Add hr-only sleep staging and expand analytics coverage

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -16,6 +16,7 @@ body:
         Many "bugs" are expected behaviour or a known limit. **Please check these before filing — it's the fastest way to an answer:**
         - **[FAQ](https://github.com/ryanbr/noop/blob/main/docs/FAQ.md)** — live HR, recovery/sleep, steps, importing, privacy, updates.
         - **[WHOOP 5.0 / MG status](https://github.com/ryanbr/noop/wiki/WHOOP-5.0-and-MG-Status)** — SpO₂, steps, recovery/sleep on the newer straps (the most common topic).
+        - **[Oura ring support](https://github.com/ryanbr/noop/blob/main/README.md#oura-ring-support)** — experimental; what a ring can and cannot give NOOP (Sleep and Strain but no Recovery on a ring-only day, no HRV or respiratory rate, live HR is partial).
         - **[Troubleshooting](https://github.com/ryanbr/noop/wiki/Troubleshooting)** — pairing, "syncs but no data", generic HR straps.
 
         ---
@@ -51,12 +52,16 @@ body:
   - type: dropdown
     id: strap
     attributes:
-      label: WHOOP strap model
+      label: WHOOP strap / Oura ring model
+      description: The model NOOP shows on the Devices screen for the device this report is about.
       options:
         - WHOOP 4.0
         - WHOOP 5.0
         - WHOOP MG
-        - No strap — imported data only
+        - Oura Ring 3 (Gen3)
+        - Oura Ring 4
+        - Oura Ring 5
+        - No strap or ring — imported data only
         - Not sure
     validations:
       required: true
@@ -67,7 +72,8 @@ body:
       multiple: true
       description: Tick all that apply.
       options:
-        - Live Bluetooth (strap connected)
+        - Live Bluetooth (WHOOP strap connected)
+        - Live Bluetooth (Oura ring connected)
         - WHOOP CSV export import
         - Apple Health import
         - Health Connect import
@@ -147,7 +153,7 @@ body:
           required: true
         - label: I checked the [Troubleshooting guide](https://github.com/ryanbr/noop/wiki/Troubleshooting) — especially "history syncs but no data" (most often the strap isn't banking history to flash; charge it to 100% and reconnect).
           required: true
-        - label: I checked the [FAQ](https://github.com/ryanbr/noop/blob/main/docs/FAQ.md) and — if I'm on a WHOOP 5.0 / MG — the [5.0/MG status page](https://github.com/ryanbr/noop/wiki/WHOOP-5.0-and-MG-Status), and this isn't an already-known limit (e.g. SpO₂, or recovery/sleep on the 5/MG).
+        - label: I checked the [FAQ](https://github.com/ryanbr/noop/blob/main/docs/FAQ.md) and — if I'm on a WHOOP 5.0 / MG — the [5.0/MG status page](https://github.com/ryanbr/noop/wiki/WHOOP-5.0-and-MG-Status), or — if I'm on an Oura ring — the [Oura ring support](https://github.com/ryanbr/noop/blob/main/README.md#oura-ring-support) table, and this isn't an already-known limit (e.g. SpO₂, recovery/sleep on the 5/MG, or no Recovery / HRV on a ring-only day).
           required: true
         - label: I've left out anything personal (strap serial, account email, raw export).
           required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -30,4 +30,4 @@ that covers it. "Builds and unit tests pass" alone is not enough for BLE work.
 
