From 1a696ed9d7694af7298d0dd7b729ac84cc39a245 Mon Sep 17 00:00:00 2001
From: David Riedel <48388362+Riedel-David@users.noreply.github.com>
Date: Tue, 3 Nov 2026 21:04:37 +0200
Subject: [PATCH 01/12] Export scale weighings to Health Connect / Apple Health
 as WEIGHT samples

---
 android/app/src/main/AndroidManifest.xml |  10 +-
 ios/Runner/Info.plist                    |   2 +-
 lib/health/health_export.dart            |  66 +++++-
 lib/health/health_weight_export.dart     | 266 +++++++++++++++++++++++
 test/health_profile_import_test.dart     |  10 +-
 test/health_weight_export_test.dart      | 216 ++++++++++++++++++
 6 files changed, 560 insertions(+), 10 deletions(-)
 create mode 100644 lib/health/health_weight_export.dart
 create mode 100644 test/health_weight_export_test.dart

diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index c9b27cee1..449e9ed14 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -96,12 +96,16 @@
          total calories with it, and a missing read fails the whole read. -->
     <uses-permission android:name="android.permission.health.READ_DISTANCE" />
     <uses-permission android:name="android.permission.health.READ_TOTAL_CALORIES_BURNED" />
-    <!-- READ only, and no WRITE counterpart on purpose: body metrics are read
-         INTO the local profile (weight drifts, and the calorie estimate
-         depends on it) and this app has no business writing them back. Health
+    <!-- Body metrics are read INTO the local profile (weight drifts, and the
+         calorie estimate depends on it); height is READ only. Weight has a
+         WRITE below, for a paired scale's own weighings only. Health
          Connect silently returns nothing for an undeclared permission rather
          than failing, so an omission here looks exactly like an empty store. -->
     <uses-permission android:name="android.permission.health.READ_WEIGHT" />
+    <!-- WRITE_WEIGHT: a paired scale's weighings are exported to Health Connect
+         (lib/health/health_weight_export.dart). Only the scale's own readings;
+         the weight read above never goes back out. -->
+    <uses-permission android:name="android.permission.health.WRITE_WEIGHT" />
     <uses-permission android:name="android.permission.health.READ_HEIGHT" />
     <!-- READ only, and there will never be a WRITE counterpart. These come
          from devices CLEARED to take them — a blood-pressure cuff, a CGM, a
diff --git a/ios/Runner/Info.plist b/ios/Runner/Info.plist
index 7f970122f..f2e756bf1 100644
--- a/ios/Runner/Info.plist
+++ b/ios/Runner/Info.plist
@@ -168,7 +168,7 @@
 	<key>NSCameraUsageDescription</key>
 	<string>OpenStrap uses the camera to read the barcode on a food packet, so logging a meal does not mean typing its nutrition panel out by hand. It reads the barcode digits and nothing else — no photo is taken, kept, or sent anywhere.</string>
 	<key>NSHealthUpdateUsageDescription</key>
-	<string>OpenStrap writes your sleep, resting heart rate, HRV, respiratory rate, energy and workouts into Apple Health.</string>
+	<string>OpenStrap writes your sleep, resting heart rate, HRV, respiratory rate, energy and workouts, and the weighings of a scale you have paired, into Apple Health.</string>
 	<key>NSBluetoothPeripheralUsageDescription</key>
 	<string>OpenStrap connects to your WHOOP band over Bluetooth to sync your health data.</string>
 	<key>NSLocationWhenInUseUsageDescription</key>
diff --git a/lib/health/health_export.dart b/lib/health/health_export.dart
index 4b1a6df92..222dcd73c 100644
--- a/lib/health/health_export.dart
+++ b/lib/health/health_export.dart
@@ -31,6 +31,7 @@ import '../data/db.dart';
 import '../data/series_codec.dart';
 import 'health_heart_rate_batch.dart';
 import 'health_sleep_session.dart';
+import 'health_weight_export.dart';
 
 /// What we can do with the health store right now.
 enum HealthLinkState {
@@ -576,6 +577,10 @@ class HealthExporter {
     for (final t in _sleepHealthTypes)
       if (t != _foreignSleepEnvelope(isApple)) t,
     HealthDataType.WORKOUT,
+    // Scale weighings (health_weight_export.dart). Authorization scope only:
+    // deliberately NOT in healthDeleteTypes / _rewriteTypes, because the
+    // per-day pass would delete weights it has no day_result to rewrite.
+    HealthDataType.WEIGHT,
   ];
 
   /// The types the per-day delete-then-write pass touches.
@@ -665,6 +670,38 @@ class HealthExporter {
     }
   }
 
+  /// WEIGHT write permission, for the weight export only. Existing users were
+  /// authorized before WEIGHT joined [_types] and are never re-prompted by
+  /// [request], so a plain attempt would no-op forever. HealthKit hides write
+  /// auth (check unknown => proceed); on Health Connect the grant is checked
+  /// and asked for at most once per install. The per-day pass keeps its
+  /// attempt-everything behaviour (see below).
+  Future<bool> _weightWriteAllowed() async {
+    if (isApple) return true;
+    final types = [HealthDataType.WEIGHT];
+    const access = [HealthDataAccess.WRITE];
+    final prefs = await SharedPreferences.getInstance();
+    return weightWritePermitted(
+      check: () async =>
+          await _health
+              .hasPermissions(types, permissions: access)
+              .timeout(_deleteTimeout) ==
+          true,
+      request: () async {
+        try {
+          await _health
+              .requestAuthorization(types, permissions: access)
+              .timeout(_deleteTimeout);
+        } catch (e) {
+          if (e is TimeoutException) _storeHung = true;
+          rethrow;
+        }
+      },
+      asked: () async => prefs.getBool(kHealthWeightPermAskedPref) == true,
+      markAsked: () => prefs.setBool(kHealthWeightPermAskedPref, true),
+    );
+  }
+
   // We do NOT gate on a write-permission check: HealthKit hides write-auth by
   // design, and Health Connect's hasPermissions(WRITE) frequently returns
   // null/false even after the user grants everything — which would leave the UI
@@ -1103,7 +1140,34 @@ class HealthExporter {
         return done;
       };
 
