CI: frame integrity verdict (upstream PR ryanbr/noop#1985) — macOS/iOS app build and StrandTests

.github/workflows/android.yml

@@ -12,11 +12,27 @@ on:
     paths:
       - 'android/**'
       - '.github/workflows/android.yml'
+      # The twin-drift guards read the SWIFT side's fixtures on purpose — DecoderOracleTest compares
+      # against Packages/.../decoder_oracle.json to catch a one-sided edit, and the schema/protocol
+      # oracles work the same way. Without these, editing the Swift copy alone leaves the very test
+      # written to catch that from ever running. Keep this list in step with what the tests read.
+      - 'Packages/WhoopProtocol/Sources/WhoopProtocol/Resources/**'
+      - 'Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/**'
+      - 'Packages/WhoopStore/Tests/WhoopStoreTests/Resources/**'
+      - 'Strand/Resources/Localizable.xcstrings'
   push:
     branches: [main]
     paths:
       - 'android/**'
       - '.github/workflows/android.yml'
+      # The twin-drift guards read the SWIFT side's fixtures on purpose — DecoderOracleTest compares
+      # against Packages/.../decoder_oracle.json to catch a one-sided edit, and the schema/protocol
+      # oracles work the same way. Without these, editing the Swift copy alone leaves the very test
+      # written to catch that from ever running. Keep this list in step with what the tests read.
+      - 'Packages/WhoopProtocol/Sources/WhoopProtocol/Resources/**'
+      - 'Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/**'
+      - 'Packages/WhoopStore/Tests/WhoopStoreTests/Resources/**'
+      - 'Strand/Resources/Localizable.xcstrings'
   workflow_dispatch:
 
 concurrency:

.github/workflows/app-build.yml

@@ -13,6 +13,18 @@ on:
     branches: [main]
     paths:
       - 'Strand/**'
+      # The app-target TESTS, not just the sources they cover. The `Test Strand` step below runs
+      # StrandTests, but a PR touching only those tests matched nothing here, so it built and ran
+      # nothing: one that failed to compile, or simply failed, merged unverified and went red on the
+      # next unrelated PR that happened to touch `Strand/**`, mis-attributing the breakage to whoever
+      # that was.
+      #
+      # This is the only test directory that needs naming, and the reason is layout rather than
+      # oversight: Android's tests sit under `android/**` and the package suites under `Packages/**`,
+      # both already inside their subject's glob, while StrandTests is a SIBLING of `Strand/` instead
+      # of part of it. `project.yml` does not cover it either — the target takes
+      # `sources: [StrandTests]`, a directory, so adding a test file changes no other tracked path.
+      - 'StrandTests/**'
       - 'StrandiOS/**'
       - 'StrandiOSShared/**'
       - 'StrandiOSWidgets/**'

.github/workflows/swift-packages.yml

@@ -16,6 +16,11 @@ on:
       - 'Tools/SleepPSG/**'
       - 'Tools/Backfill/**'
       - '.github/workflows/swift-packages.yml'
+      # Mirror of the note in android.yml: package tests read the ANDROID oracles to catch a one-sided
+      # edit, and one reads Strand/Liquid/LiquidCore.swift. Editing only that side would otherwise skip
+      # the guard written for exactly that case. Keep in step with what the tests read.
+      - 'android/app/src/test/resources/**'
+      - 'Strand/Liquid/LiquidCore.swift'
   push:
     branches: [main]
     paths:
@@ -24,6 +29,11 @@ on:
       - 'Tools/SleepPSG/**'
       - 'Tools/Backfill/**'
       - '.github/workflows/swift-packages.yml'
+      # Mirror of the note in android.yml: package tests read the ANDROID oracles to catch a one-sided
+      # edit, and one reads Strand/Liquid/LiquidCore.swift. Editing only that side would otherwise skip
+      # the guard written for exactly that case. Keep in step with what the tests read.
+      - 'android/app/src/test/resources/**'
+      - 'Strand/Liquid/LiquidCore.swift'
   workflow_dispatch:
 
 concurrency:

.github/workflows/tools-python.yml

@@ -5,22 +5,35 @@
 # one of them only ever executed when a contributor remembered to, which meant a decoder could regress and
 # the suite that would have caught it stayed green by never being run.
 #
-# Cheap to run: pure stdlib `unittest`, no dependencies, no fixtures to fetch, ubuntu rather than macOS.
-# Path-filtered so it only fires when the suites it runs change.
+# Cheap to run: pure stdlib `unittest`, no dependencies, no fixtures to fetch, ubuntu rather than macOS —
+# about 25 seconds end to end.
+#
+# NOT path-filtered, and that is deliberate. It used to fire only on `Tools/**.py`, on the premise that a
+# suite can only break when its own source changes. That is false for `test_home_i18n.py`, which asserts
+# on the CONTENTS of app and package files — AppModel.swift, the xcstrings catalogues, ReadinessEngine,
+# DayNavBar. A Swift-only commit broke it (#1671 moved a sign and a hardcoded °C out of a localized
+# literal) and the filter meant this job never ran, so `main` sat red until a contributor touching
+# `Tools/` for something unrelated tripped over it in their own PR (#1691).
+#
+# Widening the filter to name those paths would just re-create the trap one edit later: the list is
+# whatever the assertions happen to read today. Twenty-five seconds on every PR is cheaper than a gate
+# that is green because it did not run.
 name: Tools Python CI
 
 on:
+  # Path-filtered like android.yml / swift-packages.yml / app-build.yml. Without this the workflow ran on
+  # EVERY pull request and every push to main, including the many that touch no Python at all - and with a
+  # Windows runner now in it, billed at twice a Linux minute, that is a real cost for a job whose inputs
+  # cannot have changed. The workflow file itself is included so a change to the job still tests itself.
   pull_request:
     branches: [main]
     paths:
-      - 'Tools/linux-capture/**'
-      - 'Tools/*.py'
+      - 'Tools/**'
       - '.github/workflows/tools-python.yml'
   push:
     branches: [main]
     paths:
-      - 'Tools/linux-capture/**'
-      - 'Tools/*.py'
+      - 'Tools/**'
       - '.github/workflows/tools-python.yml'
   workflow_dispatch:
 
@@ -76,3 +89,36 @@ jobs:
             exit 1
           fi
         working-directory: Tools
+
+  windows-capture:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      # Keep Windows locale defaults and exercise a strict legacy console, including subprocesses.
+      # UTF-8 mode would hide implicit file encodings; replacement output would hide console bugs.
+      - name: Run Tools/linux-capture tests with legacy Windows encodings
+        working-directory: Tools/linux-capture
+        env:
+          PYTHONUTF8: '0'
+          PYTHONIOENCODING: 'cp1252:strict'
+          PYTHONLEGACYWINDOWSSTDIO: '1'
+        shell: python
+        run: |
+          import sys
+          import unittest
+
+          suite = unittest.defaultTestLoader.discover('.', pattern='test_*.py')
+          count = suite.countTestCases()
+          print(f'collected {count} tests', flush=True)
+          result = unittest.TextTestRunner(verbosity=2).run(suite)
+          if count < 200 or result.testsRun < 200:
+              print('::error::expected at least 200 tests; discovery or execution is incomplete')
+              sys.exit(1)
+          sys.exit(0 if result.wasSuccessful() else 1)

ATTRIBUTION.md

@@ -57,11 +57,15 @@ This is long-standing practice, not a one-off. Worked examples already in the tr
   field order, widths and enum values for `FilteredLabradorPacket` / `RawLabradorPacket`, plus the
   `{revision, arg, padding}` command payload shape, re-derived from static analysis of the vendor's iOS
   client. The four command NUMBERS were already in our own `CommandNumber` table from the whoomp/goose
-  work above. Everything ships as an **unvalidated candidate**: no strap has yet been asked whether it
-  honours these commands, the decode backs no metric, and the fields nobody can attest (the wrist enum's
-  raw values, the progress "timed out" sentinel, the ECG sample unit, the packet type byte) are carried
-  raw rather than named. The on-strap rhythm classifier's verdict is decoded as a byte and is never
-  presented as a finding — NOOP is not a medical device.
+  work above. Most of it still ships as an **unvalidated candidate**: the decode backs no metric, and the
+  fields nobody can attest (the wrist enum's raw values, the progress "timed out" sentinel, the ECG
+  sample unit, the packet type byte) are carried raw rather than named. **One exception is now attested
+  rather than inferred:** `ControlSignal`'s raw values were also read off the client's enum order, and a
+  WHOOP MG (`WS50_r00`, fw `50.39.1.0`) contradicts that reading — `1` stops generation, `2` starts it,
+  `0` is refused. The enum now carries the hardware values with the device and firmware named. A
+  hardware-observed value is strictly stronger than the inference it replaces, but it is one device.
+  The on-strap rhythm classifier's verdict is decoded as a byte and is never presented as a finding —
+  NOOP is not a medical device.
 
