diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index c9b27cee1..449e9ed14 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -96,12 +96,16 @@
          total calories with it, and a missing read fails the whole read. -->
     <uses-permission android:name="android.permission.health.READ_DISTANCE" />
     <uses-permission android:name="android.permission.health.READ_TOTAL_CALORIES_BURNED" />
-    <!-- READ only, and no WRITE counterpart on purpose: body metrics are read
-         INTO the local profile (weight drifts, and the calorie estimate
-         depends on it) and this app has no business writing them back. Health
+    <!-- Body metrics are read INTO the local profile (weight drifts, and the
+         calorie estimate depends on it); height is READ only. Weight has a
+         WRITE below, for a paired scale's own weighings only. Health
          Connect silently returns nothing for an undeclared permission rather
          than failing, so an omission here looks exactly like an empty store. -->
     <uses-permission android:name="android.permission.health.READ_WEIGHT" />
+    <!-- WRITE_WEIGHT: a paired scale's weighings are exported to Health Connect
+         (lib/health/health_weight_export.dart). Only the scale's own readings;
+         the weight read above never goes back out. -->
+    <uses-permission android:name="android.permission.health.WRITE_WEIGHT" />
     <uses-permission android:name="android.permission.health.READ_HEIGHT" />
     <!-- READ only, and there will never be a WRITE counterpart. These come
          from devices CLEARED to take them — a blood-pressure cuff, a CGM, a
diff --git a/ios/Runner/Info.plist b/ios/Runner/Info.plist
index 7f970122f..f2e756bf1 100644
--- a/ios/Runner/Info.plist
+++ b/ios/Runner/Info.plist
@@ -168,7 +168,7 @@
 	<key>NSCameraUsageDescription</key>
 	<string>OpenStrap uses the camera to read the barcode on a food packet, so logging a meal does not mean typing its nutrition panel out by hand. It reads the barcode digits and nothing else — no photo is taken, kept, or sent anywhere.</string>
 	<key>NSHealthUpdateUsageDescription</key>
-	<string>OpenStrap writes your sleep, resting heart rate, HRV, respiratory rate, energy and workouts into Apple Health.</string>
+	<string>OpenStrap writes your sleep, resting heart rate, HRV, respiratory rate, energy and workouts, and the weighings of a scale you have paired, into Apple Health.</string>
 	<key>NSBluetoothPeripheralUsageDescription</key>
 	<string>OpenStrap connects to your WHOOP band over Bluetooth to sync your health data.</string>
 	<key>NSLocationWhenInUseUsageDescription</key>
diff --git a/lib/data/backup_extras.dart b/lib/data/backup_extras.dart
index 80f857027..6745066b2 100644
--- a/lib/data/backup_extras.dart
+++ b/lib/data/backup_extras.dart
@@ -50,6 +50,10 @@ const Map<String, String> kPrefsNotBackedUp = {
   'alarm_probe_pending': 'legacy pending hardware probe; never resume on another band',
   'alarm_fired_at': 'last fire event from the old band, not the chosen schedule',
   'health_upload_last_ts': 'upload cursor for this installation',
+  'health_weight_perm_asked': 'WEIGHT write access is asked per install; '
+      'the new install has not asked yet',
+  'health_weight_grant_seen': 'the WEIGHT grant is per install; the new '
+      'install observes its own',
 };
 
 const Map<String, String> kSecretsNotBackedUp = {
@@ -181,6 +185,12 @@ const List<(String, String, String)> kPrefTypeFamilies = [
   ('notif_osnext:', '', 'int'),
   ('nudge.', '.dismissed', 'bool'),
   ('nudge.', '.last_shown_ms', 'int'),
+  // Per-scale weighing export state. Travels: the Health store usually
+  // survives a restore, and re-sending every weighing would stack duplicates.
+  ('health_weight_exported:', '', 'string'),
+  ('health_weight_attempts:', '', 'string'),
+  ('health_weight_maybe_landed:', '', 'string'),
+  ('health_weight_trimmed:', '', 'string'),
 ];
 
 /// The stored type the app reads [key] with, or null when it is not known.
diff --git a/lib/health/health_export.dart b/lib/health/health_export.dart
index 82af140b1..dadc66702 100644
--- a/lib/health/health_export.dart
+++ b/lib/health/health_export.dart
@@ -32,6 +32,7 @@ import '../data/series_codec.dart';
 import 'health_heart_rate_batch.dart';
 import 'health_nap_export.dart';
 import 'health_sleep_session.dart';
+import 'health_weight_export.dart';
 
 /// What we can do with the health store right now.
 enum HealthLinkState {
@@ -654,6 +655,10 @@ class HealthExporter {
     for (final t in _sleepHealthTypes)
       if (t != _foreignSleepEnvelope(isApple)) t,
     HealthDataType.WORKOUT,
+    // Scale weighings (health_weight_export.dart). Authorization scope only:
+    // deliberately NOT in healthDeleteTypes / _rewriteTypes, because the
+    // per-day pass would delete weights it has no day_result to rewrite.
+    HealthDataType.WEIGHT,
   ];
 
   /// The types the per-day delete-then-write pass touches.
@@ -735,6 +740,52 @@ class HealthExporter {
     }
   }
 
+  /// WEIGHT write permission, for the weight export only. Existing users were
+  /// authorized before WEIGHT joined [_types] and are never re-prompted by
+  /// [request], so a plain attempt would no-op forever. HealthKit hides write
+  /// auth, so the one-time request runs there too (idempotent; shows the sheet
+  /// only for undetermined types); asked for at most once per install. The per-day pass keeps its
+  /// attempt-everything behaviour (see below).
+  Future<bool> _weightWriteAllowed() async {
+    final types = [HealthDataType.WEIGHT];
+    const access = [HealthDataAccess.WRITE];
+    final prefs = await SharedPreferences.getInstance();
+    return weightWritePermitted(
+      check: () async =>
+          await _health
+              .hasPermissions(types, permissions: access)
+              .timeout(_deleteTimeout) ==
+          true,
+      request: () async {
+        try {
+          await _health
+              .requestAuthorization(types, permissions: access)
+              .timeout(_deleteTimeout);
+        } catch (e) {
+          if (e is TimeoutException) _storeHung = true;
+          rethrow;
+        }
+      },
+      asked: () async => prefs.getBool(kHealthWeightPermAskedPref) == true,
+      markAsked: () => prefs.setBool(kHealthWeightPermAskedPref, true),
+    );
+  }
+
+  /// Current WEIGHT grant for the cap-reset transition; null = unknown.
+  Future<bool?> _weightGranted() async {
+    try {
+      return await _health
+          .hasPermissions(
+            [HealthDataType.WEIGHT],
+            permissions: [HealthDataAccess.WRITE],
+          )
+          .timeout(_deleteTimeout);
+    } catch (e) {
+      debugPrint('[health] weight grant read: $e');
+      return null;
+    }
+  }
+
   // We do NOT gate on a write-permission check: HealthKit hides write-auth by
   // design, and Health Connect's hasPermissions(WRITE) frequently returns
   // null/false even after the user grants everything — which would leave the UI
@@ -793,6 +844,11 @@ class HealthExporter {
         _types,
         permissions: _types.map((_) => HealthDataAccess.WRITE).toList(),
       );
+      // WEIGHT is in _types: the scale path need not ask a second time.