-      return exportPriorityOrBulk();
+      final days = await exportPriorityOrBulk();
+      if (!_storeHung) {
+        await exportScaleWeighings(
+          reset: reset,
+          stopped: () => _storeHung,
+          permitted: _weightWriteAllowed,
+          deleteOwn: (a, b) => _deleteOwnSamples(HealthDataType.WEIGHT, a, b),
+          write: (kg, at) async {
+            if (_storeHung) return false;
+            try {
+              return await _health
+                  .writeHealthData(
+                    value: kg,
+                    type: HealthDataType.WEIGHT,
+                    startTime: at,
+                    endTime: at,
+                    unit: HealthDataUnit.KILOGRAM,
+                  )
+                  .timeout(_deleteTimeout);
+            } catch (e) {
+              if (e is TimeoutException) _storeHung = true;
+              debugPrint('[health] write WEIGHT: $e');
+              return false;
+            }
+          },
+        );
+      }
+      return days;
     } catch (e) {
       debugPrint('[health] exportAll: $e');
       return 0;
diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
new file mode 100644
index 000000000..15b0b42d5
--- /dev/null
+++ b/lib/health/health_weight_export.dart
@@ -0,0 +1,266 @@
+// Scale weighings → Apple Health / Health Connect WEIGHT samples.
+//
+// One sample per weighing, at the weighing's own instant, kg. Weight only: no
+// body fat, BMI or impedance (those are the scale's, not ours to restate).
+//
+// WHY THIS IS NOT IN THE PER-DAY PASS. `healthDeleteTypes` drives a day-wide
+// delete-then-rewrite from that day's `day_result`. A weighing is not part of
+// any day_result, so WEIGHT must NOT be in that list: the pass would delete the
+// day's weights and have nothing to write back.
+//
+// IDEMPOTENCE. Per device, a persisted SET of already-exported ts_ms (newest
+// ~2000) decides what is sent: every eligible weighing not in the set goes out
+// on each run, so a late-arriving OLDER weighing (history sync, backfill, clock
+// correction) is not skipped the way a high-water cursor would skip it. Each
+// send is delete-our-own-sample-at-that-instant, then write, so a lost set (or
+// `reset`) re-sends without stacking duplicates. A failed weighing is skipped
+// (later ones still go out) and retried on later runs, at most
+// [kMaxWeightAttempts] times.
+//
+// HOUSEHOLD SCALES. A scale carries no user, so [exportableWeighings] runs a
+// CHAINED band (kWeighingBand, see measurement_inputs.dart) before anything is
+// exported: the first weighing seeds, any weighing more than the band away from
+// the previous ACCEPTED one is dropped. Health samples cannot be recalled, so
+// this is stricter than reading the newest weighing.
+//
+// NO ECHO LOOP. `health_profile_import.dart` reads WEIGHT from the store into
+// the PROFILE (a profile field), never into `observation`. The source here is
+// the scale's own stored weighings (`LocalDb.deviceObservationValues`, keyed by
+// the scale's device id), so a weight read from the store has no row to export.
+// observation_isolation_test keeps raw table access inside db.dart, so the
+// source_kind column is not filtered here.
+import 'dart:convert';
+
+import 'package:flutter/foundation.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+import '../ble/adapters/_registry.dart' show DeviceCategory, categoryOf;
+import '../ble/adapters/miscale.dart' show kWeightMaxKg, kWeightMinKg;
+import '../compute/inputs/canonical.dart' show wearableEnabled;
+import '../compute/inputs/measurement_inputs.dart' show nearWeight;
+import '../data/db.dart';
+
+/// Per-device persisted set (JSON list) of exported weighing ts_ms.
+String healthWeightExportedKey(String deviceId) =>
+    'health_weight_exported:$deviceId';
+
+/// Per-device persisted failure counts (JSON map ts_ms -> attempts).
+String healthWeightAttemptsKey(String deviceId) =>
+    'health_weight_attempts:$deviceId';
+
+/// Superseded high-water cursor (LocalDb cursor). Never read any more; only
+/// cleared on reset.
+String healthWeightCursorName(String deviceId) =>
+    'health_weight_through:$deviceId';
+
+/// Set once WEIGHT write permission has been requested on this install.
+const String kHealthWeightPermAskedPref = 'health_weight_perm_asked';
+
+/// Bound on the exported set per device (newest kept).
+const int kMaxExportedWeighings = 2000;
+
+/// Failed attempts after which a weighing is no longer retried. Mirrors
+/// HealthExporter's `_kMaxExportAttempts`.
+const int kMaxWeightAttempts = 6;
+
+/// Half-width of the window that identifies "our sample for this weighing".
+const Duration kHealthWeightMatchWindow = Duration(milliseconds: 500);
+
+/// A weighing that may be exported, ascending by [atMs] when listed.
+typedef Weighing = ({int atMs, double kg});
+
+/// [raw] (ts_ms -> kg) as exportable weighings, ascending, minus [exported].
+/// Skips non-finite and out-of-bounds values, then applies the chained
+/// household band over ALL plausible weighings (so the chain does not depend
+/// on what was exported before). Never substitutes a value.
+@visibleForTesting
+List<Weighing> exportableWeighings(
+  Map<int, num> raw, {
+  Set<int> exported = const {},
+}) {
+  final sorted = <Weighing>[
+    for (final e in raw.entries)
+      if (e.value.isFinite &&
+          e.value >= kWeightMinKg &&
+          e.value <= kWeightMaxKg)
+        (atMs: e.key, kg: e.value.toDouble()),
+  ]..sort((a, b) => a.atMs.compareTo(b.atMs));
+  final out = <Weighing>[];
+  double? prev;
+  for (final w in sorted) {
+    if (!nearWeight(w.kg, prev)) continue;
+    prev = w.kg;
+    if (!exported.contains(w.atMs)) out.add(w);
+  }
+  return out;
+}
+
+Set<int> _decodeSet(String? s) {
+  try {
+    return {for (final v in jsonDecode(s ?? '[]') as List) (v as num).toInt()};
+  } catch (_) {
+    return {};
+  }
+}
+
+Map<int, int> _decodeAttempts(String? s) {
+  try {
+    return {
+      for (final e in (jsonDecode(s ?? '{}') as Map).entries)
+        int.parse(e.key as String): (e.value as num).toInt(),
+    };
+  } catch (_) {
+    return {};
+  }
+}
+
+/// Keeps only the newest [kMaxExportedWeighings] entries.
+List<int> _bounded(Set<int> s) {
+  final l = s.toList()..sort();
+  return l.length > kMaxExportedWeighings
+      ? l.sublist(l.length - kMaxExportedWeighings)
+      : l;
+}
+
+/// Replace-write [weighings] (ascending). A failed weighing is skipped and its
+/// attempt counted; later ones still go. Weighings already at
+/// [kMaxWeightAttempts] are not tried. Persists via [save] after each change.
+/// [stopped] (store hung) ends the run without counting the failure that
+/// tripped it. Returns how many were written.
+Future<int> writeWeighings({
+  required List<Weighing> weighings,
+  required Set<int> exported,
+  required Map<int, int> attempts,
+  required Future<void> Function() save,
+  required Future<bool> Function(DateTime start, DateTime end) deleteOwn,
+  required Future<bool> Function(double kg, DateTime at) write,
+  bool Function()? stopped,
+}) async {
+  var written = 0;
+  for (final w in weighings) {
+    if (stopped?.call() ?? false) break;
+    if ((attempts[w.atMs] ?? 0) >= kMaxWeightAttempts) continue;
+    final at = DateTime.fromMillisecondsSinceEpoch(w.atMs);
+    // A delete that cannot clear the instant must not be written on top of.
+    var ok = await deleteOwn(
+      at.subtract(kHealthWeightMatchWindow),
+      at.add(kHealthWeightMatchWindow),
+    );
+    if (ok) ok = await write(w.kg, at);
+    if (ok) {
+      written++;
+      exported.add(w.atMs);
+      attempts.remove(w.atMs);
+    } else {
+      if (stopped?.call() ?? false) break;
+      attempts[w.atMs] = (attempts[w.atMs] ?? 0) + 1;
+    }
+    await save();
+  }
+  return written;
+}
+
+/// Whether WEIGHT can be written. [check] reads the grant (null = unknown),
+/// [request] asks for it. Asks at most once per install ([kHealthWeightPermAskedPref]);
+/// not granted afterwards => false, and the caller skips without recording.
+Future<bool> weightWritePermitted({
+  required Future<bool> Function() check,
+  required Future<void> Function() request,
+  required Future<bool> Function() asked,
+  required Future<void> Function() markAsked,
+}) async {
+  try {
+    if (await check()) return true;
+    if (await asked()) return false;
+    await markAsked();
+    await request();
+    return await check();
+  } catch (e) {
+    debugPrint('[health] weight permission: $e');
+    return false;
+  }
+}
+
+/// Export every flagged-on scale's pending weighings. Best-effort; never
+/// throws. [reset] clears the exported sets (re-sends everything,
+/// idempotently). [permitted] is consulted lazily, only when something is
+/// pending. The loaders default to [LocalDb]; tests inject their own.
+Future<int> exportScaleWeighings({
+  required Future<bool> Function(DateTime start, DateTime end) deleteOwn,
+  required Future<bool> Function(double kg, DateTime at) write,
+  Future<bool> Function()? permitted,
+  bool Function()? stopped,
+  bool reset = false,
+  Future<List<Map<String, Object?>>> Function()? loadDevices,
+  Future<bool> Function(String adapterId)? isEnabled,
+  Future<Map<int, num>> Function(String deviceId)? loadWeights,
+  Future<void> Function(String name)? deleteCursor,
+}) async {
+  var total = 0;
+  try {
+    final prefs = await SharedPreferences.getInstance();
+    var permChecked = false;
+    var permOk = true;
+    for (final row in await (loadDevices ?? LocalDb.deviceRows)()) {
+      final adapter = row['adapter_id'] as String?;
+      final id = row['id'] as String?;
+      if (id == null) continue;
+      if (reset) {
+        await prefs.remove(healthWeightExportedKey(id));
+        await prefs.remove(healthWeightAttemptsKey(id));
+        await (deleteCursor ?? LocalDb.deleteCursor)(
+          healthWeightCursorName(id),
+        );
+      }
+      if (adapter == null ||
+          categoryOf(adapter) != DeviceCategory.healthMeasurement ||
+          !await (isEnabled ?? wearableEnabled)(adapter)) {
+        continue;
+      }
+      final exported = _decodeSet(prefs.getString(healthWeightExportedKey(id)));
+      final attempts = _decodeAttempts(
+        prefs.getString(healthWeightAttemptsKey(id)),
+      );
+      final raw = await (loadWeights ??
+          (d) => LocalDb.deviceObservationValues(d, 'weight'))(id);
+      // A full set means older entries were trimmed: do not resurrect them.
+      final floor = exported.length >= kMaxExportedWeighings
+          ? exported.reduce((a, b) => a < b ? a : b)
+          : 0;
+      final pending = [
+        for (final w in exportableWeighings(raw, exported: exported))
+          if (w.atMs >= floor && (attempts[w.atMs] ?? 0) < kMaxWeightAttempts)
+            w,
+      ];
+      if (pending.isEmpty) continue;
+      if (!permChecked) {
+        permChecked = true;
+        permOk = permitted == null || await permitted();
+      }
+      if (!permOk) continue;
+      total += await writeWeighings(
+        weighings: pending,
+        exported: exported,
+        attempts: attempts,
+        save: () async {
+          await prefs.setString(
+            healthWeightExportedKey(id),
+            jsonEncode(_bounded(exported)),
+          );
+          await prefs.setString(
+            healthWeightAttemptsKey(id),
+            jsonEncode({
+              for (final e in attempts.entries) '${e.key}': e.value,
+            }),
+          );
+        },
+        deleteOwn: deleteOwn,
+        write: write,
+        stopped: stopped,
+      );
+    }
+  } catch (e) {
+    debugPrint('[health] exportScaleWeighings: $e');
+  }
+  return total;
+}
diff --git a/test/health_profile_import_test.dart b/test/health_profile_import_test.dart
index 29f2f3e30..6803833c3 100644
--- a/test/health_profile_import_test.dart
+++ b/test/health_profile_import_test.dart
@@ -296,10 +296,10 @@ void main() {
         reason: '$perm is requested by HealthProfileImporter',
       );
     }
-    // And no write counterparts: this app reads body metrics, it does not
-    // write them back.
-    for (final perm in ['WRITE_WEIGHT', 'WRITE_HEIGHT']) {
-      expect(manifest, isNot(contains('android.permission.health.$perm')));
-    }
+    // Height is never written. WRITE_WEIGHT exists only for a paired scale's
+    // own weighings (lib/health/health_weight_export.dart); the weight read
+    // here is never exported (that source is `observation`, not the profile).
+    expect(manifest, isNot(contains('android.permission.health.WRITE_HEIGHT')));
+    expect(manifest, contains('android.permission.health.WRITE_WEIGHT'));
   });
 }
diff --git a/test/health_weight_export_test.dart b/test/health_weight_export_test.dart
new file mode 100644
index 000000000..81e281712
--- /dev/null
+++ b/test/health_weight_export_test.dart
@@ -0,0 +1,216 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:health/health.dart';
+import 'package:openstrap_edge/health/health_export.dart'
+    show healthDeleteTypes;
+import 'package:openstrap_edge/health/health_weight_export.dart';
+import 'package:shared_preferences/shared_preferences.dart';
+
+class _Fx {
+  final writes = <int>[]; // ts_ms written
+  final failAt = <int>{};
+  var devices = <Map<String, Object?>>[
+    {'id': 'd1', 'adapter_id': 'thermometer'},
+  ];
+  var enabled = true;
+  var weights = <int, num>{};
+  var perm = true;
+  var permCalls = 0;
+  final deletedCursors = <String>[];
+
+  Future<int> run({bool reset = false, bool Function()? stopped}) =>
+      exportScaleWeighings(
+        reset: reset,
+        stopped: stopped,
+        loadDevices: () async => devices,
+        isEnabled: (_) async => enabled,
+        loadWeights: (_) async => weights,
+        deleteCursor: (n) async => deletedCursors.add(n),
+        permitted: () async {
+          permCalls++;
+          return perm;
+        },
+        deleteOwn: (s, e) async => true,
+        write: (kg, at) async {
+          if (failAt.contains(at.millisecondsSinceEpoch)) return false;
+          writes.add(at.millisecondsSinceEpoch);
+          return true;
+        },
+      );
+}
+
+void main() {
+  setUp(() => SharedPreferences.setMockInitialValues({}));
+
+  group('exportableWeighings', () {
+    test('keeps plausible values ascending, skips absent/implausible', () {
+      final out = exportableWeighings({
+        3000: 72.4,
+        1000: 71.9,
+        2000: 0,
+        4000: 9.9,
+        5000: 300.1,
+        6000: double.nan,
+        7000: double.infinity,
+      });
+      expect(out.map((w) => w.atMs), [1000, 3000]);
+      expect(out.map((w) => w.kg), [71.9, 72.4]);
+    });
+
+    test('chained band drops a household weight, keeps the chain', () {
+      final out = exportableWeighings({
+        1000: 70.0,
+        2000: 45.0, // child: >10% off
+        3000: 74.0, // within 10% of 70
+        4000: 79.0, // within 10% of 74
+        5000: 100.0, // adult housemate
+      });
+      expect(out.map((w) => w.atMs), [1000, 3000, 4000]);
+    });
+
+    test('exported ones are filtered but still anchor the chain', () {
+      final out = exportableWeighings({
+        1000: 70.0,
+        2000: 100.0,
+        3000: 71.0,
+      }, exported: {1000});
+      expect(out.map((w) => w.atMs), [3000]);
+    });
+  });
+
+  group('exportScaleWeighings', () {
+    test('device flag off => nothing written', () async {
+      final f = _Fx()
+        ..enabled = false
+        ..weights = {1000: 70};
+      expect(await f.run(), 0);
+      expect(f.writes, isEmpty);
+    });
+
+    test('only healthMeasurement devices', () async {
+      final f = _Fx()
+        ..devices = [
+          {'id': 'w1', 'adapter_id': 'oura'},
+        ]
+        ..weights = {1000: 70};
+      expect(await f.run(), 0);
+      expect(f.writes, isEmpty);
+    });
+
+    test('late older weighing is exported later; no re-writes', () async {
+      final f = _Fx()..weights = {2000: 70, 3000: 71};
+      expect(await f.run(), 2);
+      expect(await f.run(), 0);
+      f.weights = {1000: 70.5, 2000: 70, 3000: 71};
+      expect(await f.run(), 1);
+      expect(f.writes, [2000, 3000, 1000]);
+    });
+
+    test('reset clears state and the legacy cursor, re-sends', () async {
+      final f = _Fx()..weights = {1000: 70};
+      await f.run();
+      expect(await f.run(), 0);
+      expect(await f.run(reset: true), 1);
+      expect(f.writes, [1000, 1000]);
+      expect(f.deletedCursors, contains(healthWeightCursorName('d1')));
+    });
+
+    test('failure continues to later weighings; bounded retries', () async {
+      final f = _Fx()
+        ..weights = {1000: 70, 2000: 71, 3000: 72}
+        ..failAt.add(2000);
+      expect(await f.run(), 2);
+      expect(f.writes, [1000, 3000]);
+      for (var i = 0; i < kMaxWeightAttempts + 3; i++) {
+        await f.run();
+      }
+      // 1 attempt above + enough to hit the cap; then no more tries.
+      f.failAt.clear();
+      expect(await f.run(), 0);
+      expect(f.writes, [1000, 3000]);
+    });
+
+    test('failure below the cap is retried and succeeds', () async {
+      final f = _Fx()
+        ..weights = {1000: 70}
+        ..failAt.add(1000);
+      await f.run();
+      f.failAt.clear();
+      expect(await f.run(), 1);
+    });
+
+    test('permission missing => skipped, nothing recorded', () async {
+      final f = _Fx()
+        ..weights = {1000: 70}
+        ..perm = false;
+      expect(await f.run(), 0);
+      f.perm = true;
+      expect(await f.run(), 1);
+    });
+
+    test('permission not consulted when nothing is pending', () async {
+      final f = _Fx()..weights = {};
+      await f.run();
+      expect(f.permCalls, 0);
+    });
+
+    test('a hung store ends the run without burning attempts', () async {
+      final f = _Fx()
+        ..weights = {1000: 70, 2000: 71}
+        ..failAt.addAll({1000, 2000});
+      var hung = false;
+      final n = await exportScaleWeighings(
+        loadDevices: () async => f.devices,
+        isEnabled: (_) async => true,
+        loadWeights: (_) async => f.weights,
+        deleteCursor: (_) async {},
+        stopped: () => hung,
+        deleteOwn: (s, e) async => true,
+        write: (kg, at) async {
+          hung = true;
+          return false;
+        },
+      );
+      expect(n, 0);
+      f.failAt.clear();
+      expect(await f.run(), 2);
+    });
+  });
+
+  group('weightWritePermitted', () {
+    test('asks at most once per install', () async {
+      var asked = false;
+      var requests = 0;
+      Future<bool> go() => weightWritePermitted(
+        check: () async => false,
+        request: () async => requests++,
+        asked: () async => asked,
+        markAsked: () async => asked = true,
+      );
+      expect(await go(), isFalse);
+      expect(await go(), isFalse);
+      expect(requests, 1);
+    });
+
+    test('granted after the request => true', () async {
+      var granted = false;
+      expect(
+        await weightWritePermitted(
+          check: () async => granted,
+          request: () async => granted = true,
+          asked: () async => false,
+          markAsked: () async {},
+        ),
+        isTrue,
+      );
+    });
+  });
+
+  test('WEIGHT is not in the per-day delete/rewrite types', () {
+    for (final apple in [true, false]) {
+      expect(
+        healthDeleteTypes(isApplePlatform: apple),
+        isNot(contains(HealthDataType.WEIGHT)),
+      );
+    }
+  });
+}

From 7a80de8f63fdc0d23f246dc6a0006257247abe31 Mon Sep 17 00:00:00 2001
From: David Riedel <48388362+Riedel-David@users.noreply.github.com>
Date: Tue, 3 Nov 2026 23:55:36 +0200
Subject: [PATCH 02/12] Health weight export: never block the write on an
 unreliable permission check

---
 lib/health/health_weight_export.dart | 14 +++++++++-----
 test/health_weight_export_test.dart  |  5 +++--
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
index 15b0b42d5..32e3d05d5 100644
--- a/lib/health/health_weight_export.dart
+++ b/lib/health/health_weight_export.dart
@@ -162,7 +162,7 @@ Future<int> writeWeighings({
 
 /// Whether WEIGHT can be written. [check] reads the grant (null = unknown),
 /// [request] asks for it. Asks at most once per install ([kHealthWeightPermAskedPref]);
-/// not granted afterwards => false, and the caller skips without recording.
+/// after that the write is always attempted (failures are bounded by attempts).
 Future<bool> weightWritePermitted({
   required Future<bool> Function() check,
   required Future<void> Function() request,
@@ -171,10 +171,14 @@ Future<bool> weightWritePermitted({
 }) async {
   try {
     if (await check()) return true;
-    if (await asked()) return false;
-    await markAsked();
-    await request();
-    return await check();
+    if (!await asked()) {
+      await markAsked();
+      await request();
+    }
+    // Health Connect's hasPermissions(WRITE) is unreliable (null/false after a
+    // grant), so never block on it once we've asked: attempt the write and let
+    // the bounded per-weighing attempts absorb a real denial.
+    return true;
   } catch (e) {
     debugPrint('[health] weight permission: $e');
     return false;
diff --git a/test/health_weight_export_test.dart b/test/health_weight_export_test.dart
index 81e281712..73e7337db 100644
--- a/test/health_weight_export_test.dart
+++ b/test/health_weight_export_test.dart
@@ -186,8 +186,9 @@ void main() {
         asked: () async => asked,
         markAsked: () async => asked = true,
       );
-      expect(await go(), isFalse);
-      expect(await go(), isFalse);
+      // hasPermissions is unreliable: never block the write after asking once.
+      expect(await go(), isTrue);
+      expect(await go(), isTrue);
       expect(requests, 1);
     });
 

From bfefcfd00cde3561226be8ff65ff3638c55a81c5 Mon Sep 17 00:00:00 2001
From: David Riedel <48388362+Riedel-David@users.noreply.github.com>
Date: Tue, 3 Nov 2026 23:57:29 +0200
Subject: [PATCH 03/12] Health weight export: ask on Apple too, keep the ask
 unspent on failure, forceRetry clears attempts