 And the line held from the other side:
 

CHANGELOG.md

@@ -17,6 +17,66 @@ approximate; downloads are on the [Releases](https://github.com/NoopApp/noop/rel
 
 ---
 
+## 11.1.0: A clock you choose, sleep without motion, and logs that report instead of assuming (all platforms)
+
+**Choose how you read times**
+
+- **Clock format: System / 12-hour / 24-hour (#1821).** Times were decided by your device's *region*, not
+  by you. On Apple that is deliberate — it preserves regional date order and clock style — but building a
+  locale from a region identifier discards the explicit **24-Hour Time** switch in iOS Settings, so
+  someone in a 24-hour country who preferred a 12-hour clock had no way to ask for one. Settings →
+  Appearance now offers the choice, defaulting to System, and System now follows your phone's own switch.
+  It applies to the Asleep/Woke row, workout and nap times, caffeine and hydration entries, backup
+  timestamps, sleep-stage timelines and the home-screen widgets. Chart axis ticks stay 24-hour for now:
+  12-hour labels are wider and the axis spacing needs checking on a device first.
+
+**Sleep**
+
+- **A night can be found from heart rate alone (#1801).** Sleep detection is built on stillness, so a
+  strap that banks no movement scored no nights at all — the everyday reality of a WHOOP 5/MG that will
+  not complete pairing. NOOP can now detect and stage such a night from heart rate. It is display-only by
+  design: an HR-only night never feeds resting heart rate, HRV or SDNN baselines, because it was not
+  established with the evidence those depend on.
+- **The AI coach receives your sleep stages (#1816).** It had been answering that it could not see them,
+  because deep, REM and light minutes were never included in its context. They are now, with efficiency
+  normalised so it cannot arrive as a nonsensical percentage.
+
+**Straps, logs and honesty**
+
+- **The 1970/71 clock warning takes battery into account (#1818).** It previously offered one remedy at
+  any charge level, so people already at 100% were told to charge to 100% and reconnect — advice that was
+  not backed by any precondition in the code.
+- **Every disconnect records what actually happened (#1809, thanks @supremesynergy).** How long the link
+  held, how many frames and bytes arrived, whether the realtime stream was armed, and how it ended. A
+  strap log could not previously state whether a strap had transmitted anything; you had to infer it from
+  every logged line happening to be outgoing, which measures NOOP's logging rather than the strap.
+- **The clock exchange quotes the strap's reply (#1823).** NOOP wrote "clock synced" the moment it queued
+  the write, before any answer existed, so a log could assert the clock was set while the connection
+  readout said 1970/71. It now says what it *sent* and records the reply frame. On a WHOOP 5/MG the
+  readout also claimed "RTC reads 1970/71" when no clock had ever been read on that family; it now
+  reports the evidence it has, which is how the strap dated its records.
+
+**Backup, widgets and interface**
+
+- **Oversize backups (#1807).** Export warns when an archive exceeds the 2 GiB restore ceiling instead of
+  writing one that cannot be restored, and an oversize restore can be allowed through rather than refused.
+- **Home-screen widgets (#1795, thanks @Sneheth; #1799).** Heart-rate and HRV values had swapped icons on
+  Apple. Both platforms' widgets now also read aloud properly, speaking the value rather than a bare
+  number.
+- **Live workout no longer shows two overlapping timers (#1814),** and the steps calibration card stops
+  asking for data already provided (#1815).
+- **Oura rings that advertise no name (#1797, thanks @pipiche38)** label consistently across platforms,
+  and Android's standard heart-rate logging is honest about how much it captured (#1796, thanks @kvnloo).
+
+**Still open**
+
+WHOOP 5/MG history remains unsolved. A strap that will not complete the pairing handshake is never given
+a clock, and an un-clocked 5/MG does not persist sensor data to flash, so its offloads complete empty.
+The diagnostics above exist to separate that from a strap that *was* clocked and still refuses — a
+different fault seen on the same firmware.
+
+---
+
 ## 9.3.0: Water and caffeine import, honest Effort, and an Oura resting-heart-rate fix (all platforms)
 
 A release about the numbers being right, on top of 9.2.1.