+      await (await SharedPreferences.getInstance()).setBool(
+        kHealthWeightPermAskedPref,
+        true,
+      );
     } catch (e) {
       debugPrint('[health] requestAuthorization: $e');
     }
@@ -899,6 +955,7 @@ class HealthExporter {
     if (await _androidUnavailable() != null) return 0; // HC missing/outdated
     return _workoutLock.run(() async {
     _storeHung = false;
+    var days = 0;
     try {
       await ensureHealthSleepExportEpoch(
         getCursor: LocalDb.getCursor,
@@ -1184,11 +1241,53 @@ class HealthExporter {
         return done;
       };
 
-      return exportPriorityOrBulk();
+      days = await exportPriorityOrBulk();
     } catch (e) {
+      // Weighings do not depend on the day results: log and carry on.
       debugPrint('[health] exportAll: $e');
-      return 0;
     }
+    try {
+      if (!_storeHung) {
+        await exportScaleWeighings(
+          reset: reset,
+          forceRetry: forceRetry,
+          stopped: () => _storeHung,
+          permitted: _weightWriteAllowed,
+          weightGranted: _weightGranted,
+          syncEnabled: () async =>
+              (await SharedPreferences.getInstance()).getBool(kHealthSyncPref) ==
+              true,
+          deleteOwn: (a, b) => _deleteOwnSamples(HealthDataType.WEIGHT, a, b),
+          write: (kg, at) async {
+            if (_storeHung) return false;
+            try {
+              // A timeout is rethrown: the weighing export records the instant
+              // as possibly written (persisted) and clears it, safely, before
+              // the retry.
+              return await _health
+                  .writeHealthData(
+                    value: kg,
+                    type: HealthDataType.WEIGHT,
+                    startTime: at,
+                    endTime: at,
+                    unit: HealthDataUnit.KILOGRAM,
+                  )
+                  .timeout(_deleteTimeout);
+            } catch (e) {
+              debugPrint('[health] write WEIGHT: $e');
+              if (e is TimeoutException) {
+                _storeHung = true;
+                rethrow;
+              }
+              return false;
+            }
+          },
+        );
+      }
+    } catch (e) {
+      debugPrint('[health] exportAll weighings: $e');
+    }
+    return days;
     });
   }
 
diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
new file mode 100644
index 000000000..50487378d
--- /dev/null
+++ b/lib/health/health_weight_export.dart
@@ -0,0 +1,488 @@
+// Scale weighings → Apple Health / Health Connect WEIGHT samples.
+//
+// One sample per weighing, at the weighing's own instant, kg. Weight only: no
+// body fat, BMI or impedance (those are the scale's, not ours to restate).
+//
+// WHY THIS IS NOT IN THE PER-DAY PASS. `healthDeleteTypes` drives a day-wide
+// delete-then-rewrite from that day's `day_result`. A weighing is not part of
+// any day_result, so WEIGHT must NOT be in that list: the pass would delete the
+// day's weights and have nothing to write back.
+//
+// IDEMPOTENCE. Per device, a persisted SET of already-exported ts_ms (newest
+// ~2000) decides what is sent: every eligible weighing not in the set goes out
+// on each run, so a late-arriving OLDER weighing (history sync, backfill, clock
+// correction) is not skipped the way a high-water cursor would skip it. A
+// normal send is a plain write: a weighing not in the set has no sample of ours
+// to replace, and a failed replacement must never cost a sample that was
+// exported earlier. Only a `reset` re-send deletes our own sample at that
+// instant first (so it does not stack duplicates), and never when another
+// weighing (any scale) sits inside the match window, since the delete is by
+// type + time range and would take that sample too. A failed weighing is
+// skipped (later ones still go out) and retried on later runs, at most
+// [kMaxWeightAttempts] times. At most [kMaxWeighingsPerRun] per call.
+//
+// HOUSEHOLD SCALES. A scale carries no user, so [exportableWeighings] runs a
+// CHAINED band (kWeighingBand, see measurement_inputs.dart) before anything is
+// exported: the first weighing seeds, any weighing more than the band away from
+// the previous ACCEPTED one is dropped, unless 3 consecutive rejects are near
+// each other (then the run is accepted and re-seeds the chain). Health samples cannot be recalled, so
+// this is stricter than reading the newest weighing.
+//
+// NO ECHO LOOP. `health_profile_import.dart` reads WEIGHT from the store into
+// the PROFILE (a profile field), never into `observation`. The source here is
+// the scale's own stored weighings (`LocalDb.deviceObservationValues`, keyed by
+// the scale's device id), so a weight read from the store has no row to export.
+// observation_isolation_test keeps raw table access inside db.dart, so the
+// source_kind column is not filtered here.
+import 'dart:async' show TimeoutException;
+import 'dart:convert';
+
+import 'package:flutter/foundation.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+import '../ble/adapters/_registry.dart' show DeviceCategory, categoryOf;
+import '../ble/adapters/miscale.dart' show kWeightMaxKg, kWeightMinKg;
+import '../compute/inputs/canonical.dart' show wearableEnabled;
+import '../compute/inputs/measurement_inputs.dart' show weighingChain;
+import '../data/db.dart';
+
+/// Per-device persisted set (JSON list) of exported weighing ts_ms.
+String healthWeightExportedKey(String deviceId) =>
+    'health_weight_exported:$deviceId';
+
+/// Per-device persisted failure counts (JSON map ts_ms -> attempts).
+String healthWeightAttemptsKey(String deviceId) =>
+    'health_weight_attempts:$deviceId';
+
+/// Per-device persisted set (JSON list) of weighing instants whose native
+/// write timed out and may still have landed. Kept across restarts so a retry
+/// clears our sample there first instead of stacking a duplicate.
+String healthWeightMaybeLandedKey(String deviceId) =>
+    'health_weight_maybe_landed:$deviceId';
+
+/// Per-device persisted set (JSON list) of weighing instants that were
+/// exported and then aged out of the bounded exported set. Kept apart from the
+/// never-exported instants so a late older weighing (backfill) is still sent
+/// while an old exported one is not sent again.
+String healthWeightTrimmedKey(String deviceId) =>
+    'health_weight_trimmed:$deviceId';
+
+/// Superseded high-water cursor (LocalDb cursor). Never read any more; only
+/// cleared on reset.
+String healthWeightCursorName(String deviceId) =>
+    'health_weight_through:$deviceId';
+
+/// Set once WEIGHT write permission has been requested on this install.
+const String kHealthWeightPermAskedPref = 'health_weight_perm_asked';
+
+/// Last observed WEIGHT grant (true/false) so a not-granted -> granted
+/// transition can clear the per-weighing attempt caps.
+const String kHealthWeightGrantSeenPref = 'health_weight_grant_seen';
+
+/// Most weighings processed per [exportScaleWeighings] call; the rest stay
+/// pending for the next drain so a big replay cannot hold the export lock long.