---
 lib/health/health_export.dart        |  6 +++---
 lib/health/health_weight_export.dart |  7 ++++++-
 test/health_weight_export_test.dart  | 14 ++++++++++++++
 3 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/lib/health/health_export.dart b/lib/health/health_export.dart
index 222dcd73c..9c9e55ba9 100644
--- a/lib/health/health_export.dart
+++ b/lib/health/health_export.dart
@@ -673,11 +673,10 @@ class HealthExporter {
   /// WEIGHT write permission, for the weight export only. Existing users were
   /// authorized before WEIGHT joined [_types] and are never re-prompted by
   /// [request], so a plain attempt would no-op forever. HealthKit hides write
-  /// auth (check unknown => proceed); on Health Connect the grant is checked
-  /// and asked for at most once per install. The per-day pass keeps its
+  /// auth, so the one-time request runs there too (idempotent; shows the sheet
+  /// only for undetermined types); asked for at most once per install. The per-day pass keeps its
   /// attempt-everything behaviour (see below).
   Future<bool> _weightWriteAllowed() async {
-    if (isApple) return true;
     final types = [HealthDataType.WEIGHT];
     const access = [HealthDataAccess.WRITE];
     final prefs = await SharedPreferences.getInstance();
@@ -1144,6 +1143,7 @@ class HealthExporter {
       if (!_storeHung) {
         await exportScaleWeighings(
           reset: reset,
+          forceRetry: forceRetry,
           stopped: () => _storeHung,
           permitted: _weightWriteAllowed,
           deleteOwn: (a, b) => _deleteOwnSamples(HealthDataType.WEIGHT, a, b),
diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
index 32e3d05d5..44ccfb0ea 100644
--- a/lib/health/health_weight_export.dart
+++ b/lib/health/health_weight_export.dart
@@ -172,8 +172,9 @@ Future<bool> weightWritePermitted({
   try {
     if (await check()) return true;
     if (!await asked()) {
-      await markAsked();
       await request();
+      // Only after the request ran: a throw/timeout leaves the ask unspent.
+      await markAsked();
     }
     // Health Connect's hasPermissions(WRITE) is unreliable (null/false after a
     // grant), so never block on it once we've asked: attempt the write and let
@@ -195,6 +196,7 @@ Future<int> exportScaleWeighings({
   Future<bool> Function()? permitted,
   bool Function()? stopped,
   bool reset = false,
+  bool forceRetry = false,
   Future<List<Map<String, Object?>>> Function()? loadDevices,
   Future<bool> Function(String adapterId)? isEnabled,
   Future<Map<int, num>> Function(String deviceId)? loadWeights,
@@ -221,6 +223,9 @@ Future<int> exportScaleWeighings({
           !await (isEnabled ?? wearableEnabled)(adapter)) {
         continue;
       }
+      if (forceRetry && !reset) {
+        await prefs.remove(healthWeightAttemptsKey(id));
+      }
       final exported = _decodeSet(prefs.getString(healthWeightExportedKey(id)));
       final attempts = _decodeAttempts(
         prefs.getString(healthWeightAttemptsKey(id)),
diff --git a/test/health_weight_export_test.dart b/test/health_weight_export_test.dart
index 73e7337db..214e15f8d 100644
--- a/test/health_weight_export_test.dart
+++ b/test/health_weight_export_test.dart
@@ -192,6 +192,20 @@ void main() {
       expect(requests, 1);
     });
 
+    test('a request that throws leaves the ask unspent and skips', () async {
+      var asked = false;
+      expect(
+        await weightWritePermitted(
+          check: () async => false,
+          request: () async => throw StateError('no activity'),
+          asked: () async => asked,
+          markAsked: () async => asked = true,
+        ),
+        isFalse,
+      );
+      expect(asked, isFalse);
+    });
+
     test('granted after the request => true', () async {
       var granted = false;
       expect(

From 6fcdc23efda5cfa8dd08b669eac1308dd8611b0f Mon Sep 17 00:00:00 2001
From: David Riedel <48388362+Riedel-David@users.noreply.github.com>
Date: Wed, 4 Nov 2026 09:22:27 +0200
Subject: [PATCH 04/12] Health weight export: re-seed the household band after
 3 consecutive near rejects

---
 lib/health/health_weight_export.dart | 36 ++++++++++++++-----
 test/health_weight_export_test.dart  | 52 ++++++++++++++++++++++++++++
 2 files changed, 79 insertions(+), 9 deletions(-)

diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
index 44ccfb0ea..41cb46995 100644
--- a/lib/health/health_weight_export.dart
+++ b/lib/health/health_weight_export.dart
@@ -20,7 +20,8 @@
 // HOUSEHOLD SCALES. A scale carries no user, so [exportableWeighings] runs a
 // CHAINED band (kWeighingBand, see measurement_inputs.dart) before anything is
 // exported: the first weighing seeds, any weighing more than the band away from
-// the previous ACCEPTED one is dropped. Health samples cannot be recalled, so
+// the previous ACCEPTED one is dropped, unless 3 consecutive rejects are near
+// each other (then the run is accepted and re-seeds the chain). Health samples cannot be recalled, so
 // this is stricter than reading the newest weighing.
 //
 // NO ECHO LOOP. `health_profile_import.dart` reads WEIGHT from the store into
@@ -72,7 +73,8 @@ typedef Weighing = ({int atMs, double kg});
 /// [raw] (ts_ms -> kg) as exportable weighings, ascending, minus [exported].
 /// Skips non-finite and out-of-bounds values, then applies the chained
 /// household band over ALL plausible weighings (so the chain does not depend
-/// on what was exported before). Never substitutes a value.
+/// on what was exported before), re-seeding after 3 consecutive mutually-near
+/// rejects so a guest seed or a lasting weight change recovers. Never substitutes a value.
 @visibleForTesting
 List<Weighing> exportableWeighings(
   Map<int, num> raw, {
@@ -84,15 +86,31 @@ List<Weighing> exportableWeighings(
           e.value >= kWeightMinKg &&
           e.value <= kWeightMaxKg)
         (atMs: e.key, kg: e.value.toDouble()),
-  ]..sort((a, b) => a.atMs.compareTo(b.atMs));
-  final out = <Weighing>[];
-  double? prev;
+  ]..sort((a, b) {
+      final c = a.atMs.compareTo(b.atMs);
+      return c != 0 ? c : a.kg.compareTo(b.kg);
+    });
+  // Chained band with RE-SEED: a run of 3 consecutive rejected weighings, each
+  // near the previous run member, is accepted retroactively and its last
+  // member becomes the anchor (mirrors weighingChain in measurement_inputs).
+  final chain = <Weighing>[];
+  var run = <Weighing>[];
   for (final w in sorted) {
-    if (!nearWeight(w.kg, prev)) continue;
-    prev = w.kg;
-    if (!exported.contains(w.atMs)) out.add(w);
+    if (chain.isEmpty || nearWeight(w.kg, chain.last.kg)) {
+      chain.add(w);
+      run = [];
+      continue;
+    }
+    run = run.isNotEmpty && nearWeight(w.kg, run.last.kg) ? [...run, w] : [w];
+    if (run.length >= 3) {
+      chain.addAll(run);
+      run = [];
+    }
   }
-  return out;
+  return [
+    for (final w in chain)
+      if (!exported.contains(w.atMs)) w,
+  ];
 }
 
 Set<int> _decodeSet(String? s) {
diff --git a/test/health_weight_export_test.dart b/test/health_weight_export_test.dart
index 214e15f8d..eeec46d1b 100644
--- a/test/health_weight_export_test.dart
+++ b/test/health_weight_export_test.dart
@@ -67,6 +67,58 @@ void main() {
       expect(out.map((w) => w.atMs), [1000, 3000, 4000]);
     });
 
+    test('guest seed 20 kg then user weights: re-seeds on the user run', () {
+      final out = exportableWeighings({
+        1000: 20.0,
+        2000: 70.0,
+        3000: 71.0,
+        4000: 70.0,
+      });
+      // The seed itself stays in the chain (mirrors weighingChain).
+      expect(out.map((w) => w.atMs), [1000, 2000, 3000, 4000]);
+    });
+
+    test('lasting >10% step re-seeds retroactively', () {
+      final out = exportableWeighings({
+        1000: 90.0,
+        2000: 79.0,
+        3000: 79.0,
+        4000: 80.0,
+        5000: 80.0,
+      });
+      expect(out.map((w) => w.atMs), [1000, 2000, 3000, 4000, 5000]);
+    });
+
+    test('lone outlier amid the chain is dropped', () {
+      final out = exportableWeighings({
+        1000: 70.0,
+        2000: 120.0,
+        3000: 71.0,
+      });
+      expect(out.map((w) => w.atMs), [1000, 3000]);
+    });
+
+    test('two-outlier run (<3) is dropped', () {
+      final out = exportableWeighings({
+        1000: 70.0,
+        2000: 120.0,
+        3000: 121.0,
+        4000: 71.0,
+      });
+      expect(out.map((w) => w.atMs), [1000, 4000]);
+    });
+
+    test('three mutually unrelated outliers do not re-seed', () {
+      final out = exportableWeighings({
+        1000: 70.0,
+        2000: 120.0,
+        3000: 40.0,
+        4000: 200.0,
+        5000: 71.0,
+      });
+      expect(out.map((w) => w.atMs), [1000, 5000]);
+    });
+
     test('exported ones are filtered but still anchor the chain', () {
       final out = exportableWeighings({
         1000: 70.0,

From 3e19b047c70e0017dee1e17bd6654af34cbfc7c4 Mon Sep 17 00:00:00 2001
From: David Riedel <48388362+Riedel-David@users.noreply.github.com>
Date: Wed, 4 Nov 2026 11:21:24 +0200
Subject: [PATCH 05/12] Health weight export: address review findings

---
 lib/health/health_export.dart        |  37 +++-
 lib/health/health_weight_export.dart | 265 +++++++++++++++++++--------
 test/health_weight_export_test.dart  | 227 ++++++++++++++++++++---
 3 files changed, 420 insertions(+), 109 deletions(-)

diff --git a/lib/health/health_export.dart b/lib/health/health_export.dart
index 9c9e55ba9..5a8d1ff09 100644
--- a/lib/health/health_export.dart
+++ b/lib/health/health_export.dart
@@ -701,6 +701,21 @@ class HealthExporter {
     );
   }
 
+  /// Current WEIGHT grant for the cap-reset transition; null = unknown.
+  Future<bool?> _weightGranted() async {
+    try {
+      return await _health
+          .hasPermissions(
+            [HealthDataType.WEIGHT],
+            permissions: [HealthDataAccess.WRITE],
+          )
+          .timeout(_deleteTimeout);
+    } catch (e) {
+      debugPrint('[health] weight grant read: $e');
+      return null;
+    }
+  }
+
   // We do NOT gate on a write-permission check: HealthKit hides write-auth by
   // design, and Health Connect's hasPermissions(WRITE) frequently returns
   // null/false even after the user grants everything — which would leave the UI
@@ -759,6 +774,11 @@ class HealthExporter {
         _types,
         permissions: _types.map((_) => HealthDataAccess.WRITE).toList(),
       );
+      // WEIGHT is in _types: the scale path need not ask a second time.
+      await (await SharedPreferences.getInstance()).setBool(
+        kHealthWeightPermAskedPref,
+        true,
+      );
     } catch (e) {
       debugPrint('[health] requestAuthorization: $e');
     }
@@ -865,6 +885,7 @@ class HealthExporter {
     if (await _androidUnavailable() != null) return 0; // HC missing/outdated
     return _workoutLock.run(() async {
     _storeHung = false;
+    var days = 0;
     try {
       await ensureHealthSleepExportEpoch(
         getCursor: LocalDb.getCursor,
@@ -1139,13 +1160,22 @@ class HealthExporter {
         return done;
       };
 
-      final days = await exportPriorityOrBulk();
+      days = await exportPriorityOrBulk();
+    } catch (e) {
+      // Weighings do not depend on the day results: log and carry on.
+      debugPrint('[health] exportAll: $e');
+    }
+    try {
       if (!_storeHung) {
         await exportScaleWeighings(
           reset: reset,
           forceRetry: forceRetry,
           stopped: () => _storeHung,
           permitted: _weightWriteAllowed,
+          weightGranted: _weightGranted,
+          syncEnabled: () async =>
+              (await SharedPreferences.getInstance()).getBool(kHealthSyncPref) ==
+              true,
           deleteOwn: (a, b) => _deleteOwnSamples(HealthDataType.WEIGHT, a, b),
           write: (kg, at) async {
             if (_storeHung) return false;
@@ -1167,11 +1197,10 @@ class HealthExporter {
           },
         );
       }
-      return days;
     } catch (e) {
-      debugPrint('[health] exportAll: $e');
-      return 0;
+      debugPrint('[health] exportAll weighings: $e');
     }
+    return days;
     });
   }
 
diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
index 41cb46995..261d4eb99 100644
--- a/lib/health/health_weight_export.dart
+++ b/lib/health/health_weight_export.dart
@@ -11,11 +11,15 @@
 // IDEMPOTENCE. Per device, a persisted SET of already-exported ts_ms (newest
 // ~2000) decides what is sent: every eligible weighing not in the set goes out
 // on each run, so a late-arriving OLDER weighing (history sync, backfill, clock
-// correction) is not skipped the way a high-water cursor would skip it. Each
-// send is delete-our-own-sample-at-that-instant, then write, so a lost set (or
-// `reset`) re-sends without stacking duplicates. A failed weighing is skipped
-// (later ones still go out) and retried on later runs, at most
-// [kMaxWeightAttempts] times.
+// correction) is not skipped the way a high-water cursor would skip it. A
+// normal send is a plain write: a weighing not in the set has no sample of ours
+// to replace, and a failed replacement must never cost a sample that was
+// exported earlier. Only a `reset` re-send deletes our own sample at that
+// instant first (so it does not stack duplicates), and never when another
+// weighing (any scale) sits inside the match window, since the delete is by
+// type + time range and would take that sample too. A failed weighing is
+// skipped (later ones still go out) and retried on later runs, at most
+// [kMaxWeightAttempts] times. At most [kMaxWeighingsPerRun] per call.
 //
 // HOUSEHOLD SCALES. A scale carries no user, so [exportableWeighings] runs a
 // CHAINED band (kWeighingBand, see measurement_inputs.dart) before anything is
@@ -57,6 +61,14 @@ String healthWeightCursorName(String deviceId) =>
 /// Set once WEIGHT write permission has been requested on this install.
 const String kHealthWeightPermAskedPref = 'health_weight_perm_asked';
 
