[pipiche38]

Summary

Two related, deliberately-bundled changes to the Test Centre report bundle. They
ship together because the second exists to make the first safe — separating them
would merge a feature that can hang the app, then fix it. Each is its own commit.

1. Attach Oura ring diagnostics to the report bundle — when the ring's
   Tier-B JSONL sidecars (raw notifications / IBI-HR / activity MET) are present
   in <App Support>/OpenWhoop/Diagnostics, they're added to the bundle
   (mirroring raw-capture.jsonl), redacted by the existing whole-bundle scrub
   (the ring UUID → <device>), and trimmed to the 20 MB cap alongside
   raw-capture. Attached when present — no separate brand gate: a run with no
   ring produces no files, so nothing is attached. Entry names are normalized to
   drop the ring id.

2. Don't inline large raw streams in the review sheet (fixes a hang) — the
   review-before-share sheet rendered every text entry as a single SwiftUI
   Text. A ~12 MB oura-raw.jsonl made SwiftUI/CoreText try to lay out
   megabytes as one Text, allocating >1 GB of glyph storage and pinning the
   main thread indefinitely, so generating a report appeared to hang.
   ReportReviewGate.previewText now excludes the large raw streams by name
   (screenshot + raw-capture + the Oura sidecars) plus a 1 MiB per-entry size
   guard, naming them in the "attached" note instead. report.txt / meta.json
   / last-crash.txt still show in full, and the excluded streams remain in the
   .zip — the review still shows exactly what's shared.

How the hang was found

Main-thread sample: 100% of samples in one synchronous layout pass at a 1.1 GB
footprint —
SheetContentRoot.sizeThatFits → StyledTextLayoutEngine.sizeThatFits → CTLineCreateWithAttributedString → TGlyphEncoder::EncodeChars.
Read, redaction, and zip were all ruled out; this is purely UI text layout.

Scope

• Report-bundle half only. The producers that write the Oura sidecars
  (OuraRawDump / OuraIbiHrDump / OuraActivityDump) are not on main, so the
  attach logic is dormant until they land — it safely attaches "when present"
  and no-ops otherwise. The review-sheet guard is self-contained and correct
  regardless.
• Cross-platform: Apple-only. This is the experimental Oura path on the
  Apple Test Centre; Android's report bundle does not attach these sidecars and
  has no SwiftUI review sheet, so there is no Kotlin twin to change here.

Verification

App-target Swift (CI doesn't cover it): built Strand (macOS) on origin/main;
TestBundleAssemblerTests + ReportReviewGateTests 12/12 pass, including a
new test proving a 2 MB stream never reaches the preview. Hang fix confirmed
on-device — the report sheet now opens instantly.

[ryanbr]

Reviewed both commits. This is careful work — the two-commit split is right (the guard exists to make the attach safe), the scope is honestly stated, and the tests are real rather than decorative. The proportional cap-split in particular is a clean generalization: reserve non-trimmable whole, share the remainder by size, floor-round so the sum can't breach the cap, keep each tail. testCapSharesBudgetAcrossOuraAndRawCaptureKeepingTails checks all of that (sum ≤ cap, both trimmed, newest byte kept, bigger stream bigger share).

Caveat on my verification: this is app-target Swift (Strand/StrandTests), which has no Linux/CI path, so I could not build or run it — I reviewed statically and trust your macOS 12/12. One thing I could check empirically is below.

The one substantive thing: the redaction guarantee is conditional and untested

The commit message states "the ring UUID inside each line is masked to <device> by the existing redactEntries pass." That holds only if the (off-main) producer writes the id as a canonical dashed uuidString. I ran the actual redactPii device-UUID regex against the ring id your own test uses:

MASKED   canonical dashed  5C4C0BF8-2DF6-1B3A-18D0-3DF0B3590148   -> <device>
MASKED   lowercased dashed                                        -> <device>
LEAKS    dashless          5C4C0BF82DF61B3A18D03DF0B3590148        -> unchanged
LEAKS    truncated (first 8 hex)                                   -> unchanged

CBPeripheral.identifier.uuidString is dashed-uppercase, so the happy path is covered. But the regex requires the 8-4-4-4-12 dash shape — a dashless or truncated id in the JSONL leaks verbatim into a bundle a user is about to share. Since the producers (OuraRawDump et al.) aren't on main, nothing here pins the format, and there's no test feeding a representative Oura line through redactEntries and asserting the id is gone (the existing normalizedOuraEntryName test uses a dashed UUID, but that's the filename, which is normalized away, not redacted).