+const int kMaxWeighingsPerRun = 200;
+
+/// Bound on the exported set per device (newest kept).
+const int kMaxExportedWeighings = 2000;
+
+/// Bound on the aged-out exported history per device (newest kept). Past
+/// kMaxExportedWeighings + kMaxTrimmedWeighings weighings on one scale the
+/// oldest aged-out instant is forgotten, and a reset would send it again.
+const int kMaxTrimmedWeighings = 10000;
+
+/// Failed attempts after which a weighing is no longer retried. Mirrors
+/// HealthExporter's `_kMaxExportAttempts`.
+const int kMaxWeightAttempts = 6;
+
+/// Half-width of the window that identifies "our sample for this weighing".
+const Duration kHealthWeightMatchWindow = Duration(milliseconds: 500);
+
+/// A weighing that may be exported, ascending by [atMs] when listed.
+typedef Weighing = ({int atMs, double kg});
+
+/// [raw] (ts_ms -> kg) as exportable weighings, ascending, minus [exported].
+/// Skips non-finite and out-of-bounds values, then applies the chained
+/// household band over ALL plausible weighings (so the chain does not depend
+/// on what was exported before), re-seeding after 3 consecutive mutually-near
+/// rejects so a guest seed or a lasting weight change recovers (the same
+/// [weighingChain] the trend uses). Never substitutes a value.
+@visibleForTesting
+List<Weighing> exportableWeighings(
+  Map<int, num> raw, {
+  Set<int> exported = const {},
+}) {
+  final chain = weighingChain([
+    for (final e in raw.entries)
+      if (e.value.isFinite && e.value >= kWeightMinKg && e.value <= kWeightMaxKg)
+        (atMs: e.key, kg: e.value.toDouble()),
+  ]);
+  return [
+    for (final w in chain)
+      if (!exported.contains(w.atMs)) w,
+  ];
+}
+
+Set<int> _decodeSet(String? s) {
+  try {
+    return {for (final v in jsonDecode(s ?? '[]') as List) (v as num).toInt()};
+  } catch (_) {
+    return {};
+  }
+}
+
+Map<int, int> _decodeAttempts(String? s) {
+  try {
+    return {
+      for (final e in (jsonDecode(s ?? '{}') as Map).entries)
+        int.parse(e.key as String): (e.value as num).toInt(),
+    };
+  } catch (_) {
+    return {};
+  }
+}
+
+/// Keeps only the newest [kMaxExportedWeighings] entries.
+List<int> _bounded(Set<int> s, [int max = kMaxExportedWeighings]) {
+  final l = s.toList()..sort();
+  return l.length > max ? l.sublist(l.length - max) : l;
+}
+
+/// Write [weighings] (ascending). A failed weighing is skipped and its
+/// attempt counted; later ones still go. Weighings already at
+/// [kMaxWeightAttempts] are not tried. Persists via [save] after each change.
+/// [stopped] (store hung) ends the run without counting the failure that
+/// tripped it. [mayContinue] is asked before EACH weighing; false ends the run
+/// (opt-out mid-drain). With [resend] our own sample at the instant is deleted
+/// first, unless [deleteSafe] says another sample shares the window. A delete
+/// that succeeds but whose write then fails takes the instant out of
+/// [exported], so it is pending again rather than recorded as in Health.
+/// A [write] that throws [TimeoutException] may have landed: the instant goes
+/// into [maybeLanded] and the next attempt clears our sample there first, but
+/// only when [deleteSafe] allows it (otherwise it is left and retried, bounded
+/// by the attempt cap, never deleting a neighbour's sample).
+/// Returns how many were written.
+Future<int> writeWeighings({
+  required List<Weighing> weighings,
+  required Set<int> exported,
+  required Map<int, int> attempts,
+  required Future<void> Function() save,
+  required Future<bool> Function(DateTime start, DateTime end) deleteOwn,
+  required Future<bool> Function(double kg, DateTime at) write,
+  bool Function()? stopped,
+  Future<bool> Function()? mayContinue,
+  bool resend = false,
+  bool Function(int atMs)? deleteSafe,
+  Set<int>? maybeLanded,
+  Set<int>? trimmed,
+}) async {
+  var written = 0;
+  final landed = maybeLanded ?? <int>{};
+  for (final w in weighings) {
+    if (stopped?.call() ?? false) break;
+    if (mayContinue != null && !await mayContinue()) break;
+    if ((attempts[w.atMs] ?? 0) >= kMaxWeightAttempts) continue;
+    final at = DateTime.fromMillisecondsSinceEpoch(w.atMs);
+    // Already in Health and the delete would take a neighbour's sample too:
+    // keep what is there rather than stack a duplicate.
+    if (resend &&
+        (exported.contains(w.atMs) || (trimmed?.contains(w.atMs) ?? false)) &&
+        !(deleteSafe?.call(w.atMs) ?? true)) {
+      continue;
+    }
+    var ok = true;
+    var deleted = false;
+    final safe = deleteSafe?.call(w.atMs) ?? true;
+    if ((resend || landed.contains(w.atMs)) && safe) {
+      // A delete that cannot clear the instant must not be written on top of.
+      ok = await deleteOwn(
+        at.subtract(kHealthWeightMatchWindow),
+        at.add(kHealthWeightMatchWindow),
+      );
+      deleted = ok;
+      if (ok) landed.remove(w.atMs);
+    } else if (landed.contains(w.atMs)) {
+      // A possible survivor of a timed-out write, and the delete would take a
+      // neighbour's sample too: leave it and retry later.
+      ok = false;
+    }
+    if (ok) {
+      try {
+        ok = await write(w.kg, at);
+      } on TimeoutException {
+        ok = false;
+        landed.add(w.atMs);
+      }
+    }
+    if (ok) {
+      written++;
+      exported.add(w.atMs);
+      trimmed?.remove(w.atMs);
+      attempts.remove(w.atMs);
+    } else {
+      // Our sample was deleted and the replacement did not go in: it is no
+      // longer in Health, so it must not stay marked as exported.
+      if (deleted) {
+        exported.remove(w.atMs);
+        trimmed?.remove(w.atMs);
+      }
+      if (stopped?.call() ?? false) {
+        await save();
+        break;
+      }
+      attempts[w.atMs] = (attempts[w.atMs] ?? 0) + 1;
+    }
+    await save();
+  }
+  return written;
+}
+
+/// Whether WEIGHT can be written. [check] reads the grant (a throw or timeout
+/// means UNKNOWN, and the write is still attempted), [request] asks for it.
+/// Asks at most once per install ([kHealthWeightPermAskedPref]); after that the
+/// write is always attempted (failures are bounded by attempts).
+Future<bool> weightWritePermitted({
+  required Future<bool> Function() check,
+  required Future<void> Function() request,
+  required Future<bool> Function() asked,
+  required Future<void> Function() markAsked,
+}) async {
+  try {
+    var granted = false;
+    try {
+      granted = await check();
+    } catch (e) {
+      debugPrint('[health] weight permission check (unknown): $e');
+    }
+    if (granted) return true;
+    if (!await asked()) {
+      await request();
+      // Only after the request ran: a throw/timeout leaves the ask unspent.