+/// Last observed WEIGHT grant (true/false) so a not-granted -> granted
+/// transition can clear the per-weighing attempt caps.
+const String kHealthWeightGrantSeenPref = 'health_weight_grant_seen';
+
+/// Most weighings processed per [exportScaleWeighings] call; the rest stay
+/// pending for the next drain so a big replay cannot hold the export lock long.
+const int kMaxWeighingsPerRun = 200;
+
 /// Bound on the exported set per device (newest kept).
 const int kMaxExportedWeighings = 2000;
 
@@ -80,16 +92,17 @@ List<Weighing> exportableWeighings(
   Map<int, num> raw, {
   Set<int> exported = const {},
 }) {
-  final sorted = <Weighing>[
-    for (final e in raw.entries)
-      if (e.value.isFinite &&
-          e.value >= kWeightMinKg &&
-          e.value <= kWeightMaxKg)
-        (atMs: e.key, kg: e.value.toDouble()),
-  ]..sort((a, b) {
-      final c = a.atMs.compareTo(b.atMs);
-      return c != 0 ? c : a.kg.compareTo(b.kg);
-    });
+  final sorted =
+      <Weighing>[
+        for (final e in raw.entries)
+          if (e.value.isFinite &&
+              e.value >= kWeightMinKg &&
+              e.value <= kWeightMaxKg)
+            (atMs: e.key, kg: e.value.toDouble()),
+      ]..sort((a, b) {
+        final c = a.atMs.compareTo(b.atMs);
+        return c != 0 ? c : a.kg.compareTo(b.kg);
+      });
   // Chained band with RE-SEED: a run of 3 consecutive rejected weighings, each
   // near the previous run member, is accepted retroactively and its last
   // member becomes the anchor (mirrors weighingChain in measurement_inputs).
@@ -140,11 +153,14 @@ List<int> _bounded(Set<int> s) {
       : l;
 }
 
-/// Replace-write [weighings] (ascending). A failed weighing is skipped and its
+/// Write [weighings] (ascending). A failed weighing is skipped and its
 /// attempt counted; later ones still go. Weighings already at
 /// [kMaxWeightAttempts] are not tried. Persists via [save] after each change.
 /// [stopped] (store hung) ends the run without counting the failure that
-/// tripped it. Returns how many were written.
+/// tripped it. [mayContinue] is asked before EACH weighing; false ends the run
+/// (opt-out mid-drain). With [resend] our own sample at the instant is deleted
+/// first, unless [deleteSafe] says another sample shares the window.
+/// Returns how many were written.
 Future<int> writeWeighings({
   required List<Weighing> weighings,
   required Set<int> exported,
@@ -153,17 +169,24 @@ Future<int> writeWeighings({
   required Future<bool> Function(DateTime start, DateTime end) deleteOwn,
   required Future<bool> Function(double kg, DateTime at) write,
   bool Function()? stopped,
+  Future<bool> Function()? mayContinue,
+  bool resend = false,
+  bool Function(int atMs)? deleteSafe,
 }) async {
   var written = 0;
   for (final w in weighings) {
     if (stopped?.call() ?? false) break;
+    if (mayContinue != null && !await mayContinue()) break;
     if ((attempts[w.atMs] ?? 0) >= kMaxWeightAttempts) continue;
     final at = DateTime.fromMillisecondsSinceEpoch(w.atMs);
-    // A delete that cannot clear the instant must not be written on top of.
-    var ok = await deleteOwn(
-      at.subtract(kHealthWeightMatchWindow),
-      at.add(kHealthWeightMatchWindow),
-    );
+    var ok = true;
+    if (resend && (deleteSafe?.call(w.atMs) ?? true)) {
+      // A delete that cannot clear the instant must not be written on top of.
+      ok = await deleteOwn(
+        at.subtract(kHealthWeightMatchWindow),
+        at.add(kHealthWeightMatchWindow),
+      );
+    }
     if (ok) ok = await write(w.kg, at);
     if (ok) {
       written++;
@@ -178,9 +201,10 @@ Future<int> writeWeighings({
   return written;
 }
 
-/// Whether WEIGHT can be written. [check] reads the grant (null = unknown),
-/// [request] asks for it. Asks at most once per install ([kHealthWeightPermAskedPref]);
-/// after that the write is always attempted (failures are bounded by attempts).
+/// Whether WEIGHT can be written. [check] reads the grant (a throw or timeout
+/// means UNKNOWN, and the write is still attempted), [request] asks for it.
+/// Asks at most once per install ([kHealthWeightPermAskedPref]); after that the
+/// write is always attempted (failures are bounded by attempts).
 Future<bool> weightWritePermitted({
   required Future<bool> Function() check,
   required Future<void> Function() request,
@@ -188,7 +212,13 @@ Future<bool> weightWritePermitted({
   required Future<void> Function() markAsked,
 }) async {
   try {
-    if (await check()) return true;
+    var granted = false;
+    try {
+      granted = await check();
+    } catch (e) {
+      debugPrint('[health] weight permission check (unknown): $e');
+    }
+    if (granted) return true;
     if (!await asked()) {
       await request();
       // Only after the request ran: a throw/timeout leaves the ask unspent.
@@ -204,14 +234,26 @@ Future<bool> weightWritePermitted({
   }
 }
 
+class _ScaleDevice {
+  _ScaleDevice(this.id, this.adapter, this.raw);
+  final String id;
+  final String adapter;
+  final Map<int, num> raw;
+}
+
 /// Export every flagged-on scale's pending weighings. Best-effort; never
 /// throws. [reset] clears the exported sets (re-sends everything,
 /// idempotently). [permitted] is consulted lazily, only when something is
-/// pending. The loaders default to [LocalDb]; tests inject their own.
+/// pending. [syncEnabled] / [isEnabled] are re-checked before every weighing
+/// (opt-out mid-drain). [weightGranted] (null = unknown) feeds the grant
+/// transition that clears the attempt caps. The loaders default to [LocalDb];
+/// tests inject their own.
 Future<int> exportScaleWeighings({
   required Future<bool> Function(DateTime start, DateTime end) deleteOwn,
   required Future<bool> Function(double kg, DateTime at) write,
   Future<bool> Function()? permitted,
+  Future<bool?> Function()? weightGranted,
+  Future<bool> Function()? syncEnabled,
   bool Function()? stopped,
   bool reset = false,
   bool forceRetry = false,
@@ -223,68 +265,139 @@ Future<int> exportScaleWeighings({
   var total = 0;
   try {
     final prefs = await SharedPreferences.getInstance();
-    var permChecked = false;
-    var permOk = true;
+    final enabledFn = isEnabled ?? wearableEnabled;
+    final devices = <_ScaleDevice>[];
     for (final row in await (loadDevices ?? LocalDb.deviceRows)()) {
       final adapter = row['adapter_id'] as String?;
       final id = row['id'] as String?;
       if (id == null) continue;
-      if (reset) {
-        await prefs.remove(healthWeightExportedKey(id));
-        await prefs.remove(healthWeightAttemptsKey(id));
-        await (deleteCursor ?? LocalDb.deleteCursor)(
-          healthWeightCursorName(id),
-        );
-      }
-      if (adapter == null ||
-          categoryOf(adapter) != DeviceCategory.healthMeasurement ||
-          !await (isEnabled ?? wearableEnabled)(adapter)) {
-        continue;
-      }
-      if (forceRetry && !reset) {
-        await prefs.remove(healthWeightAttemptsKey(id));
+      try {
+        if (reset) {
+          await prefs.remove(healthWeightExportedKey(id));
+          await prefs.remove(healthWeightAttemptsKey(id));
+          await (deleteCursor ?? LocalDb.deleteCursor)(
+            healthWeightCursorName(id),
+          );
+        }
+        if (adapter == null ||
+            categoryOf(adapter) != DeviceCategory.healthMeasurement ||
+            !await enabledFn(adapter)) {
+          continue;
+        }
+        if (forceRetry && !reset) {
+          await prefs.remove(healthWeightAttemptsKey(id));
+        }
+        final raw =
+            await (loadWeights ??
+                (d) => LocalDb.deviceObservationValues(d, 'weight'))(id);
+        devices.add(_ScaleDevice(id, adapter, raw));
+      } catch (e) {
+        debugPrint('[health] weighings load $id: $e');
       }
-      final exported = _decodeSet(prefs.getString(healthWeightExportedKey(id)));
-      final attempts = _decodeAttempts(
-        prefs.getString(healthWeightAttemptsKey(id)),
-      );
-      final raw = await (loadWeights ??
-          (d) => LocalDb.deviceObservationValues(d, 'weight'))(id);
-      // A full set means older entries were trimmed: do not resurrect them.
-      final floor = exported.length >= kMaxExportedWeighings
-          ? exported.reduce((a, b) => a < b ? a : b)
-          : 0;
-      final pending = [
-        for (final w in exportableWeighings(raw, exported: exported))
-          if (w.atMs >= floor && (attempts[w.atMs] ?? 0) < kMaxWeightAttempts)
-            w,
-      ];
-      if (pending.isEmpty) continue;
-      if (!permChecked) {
-        permChecked = true;
-        permOk = permitted == null || await permitted();
+    }
+
+    // Every scale's instants: a delete by time range must not take another
+    // weighing's sample with it.
+    bool deleteSafeFor(String id, int atMs) {
+      for (final d in devices) {
+        for (final ts in d.raw.keys) {
+          if (d.id == id && ts == atMs) continue;
+          if ((ts - atMs).abs() <= kHealthWeightMatchWindow.inMilliseconds) {
+            return false;
+          }
+        }
       }
-      if (!permOk) continue;
-      total += await writeWeighings(
-        weighings: pending,
-        exported: exported,
-        attempts: attempts,
-        save: () async {
+      return true;
+    }
+
+    var permChecked = false;
+    var permOk = true;
+    var grantEvaluated = false;
+    var grantTransitioned = false;
+    var budget = kMaxWeighingsPerRun;
+    var syncOff = false;
+    for (final d in devices) {
+      if (syncOff || budget <= 0) break;
+      try {
+        final id = d.id;
+        final exported = _decodeSet(
+          prefs.getString(healthWeightExportedKey(id)),
+        );
+        final attempts = _decodeAttempts(
+          prefs.getString(healthWeightAttemptsKey(id)),
+        );
+        Future<void> save() async {
           await prefs.setString(
             healthWeightExportedKey(id),
             jsonEncode(_bounded(exported)),
           );
           await prefs.setString(
             healthWeightAttemptsKey(id),
-            jsonEncode({
-              for (final e in attempts.entries) '${e.key}': e.value,
-            }),
+            jsonEncode({for (final e in attempts.entries) '${e.key}': e.value}),
           );
-        },
-        deleteOwn: deleteOwn,
-        write: write,
-        stopped: stopped,
-      );
+        }
+
+        // Attempt entries for weighings that no longer exist are dead weight.
+        final before = attempts.length;
+        attempts.removeWhere((ts, _) => !d.raw.containsKey(ts));
+        var attemptsDirty = attempts.length != before;
+        // Not-granted/unknown -> granted: capped weighings get a fresh chance.
+        if (attempts.isNotEmpty && weightGranted != null) {
+          if (!grantEvaluated) {
+            grantEvaluated = true;
+            final now = await weightGranted() == true;
+            final seen = prefs.getBool(kHealthWeightGrantSeenPref) == true;
+            grantTransitioned = now && !seen;
+            if (now != seen) {
+              await prefs.setBool(kHealthWeightGrantSeenPref, now);
+            }
+          }
+          if (grantTransitioned) {
+            attempts.clear();
+            attemptsDirty = true;
+          }
+        }
+        if (attemptsDirty) await save();
+
+        // A full set means older entries were trimmed: do not resurrect them
+        // (a failed one still under the cap is pending, not trimmed).
+        final floor = exported.length >= kMaxExportedWeighings
+            ? exported.reduce((a, b) => a < b ? a : b)
+            : 0;
+        final pending = [
+          for (final w in exportableWeighings(d.raw, exported: exported))
+            if ((attempts[w.atMs] ?? 0) < kMaxWeightAttempts &&
+                (w.atMs >= floor || attempts.containsKey(w.atMs)))
+              w,
+        ].take(budget).toList();
+        if (pending.isEmpty) continue;
+        budget -= pending.length;
+        if (!permChecked) {
+          permChecked = true;
+          permOk = permitted == null || await permitted();
+        }
+        if (!permOk) continue;
+        total += await writeWeighings(
+          weighings: pending,
+          exported: exported,
+          attempts: attempts,
+          save: save,
+          deleteOwn: deleteOwn,
+          write: write,
+          stopped: stopped,
+          resend: reset,
+          deleteSafe: (ts) => deleteSafeFor(id, ts),
+          mayContinue: () async {
+            if (syncEnabled != null && !await syncEnabled()) {
+              syncOff = true;
+              return false;
+            }
+            return await enabledFn(d.adapter);
+          },
+        );
+      } catch (e) {
+        debugPrint('[health] weighings export ${d.id}: $e');
+      }
     }
   } catch (e) {
     debugPrint('[health] exportScaleWeighings: $e');
diff --git a/test/health_weight_export_test.dart b/test/health_weight_export_test.dart
index eeec46d1b..e238a7672 100644
--- a/test/health_weight_export_test.dart
+++ b/test/health_weight_export_test.dart
@@ -16,26 +16,46 @@ class _Fx {
   var perm = true;
   var permCalls = 0;
   final deletedCursors = <String>[];
+  final writeCalls = <int>[]; // every write attempt, failed or not
+  final deletes = <int>[]; // window starts (ms) passed to deleteOwn
+  Future<bool> Function()? syncEnabled;
+  Future<bool> Function(String)? enabledFn;
+  Future<bool?> Function()? granted;
+  Future<Map<int, num>> Function(String)? loader;
+  Future<void> Function(double, DateTime)? onWrite;
 
