fix a batch of small stuff: strain copy, flaky tests, readiness clobber, gen5 rr, health export, sleep reject

lib/compute/derivation_engine.dart

@@ -1528,7 +1528,17 @@ import 'substrate.dart';
 // zone anchor. Two different derivations cannot share one number — that is
 // the whole contract of this constant, and main's 81 is the one already on
 // main, so it keeps it. Nothing about the zone change itself moved.
-const int kAlgoVersion = 82;
+//
+// 82 → 83 (edge#305): a re-derive at the retention-cutoff edge could produce
+// null rhr/rmssd/readiness for a day whose sleep-window substrate had aged
+// out while daytime HR survived, and — because `metric_series` is unversioned
+// — silently clobber a good historical baseline point, collapsing the
+// readiness baseline out from under later nights. That re-derive is now
+// declined (see the guard in `_derivePreparedDay` right after `producedNothing`)
+// so the older, complete row keeps being served. Also: the readiness z-cap
+// abstention now populates `readiness_absent_diag` with its own
+// `unstable_baseline:` reason instead of leaving it null (onehz_pipeline.dart).
+const int kAlgoVersion = 83;
 /// The sibling SHAs this version was derived against, asserted against
 /// pubspec.yaml in test/db_serve_version_and_reads_test.dart.
 ///
@@ -3684,6 +3694,50 @@ class DerivationEngine {
       }
     }
 
+    // ── NEVER WRITE NIGHT-NULL OVER NIGHT-REAL (edge#305) ───────────────────
+    // The guard above only catches a day with literally NOTHING. A day at the
+    // retention-cutoff EDGE can have plenty of daytime HR (daySub non-empty)
+    // while its sleep window's own RR/HR substrate has aged out from under it
+    // (sleepSub empty) — sleep STAGING survives regardless (it replays the
+    // durable `sleep_session_candidates` row, not raw), so `daySub`/`sleepSub`/
+    // `scMap` all look like "something" and `producedNothing` is false — but
+    // every night-physiology scalar (rhr/rmssd/readiness) comes back null.
+    // `putDayResult` replaces `metric_series` wholesale (it's UNVERSIONED), so
+    // this null silently overwrites a good historical baseline point and
+    // collapses every later night's readiness baseline out from under it.
+    //
+    // Detect the same shape the guard above already reasons about — a known
+    // sleep window whose substrate is now entirely gone, re-deriving over a
+    // day that already had a real result — and decline the SAME way: keep
+    // the existing (older-version) row being served (`_servedDayJoin` already
+    // serves the highest version <= ceiling, so nothing needs to change there)
+    // rather than writing a new, worse row. A `partial` row was considered
+    // instead, but `partial` still gets written to `day_result` and would
+    // still shadow the better older row for day-detail reads; declining is
+    // what actually protects it.
+    if (!producedNothing &&
+        nightSubstrateRegressed(
+          hasSleepWindow: day.sleepOffsetSec > day.sleepOnsetSec,
+          sleepSubEmpty: sleepSub.isEmpty,
+          nightScalarsNull: scMap == null ||
+              (scMap['rhr'] == null &&
+                  scMap['rmssd'] == null &&
+                  scMap['readiness'] == null),
+        )) {
+      final existingNight = await LocalDb.dayResult(day.date);
+      final existingHadNight = existingNight != null &&
+          (existingNight['rhr'] != null ||
+              existingNight['rmssd'] != null ||
+              existingNight['readiness'] != null);
+      if (existingHadNight) {
+        _log('derive ${day.date}: sleep-window substrate pruned out from '
+            "under a day that already had real night scalars — kept the "
+            'existing result rather than nulling the readiness baseline '
+            '(edge#305)');
+        return;
+      }
+    }
+
     // ── SECOND HALF — OFFLOADED to a background isolate ──────────────────────
     // Everything that turns the isolate-1 bundle into the full day result (wake
     // features, hybrid steps + TDEE, all-day HRV/RSA/skin-temp Timeline lines,
@@ -4141,6 +4195,22 @@ class DerivationEngine {
   /// finalizing locks the day out of every future pass at this algo version.
   static const Set<String> _transientSkipReasons = {'timeout', 'error'};
 