+      await markAsked();
+    }
+    // Health Connect's hasPermissions(WRITE) is unreliable (null/false after a
+    // grant), so never block on it once we've asked: attempt the write and let
+    // the bounded per-weighing attempts absorb a real denial.
+    return true;
+  } catch (e) {
+    debugPrint('[health] weight permission: $e');
+    return false;
+  }
+}
+
+class _ScaleDevice {
+  _ScaleDevice(this.id, this.adapter, this.raw);
+  final String id;
+  final String adapter;
+  final Map<int, num> raw;
+}
+
+/// Export every flagged-on scale's pending weighings. Best-effort; never
+/// throws. [reset] clears the exported sets (re-sends everything,
+/// idempotently). [permitted] is consulted lazily, only when something is
+/// pending. [syncEnabled] / [isEnabled] are re-checked before every weighing
+/// (opt-out mid-drain). [weightGranted] (null = unknown) feeds the grant
+/// transition that clears the attempt caps. The loaders default to [LocalDb];
+/// tests inject their own.
+Future<int> exportScaleWeighings({
+  required Future<bool> Function(DateTime start, DateTime end) deleteOwn,
+  required Future<bool> Function(double kg, DateTime at) write,
+  Future<bool> Function()? permitted,
+  Future<bool?> Function()? weightGranted,
+  Future<bool> Function()? syncEnabled,
+  bool Function()? stopped,
+  bool reset = false,
+  bool forceRetry = false,
+  Future<List<Map<String, Object?>>> Function()? loadDevices,
+  Future<bool> Function(String adapterId)? isEnabled,
+  Future<Map<int, num>> Function(String deviceId)? loadWeights,
+  Future<void> Function(String name)? deleteCursor,
+}) async {
+  var total = 0;
+  try {
+    final prefs = await SharedPreferences.getInstance();
+    final enabledFn = isEnabled ?? wearableEnabled;
+    final devices = <_ScaleDevice>[];
+    // Scales switched off still have samples in Health: their instants take
+    // part in the collision check only, never in an export.
+    final disabledScales = <_ScaleDevice>[];
+    for (final row in await (loadDevices ?? LocalDb.deviceRows)()) {
+      final adapter = row['adapter_id'] as String?;
+      final id = row['id'] as String?;
+      if (id == null) continue;
+      try {
+        if (adapter == null ||
+            categoryOf(adapter) != DeviceCategory.healthMeasurement) {
+          continue;
+        }
+        if (!await enabledFn(adapter)) {
+          disabledScales.add(
+            _ScaleDevice(
+              id,
+              adapter,
+              await (loadWeights ??
+                  (d) => LocalDb.deviceObservationValues(d, 'weight'))(id),
+            ),
+          );
+          continue;
+        }
+        // The exported set is kept on reset (a disabled scale keeps its state,
+        // and an unsafe resend keeps its mark); only attempts and the old
+        // cursor are cleared.
+        if (reset) {
+          await prefs.remove(healthWeightAttemptsKey(id));
+          await (deleteCursor ?? LocalDb.deleteCursor)(
+            healthWeightCursorName(id),
+          );
+        }
+        if (forceRetry && !reset) {
+          await prefs.remove(healthWeightAttemptsKey(id));
+        }
+        final raw =
+            await (loadWeights ??
+                (d) => LocalDb.deviceObservationValues(d, 'weight'))(id);
+        devices.add(_ScaleDevice(id, adapter, raw));
+      } catch (e) {
+        debugPrint('[health] weighings load $id: $e');
+      }
+    }
+
+    // Every scale's instants: a delete by time range must not take another
+    // weighing's sample with it.
+    bool deleteSafeFor(String id, int atMs) {
+      for (final d in [...devices, ...disabledScales]) {
+        for (final ts in d.raw.keys) {
+          if (d.id == id && ts == atMs) continue;
+          if ((ts - atMs).abs() <= kHealthWeightMatchWindow.inMilliseconds) {
+            return false;
+          }
+        }
+      }
+      return true;
+    }
+
+    var permChecked = false;
+    var permOk = true;
+    var grantEvaluated = false;
+    var grantTransitioned = false;
+    // A reset re-sends with delete-then-write; a cap would leave the rest to
+    // later plain writes that stack duplicates on the samples still in Health.
+    var budget = reset ? 1 << 30 : kMaxWeighingsPerRun;
+    var syncOff = false;
+    for (final d in devices) {
+      if (syncOff || budget <= 0) break;
+      try {
+        final id = d.id;
+        final exported = _decodeSet(
+          prefs.getString(healthWeightExportedKey(id)),
+        );
+        final attempts = _decodeAttempts(
+          prefs.getString(healthWeightAttemptsKey(id)),
+        );
+        final maybeLanded = _decodeSet(
+          prefs.getString(healthWeightMaybeLandedKey(id)),
+        );
+        final trimmed = _decodeSet(
+          prefs.getString(healthWeightTrimmedKey(id)),
+        );
+        var persistedTrimmed = {...trimmed};
+        Future<void> save() async {
+          // What the bound drops from the exported set is remembered, so an
+          // old exported weighing is not sent again as if it were new.
+          final keep = _bounded(exported).toSet();
+          final evicted = exported.difference(keep);
+          if (evicted.isNotEmpty) {
+            trimmed.addAll(evicted);
+            exported.removeAll(evicted);
+          }
+          // Also when a removal changed it (a reset deleted a trimmed sample
+          // and its replacement failed): a stale mark would read as exported.
+          if (trimmed.length != persistedTrimmed.length ||
+              !trimmed.containsAll(persistedTrimmed)) {
+            persistedTrimmed = {...trimmed};
+            await prefs.setString(
+              healthWeightTrimmedKey(id),
+              jsonEncode(_bounded(trimmed, kMaxTrimmedWeighings)),
+            );
+          }
+          await prefs.setString(
+            healthWeightMaybeLandedKey(id),
+            jsonEncode(_bounded(maybeLanded)),
+          );
+          await prefs.setString(
+            healthWeightExportedKey(id),
+            jsonEncode(_bounded(exported)),
+          );
+          await prefs.setString(
+            healthWeightAttemptsKey(id),
+            jsonEncode({for (final e in attempts.entries) '${e.key}': e.value}),
+          );
+        }
+
+        // Attempt entries for weighings that no longer exist are dead weight.
+        final before = attempts.length;
+        attempts.removeWhere((ts, _) => !d.raw.containsKey(ts));
+        var attemptsDirty = attempts.length != before;
+        // Not-granted/unknown -> granted: capped weighings get a fresh chance.
+        if (attempts.isNotEmpty && weightGranted != null) {
+          if (!grantEvaluated) {
+            grantEvaluated = true;
+            final now = await weightGranted() == true;
+            final seen = prefs.getBool(kHealthWeightGrantSeenPref) == true;
+            grantTransitioned = now && !seen;
+            if (now != seen) {
+              await prefs.setBool(kHealthWeightGrantSeenPref, now);
+            }
+          }
+          if (grantTransitioned) {
+            attempts.clear();
+            attemptsDirty = true;
+          }
+        }
+        if (attemptsDirty) await save();
+
+        // Exported history that aged out of the bounded set is in [trimmed],
+        // so a never-exported older weighing (backfill) is still pending.