-  Future<int> run({bool reset = false, bool Function()? stopped}) =>
-      exportScaleWeighings(
-        reset: reset,
-        stopped: stopped,
-        loadDevices: () async => devices,
-        isEnabled: (_) async => enabled,
-        loadWeights: (_) async => weights,
-        deleteCursor: (n) async => deletedCursors.add(n),
-        permitted: () async {
-          permCalls++;
-          return perm;
-        },
-        deleteOwn: (s, e) async => true,
-        write: (kg, at) async {
-          if (failAt.contains(at.millisecondsSinceEpoch)) return false;
-          writes.add(at.millisecondsSinceEpoch);
-          return true;
-        },
+  Future<int> run({
+    bool reset = false,
+    bool forceRetry = false,
+    bool Function()? stopped,
+  }) => exportScaleWeighings(
+    reset: reset,
+    forceRetry: forceRetry,
+    stopped: stopped,
+    syncEnabled: syncEnabled,
+    weightGranted: granted,
+    loadDevices: () async => devices,
+    isEnabled: enabledFn ?? (_) async => enabled,
+    loadWeights: loader ?? (_) async => weights,
+    deleteCursor: (n) async => deletedCursors.add(n),
+    permitted: () async {
+      permCalls++;
+      return perm;
+    },
+    deleteOwn: (s, e) async {
+      deletes.add(
+        s.millisecondsSinceEpoch + kHealthWeightMatchWindow.inMilliseconds,
       );
+      return true;
+    },
+    write: (kg, at) async {
+      writeCalls.add(at.millisecondsSinceEpoch);
+      await onWrite?.call(kg, at);
+      if (failAt.contains(at.millisecondsSinceEpoch)) return false;
+      writes.add(at.millisecondsSinceEpoch);
+      return true;
+    },
+  );
 }
 
 void main() {
@@ -90,11 +110,7 @@ void main() {
     });
 
     test('lone outlier amid the chain is dropped', () {
-      final out = exportableWeighings({
-        1000: 70.0,
-        2000: 120.0,
-        3000: 71.0,
-      });
+      final out = exportableWeighings({1000: 70.0, 2000: 120.0, 3000: 71.0});
       expect(out.map((w) => w.atMs), [1000, 3000]);
     });
 
@@ -120,11 +136,10 @@ void main() {
     });
 
     test('exported ones are filtered but still anchor the chain', () {
-      final out = exportableWeighings({
-        1000: 70.0,
-        2000: 100.0,
-        3000: 71.0,
-      }, exported: {1000});
+      final out = exportableWeighings(
+        {1000: 70.0, 2000: 100.0, 3000: 71.0},
+        exported: {1000},
+      );
       expect(out.map((w) => w.atMs), [3000]);
     });
   });
@@ -175,10 +190,12 @@ void main() {
       for (var i = 0; i < kMaxWeightAttempts + 3; i++) {
         await f.run();
       }
-      // 1 attempt above + enough to hit the cap; then no more tries.
+      // Tried exactly kMaxWeightAttempts times, then suppressed.
+      expect(f.writeCalls.where((t) => t == 2000).length, kMaxWeightAttempts);
       f.failAt.clear();
       expect(await f.run(), 0);
       expect(f.writes, [1000, 3000]);
+      expect(f.writeCalls.where((t) => t == 2000).length, kMaxWeightAttempts);
     });
 
     test('failure below the cap is retried and succeeds', () async {
@@ -210,6 +227,7 @@ void main() {
         ..weights = {1000: 70, 2000: 71}
         ..failAt.addAll({1000, 2000});
       var hung = false;
+      final calls = <int>[];
       final n = await exportScaleWeighings(
         loadDevices: () async => f.devices,
         isEnabled: (_) async => true,
@@ -218,17 +236,168 @@ void main() {
         stopped: () => hung,
         deleteOwn: (s, e) async => true,
         write: (kg, at) async {
+          calls.add(at.millisecondsSinceEpoch);
           hung = true;
           return false;
         },
       );
       expect(n, 0);
+      expect(calls, [1000]);
+      final prefs = await SharedPreferences.getInstance();
+      final att = prefs.getString(healthWeightAttemptsKey('d1'));
+      expect(att == null || !att.contains('"1000"'), isTrue, reason: '$att');
       f.failAt.clear();
       expect(await f.run(), 2);
     });
+
+    test('opt-out mid-drain: sync off stops everything', () async {
+      final f = _Fx()..weights = {1000: 70, 2000: 71, 3000: 72};
+      f.syncEnabled = () async => f.writeCalls.isEmpty;
+      expect(await f.run(), 1);
+      expect(f.writeCalls, [1000]);
+    });
+
+    test('opt-out mid-drain: device flag off stops that device', () async {
+      final f = _Fx()
+        ..devices = [
+          {'id': 'd1', 'adapter_id': 'thermometer'},
+          {'id': 'd2', 'adapter_id': 'thermometer'},
+        ]
+        ..loader = ((id) async =>
+            id == 'd1' ? {1000: 70, 2000: 71} : {9000: 70});
+      f.enabledFn = (_) async => f.writeCalls.isEmpty;
+      // Flag flips off after the first write; d2 shares the adapter flag.
+      expect(await f.run(), 1);
+      expect(f.writeCalls, [1000]);
+    });
+
+    test('one throwing device does not end the others', () async {
+      final f = _Fx()
+        ..devices = [
+          {'id': 'd1', 'adapter_id': 'thermometer'},
+          {'id': 'd2', 'adapter_id': 'thermometer'},
+        ]
+        ..loader = ((id) async =>
+            id == 'd1' ? throw StateError('boom') : {5000: 70});
+      expect(await f.run(), 1);
+      expect(f.writes, [5000]);
+    });
+
+    test('exported floor does not swallow a failed pending weighing', () async {
+      final f = _Fx()..weights = {100: 70, 200: 70};
+      SharedPreferences.setMockInitialValues({
+        healthWeightExportedKey('d1'): [
+          for (var i = 0; i < kMaxExportedWeighings; i++) 10000 + i,
+        ].toString(),
+        healthWeightAttemptsKey('d1'): '{"100":2}',
+      });
+      // 100 is below the floor but failed before: retried. 200 is below the
+      // floor with no attempt record: treated as trimmed, not resurrected.
+      await f.run();
+      expect(f.writes, [100]);
+    });
+
+    test('attempt entries for vanished weighings are pruned', () async {
+      SharedPreferences.setMockInitialValues({
+        healthWeightAttemptsKey('d1'): '{"100":2,"1000":3}',
+      });
+      final f = _Fx()..weights = {1000: 70};
+      f.failAt.add(1000);
+      await f.run();
+      final prefs = await SharedPreferences.getInstance();
+      expect(prefs.getString(healthWeightAttemptsKey('d1')), '{"1000":4}');
+    });
+
+    test(
+      'grant transition clears the caps; no transition keeps them',
+      () async {
+        final f = _Fx()
+          ..weights = {1000: 70}
+          ..failAt.add(1000);
+        for (var i = 0; i < kMaxWeightAttempts; i++) {
+          await f.run();
+        }
+        expect(f.writeCalls.length, kMaxWeightAttempts);
+        f.failAt.clear();
+        f.granted = () async => false;
+        expect(await f.run(), 0); // still capped
+        f.granted = () async => null;
+        expect(await f.run(), 0);
+        f.granted = () async => true;
+        expect(await f.run(), 1); // not-granted -> granted: retried
+        expect(f.writes, [1000]);
+      },
+    );
+
+    test('forceRetry clears the caps', () async {
+      final f = _Fx()
+        ..weights = {1000: 70}
+        ..failAt.add(1000);
+      for (var i = 0; i < kMaxWeightAttempts; i++) {
+        await f.run();
+      }
+      f.failAt.clear();
+      expect(await f.run(), 0);
+      expect(await f.run(forceRetry: true), 1);
+    });
+
+    test('per-run cap: the rest stays pending for the next drain', () async {
+      final f = _Fx()
+        ..weights = {
+          for (var i = 0; i < kMaxWeighingsPerRun + 5; i++)
+            10000 + i * 1000: 70,
+        };
+      expect(await f.run(), kMaxWeighingsPerRun);
+      expect(await f.run(), 5);
+      expect(await f.run(), 0);
+    });
+  });
+
+  group('delete safety', () {
+    test(
+      'normal run never deletes; reset deletes only a safe instant',
+      () async {
+        final f = _Fx()..weights = {1000: 70, 5000: 70};
+        await f.run();
+        expect(f.deletes, isEmpty);
+        await f.run(reset: true);
+        expect(f.deletes, [1000, 5000]);
+      },
+    );
+
+    test(
+      'reset does not delete when another scale sample is in the window',
+      () async {
+        final f = _Fx()
+          ..devices = [
+            {'id': 'd1', 'adapter_id': 'thermometer'},
+            {'id': 'd2', 'adapter_id': 'thermometer'},
+          ]
+          ..loader = ((id) async =>
+              id == 'd1' ? {1000: 70, 5000: 70} : {1300: 71});
+        await f.run(reset: true);
+        // 1000 and 1300 are 300 ms apart: neither is deleted; 5000 is.
+        expect(f.deletes, [5000]);
+        expect(f.writes.toSet(), {1000, 1300, 5000});
+      },
+    );
   });
 
   group('weightWritePermitted', () {
+    test('a throwing check is UNKNOWN: still asks once and writes', () async {
+      var asked = false;
+      var requests = 0;
+      Future<bool> go() => weightWritePermitted(
+        check: () async => throw StateError('timeout'),
+        request: () async => requests++,
+        asked: () async => asked,
+        markAsked: () async => asked = true,
+      );
+      expect(await go(), isTrue);
+      expect(await go(), isTrue);
+      expect(requests, 1);
+    });
+
     test('asks at most once per install', () async {
       var asked = false;
       var requests = 0;

From 248f307da616d436de103962ec90c0b4b876fa9d Mon Sep 17 00:00:00 2001
From: David Riedel <48388362+Riedel-David@users.noreply.github.com>
Date: Wed, 4 Nov 2026 11:24:33 +0200
Subject: [PATCH 06/12] Health weight export: do not cap a reset re-send

---
 lib/health/health_weight_export.dart |  4 +++-
 test/health_weight_export_test.dart  | 10 ++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
index 261d4eb99..b40b0cde3 100644
--- a/lib/health/health_weight_export.dart
+++ b/lib/health/health_weight_export.dart
@@ -314,7 +314,9 @@ Future<int> exportScaleWeighings({
     var permOk = true;
     var grantEvaluated = false;
     var grantTransitioned = false;
-    var budget = kMaxWeighingsPerRun;
+    // A reset re-sends with delete-then-write; a cap would leave the rest to
+    // later plain writes that stack duplicates on the samples still in Health.
+    var budget = reset ? 1 << 30 : kMaxWeighingsPerRun;
     var syncOff = false;
     for (final d in devices) {
       if (syncOff || budget <= 0) break;
diff --git a/test/health_weight_export_test.dart b/test/health_weight_export_test.dart
index e238a7672..1e330e06c 100644
--- a/test/health_weight_export_test.dart
+++ b/test/health_weight_export_test.dart
@@ -351,6 +351,16 @@ void main() {
       expect(await f.run(), 5);
       expect(await f.run(), 0);
     });
+
+    test('a reset is not capped: every weighing gets delete-then-write', () async {
+      final f = _Fx()
+        ..weights = {
+          for (var i = 0; i < kMaxWeighingsPerRun + 5; i++)
+            10000 + i * 1000: 70,
+        };
+      expect(await f.run(), kMaxWeighingsPerRun);
+      expect(await f.run(reset: true), kMaxWeighingsPerRun + 5);
+    });
   });
 
   group('delete safety', () {

From 5a3626bbd95b26453f30afecb0de76306173f8e3 Mon Sep 17 00:00:00 2001
From: Mohammad Abdul Sahil <127765312+abdulsaheel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 01:32:01 +0530
Subject: [PATCH 07/12] weight export: reuse weighingChain so export and trend
 agree

---
 lib/health/health_weight_export.dart | 38 ++++++----------------------
 1 file changed, 8 insertions(+), 30 deletions(-)

diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
index b40b0cde3..b55b84e42 100644
--- a/lib/health/health_weight_export.dart
+++ b/lib/health/health_weight_export.dart
@@ -42,7 +42,7 @@ import 'package:shared_preferences/shared_preferences.dart';
 import '../ble/adapters/_registry.dart' show DeviceCategory, categoryOf;
 import '../ble/adapters/miscale.dart' show kWeightMaxKg, kWeightMinKg;
 import '../compute/inputs/canonical.dart' show wearableEnabled;
-import '../compute/inputs/measurement_inputs.dart' show nearWeight;
+import '../compute/inputs/measurement_inputs.dart' show weighingChain;
 import '../data/db.dart';
 
 /// Per-device persisted set (JSON list) of exported weighing ts_ms.
@@ -86,40 +86,18 @@ typedef Weighing = ({int atMs, double kg});
 /// Skips non-finite and out-of-bounds values, then applies the chained
 /// household band over ALL plausible weighings (so the chain does not depend
 /// on what was exported before), re-seeding after 3 consecutive mutually-near
-/// rejects so a guest seed or a lasting weight change recovers. Never substitutes a value.
+/// rejects so a guest seed or a lasting weight change recovers (the same
+/// [weighingChain] the trend uses). Never substitutes a value.
 @visibleForTesting
 List<Weighing> exportableWeighings(
   Map<int, num> raw, {
   Set<int> exported = const {},
 }) {
-  final sorted =
-      <Weighing>[
-        for (final e in raw.entries)
-          if (e.value.isFinite &&
-              e.value >= kWeightMinKg &&
-              e.value <= kWeightMaxKg)
-            (atMs: e.key, kg: e.value.toDouble()),
-      ]..sort((a, b) {
-        final c = a.atMs.compareTo(b.atMs);
-        return c != 0 ? c : a.kg.compareTo(b.kg);
-      });
-  // Chained band with RE-SEED: a run of 3 consecutive rejected weighings, each
-  // near the previous run member, is accepted retroactively and its last
-  // member becomes the anchor (mirrors weighingChain in measurement_inputs).
-  final chain = <Weighing>[];
-  var run = <Weighing>[];
-  for (final w in sorted) {
-    if (chain.isEmpty || nearWeight(w.kg, chain.last.kg)) {
-      chain.add(w);
-      run = [];
-      continue;
-    }
-    run = run.isNotEmpty && nearWeight(w.kg, run.last.kg) ? [...run, w] : [w];
-    if (run.length >= 3) {
-      chain.addAll(run);
-      run = [];
-    }
-  }
+  final chain = weighingChain([
+    for (final e in raw.entries)
+      if (e.value.isFinite && e.value >= kWeightMinKg && e.value <= kWeightMaxKg)
+        (atMs: e.key, kg: e.value.toDouble()),
+  ]);
   return [
     for (final w in chain)
       if (!exported.contains(w.atMs)) w,

