+      reason: 'stale — run `dart run tool/gen_ios_ask_plist.dart`',
+    );
+  });
+
+  test('every framed service is declared, uppercased', () {
+    for (final e in kFramedBands) {
+      expect(plist, contains('<string>${e.service.toUpperCase()}</string>'));
+    }
+  });
+
+  test('AccessorySetup.swift keeps no second copy of the UUIDs', () {
+    // The Swift reads NSAccessorySetupBluetoothServices at runtime. A literal
+    // back in the source is the drift this whole thing exists to prevent.
+    final swift =
+        File('ios/Runner/AccessorySetup.swift').readAsStringSync().toLowerCase();
+    for (final e in kFramedBands) {
+      expect(swift, isNot(contains(e.service.toLowerCase())));
+    }
+  });
+}
diff --git a/test/night_beats_repo_test.dart b/test/night_beats_repo_test.dart
index 36b58b3f..44d2534f 100644
--- a/test/night_beats_repo_test.dart
+++ b/test/night_beats_repo_test.dart
@@ -43,6 +43,9 @@ Future<void> _seedBeats(Database db, int fromSec, int toSec) async {
   final batch = db.batch();
   for (var t = fromSec; t <= toSec; t++) {
     batch.insert('decoded_rr', {
+      // v47: the key is (device_id, ts_ms, beat_index). A hand-written row that
+      // omits ts_ms takes the DEFAULT 0 and collides with every other one.
+      'ts_ms': t * 1000,
       'rec_ts': t,
       'beat_index': 0,
       'rr_ts_ms': t * 1000,
diff --git a/test/observation_isolation_test.dart b/test/observation_isolation_test.dart
new file mode 100644
index 00000000..03ba779f
--- /dev/null
+++ b/test/observation_isolation_test.dart
@@ -0,0 +1,492 @@
+// THE INVARIANT that the `observation` table exists to have.
+//
+// OBSERVATION_SPEC §3: *nothing reads `observation` into a baseline, into a
+// trend that also contains derived values, or into any input to a derivation.*
+//
+// The table is easy. The guarantee is the work, because a violation of it is
+// SILENT — no exception, no wrong-looking row, just an unexplained step change
+// in a 28- or 90-day number that surfaces months later with no way to tell
+// which day broke it. This project has re-encountered that exact failure mode
+// (the duplicate-day baseline pollution behind the blank readiness ring), and
+// the lesson banked from it was that a comment saying "don't" is not a control.
+//
+// Three layers, each reusing a mechanism this repo already has:
+//
+//  1. STRUCTURAL — the table name may only be reached from `lib/data/db.dart`.
+//     Uses the same source scan the other structural tests are built on. This
+//     is the layer that catches the realistic violation: phase 4 adds a reader
+//     for the UI, and six months later someone joins it into a series.
+//  2. DIFFERENTIAL — every baseline / trend / derivation read in the app is
+//     snapshotted, poison observations are written on the SAME dates under the
+//     SAME key names with absurd values, and every read must come back
+//     byte-identical. This is the layer that catches a violation added INSIDE
+//     db.dart, where layer 1 cannot see.
+//  3. THE COACH BTREE GATE — already fail-closed on anything outside the coach
+//     views, so it needs no code. Asserted here so that adding `observation`
+//     to a `v_*` view (the one edit that would open it to an LLM prompt) goes
+//     red instead of shipping.
+
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_edge/coach/coach_db.dart';
+import 'package:openstrap_edge/compute/derivation_engine.dart';
+import 'package:openstrap_edge/data/db.dart';
+import 'package:openstrap_edge/data/observation.dart';
+import 'package:path/path.dart' as p;
+import 'package:path_provider_platform_interface/path_provider_platform_interface.dart';
+import 'package:sqflite_common_ffi/sqflite_ffi.dart';
+
+/// `exportCopy` writes a real file, so the backup round trip needs somewhere
+/// to put it.
+class _FakePathProvider extends PathProviderPlatform {
+  _FakePathProvider(this.root);
+  final String root;
+  @override
+  Future<String?> getTemporaryPath() async => root;
+  @override
+  Future<String?> getApplicationSupportPath() async => root;
+  @override
+  Future<String?> getApplicationDocumentsPath() async => root;
+}
+
+/// The ONLY files allowed to name the `observation` table.
+///
+/// Adding to this list is the deliberate act the invariant asks for. Before
+/// you do: a READER for the UI is fine (§6 — show their number, attributed).
+/// A reader that feeds `metric_series`, `day_result`, a `baselines` row, a
+/// rolling window, or any argument to an analytics function is the thing this
+/// whole file exists to stop.
+const _allowedToNameTheTable = {'lib/data/db.dart'};
+
+/// How a Dart file actually reaches a SQLite table: as a quoted table name
+/// handed to sqflite, or named in SQL text. Case-insensitive on the keyword,
+/// case-SENSITIVE on the table name so `ui2/grammar.dart`'s `Observation`
+/// widget (a different thing that is correctly named the same word) is not a
+/// match.
+///
+/// `'observation':` is excluded — a trailing colon is a Dart MAP KEY and never
+/// a table name. `ui2/profile/gallery.dart` keys its widget catalogue that way.
+final _reachesTable = RegExp(
+  r"""(?:['"]observation['"](?!\s*:))"""
+  r"""|(?:\b(?:from|join|into|update|table)\s+observation\b)""",
+  caseSensitive: false,
+);
+
+/// `observation` is lower-case in every table-name position; the widget is not.
+bool _namesTheTable(String line) =>
+    _reachesTable.hasMatch(line) && line.contains('observation');
+
+/// A line that is nothing but a comment cannot reach a table.
+final _pureComment = RegExp(r'^\s*(///|//|\*|/\*)');
+
+Observation _obs(
+  String iso,
+  String key,
+  double v, {
+  ObservationSource kind = ObservationSource.vendor,
+}) => Observation(
+  key: key,
+  value: v,
+  unit: 'x',
+  attribution: 'Amazfit',
+  at: DateTime.parse(iso),
+  sourceKind: kind,
+);
+
+Future<void> _measured(String date, double rhr, double lnRmssd) =>
+    LocalDb.putDayResult(
+      dayId: date,
+      algoVersion: 1,
+      payloadJson: '{"date":"$date"}',
+      windowJson: '{}',
+      finalized: true,
+      source: 'band',
+      rhr: rhr,
+      series: {'rhr': rhr, 'ln_rmssd': lnRmssd, 'readiness': 60},
+    );
+
+/// Every read in the app that a baseline, a trend or a derivation runs on.
+/// Rendered to a single string so a difference of any kind fails.
+Future<String> _everyDerivedRead() async {
+  final db = await LocalDb.instance;
+  final out = StringBuffer();
+  for (final key in const ['rhr', 'ln_rmssd', 'readiness', 'skin_temp_adc']) {
+    // The production rolling-baseline loader itself, not a stand-in.
+    out.writeln('window($key)=${await debugBaselineWindow(key)}');
+    out.writeln('trail($key)=${await LocalDb.trailingSeriesValues(key, 90)}');
+    out.writeln(
+      'trailAll($key)='
+      '${await LocalDb.trailingSeriesValues(key, 90, measuredOnly: false)}',
+    );
+    out.writeln('series($key)=${await LocalDb.metricSeries(key)}');
+    out.writeln(
+      'seriesMeasured($key)='
+      '${await LocalDb.metricSeries(key, measuredOnly: true)}',
+    );
+    out.writeln('baseline($key)=${await LocalDb.baseline(key)}');
+  }
+  out.writeln('importedDates=${(await LocalDb.importedDates()).toList()..sort()}');
+  // The frozen day bundles: a vendor scalar reaching one is spec §7's first
+  // "must never happen".
+  for (final r in await db.query('day_result', orderBy: 'day_id')) {
+    out.writeln('day ${r['day_id']}|${r['algo_version']}=${r['payload_json']}');
+  }
+  for (final r in await db.query('metric_series', orderBy: 'date, key')) {
+    out.writeln('ms ${r['date']}|${r['key']}=${r['value']}');
+  }
+  return out.toString();
+}
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  // ── LAYER 1 — structural ────────────────────────────────────────────────────
+  test('only lib/data/db.dart may reach the observation table', () {
+    final offenders = <String>[];
+    for (final e in Directory('lib').listSync(recursive: true)) {
+      if (e is! File || !e.path.endsWith('.dart')) continue;
+      final rel = p.relative(e.path).replaceAll(r'\', '/');
+      if (_allowedToNameTheTable.contains(rel)) continue;
+      final lines = e.readAsLinesSync();
+      for (var i = 0; i < lines.length; i++) {
+        if (_pureComment.hasMatch(lines[i])) continue;
+        if (_namesTheTable(lines[i])) offenders.add('$rel:${i + 1}');
+      }
+    }
+    expect(
+      offenders,
+      isEmpty,
+      reason:
+          'A vendor/typed-in/imported scalar must never reach a baseline, a '
+          'mixed trend, or a derivation input (OBSERVATION_SPEC §3). If this '
+          'is a DISPLAY reader, add the file to _allowedToNameTheTable and say '
+          'in its doc comment that nothing computed reads it. If it feeds a '
+          'number we compute, it is the bug this test exists to catch.',
+    );
+  });
+
+  test('the scanner would actually catch a violation', () {
+    // A guard whose primitive is broken fails green. These are the shapes a
+    // real violation takes.
+    for (final line in const [
+      "    final rows = await db.query('observation');",
+      '  "SELECT value FROM observation WHERE key = ?",',
+      "      'JOIN observation o ON o.date = m.date '",
+      r'''      "INSERT INTO observation (key) VALUES (?)",''',
+    ]) {
+      expect(_namesTheTable(line), isTrue, reason: line);
+    }
+    // …and the shapes that are not.