+        final pending = [
+          for (final w in exportableWeighings(
+            d.raw,
+            exported: reset ? const {} : {...exported, ...trimmed},
+          ))
+            if ((attempts[w.atMs] ?? 0) < kMaxWeightAttempts) w,
+        ].take(budget).toList();
+        if (pending.isEmpty) continue;
+        budget -= pending.length;
+        if (!permChecked) {
+          permChecked = true;
+          permOk = permitted == null || await permitted();
+        }
+        if (!permOk) continue;
+        total += await writeWeighings(
+          weighings: pending,
+          exported: exported,
+          attempts: attempts,
+          save: save,
+          deleteOwn: deleteOwn,
+          write: write,
+          stopped: stopped,
+          resend: reset,
+          deleteSafe: (ts) => deleteSafeFor(id, ts),
+          maybeLanded: maybeLanded,
+          trimmed: trimmed,
+          mayContinue: () async {
+            if (syncEnabled != null && !await syncEnabled()) {
+              syncOff = true;
+              return false;
+            }
+            return await enabledFn(d.adapter);
+          },
+        );
+      } catch (e) {
+        debugPrint('[health] weighings export ${d.id}: $e');
+      }
+    }
+  } catch (e) {
+    debugPrint('[health] exportScaleWeighings: $e');
+  }
+  return total;
+}
diff --git a/test/backup/pref_types_guard_test.dart b/test/backup/pref_types_guard_test.dart
index 450206010..b8102cd33 100644
--- a/test/backup/pref_types_guard_test.dart
+++ b/test/backup/pref_types_guard_test.dart
@@ -34,6 +34,18 @@ const _dynamicReads = <String, List<String>>{
   'notification_ids.dart|slotKey|int': ['notif_osid:health:2026-09-21:x'],
   'notification_ids.dart|ownerKey|string': ['notif_osslot:health:3'],
   'notification_ids.dart|k|int': ['notif_osid:health:2026-09-21:x'],
+  'health_weight_export.dart|healthWeightExportedKey(id|string': [
+    'health_weight_exported:d1',
+  ],
+  'health_weight_export.dart|healthWeightAttemptsKey(id|string': [
+    'health_weight_attempts:d1',
+  ],
+  'health_weight_export.dart|healthWeightMaybeLandedKey(id|string': [
+    'health_weight_maybe_landed:d1',
+  ],
+  'health_weight_export.dart|healthWeightTrimmedKey(id|string': [
+    'health_weight_trimmed:d1',
+  ],
   'nudges.dart|_dismissedKey(a|bool': ['nudge.pairing.dismissed'],
   'nudges.dart|_lastShownKey(a|int': ['nudge.pairing.last_shown_ms'],
   // The typed wrappers; each caller passes a literal or a const that is
diff --git a/test/backup/settings_audit_guard_test.dart b/test/backup/settings_audit_guard_test.dart
index 5d55e803c..933bae371 100644
--- a/test/backup/settings_audit_guard_test.dart
+++ b/test/backup/settings_audit_guard_test.dart
@@ -51,6 +51,10 @@ const _mustTravel = {
   // Serial-scoped ECG safety guards must survive so reconnect still cleans up
   // a possibly active publisher. These are separate from alarm arm receipts.
   'ecg.guard.MG123', 'ecg.wrist.MG123', 'ecg.maverick.MG123',
+  // Weighing export state: the Health store usually survives a restore, so
+  // the marks must too, or every weighing is written again as a duplicate.
+  'health_weight_exported:d1', 'health_weight_attempts:d1',
+  'health_weight_maybe_landed:d1', 'health_weight_trimmed:d1',
   'future.setting',
 };
 
@@ -65,6 +69,8 @@ const _mustStay = {
   'alarm_schedule_cleared', 'alarm_epoch', 'alarm_epoch_confirmed', 'alarm_set_at_ms',
   'alarm_pending_until', 'alarm_latch_alert', 'alarm_probe_pending', 'alarm_fired_at',
   'live.session_draft', 'live_session_checkpoint', 'telemetry_outbox',
+  // Permission and grant are per install.
+  'health_weight_perm_asked', 'health_weight_grant_seen',
 };
 
 // Interpolated keys, including ones hidden behind key-building helpers.
@@ -111,6 +117,16 @@ const _indirectKeys = <String, List<String>>{
     'onboard.skipped_pairing', 'onboard.saw_profile_setup'],
   'lib/ui2/nudges.dart:_lastShownKey(a)': ['nudge.discord.last_shown_ms'],
   'lib/ui2/nudges.dart:_dismissedKey(a)': ['nudge.discord.dismissed'],
+  'lib/health/health_export.dart:kHealthWeightPermAskedPref': [
+    'health_weight_perm_asked'],
+  'lib/health/health_weight_export.dart:healthWeightExportedKey(id)': [
+    'health_weight_exported:d1'],
+  'lib/health/health_weight_export.dart:healthWeightAttemptsKey(id)': [
+    'health_weight_attempts:d1'],
+  'lib/health/health_weight_export.dart:healthWeightMaybeLandedKey(id)': [
+    'health_weight_maybe_landed:d1'],
+  'lib/health/health_weight_export.dart:healthWeightTrimmedKey(id)': [
+    'health_weight_trimmed:d1'],
 };
 
 Map<String, String> _constants(String text) => {
diff --git a/test/health_profile_import_test.dart b/test/health_profile_import_test.dart
index 29f2f3e30..6803833c3 100644
--- a/test/health_profile_import_test.dart
+++ b/test/health_profile_import_test.dart
@@ -296,10 +296,10 @@ void main() {
         reason: '$perm is requested by HealthProfileImporter',
       );
     }
-    // And no write counterparts: this app reads body metrics, it does not
-    // write them back.
-    for (final perm in ['WRITE_WEIGHT', 'WRITE_HEIGHT']) {
-      expect(manifest, isNot(contains('android.permission.health.$perm')));
-    }
+    // Height is never written. WRITE_WEIGHT exists only for a paired scale's
+    // own weighings (lib/health/health_weight_export.dart); the weight read
+    // here is never exported (that source is `observation`, not the profile).