From c22446cf34d17f52403186d00dfb3599e69030c1 Mon Sep 17 00:00:00 2001
From: Mohammad Abdul Sahil <127765312+abdulsaheel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 06:55:12 +0530
Subject: [PATCH 08/12] weight export: keep exported state on reset, clear
 timed-out write before retry

---
 lib/health/health_export.dart        | 22 +++++++++++++++++++++-
 lib/health/health_weight_export.dart | 25 +++++++++++++++++--------
 test/health_weight_export_test.dart  | 20 ++++++++++++++++++++
 3 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/lib/health/health_export.dart b/lib/health/health_export.dart
index 81fcbd5d5..8fbb060a8 100644
--- a/lib/health/health_export.dart
+++ b/lib/health/health_export.dart
@@ -497,6 +497,10 @@ class HealthExporter {
   /// Cleared at the start of every [_workoutLock] hold.
   bool _storeHung = false;
 
+  /// Weighing instants whose native write timed out (it may still land).
+  /// The next write of the same instant deletes our sample there first.
+  final _timedOutWeightWrites = <int>{};
+
   /// Native deletes still running. [Future.timeout] doesn't cancel the
   /// plugin call, so a delete that timed out can still land after a later
   /// pass wrote into its range and take those samples with it.
@@ -1259,7 +1263,20 @@ class HealthExporter {
           deleteOwn: (a, b) => _deleteOwnSamples(HealthDataType.WEIGHT, a, b),
           write: (kg, at) async {
             if (_storeHung) return false;
+            final key = at.millisecondsSinceEpoch;
             try {
+              // An earlier write of this instant timed out and may have
+              // landed: clear it first so the retry cannot duplicate it.
+              if (_timedOutWeightWrites.contains(key)) {
+                if (!await _deleteOwnSamples(
+                  HealthDataType.WEIGHT,
+                  at.subtract(kHealthWeightMatchWindow),
+                  at.add(kHealthWeightMatchWindow),
+                )) {
+                  return false;
+                }
+                _timedOutWeightWrites.remove(key);
+              }
               return await _health
                   .writeHealthData(
                     value: kg,
@@ -1270,7 +1287,10 @@ class HealthExporter {
                   )
                   .timeout(_deleteTimeout);
             } catch (e) {
-              if (e is TimeoutException) _storeHung = true;
+              if (e is TimeoutException) {
+                _storeHung = true;
+                _timedOutWeightWrites.add(key);
+              }
               debugPrint('[health] write WEIGHT: $e');
               return false;
             }
diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
index b55b84e42..c3905ad4b 100644
--- a/lib/health/health_weight_export.dart
+++ b/lib/health/health_weight_export.dart
@@ -157,6 +157,13 @@ Future<int> writeWeighings({
     if (mayContinue != null && !await mayContinue()) break;
     if ((attempts[w.atMs] ?? 0) >= kMaxWeightAttempts) continue;
     final at = DateTime.fromMillisecondsSinceEpoch(w.atMs);
+    // Already in Health and the delete would take a neighbour's sample too:
+    // keep what is there rather than stack a duplicate.
+    if (resend &&
+        exported.contains(w.atMs) &&
+        !(deleteSafe?.call(w.atMs) ?? true)) {
+      continue;
+    }
     var ok = true;
     if (resend && (deleteSafe?.call(w.atMs) ?? true)) {
       // A delete that cannot clear the instant must not be written on top of.
@@ -250,18 +257,20 @@ Future<int> exportScaleWeighings({
       final id = row['id'] as String?;
       if (id == null) continue;
       try {
+        if (adapter == null ||
+            categoryOf(adapter) != DeviceCategory.healthMeasurement ||
+            !await enabledFn(adapter)) {
+          continue;
+        }
+        // The exported set is kept on reset (a disabled scale keeps its state,
+        // and an unsafe resend keeps its mark); only attempts and the old
+        // cursor are cleared.
         if (reset) {
-          await prefs.remove(healthWeightExportedKey(id));
           await prefs.remove(healthWeightAttemptsKey(id));
           await (deleteCursor ?? LocalDb.deleteCursor)(
             healthWeightCursorName(id),
           );
         }
-        if (adapter == null ||
-            categoryOf(adapter) != DeviceCategory.healthMeasurement ||
-            !await enabledFn(adapter)) {
-          continue;
-        }
         if (forceRetry && !reset) {
           await prefs.remove(healthWeightAttemptsKey(id));
         }
@@ -341,11 +350,11 @@ Future<int> exportScaleWeighings({
 
         // A full set means older entries were trimmed: do not resurrect them
         // (a failed one still under the cap is pending, not trimmed).
-        final floor = exported.length >= kMaxExportedWeighings
+        final floor = !reset && exported.length >= kMaxExportedWeighings
             ? exported.reduce((a, b) => a < b ? a : b)
             : 0;
         final pending = [
-          for (final w in exportableWeighings(d.raw, exported: exported))
+          for (final w in exportableWeighings(d.raw, exported: reset ? const {} : exported))
             if ((attempts[w.atMs] ?? 0) < kMaxWeightAttempts &&
                 (w.atMs >= floor || attempts.containsKey(w.atMs)))
               w,
diff --git a/test/health_weight_export_test.dart b/test/health_weight_export_test.dart
index 1e330e06c..0e6a0720d 100644
--- a/test/health_weight_export_test.dart
+++ b/test/health_weight_export_test.dart
@@ -393,6 +393,26 @@ void main() {
     );
   });
 
+  group('reset keeps state it did not replace', () {
+    test('two exported weighings within the window are not re-sent', () async {
+      final f = _Fx()..weights = {1000: 70, 1300: 70};
+      expect(await f.run(), 2);
+      expect(await f.run(reset: true), 0);
+      expect(f.writes, [1000, 1300]);
+      expect(await f.run(), 0); // still marked exported
+    });
+
+    test('a disabled scale keeps its exported set across a reset', () async {
+      final f = _Fx()..weights = {1000: 70};
+      await f.run();
+      f.enabled = false;
+      await f.run(reset: true);
+      f.enabled = true;
+      expect(await f.run(), 0);
+      expect(f.writes, [1000]);
+    });
+  });
+
   group('weightWritePermitted', () {
     test('a throwing check is UNKNOWN: still asks once and writes', () async {
       var asked = false;

From 119e1aaf890dc3e573bc4bff311489120de52796 Mon Sep 17 00:00:00 2001
From: abdulsaheel <abdulsaheel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 10:50:37 +0530
Subject: [PATCH 09/12] weight export: timed-out writes survive a restart and
 never delete a neighbour, a failed reset rewrite stays pending

a write that timed out may have landed. the instant is now stored per scale and cleared before the retry, only when no other weighing sits inside the match window. when a reset deleted our sample and the replacement failed, the weighing was still marked exported and stayed missing from health until the next reset; it is pending again now.
---
 lib/health/health_export.dart        | 24 +++----------
 lib/health/health_weight_export.dart | 52 ++++++++++++++++++++++++---
 test/health_weight_export_test.dart  | 54 ++++++++++++++++++++++++++++
 3 files changed, 107 insertions(+), 23 deletions(-)

diff --git a/lib/health/health_export.dart b/lib/health/health_export.dart
index 4f452df97..dadc66702 100644
--- a/lib/health/health_export.dart
+++ b/lib/health/health_export.dart
@@ -498,10 +498,6 @@ class HealthExporter {
   /// Cleared at the start of every [_workoutLock] hold.
   bool _storeHung = false;
 
-  /// Weighing instants whose native write timed out (it may still land).
-  /// The next write of the same instant deletes our sample there first.
-  final _timedOutWeightWrites = <int>{};
-
   /// Native deletes still running. [Future.timeout] doesn't cancel the
   /// plugin call, so a delete that timed out can still land after a later
   /// pass wrote into its range and take those samples with it.
@@ -1264,20 +1260,10 @@ class HealthExporter {
           deleteOwn: (a, b) => _deleteOwnSamples(HealthDataType.WEIGHT, a, b),
           write: (kg, at) async {
             if (_storeHung) return false;
-            final key = at.millisecondsSinceEpoch;
             try {
-              // An earlier write of this instant timed out and may have
-              // landed: clear it first so the retry cannot duplicate it.
-              if (_timedOutWeightWrites.contains(key)) {
-                if (!await _deleteOwnSamples(
-                  HealthDataType.WEIGHT,
-                  at.subtract(kHealthWeightMatchWindow),
-                  at.add(kHealthWeightMatchWindow),
-                )) {
-                  return false;
-                }
-                _timedOutWeightWrites.remove(key);
-              }
+              // A timeout is rethrown: the weighing export records the instant
+              // as possibly written (persisted) and clears it, safely, before
+              // the retry.
               return await _health
                   .writeHealthData(
                     value: kg,
@@ -1288,11 +1274,11 @@ class HealthExporter {
                   )
                   .timeout(_deleteTimeout);
             } catch (e) {
+              debugPrint('[health] write WEIGHT: $e');
               if (e is TimeoutException) {
                 _storeHung = true;
-                _timedOutWeightWrites.add(key);
+                rethrow;
               }
-              debugPrint('[health] write WEIGHT: $e');
               return false;
             }
           },
diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
index c3905ad4b..3d53658b1 100644
--- a/lib/health/health_weight_export.dart
+++ b/lib/health/health_weight_export.dart
@@ -34,6 +34,7 @@
 // the scale's device id), so a weight read from the store has no row to export.
 // observation_isolation_test keeps raw table access inside db.dart, so the
 // source_kind column is not filtered here.
+import 'dart:async' show TimeoutException;
 import 'dart:convert';
 
 import 'package:flutter/foundation.dart';
@@ -53,6 +54,12 @@ String healthWeightExportedKey(String deviceId) =>
 String healthWeightAttemptsKey(String deviceId) =>
     'health_weight_attempts:$deviceId';
 
+/// Per-device persisted set (JSON list) of weighing instants whose native
+/// write timed out and may still have landed. Kept across restarts so a retry
+/// clears our sample there first instead of stacking a duplicate.
+String healthWeightMaybeLandedKey(String deviceId) =>
+    'health_weight_maybe_landed:$deviceId';
+
 /// Superseded high-water cursor (LocalDb cursor). Never read any more; only
 /// cleared on reset.
 String healthWeightCursorName(String deviceId) =>
@@ -137,7 +144,13 @@ List<int> _bounded(Set<int> s) {
 /// [stopped] (store hung) ends the run without counting the failure that
 /// tripped it. [mayContinue] is asked before EACH weighing; false ends the run
 /// (opt-out mid-drain). With [resend] our own sample at the instant is deleted
-/// first, unless [deleteSafe] says another sample shares the window.
+/// first, unless [deleteSafe] says another sample shares the window. A delete
+/// that succeeds but whose write then fails takes the instant out of
+/// [exported], so it is pending again rather than recorded as in Health.
+/// A [write] that throws [TimeoutException] may have landed: the instant goes
+/// into [maybeLanded] and the next attempt clears our sample there first, but
+/// only when [deleteSafe] allows it (otherwise it is left and retried, bounded
+/// by the attempt cap, never deleting a neighbour's sample).
 /// Returns how many were written.
 Future<int> writeWeighings({
   required List<Weighing> weighings,
@@ -150,8 +163,10 @@ Future<int> writeWeighings({
   Future<bool> Function()? mayContinue,
   bool resend = false,
   bool Function(int atMs)? deleteSafe,
+  Set<int>? maybeLanded,
 }) async {
   var written = 0;
+  final landed = maybeLanded ?? <int>{};
   for (final w in weighings) {
     if (stopped?.call() ?? false) break;
     if (mayContinue != null && !await mayContinue()) break;
@@ -165,20 +180,41 @@ Future<int> writeWeighings({
       continue;
     }
     var ok = true;
-    if (resend && (deleteSafe?.call(w.atMs) ?? true)) {
+    var deleted = false;
+    final safe = deleteSafe?.call(w.atMs) ?? true;
+    if ((resend || landed.contains(w.atMs)) && safe) {
       // A delete that cannot clear the instant must not be written on top of.
       ok = await deleteOwn(
         at.subtract(kHealthWeightMatchWindow),
         at.add(kHealthWeightMatchWindow),
       );
+      deleted = ok;
+      if (ok) landed.remove(w.atMs);
+    } else if (landed.contains(w.atMs)) {
+      // A possible survivor of a timed-out write, and the delete would take a
+      // neighbour's sample too: leave it and retry later.
+      ok = false;
+    }
+    if (ok) {
+      try {
+        ok = await write(w.kg, at);
+      } on TimeoutException {
+        ok = false;
+        landed.add(w.atMs);
+      }
     }
-    if (ok) ok = await write(w.kg, at);
     if (ok) {
       written++;
       exported.add(w.atMs);
       attempts.remove(w.atMs);
     } else {
-      if (stopped?.call() ?? false) break;
+      // Our sample was deleted and the replacement did not go in: it is no
+      // longer in Health, so it must not stay marked as exported.
+      if (deleted) exported.remove(w.atMs);
+      if (stopped?.call() ?? false) {
+        await save();
+        break;
+      }
       attempts[w.atMs] = (attempts[w.atMs] ?? 0) + 1;
     }
     await save();
@@ -315,7 +351,14 @@ Future<int> exportScaleWeighings({
         final attempts = _decodeAttempts(
           prefs.getString(healthWeightAttemptsKey(id)),
         );
+        final maybeLanded = _decodeSet(
+          prefs.getString(healthWeightMaybeLandedKey(id)),
+        );
         Future<void> save() async {
+          await prefs.setString(
+            healthWeightMaybeLandedKey(id),
+            jsonEncode(_bounded(maybeLanded)),
+          );
           await prefs.setString(
             healthWeightExportedKey(id),
             jsonEncode(_bounded(exported)),
@@ -376,6 +419,7 @@ Future<int> exportScaleWeighings({
           stopped: stopped,
           resend: reset,
           deleteSafe: (ts) => deleteSafeFor(id, ts),
+          maybeLanded: maybeLanded,
           mayContinue: () async {
             if (syncEnabled != null && !await syncEnabled()) {
               syncOff = true;
diff --git a/test/health_weight_export_test.dart b/test/health_weight_export_test.dart
index 0e6a0720d..ff5595963 100644
--- a/test/health_weight_export_test.dart
+++ b/test/health_weight_export_test.dart
@@ -1,3 +1,5 @@
+import 'dart:async';
+
 import 'package:flutter_test/flutter_test.dart';
 import 'package:health/health.dart';
 import 'package:openstrap_edge/health/health_export.dart'
@@ -393,6 +395,58 @@ void main() {
     );
   });
 