+    for (final line in const [
+      '  const Observation(headline, detail),',
+      '/// One battery observation from `band_battery`.',
+      '  class Observation extends StatelessWidget {',
+      // The widget catalogue's map key — a Dart map key, not a table.
+      "      'observation': const Observation(",
+    ]) {
+      expect(
+        _pureComment.hasMatch(line) || !_namesTheTable(line),
+        isTrue,
+        reason: line,
+      );
+    }
+  });
+
+  group('runtime', () {
+    setUpAll(() async {
+      sqfliteFfiInit();
+      databaseFactory = databaseFactoryFfi;
+      PathProviderPlatform.instance = _FakePathProvider(
+        (await Directory.systemTemp.createTemp('openstrap_obs_')).path,
+      );
+      LocalDb.dbName = 'openstrap_observation_test.db';
+      final dir = await databaseFactory.getDatabasesPath();
+      await databaseFactory.deleteDatabase(p.join(dir, LocalDb.dbName));
+    });
+
+    tearDownAll(() async {
+      await CoachDb.close();
+      await LocalDb.close();
+    });
+
+    // ── LAYER 2 — differential ───────────────────────────────────────────────
+    test('observations move NO derived number, anywhere', () async {
+      await _measured('2026-01-01', 50, 4.0);
+      await _measured('2026-01-02', 52, 4.2);
+      await _measured('2026-01-03', 51, 4.1);
+      await LocalDb.putBaseline('rhr', '{"median":51}');
+
+      final before = await _everyDerivedRead();
+      expect(before, contains('window(rhr)=[50.0, 52.0, 51.0]'));
+
+      // Poison: OUR key names, THOSE days, values no baseline could survive,
+      // one of every source_kind. If any read below admits one of these, the
+      // window/median/trend moves and the snapshot stops matching.
+      expect(
+        await LocalDb.putObservations([
+          _obs('2026-01-01T09:00:00Z', 'rhr', 999),
+          _obs('2026-01-02T09:00:00Z', 'rhr', -999),
+          _obs('2026-01-03T09:00:00Z', 'rhr', 999),
+          _obs('2026-01-01T09:00:00Z', 'ln_rmssd', 999),
+          _obs(
+            '2026-01-02T09:00:00Z',
+            'readiness',
+            0,
+            kind: ObservationSource.imported,
+          ),
+          _obs(
+            '2026-01-03T09:00:00Z',
+            'skin_temp_adc',
+            999,
+            kind: ObservationSource.entered,
+          ),
+        ]),
+        6,
+      );
+      final db = await LocalDb.instance;
+      expect(
+        ((await db.rawQuery('SELECT COUNT(*) c FROM observation')).first['c']
+                as num)
+            .toInt(),
+        6,
+      );
+
+      expect(
+        await _everyDerivedRead(),
+        before,
+        reason:
+            'Something now reads `observation` into a computed number. That is '
+            'OBSERVATION_SPEC §3, and the failure it causes in production is '
+            'silent — an unexplained step change in a long-horizon metric.',
+      );
+    });
+
+    // ── LAYER 3 — the coach's read surface ───────────────────────────────────
+    test('the coach btree gate cannot reach observations', () async {
+      for (final sql in const [
+        'SELECT * FROM observation LIMIT 50',
+        'SELECT value FROM v_metric UNION ALL SELECT value FROM observation',
+        "SELECT * FROM v_daily WHERE date IN (SELECT date FROM observation)",
+      ]) {
+        await expectLater(
+          CoachDb.debugAssertAllowedBtrees(sql),
+          throwsA(isA<SqlGuardError>()),
+          reason: 'an LLM prompt reached the observation store: $sql',
+        );
+      }
+    });
+
+    // ── the storage layer itself ─────────────────────────────────────────────
+    test('identity is COALESCE(vendor_key, key) and REPLACE actually replaces',
+        () async {
+      final db = await LocalDb.instance;
+      await db.delete('observation');
+      final at = DateTime.parse('2026-02-01T08:00:00Z');
+      Observation biocharge(double v) => Observation(
+        vendorKey: 'BioCharge',
+        value: v,
+        attribution: 'Amazfit',
+        at: at,
+        sourceKind: ObservationSource.vendor,
+      );
+
+      // THE TRAP a plain composite PRIMARY KEY falls into: `key` is NULL on a
+      // proprietary composite, SQLite treats NULLs in a UNIQUE index as
+      // DISTINCT, so the second write would not collide and a re-import would
+      // silently double every composite it carries. The expression index has
+      // no NULL to be distinct about.
+      await LocalDb.putObservation(biocharge(40));
+      await LocalDb.putObservation(biocharge(70));
+      final rows = await db.query('observation');
+      expect(rows, hasLength(1));
+      expect(rows.single['value'], 70.0);
+      expect(rows.single['vendor_key'], 'BioCharge');
+      expect(rows.single['key'], isNull);
+      // The primary band, permanently — same standing rule as decoded_onehz.
+      expect(rows.single['device_id'], '');
+
+      // Our-vocabulary rows key off `key` instead, and do not collide with it.
+      await LocalDb.putObservation(
+        Observation(
+          key: 'steps',
+          value: 8000,
+          attribution: 'Amazfit',
+          at: at,
+          sourceKind: ObservationSource.vendor,
+        ),
+      );
+      // Nor does the same name under a different source_kind: 'you typed 8000'
+      // and 'the band counted 8000' are two facts, not one.
+      await LocalDb.putObservation(
+        Observation(
+          key: 'steps',
+          value: 8000,
+          attribution: 'you',
+          at: at,
+          sourceKind: ObservationSource.entered,
+        ),
+      );
+      expect(await db.query('observation'), hasLength(3));
+    });
+
+    test('date is the LOCAL day label, including across a DST boundary',
+        () async {
+      final db = await LocalDb.instance;
+      await db.delete('observation');
+      // 00:30 local on a spring-forward morning: a UTC-derived label puts this
+      // on the wrong day for every user west of Greenwich, which is the exact
+      // bug class `day_label.dart` exists to prevent.
+      final at = DateTime(2026, 3, 29, 0, 30);
+      await LocalDb.putObservation(
+        Observation(
+          key: 'mood',
+          value: 3,
+          attribution: 'you',
+          at: at,
+          sourceKind: ObservationSource.entered,
+        ),
+      );
+      final row = (await db.query('observation')).single;
+      expect(row['date'], '2026-03-29');
+      expect(row['ts_ms'], at.millisecondsSinceEpoch);
+    });
+
+    test('a row with no name at all is refused by the database', () async {
+      final db = await LocalDb.instance;
+      // Not just the Dart assert — the CHECK is what makes COALESCE non-NULL,
+      // and therefore what makes the unique index enforce anything.
+      await expectLater(
+        db.insert('observation', {
+          'ts_ms': 1,
+          'date': '2026-01-01',
+          'source_kind': 'vendor',
+          'value': 1.0,
+          'attribution': 'Amazfit',
+        }),
+        throwsA(anything),
+      );
+    });
+
+    test('the table survives a backup/restore round trip', () async {
+      final db = await LocalDb.instance;
+      await db.delete('observation');
+      await LocalDb.putObservation(
+        _obs('2026-04-01T10:00:00Z', 'sleep_score', 82),
+      );
+      final snapshot = await LocalDb.exportCopy();
+      await db.delete('observation');
+      await LocalDb.importFromDbFile(snapshot);
+      final rows = await db.query('observation');
+      expect(
+        rows,
+        hasLength(1),
+        reason: 'a table absent from the merge manifest silently vanishes on '
+            'restore — nothing regenerates a vendor scalar or a typed-in one',
+      );
+      expect(rows.single['value'], 82.0);
+      await File(snapshot).delete();
+    });
+
+    test('schemaHealth requires it', () async {
+      final health = await LocalDb.schemaHealth();
+      expect(health['ok'], isTrue, reason: '$health');
+      final db = await LocalDb.instance;
+      await db.execute('DROP TABLE observation');
+      final broken = await LocalDb.schemaHealth();
+      expect(broken['missing_tables'], contains('observation'));
+      // …and the every-open repair puts it back.
+      await LocalDb.close();
+      await LocalDb.instance;
+      expect((await LocalDb.schemaHealth())['ok'], isTrue);
+    });
+    // ── the v48 rung, against a REAL export ──────────────────────────────────
+    // `OPENSTRAP_TEST_DBS=/path/one.db,/path/two.db`. `onUpgrade` runs inside
+    // openDatabase on iOS's launch-path CPU watchdog, so a rung's cost is a
+    // number, not an assurance — and phase 3 must move no computed value, which
+    // means every `day_result` payload has to come back byte-identical.
+    for (final src in (Platform.environment['OPENSTRAP_TEST_DBS'] ?? '')
+        .split(',')
+        .map((s) => s.trim())
+        .where((s) => s.isNotEmpty)) {
+      test(
+        'v48 on ${p.basename(src)}: creates the table, moves no number',
+        () async {
+          final name = 'v48_${p.basenameWithoutExtension(src)}.db';
+          await LocalDb.close();
+          LocalDb.dbName = name;
+          final dir = await databaseFactory.getDatabasesPath();
+          await databaseFactory.deleteDatabase(p.join(dir, name));
+          final path = p.join(dir, name);
+          await File(src).copy(path);
+
+          Future<Map<String, Object?>> bundlesOf(DatabaseExecutor d) async => {
+            for (final r in await d.query('day_result'))
+              '${r['day_id']}|${r['algo_version']}': r['payload_json'],
+          };
+
+          // The BEFORE snapshot is read with NO version, so sqflite does not
+          // migrate the file out from under it. Every later read goes through
+          // the LocalDb handle: sqflite keeps ONE instance per path, so closing
+          // a second "read-only" handle closes the live one too.