+    expect(manifest, isNot(contains('android.permission.health.WRITE_HEIGHT')));
+    expect(manifest, contains('android.permission.health.WRITE_WEIGHT'));
   });
 }
diff --git a/test/health_weight_export_test.dart b/test/health_weight_export_test.dart
new file mode 100644
index 000000000..7c9f50be5
--- /dev/null
+++ b/test/health_weight_export_test.dart
@@ -0,0 +1,602 @@
+import 'dart:async';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:health/health.dart';
+import 'package:openstrap_edge/health/health_export.dart'
+    show healthDeleteTypes;
+import 'package:openstrap_edge/health/health_weight_export.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+class _Fx {
+  final writes = <int>[]; // ts_ms written
+  final failAt = <int>{};
+  var devices = <Map<String, Object?>>[
+    {'id': 'd1', 'adapter_id': 'thermometer'},
+  ];
+  var enabled = true;
+  var weights = <int, num>{};
+  var perm = true;
+  var permCalls = 0;
+  final deletedCursors = <String>[];
+  final writeCalls = <int>[]; // every write attempt, failed or not
+  final deletes = <int>[]; // window starts (ms) passed to deleteOwn
+  Future<bool> Function()? syncEnabled;
+  Future<bool> Function(String)? enabledFn;
+  Future<bool?> Function()? granted;
+  Future<Map<int, num>> Function(String)? loader;
+  Future<void> Function(double, DateTime)? onWrite;
+
+  Future<int> run({
+    bool reset = false,
+    bool forceRetry = false,
+    bool Function()? stopped,
+  }) => exportScaleWeighings(
+    reset: reset,
+    forceRetry: forceRetry,
+    stopped: stopped,
+    syncEnabled: syncEnabled,
+    weightGranted: granted,
+    loadDevices: () async => devices,
+    isEnabled: enabledFn ?? (_) async => enabled,
+    loadWeights: loader ?? (_) async => weights,
+    deleteCursor: (n) async => deletedCursors.add(n),
+    permitted: () async {
+      permCalls++;
+      return perm;
+    },
+    deleteOwn: (s, e) async {
+      deletes.add(
+        s.millisecondsSinceEpoch + kHealthWeightMatchWindow.inMilliseconds,
+      );
+      return true;
+    },
+    write: (kg, at) async {
+      writeCalls.add(at.millisecondsSinceEpoch);
+      await onWrite?.call(kg, at);
+      if (failAt.contains(at.millisecondsSinceEpoch)) return false;
+      writes.add(at.millisecondsSinceEpoch);
+      return true;
+    },
+  );
+}
+
+void main() {
+  setUp(() => SharedPreferences.setMockInitialValues({}));
+
+  group('exportableWeighings', () {
+    test('keeps plausible values ascending, skips absent/implausible', () {
+      final out = exportableWeighings({
+        3000: 72.4,
+        1000: 71.9,
+        2000: 0,
+        4000: 9.9,
+        5000: 300.1,
+        6000: double.nan,
+        7000: double.infinity,
+      });
+      expect(out.map((w) => w.atMs), [1000, 3000]);
+      expect(out.map((w) => w.kg), [71.9, 72.4]);
+    });
+
+    test('chained band drops a household weight, keeps the chain', () {
+      final out = exportableWeighings({
+        1000: 70.0,
+        2000: 45.0, // child: >10% off
+        3000: 74.0, // within 10% of 70
+        4000: 79.0, // within 10% of 74
+        5000: 100.0, // adult housemate
+      });
+      expect(out.map((w) => w.atMs), [1000, 3000, 4000]);
+    });
+
+    test('guest seed 20 kg then user weights: re-seeds on the user run', () {
+      final out = exportableWeighings({
+        1000: 20.0,
+        2000: 70.0,
+        3000: 71.0,
+        4000: 70.0,
+      });
+      // The seed itself stays in the chain (mirrors weighingChain).
+      expect(out.map((w) => w.atMs), [1000, 2000, 3000, 4000]);
+    });
+
+    test('lasting >10% step re-seeds retroactively', () {
+      final out = exportableWeighings({
+        1000: 90.0,
+        2000: 79.0,
+        3000: 79.0,
+        4000: 80.0,
+        5000: 80.0,
+      });
+      expect(out.map((w) => w.atMs), [1000, 2000, 3000, 4000, 5000]);
+    });
+
+    test('lone outlier amid the chain is dropped', () {
+      final out = exportableWeighings({1000: 70.0, 2000: 120.0, 3000: 71.0});
+      expect(out.map((w) => w.atMs), [1000, 3000]);
+    });
+
+    test('two-outlier run (<3) is dropped', () {
+      final out = exportableWeighings({
+        1000: 70.0,
+        2000: 120.0,
+        3000: 121.0,
+        4000: 71.0,
+      });
+      expect(out.map((w) => w.atMs), [1000, 4000]);
+    });
+
+    test('three mutually unrelated outliers do not re-seed', () {
+      final out = exportableWeighings({
+        1000: 70.0,
+        2000: 120.0,
+        3000: 40.0,
+        4000: 200.0,
+        5000: 71.0,
+      });
+      expect(out.map((w) => w.atMs), [1000, 5000]);
+    });
+
+    test('exported ones are filtered but still anchor the chain', () {
+      final out = exportableWeighings(
+        {1000: 70.0, 2000: 100.0, 3000: 71.0},
+        exported: {1000},
+      );
+      expect(out.map((w) => w.atMs), [3000]);
+    });
+  });
+
+  group('exportScaleWeighings', () {
+    test('device flag off => nothing written', () async {
+      final f = _Fx()
+        ..enabled = false
+        ..weights = {1000: 70};
+      expect(await f.run(), 0);
+      expect(f.writes, isEmpty);
+    });
+
+    test('only healthMeasurement devices', () async {
+      final f = _Fx()
+        ..devices = [
+          {'id': 'w1', 'adapter_id': 'oura'},
+        ]
+        ..weights = {1000: 70};
+      expect(await f.run(), 0);
+      expect(f.writes, isEmpty);
+    });
+
+    test('late older weighing is exported later; no re-writes', () async {
+      final f = _Fx()..weights = {2000: 70, 3000: 71};
+      expect(await f.run(), 2);
+      expect(await f.run(), 0);
+      f.weights = {1000: 70.5, 2000: 70, 3000: 71};
+      expect(await f.run(), 1);
+      expect(f.writes, [2000, 3000, 1000]);
+    });
+
+    test('reset clears state and the legacy cursor, re-sends', () async {
+      final f = _Fx()..weights = {1000: 70};
+      await f.run();
+      expect(await f.run(), 0);
+      expect(await f.run(reset: true), 1);
+      expect(f.writes, [1000, 1000]);
+      expect(f.deletedCursors, contains(healthWeightCursorName('d1')));
+    });
+
+    test('failure continues to later weighings; bounded retries', () async {
+      final f = _Fx()
+        ..weights = {1000: 70, 2000: 71, 3000: 72}
+        ..failAt.add(2000);
+      expect(await f.run(), 2);
+      expect(f.writes, [1000, 3000]);
+      for (var i = 0; i < kMaxWeightAttempts + 3; i++) {
+        await f.run();
+      }
+      // Tried exactly kMaxWeightAttempts times, then suppressed.