Not blocking — the attach path is dormant until the producers land, so nothing leaks today. But this PR is where the "redaction covers it" claim is made, so I'd either (a) add a redaction test now with a line shaped the way the producer will actually write it, or (b) make it a landing gate on the producer PRs: the ring id MUST be emitted as uuidString, pinned by a test. Privacy-path guarantees that rest on an un-landed sibling's formatting are exactly the kind that rot silently.

Minor (neither blocking)

• The size guard is per-entry, not aggregate. maxInlineBytes caps each inlined file at 1 MiB, but the preview joins all of them — report.txt + meta.json + last-crash.txt. In practice those are small so it's fine; just noting the guard bounds N×1 MiB, not the total. The name-based exclusion carries the real weight; the size guard is the belt to that suspenders, which is the right design.
• meta.json doesn't reflect the sidecars. storage.rawCaptureBytes is still raw-capture-specific and truncated is a single bool, so a maintainer can't tell from meta which stream(s) got trimmed once several are trimmable. Observability nit, not correctness.

One reframing

The hang isn't reproducible on main today — previewText already excludes raw-capture.jsonl by name, and the other inline files are bounded, so there's no large stream to choke on until oura-raw.jsonl is attached. Your description says exactly this, so no correction needed — but it means the durable value of commit 2 is the size guard, which closes the whole class: any future stream added to the bundle without being added to the exclude list can no longer hang the sheet. That's worth more than the specific Oura case and is a good reason to want commit 2 on main regardless of when the producers land.

Solid PR. The redaction contract is the only thing I'd want addressed before this class of file starts carrying real ring ids.

[pipiche38]

@ryanbr Thanks for the careful review — the redaction point is a good catch. Addressed in 9a16e7d.

Redaction contract (the blocking concern). You're right that the mask holds only for a canonical dashed uuidString — I confirmed the dash-anchored rule in LiveState.redactPii masks canonical (and lowercased) ids but leaks a dashless or truncated one. Today's producer writes the id in canonical form, so it's masked, but nothing pinned that.

I went with your first option — a redaction test rather than a wider regex — because broadening the rule to dashless hex would actively corrupt these files: the raw sidecar's hex field is a long raw-byte run, and a greedier hex rule would shred exactly the capture the diagnostic exists to preserve. So the safer fix is to hold the producer to canonical uuidString and lock it with a test.

testRedactionMasksOuraRingIdButKeepsRawHexIntact feeds a representative line in the exact OuraRawDumpLine.encode shape (schema/deviceId/utc/iso/hex) through redactEntries and asserts both halves: the id is masked to , and the raw hex bytes survive byte-for-byte. A future producer PR that emits a non-canonical id fails here instead of silently shipping the id in a bundle a user shares — the landing gate, made executable.

Verified: xcodebuild StrandTests → TestBundleAssemblerTests + ReportReviewGateTests, 13/13 pass.

On the two minor notes — both accurate, leaving as-is unless you'd prefer otherwise:

• Per-entry vs aggregate guard: the 1 MiB guard is per-entry, but the inlineable set is just the small text files (report.txt,
  meta.json, last-crash.txt); the large streams are excluded by name regardless, so the preview's aggregate stays bounded well below the layout-choke point. Happy to switch it to a running total if you'd rather have the belt-and-braces.
• Which streams were trimmed: meta.truncated is a single flag today, not per-stream. Easy follow-up to record the trimmed names/sizes in meta.json if that'd help triage — say the word and I'll add it.