+  /// edge#305 — whether THIS derive's night-physiology substrate has
+  /// regressed to nothing even though [producedNothing] (in
+  /// `_derivePreparedDay`) is false: plenty of daytime HR survives
+  /// ([hasSleepWindow] true, i.e. sleep STAGING still has a window — it
+  /// replays the durable `sleep_session_candidates` row, not raw — but
+  /// [sleepSubEmpty], the night's own RR/HR substrate, has aged out from
+  /// under it) and every night-physiology scalar ([nightScalarsNull]) came
+  /// back null. Pure so the shape is unit-testable without the full pipeline;
+  /// the caller still has to confirm an EXISTING result actually had real
+  /// night scalars before declining to write over it.
+  static bool nightSubstrateRegressed({
+    required bool hasSleepWindow,
+    required bool sleepSubEmpty,
+    required bool nightScalarsNull,
+  }) => hasSleepWindow && sleepSubEmpty && nightScalarsNull;
+
   /// Whether [row] is a REAL derived day result worth protecting — i.e. not a
   /// skip marker and not an all-absent shell.
   static bool _isRealDayResult(Map<String, dynamic>? row) {

lib/compute/onehz_pipeline.dart

@@ -104,6 +104,25 @@ double? headlineReadinessScalar(Metric<Readiness> composite) {
   return r.score;
 }
 
+/// The `readiness_absent_diag` note for a composite that computed (unlike the
+/// `!composite.present` cold-start case) but got withheld by [kReadinessZCap]
+/// — a saturated, degenerate-baseline artefact. Null whenever
+/// [headlineReadinessScalar] would have returned a value, i.e. there is
+/// nothing to explain.
+///
+/// Deliberately NOT the `need_baseline:` note (edge#305): reaching a present
+/// composite already means every input cleared `readinessCompositeMinBaseline`,
+/// so "Need N more nights" would be a proven-false cause once this fires — the
+/// UI's baseline-note convention exists precisely to prevent stating a wrong
+/// cause. Pure so the gate + note format are unit-testable without the full
+/// pipeline.
+String? zCapAbsentNote(Metric<Readiness> composite) {
+  if (!composite.present) return null;
+  if (headlineReadinessScalar(composite) != null) return null;
+  final z = composite.value!.compositeZ;
+  return 'unstable_baseline:z=${z.toStringAsFixed(3)},cap=$kReadinessZCap';
+}
+
 /// Serializable input to the isolate: one physiological day's decoded 1 Hz
 /// substrate (the day slice), the PRECOMPUTED single-source sleep segmentation,
 /// the profile, and trailing baseline history for the readiness pass.
@@ -1042,6 +1061,32 @@ Map<String, dynamic> deriveDayBundle(Map<String, dynamic> inputJson) {
   // Abstain from a saturated, degenerate-baseline readiness rather than persist a
   // bogus ~100 that a cleaner re-derive would then snap back down (#117 bounce).
   final readinessScalar = headlineReadinessScalar(composite);
+  // The z-cap can abstain even when the composite itself is `present` — a
+  // saturated, degenerate-baseline artefact, not a cold-start — and that used
+  // to leave `readinessAbsentDiag` null (only the `!composite.present` branch
+  // above sets it), so the UI fell through to the composite's own prose, which
+  // names whichever driver its renormalisation happened to refuse (e.g. temp)
+  // rather than the real reason the headline is blank (edge#305). Do NOT reuse
+  // `need_baseline:` here: on main an input needs >=`readinessCompositeMinBaseline`
+  // points before the composite is even present, so by the time THIS branch can
+  // fire "Need N more nights" is a proven-false cause. Give it its own reason,
+  // carrying the z that tripped the cap plus the same per-input counts the
+  // cold-start diag carries, so it renders with an actual explanation instead
+  // of a bare blank.
+  final zCapNote = zCapAbsentNote(composite);
+  if (readinessAbsentDiag == null && zCapNote != null) {
+    readinessAbsentDiag = {
+      'hrv': {'value': lnToday != null, 'baseline_n': d.lnRmssdHistory.length},
+      'rhr': {'value': rhrToday != null, 'baseline_n': d.rhrHistory.length},
+      'resp': {'value': respToday != null, 'baseline_n': d.respHistory.length},
+      'temp': {
+        'value': skinTempAdc != null,
+        'baseline_n': d.skinTempAdcHistory.length,
+        'settled_frac': skinTempSettledFrac,
+      },
+      'note': zCapNote,
+    };
+  }
   final strainScalar = strainMetric.present ? strainMetric.value : null;
 