+      expect(f.writeCalls.where((t) => t == 2000).length, kMaxWeightAttempts);
+      f.failAt.clear();
+      expect(await f.run(), 0);
+      expect(f.writes, [1000, 3000]);
+      expect(f.writeCalls.where((t) => t == 2000).length, kMaxWeightAttempts);
+    });
+
+    test('failure below the cap is retried and succeeds', () async {
+      final f = _Fx()
+        ..weights = {1000: 70}
+        ..failAt.add(1000);
+      await f.run();
+      f.failAt.clear();
+      expect(await f.run(), 1);
+    });
+
+    test('permission missing => skipped, nothing recorded', () async {
+      final f = _Fx()
+        ..weights = {1000: 70}
+        ..perm = false;
+      expect(await f.run(), 0);
+      f.perm = true;
+      expect(await f.run(), 1);
+    });
+
+    test('permission not consulted when nothing is pending', () async {
+      final f = _Fx()..weights = {};
+      await f.run();
+      expect(f.permCalls, 0);
+    });
+
+    test('a hung store ends the run without burning attempts', () async {
+      final f = _Fx()
+        ..weights = {1000: 70, 2000: 71}
+        ..failAt.addAll({1000, 2000});
+      var hung = false;
+      final calls = <int>[];
+      final n = await exportScaleWeighings(
+        loadDevices: () async => f.devices,
+        isEnabled: (_) async => true,
+        loadWeights: (_) async => f.weights,
+        deleteCursor: (_) async {},
+        stopped: () => hung,
+        deleteOwn: (s, e) async => true,
+        write: (kg, at) async {
+          calls.add(at.millisecondsSinceEpoch);
+          hung = true;
+          return false;
+        },
+      );
+      expect(n, 0);
+      expect(calls, [1000]);
+      final prefs = await SharedPreferences.getInstance();
+      final att = prefs.getString(healthWeightAttemptsKey('d1'));
+      expect(att == null || !att.contains('"1000"'), isTrue, reason: '$att');
+      f.failAt.clear();
+      expect(await f.run(), 2);
+    });
+
+    test('opt-out mid-drain: sync off stops everything', () async {
+      final f = _Fx()..weights = {1000: 70, 2000: 71, 3000: 72};
+      f.syncEnabled = () async => f.writeCalls.isEmpty;
+      expect(await f.run(), 1);
+      expect(f.writeCalls, [1000]);
+    });
+
+    test('opt-out mid-drain: device flag off stops that device', () async {
+      final f = _Fx()
+        ..devices = [
+          {'id': 'd1', 'adapter_id': 'thermometer'},
+          {'id': 'd2', 'adapter_id': 'thermometer'},
+        ]
+        ..loader = ((id) async =>
+            id == 'd1' ? {1000: 70, 2000: 71} : {9000: 70});
+      f.enabledFn = (_) async => f.writeCalls.isEmpty;
+      // Flag flips off after the first write; d2 shares the adapter flag.
+      expect(await f.run(), 1);
+      expect(f.writeCalls, [1000]);
+    });
+
+    test('one throwing device does not end the others', () async {
+      final f = _Fx()
+        ..devices = [
+          {'id': 'd1', 'adapter_id': 'thermometer'},
+          {'id': 'd2', 'adapter_id': 'thermometer'},
+        ]
+        ..loader = ((id) async =>
+            id == 'd1' ? throw StateError('boom') : {5000: 70});
+      expect(await f.run(), 1);
+      expect(f.writes, [5000]);
+    });
+
+    test('a full exported set: trimmed history stays unsent, a failed one retries',
+        () async {
+      final f = _Fx()..weights = {100: 70, 200: 70};
+      SharedPreferences.setMockInitialValues({
+        healthWeightExportedKey('d1'): [
+          for (var i = 0; i < kMaxExportedWeighings; i++) 10000 + i,
+        ].toString(),
+        healthWeightTrimmedKey('d1'): '[200]',
+        healthWeightAttemptsKey('d1'): '{"100":2}',
+      });
+      // 100 failed before and is retried. 200 was exported and aged out: it is
+      // in the trimmed record, so it is not sent again.
+      await f.run();
+      expect(f.writes, [100]);
+    });
+
+    test('a backfilled older weighing below the exported history is still sent',
+        () async {
+      final f = _Fx()..weights = {100: 70, 20000: 71};
+      SharedPreferences.setMockInitialValues({
+        healthWeightExportedKey('d1'): [
+          for (var i = 0; i < kMaxExportedWeighings; i++) 10000 + i,
+        ].toString(),
+      });
+      // 100 has no export record anywhere: it arrived late, so it goes out.
+      await f.run();
+      expect(f.writes.toSet(), {100, 20000});
+    });
+
+    test('a reset that deletes a trimmed weighing and fails to rewrite it '
+        'leaves it pending after a restart', () async {
+      final f = _Fx()..weights = {100: 70};
+      SharedPreferences.setMockInitialValues({
+        healthWeightExportedKey('d1'): [
+          for (var i = 0; i < kMaxExportedWeighings; i++) 10000 + i,
+        ].toString(),
+        healthWeightTrimmedKey('d1'): '[100]',
+      });
+      f.failAt.add(100);
+      await f.run(reset: true);
+      expect(f.deletes, [100]);
+      // The persisted state, not memory, decides what a new run sends.
+      final prefs = await SharedPreferences.getInstance();
+      expect(prefs.getString(healthWeightTrimmedKey('d1')), '[]');
+      final g = _Fx()..weights = {100: 70};
+      expect(await g.run(forceRetry: true), 1);
+      expect(g.writes, [100]);
+    });
+
+    test('what the bound drops from the exported set is remembered', () async {
+      final f = _Fx()
+        ..weights = {
+          for (var i = 0; i < kMaxExportedWeighings + 3; i++) 10000 + i * 1000: 70,
+        };
+      while (await f.run() > 0) {} // the per-run cap spreads it over drains
+      final prefs = await SharedPreferences.getInstance();
+      expect(prefs.getString(healthWeightTrimmedKey('d1')),
+          '[10000,11000,12000]');
+      // Nothing is sent a second time, trimmed or not.
