bug fixes

lib/ble/ble_state.dart

@@ -263,6 +263,14 @@ class BandStatus {
       condition != BandCondition.disconnected;
 }
 
+/// True when a GATT error [code] means the band will not accept the phone's
+/// encryption key: insufficient authentication (5), authorization (8) or
+/// encryption (15), or an auth failure (137). On iOS there is no explicit bond
+/// step, so a stale or rejected key only ever shows up here, on the first
+/// notification registration.
+bool isLinkAuthRefusal(int? code) =>
+    code == 5 || code == 8 || code == 15 || code == 137;
+
 /// Fold the phone-level blocker and the band's own diagnostic flags into one
 /// state. Pure; [connection] is `DeviceState.connection`.
 ///
@@ -2196,16 +2204,24 @@ enum LiveStreamStep {
 /// gen4 bundle can be half-applied). Dirty ALWAYS replays the newest desired
 /// direction before convergence, even when nothing is desired: a dirty OFF
 /// must be cleaned up, unlike a fresh one.
+///
+/// [holdImuOn] — a history offload is running on gen4. Arming the bundle
+/// mid-burst silences the strap: the burst stops, the 60 s idle watchdog
+/// aborts it and the drain restarts. Only the ON is held; the caller
+/// re-runs the reconcile when the offload ends.
 LiveStreamStep? nextLiveStreamStep({
   required LiveStreamIntent applied,
   required LiveStreamIntent desired,
   bool imuFresh = false,
   bool imuDirty = false,
   bool hrDirty = false,
+  bool holdImuOn = false,
 }) {
   final replayImu = imuDirty || (imuFresh && desired.any);
   if (desired.hr && (!applied.hr || hrDirty)) return LiveStreamStep.hrOn;
-  if (desired.imu && (!applied.imu || replayImu)) return LiveStreamStep.imuOn;
+  if (desired.imu && (!applied.imu || replayImu) && !holdImuOn) {
+    return LiveStreamStep.imuOn;
+  }
   if (!desired.imu && (applied.imu || replayImu)) return LiveStreamStep.imuOff;
   if (!desired.hr && (applied.hr || hrDirty)) return LiveStreamStep.hrOff;
   return null;

lib/compute/derivation_engine.dart

@@ -1848,7 +1848,11 @@ import 'vendor_sleep.dart';
 // temperature rhythm and alertness forecast use local time. Steps: the live
 // pedometer counts from stride periodicity. Workouts: a 5-15 min rest with HR
 // still raised stays inside one suggested workout.
-const int kAlgoVersion = 119;
+// 119 → 120 (gen5/MG steps): the on-chip counter answers whenever it counted
+// more than the windowed live/phone sources, instead of only when they counted
+// nothing, so a short tracked walk no longer hides the day's chip total.
+// gen4 (no counter) is unchanged. Edge-only.
+const int kAlgoVersion = 120;
 /// The sibling SHAs this version was derived against, asserted against
 /// pubspec.yaml in test/db_serve_version_and_reads_test.dart.
 ///
@@ -8661,17 +8665,23 @@ class DerivationEngine {
     // per record, so the day screen gets hourly `spans` off them; but adding
     // it to the windowed spans would double-count every walk the other two
     // already counted. So it stays a
-    // WHOLE-DAY FALLBACK — used only when no span source covered the day at
-    // all. That inversion is deliberate: whole-day precedence for this counter
-    // is exactly the bug being fixed (622 steps published over the phone's
-    // 18,856 on a day the strap synced for part of).
+    // WHOLE-DAY ALTERNATIVE: whichever of the two whole-day answers counted
+    // MORE wins. Unconditional counter precedence is the old bug (622 steps
+    // published over the phone's 18,856 on a day the strap synced for part
+    // of); "counter only when nothing else counted" was the next one: a
+    // 53-step manual walk hid the chip's 6,164 for the whole day. Neither
+    // answer adds to the other, so nothing is double-counted.
+    // ponytail: max undercounts a day split between disjoint sources; the
+    // upgrade is windowed total + counter ticks outside those windows
+    // (`counterTicksPerWindow`).
     final strap = liveStepsFromStrap.clamp(0, liveStepsReal);
     final phone = liveStepsReal - strap;
     final rawBand = counter?.total;
     final calibratedBand =
         rawBand == null ? null : applyStepCalibration(rawBand, profile);
-    final useBand =
-        liveStepsReal <= 0 && calibratedBand != null && calibratedBand > 0;
+    final useBand = calibratedBand != null &&
+        calibratedBand > 0 &&
+        calibratedBand > liveStepsReal;
     final steps = useBand ? calibratedBand : liveStepsReal;
     final calibrated = useBand && profile != null && profile.isCalibrated;
     final haveRealSteps = steps > 0;