[ryanbr]

Draft — the pure, testable core of #1284 residual 3 (duplicate generation), landing the design @pipiche38's four-night corpus selected. Wiring into the live path is the hardware-gated follow-up (below), matching this issue's draft → hardware-run cadence.

What this is

OuraSessionReconciler (Swift WhoopStore + byte-identical Kotlin com.noop.oura twin) — pure, no store/BLE:

• noonAnchoredSleepDay(startTs, tz) — groups a ring's sessions by date(startTs_local + 12h).
• reconcile(new, existing) — within a sleep-day, overlap-or-gap<60min ⇒ same session; keep the fuller decode (the completeness guard). Returns insert / skip / replace(supersededStartTs).

Why this design (from the corpus, not a guess)

• Option (2) collapses 4/4 nights; the 30-min grid only 1/4. The grid fails on 08-11/12 (starts 6¼ min apart straddle 22:30) and spends the bedtime precision that let 08-13/14 be checked against WHOOP to −10 s/+50 s.
• Noon-anchor, not wake-day — on 08-10/11 the 40-min fragment ends before midnight, so its wake-day (Aug 10) differs from the night's (Aug 11); the noon anchor maps both together. The test asserts exactly this (and that wake-day would not).
• Two duplicate modes, both handled — re-anchor (same hypnogram, two onsets) and partial-drain (shorter divergent decode). The completeness guard adjudicates the partial-drain case; the fuller row is the WHOOP-matching one on every measured night.
• Nap safety — 08-09's real 22-min afternoon nap shares the sleep-day with that night's sleep, but the ~7½ h gap keeps it a distinct row.

Validation

• Kotlin: 6/6 green locally (OuraSessionReconcilerTest) — every fixture is one of @pipiche38's nights.
• Swift runs under swift-packages (WhoopStoreTests, macos-15). Pure package code — no app-target Swift, so no app-build gate needed.
• One test caught a real bug in my own test premise while writing it (wake-day is the end day, not start), which is now asserted correctly — the design itself held.

Follow-up (needs @pipiche38's ring — Q3)

Wire the reconciler into OuraLiveSource.persistHypnogramBurst: at persist time read the day's already-stored sessions (noonAnchoredSleepDay window) and insert/skip/replace on the decision. That read is the same one that lets the cross-connection check see duplicates a per-connection in-memory list can't — so it also closes the #1297 diagnostic blind spot. It's the write-only-source read dependency we discussed; it can't be unit-tested (BLE + store) and needs a hardware run confirming one row across two connections at the correct window.

Relates to #1284. Design + measurements: @pipiche38 (thank you).

[ryanbr]

Closing — superseded. The persist-time reconciler here had a TOCTOU race (non-atomic read-modify-write on the BLE thread) and a userEdited data-loss edge, and a tracker comparison showed it was a divergent second dedup rule: WHOOP has the same moving-startTs problem and handles it with the #899 post-hoc SleepSessionDedup heal, which already collapses 3 of pipiche's 4 nights with the right survivor.

Split into:

• fix(sleep): collapse a near-adjacent pre-onset fragment in the dedup heal (#1284) #1338 — extends the Publish the command result code on Apple, as Android already does (#894) #899 heal to catch the one mode it missed (the non-overlapping pre-onset fragment). Heal-side; ships now.
• Generation-side (0x49/sleep-day keying) + the logging to design it — tracked on [oura] Three residuals after #1249 / #1251, measured on a second night #1284 (needs @pipiche38's hardware captures).