+          final plain = await databaseFactory.openDatabase(
+            path,
+            options: OpenDatabaseOptions(readOnly: true),
+          );
+          final before = await bundlesOf(plain);
+          await plain.close();
+          expect(before, isNotEmpty);
+
+          final whole = Stopwatch()..start();
+          var db = await LocalDb.instance;
+          whole.stop();
+          expect(
+            await bundlesOf(db),
+            before,
+            reason: 'the ladder moved a number',
+          );
+
+          // THE v48 RUNG ON ITS OWN. The export is at user_version 27, so the
+          // open above pays for twenty-one rungs (the v47 re-key dominates).
+          // Rewinding the stamp on the now-migrated file and re-opening runs
+          // this rung and nothing else, which is the share it actually costs a
+          // user upgrading from the shipped build.
+          await db.execute('DROP TABLE observation');
+          await db.execute('PRAGMA user_version = 47');
+          await LocalDb.close();
+          final rung = Stopwatch()..start();
+          db = await LocalDb.instance;
+          rung.stop();
+          // ignore: avoid_print
+          print(
+            '[v48] ${p.basename(src)} whole ladder ${whole.elapsedMilliseconds}'
+            ' ms; v48 rung alone ${rung.elapsedMilliseconds} ms',
+          );
+          expect(await bundlesOf(db), before);
+
+          final info = await db.rawQuery('PRAGMA table_info(observation)');
+          expect(info, isNotEmpty);
+          expect(
+            (await db.rawQuery(
+              "SELECT name FROM sqlite_master WHERE type='index' "
+              "AND tbl_name='observation'",
+            )).map((r) => r['name']).toSet(),
+            containsAll(['idx_observation_identity', 'idx_observation_date']),
+          );
+          // The new table starts empty and stays empty: nothing writes it yet.
+          expect(
+            ((await db.rawQuery(
+              'SELECT COUNT(*) c FROM observation',
+            )).first['c'] as num).toInt(),
+            0,
+          );
+          expect((await LocalDb.schemaHealth())['ok'], isTrue);
+          await LocalDb.close();
+          await File(path).delete();
+        },
+        timeout: const Timeout(Duration(minutes: 15)),
+      );
+    }
+
+  });
+}
diff --git a/test/oura_link_test.dart b/test/oura_link_test.dart
new file mode 100644
index 00000000..d9276680
--- /dev/null
+++ b/test/oura_link_test.dart
@@ -0,0 +1,399 @@
+// The Oura HOST: scripted frames in, `raw_archive` / `decoded_onehz` out.
+//
+// NOTHING HERE HAS MET HARDWARE. Nobody on this project owns a ring (owner
+// ruling R6) and `flutter_blue_plus` has no simulator path, so the ring below
+// is a script and the frames are hand-built to the layouts the protocol package's
+// Oura wire format documents. It pins the HOST — the anchor, the commit ordering, the
+// attribution and what is refused — and it proves nothing about a real ring.
+//
+// `oura_adapter_test.dart` already proves the session state machine. This file
+// exists for the three things only a host can get wrong: banking every byte,
+// refusing to stamp a second it cannot honestly name, and never putting a
+// command on the wire that no builder produced.
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_protocol/openstrap_protocol.dart';
+import 'package:openstrap_edge/ble/adapters/_registry.dart';
+import 'package:openstrap_edge/ble/oura_link.dart';
+import 'package:openstrap_edge/data/db.dart';
+import 'package:path/path.dart' as p;
+import 'package:sqflite_common_ffi/sqflite_ffi.dart';
+
+const String _deviceId = 'oura-0a1b2c3d';
+
+/// Any 16 bytes. The replay ring answers a scripted result rather than actually
+/// verifying the AES block, so the VALUE of the key is not what is under test
+/// here — `oura_adapter_test.dart` pins the cipher against a known vector.
+const List<int> _key = <int>[
+  1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, //
+];
+
+/// The session's "now". Fixed so a stamp assertion is a real assertion.
+const int _nowSec = 1786000000;
+
+List<int> _hex(String s) => [
+      for (var i = 0; i + 1 < s.length; i += 2)
+        int.parse(s.substring(i, i + 2), radix: 16),
+    ];
+
+List<int> _frame(int tag, List<int> payload) =>
+    <int>[tag, payload.length, ...payload];
+
+List<int> _event(int tag, int tsDs, List<int> body) => _frame(tag, <int>[
+      tsDs & 0xff,
+      (tsDs >> 8) & 0xff,
+      (tsDs >> 16) & 0xff,
+      (tsDs >> 24) & 0xff,
+      ...body,
+    ]);
+
+List<int> _summary(int received, int bytesLeft) => _frame(0x11, <int>[
+      received,
+      0,
+      bytesLeft & 0xff,
+      (bytesLeft >> 8) & 0xff,
+      (bytesLeft >> 16) & 0xff,
+      (bytesLeft >> 24) & 0xff,
+    ]);
+
+final List<int> _nonceReply =
+    _frame(0x2f, _hex('2c') + _hex('0e2d6a0a08c99b4365f458e6e97382'));
+final List<int> _authOk = _frame(0x2f, _hex('2e00'));
+
+/// 0x0d6c centi-degrees = 34.36 C, a plausible worn reading.
+const String _temp3436 = '6c0d';
+
+/// A time_sync body: Unix seconds, little-endian.
+List<int> _syncBody(int unix) => <int>[
+      unix & 0xff,
+      (unix >> 8) & 0xff,
+      (unix >> 16) & 0xff,
+      (unix >> 24) & 0xff,
+    ];
+
+/// A ring that serves [batches] in order, one per history request, then stops.
+List<List<int>> Function(int, List<int>) _ring(List<List<List<int>>> batches) {
+  var served = 0;
+  return (int i, List<int> v) {
+    if (v.first == 0x2f && v[2] == 0x2b) return [_nonceReply];
+    if (v.first == 0x2f && v[2] == 0x2d) return [_authOk];
+    if (v.first != 0x10) return const <List<int>>[];
+    if (served >= batches.length) return [_summary(0, 0)];
+    return batches[served++];
+  };
+}
+
+Future<ReplayBandLinkResult> _run(List<List<List<int>>> batches) async {
+  final link = await OuraLink.instance.ingestForTest(
+    _deviceId,
+    _key,
+    _ring(batches),
+    nowSeconds: () => _nowSec,
+  );
+  final db = await LocalDb.instance;
+  return ReplayBandLinkResult(
+    writes: [for (final w in link.writes) w.$2],
+    onehz: await db.query('decoded_onehz', orderBy: 'ts_ms'),
+    archive: await db.query('raw_archive', orderBy: 'captured_at, hex'),
+  );
+}
+
+class ReplayBandLinkResult {
+  final List<List<int>> writes;
+  final List<Map<String, Object?>> onehz;
+  final List<Map<String, Object?>> archive;
+  const ReplayBandLinkResult({
+    required this.writes,
+    required this.onehz,
+    required this.archive,
+  });
+}
+
+void main() {
+  setUpAll(() {
+    sqfliteFfiInit();
+    databaseFactory = databaseFactoryFfi;
+  });
+
+  setUp(() async {
+    await LocalDb.close();
+    LocalDb.dbName = 'oura_link_test.db';
+    final dir = await databaseFactory.getDatabasesPath();
+    await databaseFactory.deleteDatabase(p.join(dir, LocalDb.dbName));
+  });
+
+  tearDown(() async => LocalDb.close());
+
+  test('every frame is banked verbatim, decoded or not', () async {
+    const unknown = '0102030405060708090a0b0c0d0e';
+    final r = await _run([
+      [
+        _event(kOuraEvtTimeSync, 1000, _syncBody(1782043215)),
+        _event(kOuraEvtTempPeriod, 1200, _hex(_temp3436)),
+        // Nothing decodes this one. It must still reach the archive — the beat
+        // intervals and the hypnogram live in frames exactly like it.
+        _event(0x60, 1300, _hex(unknown)),
+        _summary(3, 0),
+      ],
+    ]);
+    expect(r.archive, hasLength(3));
+    final hexes = r.archive.map((a) => a['hex']).toSet();
+    expect(hexes.contains(_hexOf(_event(0x60, 1300, _hex(unknown)))), isTrue);
+    // One reason PER TAG, so a decoder written later finds its records by name.
+    expect(
+      r.archive.map((a) => a['reason']).toSet(),
+      {'oura_evt_0x42', 'oura_evt_0x69', 'oura_evt_0x60'},
+    );
+    // NOT re-drivable, and that is deliberate: `redriveArchivedRecords` replays
+    // a row's hex through the WHOOP R24 chain, which would be the wrong decoder
+    // over the right bytes.
+    for (final a in r.archive) {
+      expect(LocalDb.redrivableArchiveReasons, isNot(contains(a['reason'])));
+    }
+  });
+
+  test('a measured time_sync is what stamps the batch carrying it', () async {
+    const syncUnix = 1782043215;
+    final r = await _run([
+      [
+        _event(kOuraEvtTimeSync, 1000, _syncBody(syncUnix)),
+        // 200 deciseconds — 20 seconds — after the sync.
+        _event(kOuraEvtTempPeriod, 1200, _hex(_temp3436)),
+        _summary(2, 0),
+      ],
+    ]);
+    expect(r.onehz, hasLength(1));
+    expect(r.onehz.first['rec_ts'], syncUnix + 20);
+    expect(r.onehz.first['ts_ms'], (syncUnix + 20) * 1000);
+    expect(r.onehz.first['skin_temp_c'], closeTo(34.36, 0.001));
+    // Absolute Celsius NEVER lands in the relative-ADC column, and a ring
+    // second that carried a temperature carried no heart rate.