   // ── STRESS: Baevsky SI → a transparent 0–100 score (log-mapped over the

lib/compute/substrate.dart

@@ -941,7 +941,11 @@ class SleepWindowOverride {
   final String dayId;
   final int onsetSec;
   final int offsetSec;
-  final String source; // 'manual' | 'confirmed'
+  final String source; // 'manual' | 'confirmed' | 'rejected'
+  // 'rejected': onsetSec/offsetSec still carry the window being rejected (the
+  // auto-detected window at the time of rejection, same convention the
+  // already-shipped rejected-nap rows use), but the window is never staged —
+  // see calendarDays' `ov.source == 'rejected'` branch.
 
   const SleepWindowOverride({
     required this.dayId,
@@ -1070,7 +1074,14 @@ List<PhysioDay> calendarDays(
 
       ana.SleepSegmentation s;
       String src;
-      if (ov != null) {
+      if (ov != null && ov.source == 'rejected') {
+        // The user's word again, the other direction: this was NOT sleep at
+        // all. Skip detection/staging entirely rather than force a window —
+        // the day derives with no main sleep, same as the already-shipped
+        // rejected-nap path (`sleep_nap` source='rejected').
+        s = ana.SleepSegmentation.absent;
+        src = 'rejected';
+      } else if (ov != null) {
         // The user's word — force the window, skip detection entirely.
         s = ana.segmentSleep(
           accelSlice,
@@ -1156,6 +1167,11 @@ List<PhysioDay> calendarDays(
             ));
           }
         }
+      } else if (src == 'rejected') {
+        // No window to stage (deliberately), but the day still needs to know
+        // it was a rejection rather than an ordinary absence — sleep_detail
+        // reads this to keep the "not sleep" state from re-prompting.
+        sleepSource = 'rejected';
       }
     }
 
@@ -1174,7 +1190,9 @@ List<PhysioDay> calendarDays(
               : (sleepSource == 'manual' || sleepSource == 'confirmed'
                   ? const <String>['SLEEP_MANUAL']
                   : const <String>[]))
-          : const <String>['NO_SLEEP_DETECTED'],
+          : (sleepSource == 'rejected'
+              ? const <String>['SLEEP_REJECTED']
+              : const <String>['NO_SLEEP_DETECTED']),
     ));
     dayStart = dayEnd;
   }

lib/data/local_repository_impl.dart

@@ -13,6 +13,7 @@
 // Honesty: a metric whose value is absent stays absent ("—"); we never fabricate.
 // Profile-gated metrics are null when the profile field is missing.
 