+  group('timed-out and half-done writes', () {
+    test('a write that timed out is cleared before the retry, across a restart',
+        () async {
+      final f = _Fx()
+        ..weights = {1000: 70}
+        ..onWrite = (_, _) async => throw TimeoutException('hung');
+      expect(await f.run(), 0);
+      expect(f.deletes, isEmpty);
+      // New exporter instance, same prefs: the marker was persisted.
+      final g = _Fx()..weights = {1000: 70};
+      expect(await g.run(forceRetry: true), 1);
+      expect(g.deletes, [1000]);
+      expect(g.writes, [1000]);
+      // Cleared once written: a later reset-free pass does not delete again.
+      final h = _Fx()..weights = {1000: 70, 5000: 71};
+      await h.run();
+      expect(h.deletes, isEmpty);
+    });
+
+    test('a timed-out instant never deletes a neighbour sample', () async {
+      final f = _Fx()
+        ..devices = [
+          {'id': 'd1', 'adapter_id': 'thermometer'},
+          {'id': 'd2', 'adapter_id': 'thermometer'},
+        ]
+        ..loader = ((id) async => id == 'd1' ? {1000: 70} : {1300: 71})
+        ..onWrite = (_, at) async {
+          if (at.millisecondsSinceEpoch == 1000) {
+            throw TimeoutException('hung');
+          }
+        };
+      await f.run();
+      f.onWrite = null;
+      await f.run(forceRetry: true);
+      expect(f.deletes, isEmpty);
+      expect(f.writes, isNot(contains(1000)));
+    });
+
+    test('reset: delete ok but write fails leaves it pending, not exported',
+        () async {
+      final f = _Fx()..weights = {1000: 70};
+      await f.run();
+      f.failAt.add(1000);
+      await f.run(reset: true);
+      expect(f.deletes, [1000]);
+      f.failAt.clear();
+      f.writes.clear();
+      expect(await f.run(forceRetry: true), 1);
+      expect(f.writes, [1000]);
+    });
+  });
+
   group('reset keeps state it did not replace', () {
     test('two exported weighings within the window are not re-sent', () async {
       final f = _Fx()..weights = {1000: 70, 1300: 70};

From 27bb66f54117320e4880b2cfd580742d49691508 Mon Sep 17 00:00:00 2001
From: abdulsaheel <abdulsaheel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 11:12:56 +0530
Subject: [PATCH 10/12] weight export: its prefs describe this phone's health
 store, so they stay out of backups

---
 lib/data/backup_extras.dart                | 25 ++++++++++++-
 test/backup/backup_support.dart            |  1 +
 test/backup/pref_types_guard_test.dart     | 11 +++++-
 test/backup/settings_audit_guard_test.dart | 43 +++++++++++++++++++---
 4 files changed, 73 insertions(+), 7 deletions(-)

diff --git a/lib/data/backup_extras.dart b/lib/data/backup_extras.dart
index 80f857027..675d93889 100644
--- a/lib/data/backup_extras.dart
+++ b/lib/data/backup_extras.dart
@@ -50,6 +50,24 @@ const Map<String, String> kPrefsNotBackedUp = {
   'alarm_probe_pending': 'legacy pending hardware probe; never resume on another band',
   'alarm_fired_at': 'last fire event from the old band, not the chosen schedule',
   'health_upload_last_ts': 'upload cursor for this installation',
+  'health_weight_perm_asked': 'records that this phone already asked for '
+      'WEIGHT write access; the new phone has not asked yet',
+  'health_weight_grant_seen': 'last WEIGHT grant observed on this phone; '
+      'the grant belongs to its Health store',
+};
+
+/// Per-item families that stay on the phone: (prefix, reason). Each describes
+/// what this phone's Health store holds, which a restore onto another phone
+/// cannot carry. Exported and attempt marks would claim samples that are not
+/// there, and a maybe-landed marker would clear a sample the new store never
+/// received.
+const Map<String, String> kPrefFamiliesNotBackedUp = {
+  'health_weight_exported:': 'weighings already written to this phone\'s '
+      'Health store; the new store is empty, so they must be sent again',
+  'health_weight_attempts:': 'failure counts against this phone\'s Health '
+      'store, not the new one',
+  'health_weight_maybe_landed:': 'writes that timed out on this phone\'s '
+      'Health store; the retry clears a sample only this store may hold',
 };
 
 const Map<String, String> kSecretsNotBackedUp = {
@@ -193,7 +211,12 @@ String? expectedPrefType(String key) {
   return null;
 }
 
-bool _backedUp(String key) => !kPrefsNotBackedUp.containsKey(key);
+bool _backedUp(String key) =>
+    !kPrefsNotBackedUp.containsKey(key) &&
+    !kPrefFamiliesNotBackedUp.keys.any(key.startsWith);
+
+/// Whether [key] travels in a backup (exact exclusions and families).
+bool prefBackedUp(String key) => _backedUp(key);
 
 (String, String)? _encode(Object? value) => switch (value) {
   bool b => ('bool', '$b'),
diff --git a/test/backup/backup_support.dart b/test/backup/backup_support.dart
index d7a112eb8..18c31b545 100644
--- a/test/backup/backup_support.dart
+++ b/test/backup/backup_support.dart
@@ -129,6 +129,7 @@ void expectNoSecretIn(String path, Iterable<String> secrets) {
 Map<String, String> policyMap(String name) => switch (name) {
   'kPrefsNotBackedUp' => kPrefsNotBackedUp,
   'kSecretsNotBackedUp' => kSecretsNotBackedUp,
+  'kPrefFamiliesNotBackedUp' => kPrefFamiliesNotBackedUp,
   _ => throw ArgumentError.value(name),
 };
 
diff --git a/test/backup/pref_types_guard_test.dart b/test/backup/pref_types_guard_test.dart
index 450206010..3e91815b9 100644
--- a/test/backup/pref_types_guard_test.dart
+++ b/test/backup/pref_types_guard_test.dart
@@ -34,6 +34,15 @@ const _dynamicReads = <String, List<String>>{
   'notification_ids.dart|slotKey|int': ['notif_osid:health:2026-09-21:x'],
   'notification_ids.dart|ownerKey|string': ['notif_osslot:health:3'],
   'notification_ids.dart|k|int': ['notif_osid:health:2026-09-21:x'],
+  'health_weight_export.dart|healthWeightExportedKey(id|string': [
+    'health_weight_exported:d1',
+  ],
+  'health_weight_export.dart|healthWeightAttemptsKey(id|string': [
+    'health_weight_attempts:d1',
+  ],
+  'health_weight_export.dart|healthWeightMaybeLandedKey(id|string': [
+    'health_weight_maybe_landed:d1',
+  ],
   'nudges.dart|_dismissedKey(a|bool': ['nudge.pairing.dismissed'],
   'nudges.dart|_lastShownKey(a|int': ['nudge.pairing.last_shown_ms'],
   // The typed wrappers; each caller passes a literal or a const that is
@@ -150,7 +159,7 @@ void main() {
   test('every backed-up key that is read has its type in the table', () {
     final wrong = <String>[];
     void check(String key, String type, String where) {
-      if (kPrefsNotBackedUp.containsKey(key)) return;
+      if (!prefBackedUp(key)) return;
       final want = expectedPrefType(key);
       if (want != type) wrong.add('$key read as $type at $where; table: $want');
     }
diff --git a/test/backup/settings_audit_guard_test.dart b/test/backup/settings_audit_guard_test.dart
index 5d55e803c..e9c74578c 100644
--- a/test/backup/settings_audit_guard_test.dart
+++ b/test/backup/settings_audit_guard_test.dart
@@ -65,6 +65,16 @@ const _mustStay = {
   'alarm_schedule_cleared', 'alarm_epoch', 'alarm_epoch_confirmed', 'alarm_set_at_ms',
   'alarm_pending_until', 'alarm_latch_alert', 'alarm_probe_pending', 'alarm_fired_at',
   'live.session_draft', 'live_session_checkpoint', 'telemetry_outbox',
+  // What this phone's Health store holds; the new phone's store is empty.
+  'health_weight_perm_asked', 'health_weight_grant_seen',
+};
+
+// One concrete member of each per-device family that stays on the phone
+// (kPrefFamiliesNotBackedUp). The persisted maybe-landed marker is one: it
+// names a sample only the old phone's Health store may contain.
+const _mustStayFamilies = {
+  'health_weight_exported:d1', 'health_weight_attempts:d1',
+  'health_weight_maybe_landed:d1',
 };
 
 // Interpolated keys, including ones hidden behind key-building helpers.
@@ -111,6 +121,14 @@ const _indirectKeys = <String, List<String>>{
     'onboard.skipped_pairing', 'onboard.saw_profile_setup'],
   'lib/ui2/nudges.dart:_lastShownKey(a)': ['nudge.discord.last_shown_ms'],
   'lib/ui2/nudges.dart:_dismissedKey(a)': ['nudge.discord.dismissed'],
+  'lib/health/health_export.dart:kHealthWeightPermAskedPref': [
+    'health_weight_perm_asked'],
+  'lib/health/health_weight_export.dart:healthWeightExportedKey(id)': [
+    'health_weight_exported:d1'],
+  'lib/health/health_weight_export.dart:healthWeightAttemptsKey(id)': [
+    'health_weight_attempts:d1'],
+  'lib/health/health_weight_export.dart:healthWeightMaybeLandedKey(id)': [
+    'health_weight_maybe_landed:d1'],
 };
 
 Map<String, String> _constants(String text) => {
@@ -160,7 +178,7 @@ void main() {
     expect(keys, containsAll(['theme_choice', 'backup.cadence', 'coach_model',
       'local_profile_json', 'consent_chosen', 'nudge.discord.dismissed']),
         reason: 'scanner positive control');
-    expect(keys.difference({..._mustTravel, ..._mustStay}), isEmpty,
+    expect(keys.difference({..._mustTravel, ..._mustStay, ..._mustStayFamilies}), isEmpty,
         reason: 'new preference needs a policy decision in this test');
     final all = lib.map((f) => f.readAsStringSync()).join('\n');
     for (final e in _dynamicExamples.entries) {
@@ -171,7 +189,10 @@ void main() {
 
   test('required user settings and dynamic keys actually travel', () async {
     await env.wipe();
-    await setPrefs({for (final key in {..._mustTravel, ..._mustStay}) key: 'audit value'});
+    await setPrefs({
+      for (final key in {..._mustTravel, ..._mustStay, ..._mustStayFamilies})
+        key: 'audit value'
+    });
     final prefs = (await exportedPrefs(await LocalDb.exportCopy()))!;
     for (final key in _mustTravel) {
       expect(prefs[key], ('string', 'audit value'), reason: '$key must travel');
@@ -182,7 +203,7 @@ void main() {
     await env.wipe();
     // Typed as the app reads them: restore refuses a row of another type.
     await setPrefs({
-      for (final key in {..._mustTravel, ..._mustStay}) key: switch (expectedPrefType(key)) {
+      for (final key in {..._mustTravel, ..._mustStay, ..._mustStayFamilies}) key: switch (expectedPrefType(key)) {
         'bool' => true,
         'int' => 1,
         'double' => 1.5,
@@ -192,13 +213,13 @@ void main() {
     });
     final path = await LocalDb.exportCopy();
     final prefs = (await exportedPrefs(path))!;
-    for (final key in _mustStay) {
+    for (final key in {..._mustStay, ..._mustStayFamilies}) {
       expect(prefs, isNot(contains(key)), reason: '$key stays on the phone');
     }
     // Even an old or foreign export that carries blocked state cannot inject it.
     final copy = await databaseFactoryFfi.openDatabase(path,
         options: OpenDatabaseOptions(singleInstance: false));
-    for (final key in _mustStay) {
+    for (final key in {..._mustStay, ..._mustStayFamilies}) {
       await copy.insert('backup_prefs',
           {'key': key, 'type': 'string', 'value': 'foreign state'},
           conflictAlgorithm: ConflictAlgorithm.replace);
@@ -226,6 +247,18 @@ void main() {
     }
   });
 
+  test('each per-device family has a reason and a sample under it', () {
+    final families = policyMap('kPrefFamiliesNotBackedUp');
+    for (final e in families.entries) {
+      expect(e.value.length, greaterThan(10), reason: e.key);
+      expect(_mustStayFamilies.where((k) => k.startsWith(e.key)), isNotEmpty,
+          reason: '${e.key} has no sample in _mustStayFamilies');
+    }
+    for (final k in _mustStayFamilies) {
+      expect(families.keys.any(k.startsWith), isTrue, reason: k);
+    }
+  });
+
   test('a credential never sits in plain preferences', () {
     final credential = RegExp(r'api_key|secret|password|auth_token');
     expect(credential.hasMatch('coach_api_key'), isTrue);

From bdf554433667b2c882f7b494aa785986b86c8538 Mon Sep 17 00:00:00 2001
From: abdulsaheel <abdulsaheel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 12:09:29 +0530
Subject: [PATCH 11/12] weight export: state travels in backups, disabled
 scales guard deletes, late older weighings are sent

the exporter's marks now restore with the rest of the settings, since the health store usually survives a restore and re-sending everything would stack duplicates. only the permission flags stay per install. a switched-off scale's instants count in the collision check. exported weighings that age out of the bounded set are remembered separately, so an older weighing that shows up late is still sent instead of being mistaken for one that aged out.
---
 lib/data/backup_extras.dart                | 35 ++++------
 lib/health/health_weight_export.dart       | 76 +++++++++++++++++-----
 test/backup/backup_support.dart            |  1 -
 test/backup/pref_types_guard_test.dart     |  5 +-
 test/backup/settings_audit_guard_test.dart | 41 ++++--------
 test/health_weight_export_test.dart        | 52 ++++++++++++++-
 6 files changed, 134 insertions(+), 76 deletions(-)

diff --git a/lib/data/backup_extras.dart b/lib/data/backup_extras.dart
index 675d93889..6745066b2 100644
--- a/lib/data/backup_extras.dart
+++ b/lib/data/backup_extras.dart
@@ -50,24 +50,10 @@ const Map<String, String> kPrefsNotBackedUp = {
   'alarm_probe_pending': 'legacy pending hardware probe; never resume on another band',
   'alarm_fired_at': 'last fire event from the old band, not the chosen schedule',
   'health_upload_last_ts': 'upload cursor for this installation',
-  'health_weight_perm_asked': 'records that this phone already asked for '
-      'WEIGHT write access; the new phone has not asked yet',
-  'health_weight_grant_seen': 'last WEIGHT grant observed on this phone; '
-      'the grant belongs to its Health store',
-};
-
-/// Per-item families that stay on the phone: (prefix, reason). Each describes
-/// what this phone's Health store holds, which a restore onto another phone
-/// cannot carry. Exported and attempt marks would claim samples that are not
-/// there, and a maybe-landed marker would clear a sample the new store never
-/// received.
-const Map<String, String> kPrefFamiliesNotBackedUp = {
-  'health_weight_exported:': 'weighings already written to this phone\'s '
-      'Health store; the new store is empty, so they must be sent again',
-  'health_weight_attempts:': 'failure counts against this phone\'s Health '
-      'store, not the new one',
-  'health_weight_maybe_landed:': 'writes that timed out on this phone\'s '
-      'Health store; the retry clears a sample only this store may hold',
+  'health_weight_perm_asked': 'WEIGHT write access is asked per install; '
+      'the new install has not asked yet',
+  'health_weight_grant_seen': 'the WEIGHT grant is per install; the new '
+      'install observes its own',
 };
 
 const Map<String, String> kSecretsNotBackedUp = {
@@ -199,6 +185,12 @@ const List<(String, String, String)> kPrefTypeFamilies = [
   ('notif_osnext:', '', 'int'),
   ('nudge.', '.dismissed', 'bool'),
   ('nudge.', '.last_shown_ms', 'int'),
+  // Per-scale weighing export state. Travels: the Health store usually
+  // survives a restore, and re-sending every weighing would stack duplicates.
+  ('health_weight_exported:', '', 'string'),
+  ('health_weight_attempts:', '', 'string'),
+  ('health_weight_maybe_landed:', '', 'string'),
+  ('health_weight_trimmed:', '', 'string'),
 ];
 