+    expect(r.onehz.first['skin_temp_raw'], isNull);
+    expect(r.onehz.first['hr'], isNull);
+    for (final c in ['ax', 'ay', 'az', 'spo2_red_raw']) {
+      expect(r.onehz.first[c], isNull, reason: c);
+    }
+    // Attributed, and not the primary band.
+    expect(r.onehz.first['device_id'], _deviceId);
+    expect(r.onehz.first['device_id'], isNot(LocalDb.kPrimaryDeviceId));
+    expect(r.onehz.first['source'], 'oura');
+    expect(r.onehz.first['device_family'], 'oura');
+  });
+
+  test('the anchor and the cursor both survive the session', () async {
+    const syncUnix = 1782043215;
+    await _run([
+      [
+        _event(kOuraEvtTimeSync, 1000, _syncBody(syncUnix)),
+        _summary(1, 0),
+      ],
+    ]);
+    expect(await LocalDb.getCursor('oura_anchor:$_deviceId'), '1000,$syncUnix');
+    // The highest envelope stamp in the batch plus one — the short-batch
+    // advance. Persisted only because the commit landed first.
+    expect(await LocalDb.getCursorInt('oura_cursor_ds:$_deviceId'), 1001);
+  });
+
+  test('no anchor anywhere writes no timestamped row, and banks the bytes',
+      () async {
+    // THE HONEST ABSTENTION. A plausible wrong `ts_ms` is worse than a missing
+    // one: it writes the same physiological second under a second key that
+    // REPLACE can never collapse.
+    final r = await _run([
+      [
+        _event(kOuraEvtTempPeriod, 1200, _hex(_temp3436)),
+        _summary(1, 0),
+      ],
+    ]);
+    expect(r.onehz, isEmpty);
+    expect(r.archive, hasLength(1));
+    expect(await LocalDb.getCursor('oura_anchor:$_deviceId'), isNull);
+  });
+
+  test('a reading held before the anchor arrives is written once it does',
+      () async {
+    // Every connect writes SET_TIME, so the ring's fresh `time_sync` lands at
+    // its CURRENT decisecond — the END of the drain. On a fresh pairing that is
+    // after the whole of its history, and abstaining would throw all of it away.
+    const syncUnix = 1782043215;
+    final r = await _run([
+      [
+        _event(kOuraEvtTempPeriod, 1200, _hex(_temp3436)),
+        _summary(1, 512),
+      ],
+      [
+        // 100 deciseconds — 10 seconds — after the reading above.
+        _event(kOuraEvtTimeSync, 1300, _syncBody(syncUnix)),
+        _summary(1, 0),
+      ],
+    ]);
+    expect(r.onehz, hasLength(1));
+    expect(r.onehz.first['rec_ts'], syncUnix - 10);
+  });
+
+  test('a stored anchor stamps a session that measures none', () async {
+    const storedUnix = 1782043215;
+    await LocalDb.setCursor('oura_anchor:$_deviceId', '1000,$storedUnix');
+    final r = await _run([
+      [
+        _event(kOuraEvtTempPeriod, 1200, _hex(_temp3436)),
+        _summary(1, 0),
+      ],
+    ]);
+    expect(r.onehz, hasLength(1));
+    expect(r.onehz.first['rec_ts'], storedUnix + 20);
+  });
+
+  test('a stamp in the future is refused, not written', () async {
+    // The reboot direction that CAN be bounded for free: the ring's decisecond
+    // counter is an uptime, so a stale origin extrapolates a record forward
+    // past now — and no record is from the future.
+    await LocalDb.setCursor('oura_anchor:$_deviceId', '0,$_nowSec');
+    final r = await _run([
+      [
+        _event(kOuraEvtTempPeriod, 10000000, _hex(_temp3436)),
+        _summary(1, 0),
+      ],
+    ]);
+    expect(r.onehz, isEmpty, reason: 'a million seconds from now');
+    expect(r.archive, hasLength(1), reason: 'still banked, just not stamped');
+  });
+
+  test('the host writes nothing that no builder produced', () async {
+    // ASSUMPTIONS I1: `GattBandLink`'s dangerous-opcode block reads an opcode
+    // out of a WHOOP envelope and answers null for an unframed band, so NOTHING
+    // at the link refuses these. The ring has a factory reset, a DFU state
+    // machine, a flight mode, a manufacturing-mode setter and a bulk-sampler
+    // erase, and the only thing stopping them is that no builder exists and
+    // this host writes nothing else.
+    final r = await _run([
+      [
+        _event(kOuraEvtTimeSync, 1000, _syncBody(1782043215)),
+        _event(kOuraEvtDebugData, 1100, _hex('2456c80f00')),
+        _summary(2, 0),
+      ],
+    ]);
+    expect(r.writes, isNotEmpty);
+    // The four builders in the protocol package's Oura wire format, and nothing
+    // else — a new tag here means someone added a builder, go and read which one.
+    const built = {0x2f, 0x1c, 0x12, 0x10};
+    for (final w in r.writes) {
+      expect(built, contains(w.first),
+          reason: 'unbuilt command tag 0x${w.first.toRadixString(16)}');
+    }
+    // And each write is byte-identical to what its builder produces.
+    for (final w in r.writes) {
+      final rebuilt = switch (w.first) {
+        0x2f when w[2] == 0x2b => ouraCmdAuthNonce(),
+        0x2f => ouraCmdAuthenticate(w.sublist(3)),
+        0x1c => ouraCmdSetNotifyFlags(w[2]),
+        0x12 => ouraCmdSyncTime(
+            w[2] | (w[3] << 8) | (w[4] << 16) | (w[5] << 24),
+            tzHalfHours: w[10],
+          ),
+        _ => ouraCmdGetEvents(
+            w[2] | (w[3] << 8) | (w[4] << 16) | (w[5] << 24),
+            maxEvents: w[6],
+          ),
+      };
+      expect(w, rebuilt);
+    }
+  });
+
+  test('the band-only readers cannot see a ring row', () async {
+    await _run([
+      [
+        _event(kOuraEvtTimeSync, 1000, _syncBody(1782043215)),
+        _event(kOuraEvtTempPeriod, 1200, _hex(_temp3436)),
+        _summary(2, 0),
+      ],
+    ]);
+    final db = await LocalDb.instance;
+    final banded = await db.rawQuery(
+      'SELECT COUNT(*) c FROM decoded_onehz WHERE source IS NULL',
+    );
+    expect(banded.first['c'], 0,
+        reason: 'every derive/export read filters `source IS NULL`');
+  });
+
+  test('a bookmark past the end of the ring is dropped, not kept', () async {
+    // The ring rebooted: its decisecond counter restarted below our bookmark,
+    // so every request from there matches nothing while it quietly fills up.
+    // Bytes remaining with nothing delivered is the signal, and the remedy is
+    // to re-read from the beginning — free, because a re-read is idempotent.
+    await LocalDb.setCursor('oura_cursor_ds:$_deviceId', '9391523');
+    await OuraLink.instance.ingestForTest(_deviceId, _key, (i, v) {
+      if (v.first == 0x2f && v[2] == 0x2b) return [_nonceReply];
+      if (v.first == 0x2f && v[2] == 0x2d) return [_authOk];
+      if (v.first == 0x10) return [_summary(0, 4096)];
+      return const <List<int>>[];
+    }, nowSeconds: () => _nowSec);
+    expect(await LocalDb.getCursorInt('oura_cursor_ds:$_deviceId'), 0);
+  });
+
+  test('an empty ring keeps its bookmark', () async {
+    // The other half of the same signal, and getting it wrong costs a full
+    // re-read on every idle sync: no bytes left and nothing delivered is a ring
+    // with nothing to give, not a stranded bookmark.
+    await LocalDb.setCursor('oura_cursor_ds:$_deviceId', '9391523');
+    await OuraLink.instance.ingestForTest(_deviceId, _key, (i, v) {
+      if (v.first == 0x2f && v[2] == 0x2b) return [_nonceReply];
+      if (v.first == 0x2f && v[2] == 0x2d) return [_authOk];
+      if (v.first == 0x10) return [_summary(0, 0)];
+      return const <List<int>>[];
+    }, nowSeconds: () => _nowSec);
+    expect(await LocalDb.getCursorInt('oura_cursor_ds:$_deviceId'), 9391523);
+  });
+
+  test('the key install is one frame, the key in the clear, 16 bytes', () {
+    // It cannot be authenticated — it is what creates the credential the
+    // handshake uses — so the whole of its safety is that a ring only accepts
+    // one while it is factory reset.
+    final frame = ouraCmdSetAuthKey(_key);
+    expect(frame.first, 0x24);
+    expect(frame[1], 16, reason: 'length counts payload bytes only');
+    expect(frame.sublist(2), _key);
+    expect(frame, hasLength(18));
+    // A short or long key is a caller bug, not something to pad around: the
+    // ring would latch whatever it was sent and only a factory reset undoes it.
+    expect(() => ouraCmdSetAuthKey(const <int>[1, 2, 3]), throwsArgumentError);
+    // Success is status 0; anything else, and silence, is a refusal.