+import 'dart:async';
 import 'dart:convert';
 import 'dart:isolate';
 import 'dart:math' as math;
@@ -27,6 +28,7 @@ import 'package:openstrap_analytics/onehz.dart' as ana;
 
 import 'day_label.dart';
 import 'db.dart';
+import '../health/health_export.dart';
 import 'journal_fields.dart';
 import 'local_repository.dart';
 import 'series_codec.dart';
@@ -2475,6 +2477,12 @@ class LocalRepositoryImpl extends LocalRepository {
         'status': 'done',
         'end_ts': DateTime.now().millisecondsSinceEpoch ~/ 1000,
       });
+      // This is the choke point the AI coach's `end_workout` tool reaches
+      // directly (bypassing AppState.stopWorkout, the only other place this
+      // used to happen) — without it a coach-ended workout never reached
+      // Apple Health / Health Connect (edge#277). Idempotent + best-effort;
+      // exportWorkoutId re-reads the row and no-ops if sync is off.
+      unawaited(HealthExporter.exportWorkoutId(workoutId));
     }
     return {'workout_id': workoutId};
   }
@@ -2528,6 +2536,15 @@ class LocalRepositoryImpl extends LocalRepository {
     if (existing['status'] == 'live') {
       throw StateError('setWorkoutWindow: session $id is still live');
     }
+    // Clear the OLD Health window before the retimed row overwrites it — the
+    // caller's subsequent exportWorkoutId only deletes inside the NEW window,
+    // so a narrowed/moved retime would otherwise leave the previous sample
+    // stranded outside it.
+    final oldStart = (existing['start_ts'] as num?)?.toInt();
+    final oldEnd = (existing['end_ts'] as num?)?.toInt();
+    if (oldStart != null && oldEnd != null) {
+      await HealthExporter.deleteWorkoutWindow(oldStart, oldEnd);
+    }
     // A retimed session keeps its id, so the OLD row is replaced rather than
     // orphaned — including its GPS route, which still belongs to it.
     return _writeManualSession(
@@ -4081,17 +4098,48 @@ Map<String, dynamic>? stressSummaryForToday(
 // Top-level (no `this` capture) + only file-scoped `proto`/`ana` top-level
 // functions + a List<String> of hex frames in, a plain Map out — all sendable.
 