CLAUDE.md

@@ -7,14 +7,18 @@ and [`docs/IOS.md`](docs/IOS.md) covers the iOS target. Read this first; follow
 
 ## What NOOP is (and the hard scope limits)
 
-NOOP is a **fully offline, on-device** companion app for WHOOP 4.0 and 5.0/MG straps (with
+NOOP is an **offline-by-default, on-device** companion app for WHOOP 4.0 and 5.0/MG straps (with
 **experimental** Oura support in the tree — gated behind `ExperimentalBrand`, not a shipped supported
 strap). It pairs over Bluetooth, stores everything in on-device SQLite, and computes recovery / strain
-/ HRV / sleep locally. There is **no server, no account, no cloud sync, no telemetry**, and the project stays
-**anonymous** (iOS/Android ship build-from-source / sideload, not via the App Store).
+/ HRV / sleep locally. There is **no NOOP-operated server, no account, no cloud dependency, no
+telemetry**, and the project stays **anonymous** (iOS/Android ship build-from-source / sideload, not
+via the App Store). Issue #1314 permits one narrow exception: a default-off Experimental client may
+export data one way to an HTTP(S) endpoint the user owns and configures. It must remain outside strap
+sync, never read data back, and ship no receiver or hosted service in this repository.
 
 These are hard constraints, not preferences. A PR is out of scope if it:
-- adds a server, account, cloud sync, or sends any data off-device;
+- adds a server, account, cloud dependency, or sends data off-device without the explicit user export
+  boundary in [`docs/SCOPE.md`](docs/SCOPE.md) (including #1314's one-way self-hosted push);
 - adds analytics/telemetry/crash-reporting that phones home;
 - adds WHOOP firmware, decompiled app code, logos/assets, or any DRM circumvention. NOOP is
   **clean-room interoperability** with hardware the user owns — keep it that way. (That bars
@@ -115,7 +119,7 @@ xcodegen generate && xcodebuild -project Strand.xcodeproj -scheme Strand \
 ### What each CI job covers — and the gaps
 | Workflow | Covers | Runner | Default state |
 |---|---|---|---|
-| `swift-packages.yml` | `swift test` for **`Packages/**` only** (WhoopProtocol, WhoopStore, StrandAnalytics, StrandImport, StrandDesign, NoopLocalAccess) | macos-15 | **active** |
+| `swift-packages.yml` | TWO jobs. `test`: `swift test` over **`Packages/**`** (WhoopProtocol, WhoopStore, StrandAnalytics, StrandImport, StrandDesign, NoopLocalAccess). `tools`: `swift build` + `swift test` over **`Tools/SleepBench`, `Tools/SleepPSG`, `Tools/Backfill`** — Backfill has no test target, so it is build-only. Path-filtered to those directories. | macos-15 | **active** |
 | `app-build.yml` | Builds the **app targets** (`Strand` macOS + `NOOPiOS` iOS) **and runs `StrandTests`** on the macOS/`Strand` leg only — the iOS leg is compile-only. iOS leg needs **macos-26** (iOS 26 SDK / `glassEffect`). | macos-15 / macos-26 | **disabled** (on-demand) |
 | `android.yml` | `assembleFullDebug` + `testFullDebugUnitTest` | ubuntu | **active**, path-filtered to `android/**` |
 | `source-hygiene.yml` | Doc comments that bind to nothing (`Tools/doc_comment_lint.py`) | ubuntu | **active** |
@@ -132,10 +136,13 @@ properties are initialized`) will pass every green check and still be broken. If
 Swift, you MUST build the app yourself: `xcodebuild … build` locally, or run `app-build.yml` on demand.
 
 ### Local walls (things that will *not* build where you expect)
-- **On Linux:** only `WhoopProtocol` / `OuraProtocol` (pure) build & test. Every GRDB-linked package —
-  `WhoopStore`, `StrandImport`, `StrandAnalytics` (via `WhoopStore`), and `NoopLocalAccess` — fails with
-  `sqlite3.h not found` (GRDB's CSQLite), and `StrandDesign` needs SwiftUI — all need **macOS**. Android
-  JVM unit tests **do** run on Linux.
+- **On Linux:** `WhoopProtocol` / `OuraProtocol` (pure) build & test with a bare toolchain. The
+  GRDB-linked packages need the snapshot-enabled SQLite build in [`docs/BUILD.md`](docs/BUILD.md) — with
+  it, all four build AND test: `StrandAnalytics` (1523), `WhoopStore` (439), `StrandImport` (249) and
+  `NoopLocalAccess` (9). Without those flags they fail with `sqlite3.h not found` (GRDB's CSQLite). `StrandDesign`
+  needs SwiftUI and is macOS-only. Android JVM unit tests **do** run on Linux.
+  **None of this is CI-enforced** — `swift-packages.yml` is macOS-only, so Linux support is honour-system
+  and a change can break it silently.
 - **App targets** (`Strand`, `NOOPiOS`) need **Xcode on macOS**; `StrandTests` runs only under
   `xcodebuild … test` on macOS — locally, or via `app-build.yml`, which does run it on the `Strand` leg.
   Since that workflow is **disabled by default**, app-target tests are only as validated as your last