 ## Related issues
 
-<!-- Closes #N -->
+<!-- Refs #N -->

.github/workflows/android.yml

@@ -12,11 +12,27 @@ on:
     paths:
       - 'android/**'
       - '.github/workflows/android.yml'
+      # The twin-drift guards read the SWIFT side's fixtures on purpose — DecoderOracleTest compares
+      # against Packages/.../decoder_oracle.json to catch a one-sided edit, and the schema/protocol
+      # oracles work the same way. Without these, editing the Swift copy alone leaves the very test
+      # written to catch that from ever running. Keep this list in step with what the tests read.
+      - 'Packages/WhoopProtocol/Sources/WhoopProtocol/Resources/**'
+      - 'Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/**'
+      - 'Packages/WhoopStore/Tests/WhoopStoreTests/Resources/**'
+      - 'Strand/Resources/Localizable.xcstrings'
   push:
     branches: [main]
     paths:
       - 'android/**'
       - '.github/workflows/android.yml'
+      # The twin-drift guards read the SWIFT side's fixtures on purpose — DecoderOracleTest compares
+      # against Packages/.../decoder_oracle.json to catch a one-sided edit, and the schema/protocol
+      # oracles work the same way. Without these, editing the Swift copy alone leaves the very test
+      # written to catch that from ever running. Keep this list in step with what the tests read.
+      - 'Packages/WhoopProtocol/Sources/WhoopProtocol/Resources/**'
+      - 'Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/**'
+      - 'Packages/WhoopStore/Tests/WhoopStoreTests/Resources/**'
+      - 'Strand/Resources/Localizable.xcstrings'
   workflow_dispatch:
 
 concurrency:

.github/workflows/app-build.yml

@@ -13,9 +13,29 @@ on:
     branches: [main]
     paths:
       - 'Strand/**'
+      # The app-target TESTS, not just the sources they cover. The `Test Strand` step below runs
+      # StrandTests, but a PR touching only those tests matched nothing here, so it built and ran
+      # nothing: one that failed to compile, or simply failed, merged unverified and went red on the
+      # next unrelated PR that happened to touch `Strand/**`, mis-attributing the breakage to whoever
+      # that was.
+      #
+      # This is the only test directory that needs naming, and the reason is layout rather than
+      # oversight: Android's tests sit under `android/**` and the package suites under `Packages/**`,
+      # both already inside their subject's glob, while StrandTests is a SIBLING of `Strand/` instead
+      # of part of it. `project.yml` does not cover it either — the target takes
+      # `sources: [StrandTests]`, a directory, so adding a test file changes no other tracked path.
+      - 'StrandTests/**'
       - 'StrandiOS/**'
       - 'StrandiOSShared/**'
       - 'StrandiOSWidgets/**'
+      # The watch app and its complications, for the same reason StrandTests is named above: the
+      # NOOPiOS scheme BUILDS them (NOOPiOS embeds NOOPWatch, which embeds NOOPWatchComplications),
+      # but neither directory sits under any glob here, so a PR touching only them matched nothing
+      # and compiled nothing. A broken watch target merged unverified and surfaced on the next PR
+      # that happened to touch Strand/**, pointing at the wrong change. #2227 translated 25
+      # complication strings and got no build at all, which is what surfaced this.
+      - 'NOOPWatch/**'
+      - 'NOOPWatchComplications/**'
       - 'Packages/**'
       - 'project.yml'
       - '.github/workflows/app-build.yml'

.github/workflows/fork-release.yml

@@ -210,12 +210,23 @@ jobs:
         run: xcodegen generate
       - name: Build NOOP.app (macOS, unsigned, universal)
         # #51: 'platform=macOS' on an Apple-Silicon runner resolves to the host arch and thins the binary to
-        # arm64-only (project.yml's ONLY_ACTIVE_ARCH: NO is set only under configs.Release, so the Debug build
-        # inherits the default YES). That shipped an arm64-only app that won't launch on Intel Macs. Force a
-        # true universal build with the generic destination + explicit ARCHS/ONLY_ACTIVE_ARCH; these
-        # command-line settings override the config, so it stays Debug (unchanged shipping behaviour).
+        # arm64-only. That shipped an arm64-only app that won't launch on Intel Macs. Force a true universal
+        # build with the generic destination + explicit ARCHS/ONLY_ACTIVE_ARCH, which override whatever the
+        # configuration says and therefore keep holding after the switch below.
+        #
+        # #2393: Release, matching the iOS leg. macOS shipped Debug for no reason anyone chose — #51 was
+        # about architecture and said so, and "unchanged shipping behaviour" there meant that PR was not
+        # also changing the configuration. The artefact showed it: a 120 KB stub plus a 195 MB
+        # `.debug.dylib` and a `__preview.dylib`, against 53 MB for the same commit built Release. A
+        # reporter measured the shipped build costing a third to half a CPU core at idle, and unoptimised
+        # SwiftUI compounds a hot path that already ran every frame.
+        #
+        # What Release removes beyond the optimisation: `#if DEBUG` code, which here is previews, sample
+        # data and the `--demo-sync` screenshot harness (its own doc already says it is stripped from every
+        # Release build). The iOS artefact has shipped without all of that since it went Release, so this
+        # brings macOS into line rather than into new territory. Use a local Debug build for the harness.
         run: >-
-          xcodebuild -scheme Strand -configuration Debug
+          xcodebuild -scheme Strand -configuration Release
           -destination 'generic/platform=macOS' ARCHS="x86_64 arm64" ONLY_ACTIVE_ARCH=NO
           -derivedDataPath build/dd
           CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO CODE_SIGN_IDENTITY=""