+    expect(ouraSetAuthKeyResult(parseOuraFrame(<int>[0x25, 0x01, 0x00])!), 0);
+    expect(ouraSetAuthKeyResult(parseOuraFrame(<int>[0x25, 0x01, 0x02])!), 2);
+    expect(ouraSetAuthKeyResult(parseOuraFrame(<int>[0x11, 0x01, 0x00])!), isNull);
+  });
+
+  test('nothing paired means nothing to sync', () async {
+    expect(await OuraLink.pairedRingRow(), isNull);
+    expect(await OuraLink.instance.sync(), isFalse);
+  });
+
+  group('forgetRing', () {
+    test('drops the device row', () async {
+      await LocalDb.upsertDevice(
+        id: _deviceId,
+        adapterId: kOura.id,
+        remoteId: 'AA:BB:CC:DD:EE:FF',
+        label: 'Ring',
+      );
+      expect(await OuraLink.pairedRingRow(), isNotNull);
+      final ok = await OuraLink.forgetRing(_deviceId);
+      expect(ok, isTrue);
+      expect(await OuraLink.pairedRingRow(), isNull);
+    });
+
+    test('refuses the primary device id outright', () async {
+      final ok = await OuraLink.forgetRing(LocalDb.kPrimaryDeviceId);
+      expect(ok, isFalse);
+    });
+
+    test('a device id nothing paired is a harmless no-op', () async {
+      final ok = await OuraLink.forgetRing('oura-never-paired');
+      expect(ok, isTrue);
+      expect(await OuraLink.pairedRingRow(), isNull);
+    });
+  });
+}
+
+String _hexOf(List<int> b) =>
+    b.map((x) => x.toRadixString(16).padLeft(2, '0')).join();
diff --git a/test/pair_sensor_test.dart b/test/pair_sensor_test.dart
new file mode 100644
index 00000000..c04835bd
--- /dev/null
+++ b/test/pair_sensor_test.dart
@@ -0,0 +1,257 @@
+// THE DOOR — the pairing screen and the two pieces of HrsLink behind it.
+//
+// The whole heart-rate-sensor path shipped unreachable: `HrsLink.arm()` reads
+// a `device` row and nothing created one, so it returned false on every call
+// forever. What is pinned here is the part of the fix that can be wrong
+// SILENTLY:
+//
+//   * the minted `device.id`. It is a PRIMARY KEY. If it is ever the BLE
+//     remote id, one sensor becomes N identities; if it is ever `''`, a strap
+//     writes its seconds into the primary band's rows; and if it is not stable
+//     across restarts, re-pairing the same sensor orphans its own history.
+//   * the live surface. A reading left on screen after the link died is the
+//     one lie this surface can tell, and `null` vs `bpm == null` are different
+//     sentences ("no sensor" vs "no signal yet"), neither of which is a zero.
+//   * the screen's states. Rendered, not read: this project has paid three
+//     times for layout faults that inspecting a widget tree does not find.
+//
+// The scan itself is not here and cannot be: `flutter_blue_plus` has no
+// simulator path, so a scan test would only prove the fake.
+
+import 'package:flutter/material.dart';
+import 'package:flutter_blue_plus/flutter_blue_plus.dart' show BluetoothDevice;
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_edge/ble/adapters/_registry.dart';
+import 'package:openstrap_edge/ble/hrs_link.dart';
+import 'package:openstrap_edge/data/db.dart';
+import 'package:openstrap_edge/ui2/profile/pair_sensor.dart';
+import 'package:openstrap_edge/ui2/ui2.dart';
+import 'package:path/path.dart' as p;
+import 'package:sqflite_common_ffi/sqflite_ffi.dart';
+
+BandCandidate _cand(String id, {String? label, int rssi = -60}) =>
+    (device: BluetoothDevice.fromId(id), label: label, rssi: rssi);
+
+Future<void> _pump(
+  WidgetTester t,
+  PairSensorView view, {
+  double scale = 1,
+}) async {
+  t.view.physicalSize = Size(390 * 3, 2400 * 3 * scale);
+  t.view.devicePixelRatio = 3;
+  addTearDown(t.view.reset);
+  await t.pumpWidget(
+    MediaQuery(
+      data: MediaQueryData(textScaler: TextScaler.linear(scale)),
+      child: MaterialApp(theme: buildTheme(Brightness.light), home: view),
+    ),
+  );
+  await t.pumpAndSettle();
+}
+
+void main() {
+  group('the minted device id', () {
+    test('is never the remote id and never the primary band', () {
+      const remote = '0A1B2C3D-4E5F-6071-8293-A4B5C6D7E8F9';
+      final id = HrsLink.mintDeviceId(kBleHrs, remote);
+      expect(id, isNot(remote));
+      expect(id, isNot(LocalDb.kPrimaryDeviceId));
+      expect(id, startsWith('${kBleHrs.id}-'));
+    });
+
+    test('is stable for the same remote id and distinct for another', () {
+      // Stability is the whole point: `String.hashCode` is only promised
+      // within one run, and this value has to name the same sensor tomorrow.
+      expect(
+        HrsLink.mintDeviceId(kBleHrs, 'AA:BB:CC:DD:EE:FF'),
+        HrsLink.mintDeviceId(kBleHrs, 'AA:BB:CC:DD:EE:FF'),
+      );
+      expect(
+        HrsLink.mintDeviceId(kBleHrs, 'AA:BB:CC:DD:EE:FF'),
+        isNot(HrsLink.mintDeviceId(kBleHrs, 'AA:BB:CC:DD:EE:F0')),
+      );
+    });
+
+    test('a different band mints a different id for the same peripheral', () {
+      // Two adapters over one physical device are two sources with two
+      // measurement tiers, and merging them under one key is the silent kind
+      // of wrong.
+      expect(
+        HrsLink.mintDeviceId(kBleHrs, 'X'),
+        isNot(HrsLink.mintDeviceId(kOura, 'X')),
+      );
+    });
+  });
+
+  group('the live surface', () {
+    // `ingestForTest` flushes into the real substrate on its way out, so the
+    // database has to be a real one — the reading is what is under test, not
+    // the write, but a flush with nowhere to go would hang the seam.
+    setUpAll(() {
+      sqfliteFfiInit();
+      databaseFactory = databaseFactoryFfi;
+    });
+
+    setUp(() async {
+      await LocalDb.close();
+      LocalDb.dbName = 'pair_sensor_test.db';
+      final dir = await databaseFactory.getDatabasesPath();
+      await databaseFactory.deleteDatabase(p.join(dir, LocalDb.dbName));
+    });
+
+    tearDown(() async => LocalDb.close());
+
+    test('starts absent, follows the beats, and is absent again after disarm',
+        () async {
+      final link = HrsLink.instance;
+      expect(link.reading.value, isNull, reason: 'no sensor armed');
+
+      // flags 0x10 (RR present) + 72 bpm + one 1000 ms beat.
+      await link.ingestForTest('hrs-test', [
+        (1_700_000_000, [0x10, 72, 0x00, 0x04]),
+      ]);
+      expect(link.reading.value?.bpm, 72);
+      expect(link.reading.value?.atSec, 1_700_000_000);
+
+      await link.disarm();
+      expect(link.reading.value, isNull,
+          reason: 'a number left on screen after the link died is a lie');
+    });
+  });
+
+  group('the screen renders', () {
+    testWidgets('nothing paired, nothing found: it says what would find one',
+        (t) async {
+      await _pump(t, const PairSensorView(entryLabel: 'Bluetooth heart rate '
+          'sensor'));
+      expect(layoutFaults, isEmpty);
+      expect(find.text('Search for sensors'), findsOneWidget);
+      expect(find.text('Nothing found yet'), findsOneWidget);
+      // Never a promise the honesty contract cannot keep.
+      expect(find.textContaining('recovery'), findsNothing);
+    });
+
+    testWidgets('the iOS gate replaces the button with the reason', (t) async {
+      await _pump(
+        t,
+        const PairSensorView(
+          entryLabel: 'Bluetooth heart rate sensor',
+          heldBack: 'Your WHOOP is not paired yet.',
+        ),
+      );
+      expect(layoutFaults, isEmpty);
+      // The plain button is gone — the choice has to be made knowingly.
+      expect(find.text('Search for sensors'), findsNothing);
+      expect(find.text('Your WHOOP is not paired yet.'), findsOneWidget);
+      expect(find.text('Search anyway'), findsOneWidget);
+    });
+
+    // Order is the scan's (strongest signal first) and is applied in
+    // `HrsLink._ranked`, which cannot be reached without a radio — the view
+    // draws what it is handed, which is what this pins.
+    testWidgets('every candidate is a row, and an unnamed one is told apart',
+        (t) async {
+      final picked = <String>[];
+      await _pump(
+        t,
+        PairSensorView(
+          entryLabel: 'Bluetooth heart rate sensor',
+          candidates: [
+            _cand('AA:BB:CC:DD:EE:01', label: 'Polar H10', rssi: -42),
+            _cand('AA:BB:CC:DD:EE:02', rssi: -77),
+          ],
+          onPick: (c) => picked.add(c.device.remoteId.str),
+        ),
+      );
+      expect(layoutFaults, isEmpty);
+      expect(find.text('Polar H10'), findsOneWidget);
+      expect(find.text('-42 dBm'), findsOneWidget);
+      // No name means the id tail is what tells two of them apart.