+      f.writes.clear();
+      await f.run();
+      expect(f.writes, isEmpty);
+    });
+
+    test('attempt entries for vanished weighings are pruned', () async {
+      SharedPreferences.setMockInitialValues({
+        healthWeightAttemptsKey('d1'): '{"100":2,"1000":3}',
+      });
+      final f = _Fx()..weights = {1000: 70};
+      f.failAt.add(1000);
+      await f.run();
+      final prefs = await SharedPreferences.getInstance();
+      expect(prefs.getString(healthWeightAttemptsKey('d1')), '{"1000":4}');
+    });
+
+    test(
+      'grant transition clears the caps; no transition keeps them',
+      () async {
+        final f = _Fx()
+          ..weights = {1000: 70}
+          ..failAt.add(1000);
+        for (var i = 0; i < kMaxWeightAttempts; i++) {
+          await f.run();
+        }
+        expect(f.writeCalls.length, kMaxWeightAttempts);
+        f.failAt.clear();
+        f.granted = () async => false;
+        expect(await f.run(), 0); // still capped
+        f.granted = () async => null;
+        expect(await f.run(), 0);
+        f.granted = () async => true;
+        expect(await f.run(), 1); // not-granted -> granted: retried
+        expect(f.writes, [1000]);
+      },
+    );
+
+    test('forceRetry clears the caps', () async {
+      final f = _Fx()
+        ..weights = {1000: 70}
+        ..failAt.add(1000);
+      for (var i = 0; i < kMaxWeightAttempts; i++) {
+        await f.run();
+      }
+      f.failAt.clear();
+      expect(await f.run(), 0);
+      expect(await f.run(forceRetry: true), 1);
+    });
+
+    test('per-run cap: the rest stays pending for the next drain', () async {
+      final f = _Fx()
+        ..weights = {
+          for (var i = 0; i < kMaxWeighingsPerRun + 5; i++)
+            10000 + i * 1000: 70,
+        };
+      expect(await f.run(), kMaxWeighingsPerRun);
+      expect(await f.run(), 5);
+      expect(await f.run(), 0);
+    });
+
+    test('a reset is not capped: every weighing gets delete-then-write', () async {
+      final f = _Fx()
+        ..weights = {
+          for (var i = 0; i < kMaxWeighingsPerRun + 5; i++)
+            10000 + i * 1000: 70,
+        };
+      expect(await f.run(), kMaxWeighingsPerRun);
+      expect(await f.run(reset: true), kMaxWeighingsPerRun + 5);
+    });
+  });
+
+  group('delete safety', () {
+    test(
+      'normal run never deletes; reset deletes only a safe instant',
+      () async {
+        final f = _Fx()..weights = {1000: 70, 5000: 70};
+        await f.run();
+        expect(f.deletes, isEmpty);
+        await f.run(reset: true);
+        expect(f.deletes, [1000, 5000]);
+      },
+    );
+
+    test(
+      'reset does not delete when another scale sample is in the window',
+      () async {
+        final f = _Fx()
+          ..devices = [
+            {'id': 'd1', 'adapter_id': 'thermometer'},
+            {'id': 'd2', 'adapter_id': 'thermometer'},
+          ]
+          ..loader = ((id) async =>
+              id == 'd1' ? {1000: 70, 5000: 70} : {1300: 71});
+        await f.run(reset: true);
+        // 1000 and 1300 are 300 ms apart: neither is deleted; 5000 is.
+        expect(f.deletes, [5000]);
+        expect(f.writes.toSet(), {1000, 1300, 5000});
+      },
+    );
+  });
+
+  group('a disabled scale still guards the delete', () {
+    test('reset does not delete beside a disabled scale\'s sample', () async {
+      final f = _Fx()
+        ..devices = [
+          {'id': 'd1', 'adapter_id': 'thermometer'},
+          {'id': 'd2', 'adapter_id': 'miscale2'},
+        ]
+        // d2 is switched off; its sample 300 ms away is still in Health.
+        ..enabledFn = ((a) async => a == 'thermometer')
+        ..loader = ((id) async => id == 'd1' ? {1000: 70} : {1300: 71});
+      await f.run(reset: true);
+      expect(f.deletes, isEmpty);
+      expect(f.writes, [1000]);
+    });
+  });
+
+  group('timed-out and half-done writes', () {
+    test('a write that timed out is cleared before the retry, across a restart',
+        () async {
+      final f = _Fx()
+        ..weights = {1000: 70}
+        ..onWrite = (_, _) async => throw TimeoutException('hung');
+      expect(await f.run(), 0);
+      expect(f.deletes, isEmpty);
+      // New exporter instance, same prefs: the marker was persisted.
+      final g = _Fx()..weights = {1000: 70};
+      expect(await g.run(forceRetry: true), 1);
+      expect(g.deletes, [1000]);
+      expect(g.writes, [1000]);
+      // Cleared once written: a later reset-free pass does not delete again.
+      final h = _Fx()..weights = {1000: 70, 5000: 71};
+      await h.run();
+      expect(h.deletes, isEmpty);
+    });
+
+    test('a timed-out instant never deletes a neighbour sample', () async {
+      final f = _Fx()
+        ..devices = [
+          {'id': 'd1', 'adapter_id': 'thermometer'},
+          {'id': 'd2', 'adapter_id': 'thermometer'},
+        ]
+        ..loader = ((id) async => id == 'd1' ? {1000: 70} : {1300: 71})
+        ..onWrite = (_, at) async {
+          if (at.millisecondsSinceEpoch == 1000) {
+            throw TimeoutException('hung');
+          }
+        };
+      await f.run();
+      f.onWrite = null;
+      await f.run(forceRetry: true);
+      expect(f.deletes, isEmpty);
+      expect(f.writes, isNot(contains(1000)));
+    });
+
+    test('reset: delete ok but write fails leaves it pending, not exported',
+        () async {
+      final f = _Fx()..weights = {1000: 70};
+      await f.run();
+      f.failAt.add(1000);
+      await f.run(reset: true);
+      expect(f.deletes, [1000]);
+      f.failAt.clear();
+      f.writes.clear();
+      expect(await f.run(forceRetry: true), 1);
+      expect(f.writes, [1000]);
+    });
+  });
+
+  group('reset keeps state it did not replace', () {
+    test('two exported weighings within the window are not re-sent', () async {
+      final f = _Fx()..weights = {1000: 70, 1300: 70};
+      expect(await f.run(), 2);
+      expect(await f.run(reset: true), 0);
+      expect(f.writes, [1000, 1300]);
+      expect(await f.run(), 0); // still marked exported
+    });
+
+    test('a disabled scale keeps its exported set across a reset', () async {
+      final f = _Fx()..weights = {1000: 70};
+      await f.run();
+      f.enabled = false;
+      await f.run(reset: true);
+      f.enabled = true;
+      expect(await f.run(), 0);
+      expect(f.writes, [1000]);
+    });
+  });
+
+  group('weightWritePermitted', () {
+    test('a throwing check is UNKNOWN: still asks once and writes', () async {
+      var asked = false;
+      var requests = 0;
+      Future<bool> go() => weightWritePermitted(
+        check: () async => throw StateError('timeout'),
+        request: () async => requests++,
+        asked: () async => asked,
+        markAsked: () async => asked = true,
+      );
+      expect(await go(), isTrue);
+      expect(await go(), isTrue);
+      expect(requests, 1);
+    });
+
+    test('asks at most once per install', () async {
+      var asked = false;
+      var requests = 0;
+      Future<bool> go() => weightWritePermitted(
+        check: () async => false,
+        request: () async => requests++,
+        asked: () async => asked,
+        markAsked: () async => asked = true,
+      );
+      // hasPermissions is unreliable: never block the write after asking once.
+      expect(await go(), isTrue);
+      expect(await go(), isTrue);
+      expect(requests, 1);
+    });
+
+    test('a request that throws leaves the ask unspent and skips', () async {
+      var asked = false;
+      expect(
+        await weightWritePermitted(
+          check: () async => false,
+          request: () async => throw StateError('no activity'),
+          asked: () async => asked,
+          markAsked: () async => asked = true,
+        ),
+        isFalse,
+      );
+      expect(asked, isFalse);
+    });
+
+    test('granted after the request => true', () async {
+      var granted = false;
+      expect(
+        await weightWritePermitted(
+          check: () async => granted,
+          request: () async => granted = true,
+          asked: () async => false,
+          markAsked: () async {},
+        ),
+        isTrue,
+      );
+    });
+  });
+
+  test('WEIGHT is not in the per-day delete/rewrite types', () {
+    for (final apple in [true, false]) {
+      expect(
+        healthDeleteTypes(isApplePlatform: apple),
+        isNot(contains(HealthDataType.WEIGHT)),
+      );
+    }
+  });
+}