.github/workflows/fork-testing-build.yml

@@ -37,7 +37,56 @@ jobs:
           echo "ver=$VER" >> "$GITHUB_OUTPUT"
           # ROLLING release: recreate the single tag so stale (incl. old-version) assets never linger —
           # one stable URL, always the newest build, zero cleanup. (To KEEP a build, cut a one-off tag.)
-          gh release delete "$TAG" --repo "$GITHUB_REPOSITORY" --cleanup-tag --yes || true
+          #
+          # The delete USED to end in `|| true`, which could not tell "the tag is not there yet",
+          # which is the normal first-run case and fine, from "the delete failed", which makes the
+          # create below certain to fail (#2174). Build 499 hit a 500 from GitHub here, the create
+          # then stopped on "Release.tag_name already exists", and since meta gates all four build
+          # legs a blip in a metadata step threw away the Android, iOS and macOS builds behind it.
+          # The message a reader got described the symptom and pointed away from the cause.
+          delete_rolling_release() {
+            local out status attempt
+            for attempt in 1 2 3; do
+              out=$(gh release delete "$TAG" --repo "$GITHUB_REPOSITORY" --cleanup-tag --yes 2>&1) && status=0 || status=$?
+              [ "$status" -eq 0 ] && return 0
+              # Nothing there to delete is success, not failure: first build, or an earlier run that
+              # got as far as deleting. Anything else is worth another go, GitHub 5xx being transient.
+              case "$(printf '%s' "$out" | tr '[:upper:]' '[:lower:]')" in
+                *"not found"*|*404*) return 0 ;;
+              esac
+              echo "release delete attempt ${attempt} of 3 did not succeed: ${out}"
+              sleep $((attempt * 5))
+            done
+            return 1
+          }
+          delete_rolling_release || {
+            echo "::error::Could not delete $TAG after 3 attempts. Not creating over it, because that fails with a message about the tag existing rather than about this."
+            exit 1
+          }
+          # Assert rather than assume. A delete that reports success but leaves the release standing
+          # would otherwise be read by the create as a name clash, which is the confusion above.
+          # Known limit: a 5xx on this view reads the same as a clean 404, so a blip here lands back
+          # on the create's own error. That is where we were before, not somewhere worse, and failing
+          # the build on an inconclusive view would stop builds whose release really had gone.
+          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "::error::$TAG still exists after a delete that reported success. Refusing to create over it."
+            exit 1
+          fi
+          # The TAG has to go as well, and its own failure is the quiet one. `create` ignores --target
+          # when the tag already exists, so a release gone but a tag left behind does not fail: it
+          # publishes today's assets against a tag still pointing at the previous build's commit, and
+          # nothing says so. The release title carries $SHA from the workflow, so it would read as
+          # today's build while `git checkout testing-latest` handed someone yesterday's source.
+          # Deleting the ref directly is the same thing --cleanup-tag meant to do, so try once more
+          # before giving up rather than failing a build over a leftover.
+          if gh api "repos/$GITHUB_REPOSITORY/git/refs/tags/$TAG" >/dev/null 2>&1; then
+            echo "$TAG survived --cleanup-tag; deleting the ref directly."
+            gh api -X DELETE "repos/$GITHUB_REPOSITORY/git/refs/tags/$TAG" >/dev/null 2>&1 || true
+            if gh api "repos/$GITHUB_REPOSITORY/git/refs/tags/$TAG" >/dev/null 2>&1; then
+              echo "::error::The tag $TAG could not be removed. Creating now would publish this build against the previous build's commit, so stopping instead."
+              exit 1
+            fi
+          fi
           gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --prerelease --target "${{ github.sha }}" \
             --title "NOOP Staging — base ${VER} · ${DATE} · ${SHA}" \
             --notes "Rolling **latest** testing build — refreshed in place, so this tag is always the newest. NOOP main + ryanbr's open PRs + vetted community PRs, built with the **NOOP Staging** identity (installs **beside** the official app, separate data). Filenames carry the base app version (\`v${VER}\`).
@@ -103,8 +152,11 @@ jobs:
       - name: Build NOOP.app (macOS, unsigned, universal)
         # #51: force a true universal (x86_64 + arm64) build — 'platform=macOS' on an Apple-Silicon runner
         # thins to arm64-only. Mirrors the release workflow so testing builds match what ships.
+        # #2393: Release, for the reasons spelled out in fork-release.yml. A testing build that is not
+        # built the way the release is cannot be used to judge how the release performs, which is the one
+        # thing a testing build is for.
         run: >-
-          xcodebuild -scheme Strand -configuration Debug
+          xcodebuild -scheme Strand -configuration Release
           -destination 'generic/platform=macOS' ARCHS="x86_64 arm64" ONLY_ACTIVE_ARCH=NO
           -derivedDataPath build/dd
           CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO CODE_SIGN_IDENTITY=""