+      expect(find.text('…EE:02 · -77 dBm'), findsOneWidget);
+
+      await t.tap(find.text('Polar H10'));
+      await t.pumpAndSettle();
+      expect(picked, ['AA:BB:CC:DD:EE:01']);
+    });
+
+    testWidgets('a pair in flight locks the rest of the list', (t) async {
+      final picked = <String>[];
+      await _pump(
+        t,
+        PairSensorView(
+          entryLabel: 'Bluetooth heart rate sensor',
+          candidates: [
+            _cand('AA:BB:CC:DD:EE:01', label: 'Polar H10', rssi: -42),
+            _cand('AA:BB:CC:DD:EE:02', label: 'Wahoo TICKR', rssi: -77),
+          ],
+          busyRemoteId: 'AA:BB:CC:DD:EE:01',
+          onPick: (c) => picked.add(c.device.remoteId.str),
+        ),
+      );
+      expect(layoutFaults, isEmpty);
+      expect(find.text('Pairing…'), findsOneWidget);
+      await t.tap(find.text('Wahoo TICKR'));
+      await t.pumpAndSettle();
+      expect(picked, isEmpty, reason: 'two pairings at once is two GATT links');
+    });
+
+    testWidgets('forget says what it removes and what it does not', (t) async {
+      final forgotten = <String>[];
+      await _pump(
+        t,
+        PairSensorView(
+          entryLabel: 'Bluetooth heart rate sensor',
+          paired: (id: 'ble_hrs-0a1b2c3d', label: 'Polar H10'),
+          onForget: forgotten.add,
+        ),
+      );
+      expect(layoutFaults, isEmpty);
+      expect(find.text('Polar H10'), findsOneWidget);
+      expect(
+        find.text('Removes the source. The readings it already took stay.'),
+        findsOneWidget,
+      );
+      await t.tap(find.text('Forget this sensor'));
+      await t.pumpAndSettle();
+      expect(forgotten, ['ble_hrs-0a1b2c3d']);
+    });
+
+    testWidgets('a failure is a sentence, not a code', (t) async {
+      await _pump(
+        t,
+        const PairSensorView(
+          entryLabel: 'Bluetooth heart rate sensor',
+          problem: 'That sensor did not answer.',
+        ),
+      );
+      expect(layoutFaults, isEmpty);
+      expect(find.text('That sensor did not answer.'), findsOneWidget);
+    });
+
+    testWidgets('nothing overflows at 3.1x text', (t) async {
+      await _pump(
+        t,
+        PairSensorView(
+          entryLabel: 'Bluetooth heart rate sensor',
+          paired: (id: 'ble_hrs-0a1b2c3d', label: 'Polar H10'),
+          candidates: [_cand('AA:BB:CC:DD:EE:01', label: 'Polar H10')],
+          problem: 'That sensor did not answer.',
+        ),
+        scale: 3.1,
+      );
+      expect(layoutFaults, isEmpty);
+    });
+  });
+}
+
+/// Layout faults are reported as caught exceptions, not failed matchers — a
+/// negative margin asserting on every build still leaves a findable tree.
+List<Object> get layoutFaults {
+  final out = <Object>[];
+  while (true) {
+    final e = TestWidgetsFlutterBinding.instance.takeException();
+    if (e == null) break;
+    out.add(e as Object);
+  }
+  return out;
+}
diff --git a/test/readiness_saturation_test.dart b/test/readiness_saturation_test.dart
index 7ce3e9a1..7a4ada87 100644
--- a/test/readiness_saturation_test.dart
+++ b/test/readiness_saturation_test.dart
@@ -21,8 +21,18 @@ import 'package:openstrap_edge/compute/onehz_pipeline.dart';
 void main() {
   // A near-constant but strictly-increasing baseline: tiny NON-zero MAD, exactly
   // the shape duplicate-day pollution produces (not the exact-zero-MAD blank).
+  //
+  // Used for HRV ONLY (quantum 0, unguarded) below — since the readinessComposite
+  // sub-quantum-dispersion guard (analytics#26 follow-up) now checks stddev for
+  // EVERY quantized input regardless of whether robustZ succeeded, this exact
+  // shape on a whole-bpm RHR baseline (quantum 1) would be refused outright by
+  // name (`baseline_dispersion_below_quantum`) before ever reaching the
+  // logistic — a strictly earlier, more explicit catch of the same "no real
+  // dispersion" problem, but a different one than the z-cap this file tests.
   final degenerate = [for (var i = 0; i < 28; i++) 60.0 + i * 0.001];
-  // A healthy, well-spread baseline: a real robust-z, well within the cap.
+  // A healthy, well-spread baseline: a real robust-z, well within the cap. Used
+  // for RHR in every case below so RHR always clears the quantum-dispersion
+  // guard — HRV's near-degenerate baseline is what drives the saturation.
   final clean = [for (var i = 0; i < 28; i++) 50.0 + i.toDouble()];
 
   // TWO drivers, not one. `readinessComposite` refuses to renormalise a single
@@ -31,8 +41,14 @@ void main() {
   // pass for the wrong reason. HRV (0.40) + RHR (0.30) clears that floor and
   // still drives the composite the same way, so the saturation path below is
   // the thing under test rather than the input-count rule.
-  Metric<Readiness> composite(double hrv, double rhr, List<double> base) =>
-      readinessComposite([hrvInput(hrv, base), rhrInput(rhr, base)]);
+  Metric<Readiness> composite(
+    double hrv,
+    double rhr,
+    List<double> hrvBase, {
+    List<double>? rhrBase,
+  }) =>
+      readinessComposite(
+          [hrvInput(hrv, hrvBase), rhrInput(rhr, rhrBase ?? clean)]);
 
   group('headlineReadinessScalar', () {
     test('a near-degenerate baseline saturates the logistic → abstained', () {
@@ -72,8 +88,12 @@ void main() {
     });
 
     test('exact-zero MAD stays the honest blank path (unchanged)', () {
-      // Fully-quantised baseline → robustZ null → composite absent → '—', not 100.
-      final flat = composite(61.0, 59.0, List.filled(28, 60.0));
+      // Fully-quantised baseline → robustZ null → composite absent → '—', not
+      // 100. RHR given the SAME flat baseline explicitly (not the default
+      // `clean`) so it is refused too, exactly as the shared-baseline version
+      // of this test refused both inputs before HRV/RHR baselines were split.
+      final flat = composite(61.0, 59.0, List.filled(28, 60.0),
+          rhrBase: List.filled(28, 60.0));
       expect(flat.present, isFalse);
       expect(headlineReadinessScalar(flat), isNull);
     });
diff --git a/test/step_source_ladder_test.dart b/test/step_source_ladder_test.dart
index 94bed3da..81020908 100644
--- a/test/step_source_ladder_test.dart
+++ b/test/step_source_ladder_test.dart
@@ -40,9 +40,16 @@ CoverageSpan _phone(int fromSec, int toSec, int steps) => CoverageSpan(
 const _h = 3600;
 
 /// A 1 Hz substrate carrying [counters] (`-1` = this hardware has no counter).
-Substrate _sub(List<int> counters, {int step = 600}) {
+///
+/// STAMPED `gen5`, as every real substrate carrying this column is (ingest
+/// writes `decoded_onehz.device_family`). Since BANDAGNOSTIC C13 the stamp is
+/// what establishes the counter's BEHAVIOUR — cumulative, wraps at 65536, no
+/// midnight reset — and an unstamped one abstains rather than sum deltas off a
+/// counter that might reset at midnight and lose the day's pre-sync prefix.
+Substrate _sub(List<int> counters, {int step = 600, String? family = 'gen5'}) {
   final n = counters.length;
   return Substrate(
+    deviceFamily: family,
     tsSec: [for (var i = 0; i < n; i++) _t0 + i * step],
     hr: List<int>.filled(n, 60),
     rrTsMs: const [],
diff --git a/test/substrate_admission_test.dart b/test/substrate_admission_test.dart
new file mode 100644
index 00000000..ac3ebd87
--- /dev/null
+++ b/test/substrate_admission_test.dart
@@ -0,0 +1,331 @@
+// THE INVARIANT the `source` column exists to have.
+//
+// A row in `decoded_onehz` / `decoded_rr` may become a NUMBER only if its
+// source is admitted: NULL (the primary band) or one of `kDerivableSources`
+// (an adapter the owner has personally confirmed — ASSUMPTIONS R6/E5). An
+// unverified adapter's seconds bank, sync, back up and appear in diagnostics,
+// and produce no metric at all.
+//
+// Same failure shape as `observation_isolation_test.dart`, and that file is the
+// worked example this one copies: a violation here is SILENT. Nothing throws,
+// no row looks wrong, a session HR just quietly becomes the average of a chest
+// electrode and a wrist LED — a number that is neither sensor's, inside a
+// long-horizon baseline, months before anyone notices.
+//
+// Three layers:
+//
+//  1. STRUCTURAL — nobody may hand-write the predicate. Every reader goes
+//     through `derivableSourceSql()` or `kPrimaryBandSourceSql`, because the
+//     two are byte-identical today and are NOT the same question. This is the
+//     layer that catches the realistic violation: a new decoded read added six
+//     months from now, copied from the one next to it.
+//  2. DIFFERENTIAL — real unverified rows are written at the SAME seconds as
+//     band rows with absurd values, and every admission read must come back
+//     byte-identical. This is the layer that catches a reader that forgot the
+//     gate entirely, which layer 1 cannot see.
+//  3. THE MECHANISM ITSELF — that an empty admitted set really does render the
+//     old predicate (which is what makes this whole change a no-op today), and
+//     that a non-empty one really does widen it (which is what makes it worth
+//     having).
+
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:openstrap_edge/data/db.dart';
+import 'package:openstrap_edge/data/models.dart';
+import 'package:path/path.dart' as p;
+import 'package:path_provider_platform_interface/path_provider_platform_interface.dart';
+import 'package:sqflite_common_ffi/sqflite_ffi.dart';
+
+class _FakePathProvider extends PathProviderPlatform {
+  _FakePathProvider(this.root);
+  final String root;
+  @override
+  Future<String?> getTemporaryPath() async => root;
+  @override
+  Future<String?> getApplicationSupportPath() async => root;
+  @override
+  Future<String?> getApplicationDocumentsPath() async => root;
+}
+
+/// The ONLY places the predicate may be written out by hand.
+///
+/// `db.dart` defines both fragments; `health_export.dart` names
+/// `kPrimaryBandSourceSql` in prose because its comment argues, at length, why
+/// it is deliberately the narrow one. Adding a file here is the deliberate act
+/// the invariant asks for — and if you are adding one because you wrote a new
+/// decoded read, you wanted `derivableSourceSql()` instead.
+const _mayWriteThePredicate = {
+  'lib/data/db.dart',
+  'lib/health/health_export.dart',
+};
+
+/// A hand-written admission predicate against the decoded store.