-Map<String, dynamic> _spotCheckCompute(List<String> records) {
-  // Decode RR from the live RR-bearing frames (0x28 / R10), clean, compute HRV.
+/// Decode RR beats from the live RR-bearing frames (0x28 / R10), shared by
+/// [_spotCheckCompute] and [_breathingCoherenceCompute] (CodeRabbit noted the
+/// duplication on edge#308). rrTsMs carries each beat's packet timestamp
+/// (ms) alongside it — same seam getNightBeats uses (line ~867) — so
+/// correctRr can re-anchor at a dropout and hrvTime's/coherence's seam
+/// detection can refuse to diff across it (edge#286: a flat rrMs-only list
+/// let a real packet gap read as two successive beats). rr.ts is whole
+/// SECONDS, and a live 0x2B packet can legitimately land more than once in
+/// the same second — only an out-of-order (strictly older) timestamp can't
+/// prove adjacency to what came before it, so only that gets dropped; an
+/// equal timestamp is accepted like normal (sourcery flagged the earlier
+/// strict `>` as silently losing real beats on any multi-packet-per-second
+/// burst).
+({List<double> rrMs, List<double> rrTsMs}) _decodeLiveRr(
+  List<String> records,
+) {
   final rrMs = <double>[];
-  final hrs = <double>[];
+  final rrTsMs = <double>[];
+  int? lastPacketTs;
   for (final hex in records) {
     final rr = proto.realtimeRr(hex);
-    if (rr != null) {
-      for (final v in rr.rrMs) {
-        if (v > 0) rrMs.add(v.toDouble());
+    if (rr == null || (lastPacketTs != null && rr.ts < lastPacketTs)) {
+      continue;
+    }
+    lastPacketTs = rr.ts;
+    final ts = rr.ts.toDouble() * 1000;
+    for (final v in rr.rrMs) {
+      if (v > 0) {
+        rrMs.add(v.toDouble());
+        rrTsMs.add(ts);
       }
     }
+  }
+  return (rrMs: rrMs, rrTsMs: rrTsMs);
+}
+
+Map<String, dynamic> _spotCheckCompute(List<String> records) {
+  final decoded = _decodeLiveRr(records);
+  final rrMs = decoded.rrMs;
+  final rrTsMs = decoded.rrTsMs;
+  final hrs = <double>[];
+  for (final hex in records) {
     try {
       final s = proto.decodeRecord(hex);
       if (s != null && s.hr > 0) hrs.add(s.hr.toDouble());
@@ -4100,7 +4148,7 @@ Map<String, dynamic> _spotCheckCompute(List<String> records) {
   if (rrMs.length < 20) {
     return {'ok': false, 'n_beats': rrMs.length};
   }
-  final cleaned = ana.correctRr(rrMs);
+  final cleaned = ana.correctRr(rrMs, rrTsMs: rrTsMs);
   final hrv = ana.hrvTime(cleaned.nn, nnTimesMs: cleaned.nnTimesMs);
   if (!hrv.present) return {'ok': false, 'n_beats': cleaned.nn.length};
   final meanHr = hrs.isEmpty ? null : hrs.reduce((a, b) => a + b) / hrs.length;
@@ -4118,21 +4166,18 @@ Map<String, dynamic> _breathingCoherenceCompute(
   List<String> records,
   double? pacedHz,
 ) {
-  // Decode RR from the live RR-bearing frames (0x28 / R10) — same seam
-  // spotCheck uses — then run McCraty & Zayas 2014 cardiac coherence.
-  final rrMs = <double>[];
-  for (final hex in records) {
-    final rr = proto.realtimeRr(hex);
-    if (rr != null) {
-      for (final v in rr.rrMs) {
-        if (v > 0) rrMs.add(v.toDouble());
-      }
-    }
-  }
+  // Decode RR from the live RR-bearing frames (0x28 / R10) via the shared
+  // _decodeLiveRr helper (same seam spotCheck uses), then run McCraty &
+  // Zayas 2014 cardiac coherence. rrTsMs lets correctRr re-anchor at a real
+  // packet gap so the coherence time axis is the real wall clock, not a
+  // gap-free cumsum (edge#286).
+  final decoded = _decodeLiveRr(records);
+  final rrMs = decoded.rrMs;
+  final rrTsMs = decoded.rrTsMs;
   if (rrMs.length < 20) {
     return {'ok': false, 'n_beats': rrMs.length};
   }
-  final cleaned = ana.correctRr(rrMs);
+  final cleaned = ana.correctRr(rrMs, rrTsMs: rrTsMs);
   final m = ana.cardiacCoherence(
     cleaned.nn,
     cleaned.nnTimesMs,

lib/health/health_export.dart

@@ -298,6 +298,29 @@ class HealthExporter {
     }
   }
 
+  /// Clear a stale workout's OLD window before the caller writes its retimed
+  /// replacement. [exportWorkout] only ever deletes inside the row's CURRENT
+  /// `[start,end]` — fine for a same-window re-export, but `setWorkoutWindow`
+  /// narrowing or moving a session leaves its previous Health sample outside
+  /// that window, so it survives untouched. Call this with the row's window
+  /// as it stood BEFORE the retime, then let the normal exportWorkoutId path
+  /// write the new one. Best-effort; never throws.
+  static Future<void> deleteWorkoutWindow(int startTs, int endTs) async {
+    try {
+      final prefs = await SharedPreferences.getInstance();
+      if (prefs.getBool(kHealthSyncPref) != true) return;
+      await shared._ensureConfigured();
+      if (await shared._androidUnavailable() != null) return;
+      await shared._deleteOwnSamples(
+        HealthDataType.WORKOUT,
+        DateTime.fromMillisecondsSinceEpoch(startTs * 1000),
+        DateTime.fromMillisecondsSinceEpoch(endTs * 1000),
+      );
+    } catch (e) {
+      debugPrint('[health] deleteWorkoutWindow: $e');
+    }
+  }
+
   /// True on iOS/macOS (Apple Health); false on Android (Health Connect).
   static bool get isApple => Platform.isIOS || Platform.isMacOS;