.github/workflows/i18n-coverage.yml

@@ -34,8 +34,43 @@ jobs:
         with:
           fetch-depth: 0
 
-      # `github.base_ref` is set ONLY for pull_request; on a push to main it is empty, which would
-      # pass a bare `origin/`. Fall back to main. (The ref is retained for workflow compatibility —
-      # `--ci` is a whole-tree gate, so the value it resolves to does not change the verdict.)
+      # Which commit the audit diffs against. Since #524 this DECIDES the verdict: `--ci` exempts
+      # any violation already present at the base, so the gate reports what this change introduced
+      # rather than auditing the whole tree. That is the point of #524 (a regression on main no
+      # longer red-flags every open PR), and it makes the base ref load-bearing in two ways.
+      #
+      # `fetch-depth: 0` above is one of them. The audit reads the base through `git show`, so a
+      # shallow clone misses every base lookup. That direction fails safe, since nothing is exempt
+      # and the gate fails loudly rather than passing, but it fails for a reason nobody would guess.
+      #
+      # The other is this resolution. `github.base_ref` is set ONLY for pull_request. On a push it is
+      # empty, and the obvious fallback of origin/main is the PUSHED COMMIT ITSELF: the run would
+      # compare the tree against itself and could never fail. Verified by planting a hardcoded
+      # literal, base=HEAD passes and base=HEAD~1 catches it. That would have quietly retired the
+      # case the push trigger exists for, described at the top of this file: a release pushes
+      # straight to main with no PR, and appchangelog-gen.py emits the What's New title as a raw
+      # Kotlin literal. So a push diffs against `github.event.before`, the tip before the push,
+      # which spans every commit the push carried rather than just the last one.
+      - name: Resolve the base to diff against
+        id: base
+        run: |
+          set -euo pipefail
+          if [ -n "${{ github.base_ref }}" ]; then
+            base="origin/${{ github.base_ref }}"          # pull_request: the branch it targets
+          else
+            before="${{ github.event.before }}"           # push: the tip before this push
+            # All-zeros on a branch's first push, and absent for a manual run. Neither can be
+            # diffed, so fall back to the parent: still a real comparison, just narrower.
+            if [ -n "$before" ] \
+               && [ "$before" != "0000000000000000000000000000000000000000" ] \
+               && git cat-file -e "$before^{commit}" 2>/dev/null; then
+              base="$before"
+            else
+              base="HEAD~1"
+            fi
+          fi
+          echo "ref=$base" >> "$GITHUB_OUTPUT"
+          echo "diffing against $base"
+
       - name: i18n audit (regression gate)
-        run: python3 Tools/i18n_audit.py --ci origin/${{ github.base_ref || 'main' }}
+        run: python3 Tools/i18n_audit.py --ci "${{ steps.base.outputs.ref }}"