+final _handWritten = RegExp(r'source\s+IS\s+(NOT\s+)?NULL', caseSensitive: false);
+
+/// A line that is nothing but a comment cannot reach a table.
+final _pureComment = RegExp(r'^\s*(///|//|\*|/\*)');
+
+Sample _band(int ts, int counter) => Sample(
+  tsEpoch: ts,
+  counter: counter,
+  hr: 60,
+  rrIntervalsMs: const [1000],
+  ax: 0.0,
+  ay: 0.0,
+  az: 1.0,
+  spo2RedRaw: 1,
+  spo2IrRaw: 2,
+  skinTempRaw: 3,
+);
+
+RawRecord _raw(int ts, int counter) => RawRecord(
+  counter: counter,
+  packetType: 47,
+  hex: 'beef$counter',
+  capturedAt: ts * 1000,
+  recTs: ts,
+);
+
+/// One second measured by an adapter nobody has verified, at a second the band
+/// also measured, with values no real reader could absorb quietly: 199 bpm
+/// against the band's 60, and a 400 ms beat against its 1000 ms.
+Future<void> _poison(int ts, int counter) async {
+  final db = await LocalDb.instance;
+  await db.insert('decoded_onehz', {
+    'device_id': 'unverified_unit_1',
+    'ts_ms': ts * 1000,
+    'rec_ts': ts,
+    'counter': counter,
+    'hr': 199,
+    'ax': 0.0,
+    'ay': 0.0,
+    'az': 1.0,
+    'source': 'unverified_test_adapter',
+  });
+  await db.insert('decoded_rr', {
+    'device_id': 'unverified_unit_1',
+    'ts_ms': ts * 1000,
+    'rec_ts': ts,
+    'beat_index': 0,
+    'rr_ts_ms': ts * 1000,
+    'rr_ms': 400,
+    'source': 'unverified_test_adapter',
+  });
+}
+
+/// Every read whose rows are allowed to become a number, plus the two that mean
+/// the primary band specifically — both must be unmoved, for different reasons.
+/// Rendered to one string so a difference of any kind fails.
+Future<String> _everyAdmissionRead(int lo, int hi) async {
+  final out = StringBuffer();
+  out.writeln('span=${await LocalDb.firstAndLastRecordTs()}');
+  out.writeln('byDay=${await LocalDb.decodedRecTsMaxByDay()}');
+  out.writeln(
+    'batch=${await LocalDb.decodedOneHzBatchByRecTsRange(limit: 100, fromRecTs: lo, toRecTs: hi)}',
+  );
+  // The keyset-cursor branch is a SECOND copy of the predicate in the same
+  // method, so it gets its own line.
+  out.writeln(
+    'batchAfter=${await LocalDb.decodedOneHzBatchByRecTsRange(limit: 100, fromRecTs: lo, toRecTs: hi, afterRecTs: lo, afterCounter: 0)}',
+  );
+  out.writeln(
+    'rr=${await LocalDb.decodedRrByRecTsRange(fromRecTs: lo, toRecTs: hi)}',
+  );
+  out.writeln('history=${await LocalDb.dataHistoryDays()}');
+  // Sample has no value-bearing toString, so render the two fields the poison
+  // rows would move.
+  out.writeln(
+    'samples=${(await LocalDb.samplesInRange(lo, hi)).map((s) => '${s.tsEpoch}:${s.hr}').toList()}',
+  );
+  out.writeln('latest=${(await LocalDb.latestSample())?.hr}');
+  out.writeln('hr=${await LocalDb.hrSamplesInRange(lo, hi)}');
+  out.writeln('sessionStats=${await LocalDb.sessionHrStats(lo, hi)}');
+  out.writeln('sessionHr=${await LocalDb.sessionHrSamplesBySession(lo, hi)}');
+  out.writeln('dataEdge=${await LocalDb.lastDecodedRecTs()}');
+  return out.toString();
+}
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  // ── LAYER 1 — structural ───────────────────────────────────────────────────
+  test('nobody hand-writes the admission predicate', () {
+    final offenders = <String>[];
+    for (final f in Directory('lib').listSync(recursive: true)) {
+      if (f is! File || !f.path.endsWith('.dart')) continue;
+      final rel = p.relative(f.path);
+      if (_mayWriteThePredicate.contains(rel)) continue;
+      final lines = f.readAsLinesSync();
+      for (var i = 0; i < lines.length; i++) {
+        if (_pureComment.hasMatch(lines[i])) continue;
+        if (_handWritten.hasMatch(lines[i])) offenders.add('$rel:${i + 1}');
+      }
+    }
+    expect(
+      offenders,
+      isEmpty,
+      reason:
+          'These write the admission predicate by hand. Use derivableSourceSql() '
+          '(may this row become a number?) or kPrimaryBandSourceSql (is this the '
+          'primary band specifically?). They render the same SQL today and they '
+          'answer different questions, which is exactly why neither may be a '
+          'literal: $offenders',
+    );
+  });
+
+  test('the scanner would actually catch a violation', () {
+    expect(_handWritten.hasMatch("'WHERE hr > 0 AND source IS NULL'"), isTrue);
+    expect(_handWritten.hasMatch("'AND d.source IS NOT NULL'"), isTrue);
+    expect(_pureComment.hasMatch('  // source IS NULL — the band'), isTrue);
+    expect(_handWritten.hasMatch(r"'AND ${derivableSourceSql()}'"), isFalse);
+  });
+
+  test('both fragments really are named in the two files that may', () {
+    expect(
+      File('lib/health/health_export.dart').readAsStringSync(),
+      contains(r'$kPrimaryBandSourceSql'),
+      reason:
+          'The HealthKit / Health Connect HR export is deliberately the NARROW '
+          'predicate: a sample written into a system store carries no source '
+          'seam and the user cannot unpick it later. If this is now wide, that '
+          'decision was reversed by accident.',
+    );
+  });
+
+  // ── LAYER 3 — the mechanism ────────────────────────────────────────────────
+  group('the admitted-source set', () {
+    test('renders the pre-existing predicate while it is empty', () {
+      expect(kDerivableSources, isEmpty);
+      expect(derivableSourceSql(), 'source IS NULL');
+      expect(derivableSourceSql('d.source'), 'd.source IS NULL');
+      expect(kPrimaryBandSourceSql, 'source IS NULL');
+    });
+
+    test('ids are SQL-safe, because the fragment interpolates them', () {
+      for (final id in kDerivableSources) {
+        expect(
+          RegExp(r'^[a-z0-9_]+$').hasMatch(id),
+          isTrue,
+          reason: '`$id` is interpolated straight into rawQuery text',
+        );
+      }
+    });
+
+    test('a non-empty set widens, and never widens the band-only one', () {
+      // The fragment is a pure function of the set, so the future shape is
+      // checkable today without pretending an adapter is verified.
+      String render(Set<String> ids, [String col = 'source']) => ids.isEmpty
+          ? '$col IS NULL'
+          : '($col IS NULL OR $col IN '
+                "(${ids.map((s) => "'$s'").join(', ')}))";
+      expect(render(const {}), derivableSourceSql());
+      expect(
+        render(const {'polar_h10'}),
+        "(source IS NULL OR source IN ('polar_h10'))",
+      );
+      expect(
+        render(const {'polar_h10', 'hrs_generic'}, 'd.source'),
+        "(d.source IS NULL OR d.source IN ('polar_h10', 'hrs_generic'))",
+      );
+      // kPrimaryBandSourceSql is a const: it cannot widen, which is the point.
+      expect(kPrimaryBandSourceSql, isNot(contains('IN')));
+    });
+  });
+
+  // ── LAYER 2 — differential ─────────────────────────────────────────────────
+  group('runtime', () {
+    setUpAll(() async {
+      sqfliteFfiInit();
+      databaseFactory = databaseFactoryFfi;
+      PathProviderPlatform.instance = _FakePathProvider(
+        (await Directory.systemTemp.createTemp('openstrap_admit_')).path,
+      );
+      LocalDb.dbName = 'openstrap_admission_test.db';
+      final dir = await databaseFactory.getDatabasesPath();
+      await databaseFactory.deleteDatabase(p.join(dir, LocalDb.dbName));
+    });
+
+    tearDownAll(() async => LocalDb.close());
+
+    test('an unverified adapter moves NO number, anywhere', () async {
+      const lo = 1786690000;
+      const hi = lo + 9;
+      await LocalDb.commitSyncBatch(
+        [for (var i = 0; i < 10; i++) _raw(lo + i, i + 1)],
+        [for (var i = 0; i < 10; i++) _band(lo + i, i + 1)],
+      );
+      final db = await LocalDb.instance;
+      await db.insert('sessions', {
+        'id': 'w1',
+        'start_ts': lo,
+        'end_ts': hi,
+        'type': 'run',
+        'status': 'ended',
+        'created_at': lo,
+      });
+
+      final before = await _everyAdmissionRead(lo, hi);
+      // The band really is in there — otherwise this test passes on two empty
+      // strings and proves nothing.
+      expect(before, contains('hr: 60'));
+      expect(before, contains('dataEdge=$hi'));
+
+      for (var i = 0; i < 10; i++) {
+        await _poison(lo + i, 90000 + i);
+      }
+      // The rows really did land: stored, not derived, is the contract.
+      expect(
+        ((await db.rawQuery(
+                  'SELECT COUNT(*) c FROM decoded_onehz WHERE source IS NOT NULL',
+                )).first['c']
+                as num)
+            .toInt(),
+        10,
+      );
+      expect(
+        ((await db.rawQuery(
+                  'SELECT COUNT(*) c FROM decoded_rr WHERE source IS NOT NULL',
+                )).first['c']
+                as num)
+            .toInt(),
+        10,
+      );
+
+      expect(
+        await _everyAdmissionRead(lo, hi),
+        before,
+        reason:
+            'A read admitted an UNVERIFIED adapter\'s seconds. Nothing throws '
+            'when this ships: a session HR silently becomes the average of two '
+            'sensors that disagree systematically, and it lands in a baseline '
+            'that outlives the band. Route the read through '
+            'derivableSourceSql().',
+      );
+    });
+
+    test('an admitted source WOULD be seen — the gate is not just a WHERE that '
+        'excludes everything', () async {
+      const lo = 1786690000;
+      const hi = lo + 9;
+      // Same shape as the poison rows, but source NULL: a second physical unit
+      // under the primary band's own admission. If the readers were filtering
+      // on something else (device_id, say), this would not move either, and the
+      // test above would be proving nothing.
+      final db = await LocalDb.instance;
+      await db.insert('decoded_onehz', {
+        'device_id': 'admitted_unit_2',
+        'ts_ms': lo * 1000,
+        'rec_ts': lo,
+        'counter': 80001,
+        'hr': 199,
+        'source': null,
+      });
+      expect(
+        (await LocalDb.hrSamplesInRange(lo, hi)).where((r) => r['hr'] == 199),
+        isNotEmpty,
+        reason: 'the admission gate filters on `source`, and nothing else',
+      );
+    });
+  });
+}
diff --git a/test/substrate_hr_valid_test.dart b/test/substrate_hr_valid_test.dart
index 3f99ff7f..4a485221 100644
--- a/test/substrate_hr_valid_test.dart
+++ b/test/substrate_hr_valid_test.dart
@@ -44,11 +44,16 @@ void main() {
     expect(s.hrValidAt(1), isNull);
   });
 
-  test('unknown provenance refuses even when the array carries values', () {
-    // A pre-schema-41 row, an import or a raw replay has no device stamp. The
-    // column belongs to gen5, so an unstamped substrate cannot claim it.
-    final s = _sub(family: null, hrValid: const [1, 1]);
-    expect(s.hrValidAt(0), isNull);
+  test('an unstamped substrate that carries real flags is BELIEVED', () {
+    // BANDAGNOSTIC C12. This used to refuse: `hrValidAt` also required
+    // `deviceFamily == 'gen5'`, a band id hardcoded in the neutral layer. Only
+    // a decoder that read the flag off the wire ever writes a non-negative
+    // value into this column, so a value >= 0 is the source's own declaration —
+    // and refusing it discarded a measurement because the metadata beside it
+    // was missing. Absence is still absence; see the gen4 case above.
+    final s = _sub(family: null, hrValid: const [1, 0]);
+    expect(s.hrValidAt(0), isTrue);
+    expect(s.hrValidAt(1), isFalse);
   });
 
   test('an out-of-range index is absent, not a crash and not false', () {
diff --git a/test/ui2_router_test.dart b/test/ui2_router_test.dart
index 88a53ffc..260e8d5a 100644
--- a/test/ui2_router_test.dart
+++ b/test/ui2_router_test.dart
@@ -489,7 +489,7 @@ void main() {
         child: MaterialApp(
             theme: buildTheme(Brightness.light), home: const MyDevices()),
       ));
-      expect(find.text('WHOOP band'), findsOneWidget);
+      expect(find.text('Your band'), findsOneWidget);
       expect(find.text('Pair a band'), findsNothing);
 
       // Forget. `unpair()` itself is platform-bound (ASK, the engine, the
@@ -498,7 +498,7 @@ void main() {
       app.notifyListeners();
       await tester.pump();
 
-      expect(find.text('WHOOP band'), findsNothing);
+      expect(find.text('Your band'), findsNothing);
       expect(find.text('This phone'), findsOneWidget,
           reason: 'the phone row is what used to swallow the empty state');
       expect(find.text('Pair a band'), findsOneWidget);
diff --git a/test/ui2_tokens_test.dart b/test/ui2_tokens_test.dart
index bc14ebfd..4ea831d1 100644
--- a/test/ui2_tokens_test.dart
+++ b/test/ui2_tokens_test.dart
@@ -207,6 +207,13 @@ const _notComponents = {
   // permission on tap — a gallery case would either mock all of that or
   // trigger a real health-store prompt from a screenshot sweep.
   'PhoneImport', 'AutomationSettings',
+  // The second-sensor pairing route. A Scaffold that owns a BLE scan, reads
+  // the `device` table and asks CoreBluetooth whether AccessorySetupKit has
+  // provisioned anything — a gallery case would be a photograph of a fixture,
+  // and a screenshot sweep would start a real radio scan. `PairSensorView` is
+  // the pure half and is what `pair_sensor_test.dart` pumps, at a real phone
+  // width, in each of its states.
+  'PairSensorScreen', 'PairSensorView',
   // The double-tap picker. A Scaffold route whose whole content is decided by
   // what the OS answered to a method channel, so a gallery case would be a
   // photograph of a fixture rather than of the screen. Rendered instead by
diff --git a/tool/gen_ios_ask_plist.dart b/tool/gen_ios_ask_plist.dart
new file mode 100644
index 00000000..287ff0c0
--- /dev/null
+++ b/tool/gen_ios_ask_plist.dart
@@ -0,0 +1,102 @@
+// Info.plist's AccessorySetupKit block is DERIVED from the band registry —
+// from [kFramedBands], not the whole of it. ASK provisions the PRIMARY band,
+// the one that holds a link and gets its flash trimmed. A notify-only sensor
+// is connected straight from its stored remote id during a workout and needs
+// no ASK descriptor, so declaring its service here would only put chest straps
+// in the WHOOP pairing picker.
+//
+// Apple requires every criterion an ASK discovery descriptor matches on to be
+// declared in Info.plist under NSAccessorySetupBluetoothServices. On iOS 18+
+// that picker IS our pairing path, so a band missing from that array cannot be
+// paired on iPhone at all — and per TN3115 note 5 it also gives up the iOS 26
+// relaunch-after-force-quit / Control-Centre-toggle case. A hand-maintained
+// second copy of `kBandRegistry` is exactly the drift nobody notices until a
+// user's band silently stops pairing.
+//
+//   dart run tool/gen_ios_ask_plist.dart           # rewrite the block
+//   dart run tool/gen_ios_ask_plist.dart --check   # verify, exit 1 on drift
+//
+// The check is also a unit test (`test/ios_ask_plist_test.dart`), which is
+// what actually enforces it: `flutter test` runs on every PR, so drift fails
+// CI loudly. Deliberately NOT an Xcode script phase — the registry is a Dart
+// `const`, so only the Dart VM can evaluate it, and a phase that regenerates a
+// tracked source file mid-build is the fail-open mode we are trying to avoid
+// (a stale plist that still builds).
+//
+// Both keys must already exist in the plist; this rewrites their bodies and
+// never invents structure.
+
+import 'dart:io';
+
+import 'package:openstrap_edge/ble/adapters/_registry.dart';
+
+const String kPlistPath = 'ios/Runner/Info.plist';
+
+/// Apple's required list of service UUIDs the ASK picker may match on.
+const String kServicesKey = 'NSAccessorySetupBluetoothServices';
+
+/// Our own key: service UUID -> picker row label. Cosmetic only — the Swift
+/// falls back to a generic name — so a stale label degrades the picker text
+/// rather than hiding a band.
+const String kLabelsKey = 'OSBandLabels';
+
+String _esc(String s) => s
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;');
+
+String _servicesBody(List<BandEntry> registry) => registry
+    .map((e) => '\t\t<string>${e.service.toUpperCase()}</string>\n')
+    .join();
+
+String _labelsBody(List<BandEntry> registry) => registry
+    .map((e) => '\t\t<key>${e.service.toUpperCase()}</key>\n'
+        '\t\t<string>${_esc(e.label)}</string>\n')
+    .join();
+
+String _replaceBody(String plist, String key, String tag, String body) {
+  final re = RegExp(
+    '(\\t<key>$key</key>\\n\\t<$tag>\\n).*?(\\t</$tag>\\n)',
+    dotAll: true,
+  );
+  final m = re.firstMatch(plist);
+  if (m == null) {
+    throw StateError(
+        '$kPlistPath has no <$tag> block for <key>$key</key> — add one '
+        '(with at least one child) before running this.');
+  }
+  return plist.replaceRange(m.start, m.end, '${m[1]}$body${m[2]}');
+}
+
+/// [plist] with both generated blocks rebuilt from [registry].
+String applyBlocks(String plist, List<BandEntry> registry) {
+  var out = _replaceBody(plist, kServicesKey, 'array', _servicesBody(registry));
+  out = _replaceBody(out, kLabelsKey, 'dict', _labelsBody(registry));
+  return out;
+}
+
+void main(List<String> args) {
+  final file = File(kPlistPath);
+  if (!file.existsSync()) {
+    stderr.writeln('$kPlistPath not found — run from the edge/ package root.');
+    exit(2);
+  }
+  final current = file.readAsStringSync();
+  final wanted = applyBlocks(current, kFramedBands);
+  if (current == wanted) {
+    stdout.writeln('$kPlistPath is in sync with kFramedBands.');
+    return;
+  }
+  if (args.contains('--check')) {
+    stderr.writeln('$kPlistPath is STALE. Expected:\n'
+        '\t<key>$kServicesKey</key>\n\t<array>\n${_servicesBody(kFramedBands)}'
+        '\t</array>\n'
+        '\t<key>$kLabelsKey</key>\n\t<dict>\n${_labelsBody(kFramedBands)}'
+        '\t</dict>\n'
+        'Run: dart run tool/gen_ios_ask_plist.dart');
+    exit(1);
+  }
+  file.writeAsStringSync(wanted);
+  stdout.writeln('$kPlistPath updated from kFramedBands '
+      '(${kFramedBands.length} band(s)).');
+}