 /// The stored type the app reads [key] with, or null when it is not known.
@@ -211,12 +203,7 @@ String? expectedPrefType(String key) {
   return null;
 }
 
-bool _backedUp(String key) =>
-    !kPrefsNotBackedUp.containsKey(key) &&
-    !kPrefFamiliesNotBackedUp.keys.any(key.startsWith);
-
-/// Whether [key] travels in a backup (exact exclusions and families).
-bool prefBackedUp(String key) => _backedUp(key);
+bool _backedUp(String key) => !kPrefsNotBackedUp.containsKey(key);
 
 (String, String)? _encode(Object? value) => switch (value) {
   bool b => ('bool', '$b'),
diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
index 3d53658b1..170c978cf 100644
--- a/lib/health/health_weight_export.dart
+++ b/lib/health/health_weight_export.dart
@@ -60,6 +60,13 @@ String healthWeightAttemptsKey(String deviceId) =>
 String healthWeightMaybeLandedKey(String deviceId) =>
     'health_weight_maybe_landed:$deviceId';
 
+/// Per-device persisted set (JSON list) of weighing instants that were
+/// exported and then aged out of the bounded exported set. Kept apart from the
+/// never-exported instants so a late older weighing (backfill) is still sent
+/// while an old exported one is not sent again.
+String healthWeightTrimmedKey(String deviceId) =>
+    'health_weight_trimmed:$deviceId';
+
 /// Superseded high-water cursor (LocalDb cursor). Never read any more; only
 /// cleared on reset.
 String healthWeightCursorName(String deviceId) =>
@@ -79,6 +86,9 @@ const int kMaxWeighingsPerRun = 200;
 /// Bound on the exported set per device (newest kept).
 const int kMaxExportedWeighings = 2000;
 
+/// Bound on the aged-out exported history per device (newest kept).
+const int kMaxTrimmedWeighings = 10000;
+
 /// Failed attempts after which a weighing is no longer retried. Mirrors
 /// HealthExporter's `_kMaxExportAttempts`.
 const int kMaxWeightAttempts = 6;
@@ -131,11 +141,9 @@ Map<int, int> _decodeAttempts(String? s) {
 }
 
 /// Keeps only the newest [kMaxExportedWeighings] entries.
-List<int> _bounded(Set<int> s) {
+List<int> _bounded(Set<int> s, [int max = kMaxExportedWeighings]) {
   final l = s.toList()..sort();
-  return l.length > kMaxExportedWeighings
-      ? l.sublist(l.length - kMaxExportedWeighings)
-      : l;
+  return l.length > max ? l.sublist(l.length - max) : l;
 }
 
 /// Write [weighings] (ascending). A failed weighing is skipped and its
@@ -164,6 +172,7 @@ Future<int> writeWeighings({
   bool resend = false,
   bool Function(int atMs)? deleteSafe,
   Set<int>? maybeLanded,
+  Set<int>? trimmed,
 }) async {
   var written = 0;
   final landed = maybeLanded ?? <int>{};
@@ -175,7 +184,7 @@ Future<int> writeWeighings({
     // Already in Health and the delete would take a neighbour's sample too:
     // keep what is there rather than stack a duplicate.
     if (resend &&
-        exported.contains(w.atMs) &&
+        (exported.contains(w.atMs) || (trimmed?.contains(w.atMs) ?? false)) &&
         !(deleteSafe?.call(w.atMs) ?? true)) {
       continue;
     }
@@ -206,11 +215,15 @@ Future<int> writeWeighings({
     if (ok) {
       written++;
       exported.add(w.atMs);
+      trimmed?.remove(w.atMs);
       attempts.remove(w.atMs);
     } else {
       // Our sample was deleted and the replacement did not go in: it is no
       // longer in Health, so it must not stay marked as exported.
-      if (deleted) exported.remove(w.atMs);
+      if (deleted) {
+        exported.remove(w.atMs);
+        trimmed?.remove(w.atMs);
+      }
       if (stopped?.call() ?? false) {
         await save();
         break;
@@ -288,14 +301,27 @@ Future<int> exportScaleWeighings({
     final prefs = await SharedPreferences.getInstance();
     final enabledFn = isEnabled ?? wearableEnabled;
     final devices = <_ScaleDevice>[];
+    // Scales switched off still have samples in Health: their instants take
+    // part in the collision check only, never in an export.
+    final disabledScales = <_ScaleDevice>[];
     for (final row in await (loadDevices ?? LocalDb.deviceRows)()) {
       final adapter = row['adapter_id'] as String?;
       final id = row['id'] as String?;
       if (id == null) continue;
       try {
         if (adapter == null ||
-            categoryOf(adapter) != DeviceCategory.healthMeasurement ||
-            !await enabledFn(adapter)) {
+            categoryOf(adapter) != DeviceCategory.healthMeasurement) {
+          continue;
+        }
+        if (!await enabledFn(adapter)) {
+          disabledScales.add(
+            _ScaleDevice(
+              id,
+              adapter,
+              await (loadWeights ??
+                  (d) => LocalDb.deviceObservationValues(d, 'weight'))(id),
+            ),
+          );
           continue;
         }
         // The exported set is kept on reset (a disabled scale keeps its state,
@@ -322,7 +348,7 @@ Future<int> exportScaleWeighings({
     // Every scale's instants: a delete by time range must not take another
     // weighing's sample with it.
     bool deleteSafeFor(String id, int atMs) {
-      for (final d in devices) {
+      for (final d in [...devices, ...disabledScales]) {
         for (final ts in d.raw.keys) {
           if (d.id == id && ts == atMs) continue;
           if ((ts - atMs).abs() <= kHealthWeightMatchWindow.inMilliseconds) {
@@ -354,7 +380,22 @@ Future<int> exportScaleWeighings({
         final maybeLanded = _decodeSet(
           prefs.getString(healthWeightMaybeLandedKey(id)),
         );
+        final trimmed = _decodeSet(
+          prefs.getString(healthWeightTrimmedKey(id)),
+        );
         Future<void> save() async {
+          // What the bound drops from the exported set is remembered, so an
+          // old exported weighing is not sent again as if it were new.
+          final keep = _bounded(exported).toSet();
+          final evicted = exported.difference(keep);
+          if (evicted.isNotEmpty) {
+            trimmed.addAll(evicted);
+            exported.removeAll(evicted);
+            await prefs.setString(
+              healthWeightTrimmedKey(id),
+              jsonEncode(_bounded(trimmed, kMaxTrimmedWeighings)),
+            );
+          }
           await prefs.setString(
             healthWeightMaybeLandedKey(id),
             jsonEncode(_bounded(maybeLanded)),
@@ -391,16 +432,14 @@ Future<int> exportScaleWeighings({
         }
         if (attemptsDirty) await save();
 
-        // A full set means older entries were trimmed: do not resurrect them
-        // (a failed one still under the cap is pending, not trimmed).
-        final floor = !reset && exported.length >= kMaxExportedWeighings
-            ? exported.reduce((a, b) => a < b ? a : b)
-            : 0;
+        // Exported history that aged out of the bounded set is in [trimmed],
+        // so a never-exported older weighing (backfill) is still pending.
         final pending = [
-          for (final w in exportableWeighings(d.raw, exported: reset ? const {} : exported))
-            if ((attempts[w.atMs] ?? 0) < kMaxWeightAttempts &&
-                (w.atMs >= floor || attempts.containsKey(w.atMs)))
-              w,
+          for (final w in exportableWeighings(
+            d.raw,
+            exported: reset ? const {} : {...exported, ...trimmed},
+          ))
+            if ((attempts[w.atMs] ?? 0) < kMaxWeightAttempts) w,
         ].take(budget).toList();
         if (pending.isEmpty) continue;
         budget -= pending.length;
@@ -420,6 +459,7 @@ Future<int> exportScaleWeighings({
           resend: reset,
           deleteSafe: (ts) => deleteSafeFor(id, ts),
           maybeLanded: maybeLanded,
+          trimmed: trimmed,
           mayContinue: () async {
             if (syncEnabled != null && !await syncEnabled()) {
               syncOff = true;
diff --git a/test/backup/backup_support.dart b/test/backup/backup_support.dart
index 18c31b545..d7a112eb8 100644
--- a/test/backup/backup_support.dart
+++ b/test/backup/backup_support.dart
@@ -129,7 +129,6 @@ void expectNoSecretIn(String path, Iterable<String> secrets) {
 Map<String, String> policyMap(String name) => switch (name) {
   'kPrefsNotBackedUp' => kPrefsNotBackedUp,
   'kSecretsNotBackedUp' => kSecretsNotBackedUp,
-  'kPrefFamiliesNotBackedUp' => kPrefFamiliesNotBackedUp,
   _ => throw ArgumentError.value(name),
 };
 
diff --git a/test/backup/pref_types_guard_test.dart b/test/backup/pref_types_guard_test.dart
index 3e91815b9..b8102cd33 100644
--- a/test/backup/pref_types_guard_test.dart
+++ b/test/backup/pref_types_guard_test.dart
@@ -43,6 +43,9 @@ const _dynamicReads = <String, List<String>>{
   'health_weight_export.dart|healthWeightMaybeLandedKey(id|string': [
     'health_weight_maybe_landed:d1',
   ],
+  'health_weight_export.dart|healthWeightTrimmedKey(id|string': [
+    'health_weight_trimmed:d1',
+  ],
   'nudges.dart|_dismissedKey(a|bool': ['nudge.pairing.dismissed'],
   'nudges.dart|_lastShownKey(a|int': ['nudge.pairing.last_shown_ms'],
   // The typed wrappers; each caller passes a literal or a const that is
@@ -159,7 +162,7 @@ void main() {
   test('every backed-up key that is read has its type in the table', () {
     final wrong = <String>[];
     void check(String key, String type, String where) {
-      if (!prefBackedUp(key)) return;
+      if (kPrefsNotBackedUp.containsKey(key)) return;
       final want = expectedPrefType(key);
       if (want != type) wrong.add('$key read as $type at $where; table: $want');
     }
diff --git a/test/backup/settings_audit_guard_test.dart b/test/backup/settings_audit_guard_test.dart
index e9c74578c..933bae371 100644
--- a/test/backup/settings_audit_guard_test.dart
+++ b/test/backup/settings_audit_guard_test.dart
@@ -51,6 +51,10 @@ const _mustTravel = {
   // Serial-scoped ECG safety guards must survive so reconnect still cleans up
   // a possibly active publisher. These are separate from alarm arm receipts.
   'ecg.guard.MG123', 'ecg.wrist.MG123', 'ecg.maverick.MG123',
+  // Weighing export state: the Health store usually survives a restore, so
+  // the marks must too, or every weighing is written again as a duplicate.
+  'health_weight_exported:d1', 'health_weight_attempts:d1',
+  'health_weight_maybe_landed:d1', 'health_weight_trimmed:d1',
   'future.setting',
 };
 
@@ -65,18 +69,10 @@ const _mustStay = {
   'alarm_schedule_cleared', 'alarm_epoch', 'alarm_epoch_confirmed', 'alarm_set_at_ms',
   'alarm_pending_until', 'alarm_latch_alert', 'alarm_probe_pending', 'alarm_fired_at',
   'live.session_draft', 'live_session_checkpoint', 'telemetry_outbox',
-  // What this phone's Health store holds; the new phone's store is empty.
+  // Permission and grant are per install.
   'health_weight_perm_asked', 'health_weight_grant_seen',
 };
 
-// One concrete member of each per-device family that stays on the phone
-// (kPrefFamiliesNotBackedUp). The persisted maybe-landed marker is one: it
-// names a sample only the old phone's Health store may contain.
-const _mustStayFamilies = {
-  'health_weight_exported:d1', 'health_weight_attempts:d1',
-  'health_weight_maybe_landed:d1',
-};
-
 // Interpolated keys, including ones hidden behind key-building helpers.
 // Notification dedupe/allocation survives to avoid replaying alerts; UI choices
 // and community-ask dismissal/cooldown are user preferences. metricTab has no
@@ -129,6 +125,8 @@ const _indirectKeys = <String, List<String>>{
     'health_weight_attempts:d1'],
   'lib/health/health_weight_export.dart:healthWeightMaybeLandedKey(id)': [
     'health_weight_maybe_landed:d1'],
+  'lib/health/health_weight_export.dart:healthWeightTrimmedKey(id)': [
+    'health_weight_trimmed:d1'],
 };
 
 Map<String, String> _constants(String text) => {
@@ -178,7 +176,7 @@ void main() {
     expect(keys, containsAll(['theme_choice', 'backup.cadence', 'coach_model',
       'local_profile_json', 'consent_chosen', 'nudge.discord.dismissed']),
         reason: 'scanner positive control');
-    expect(keys.difference({..._mustTravel, ..._mustStay, ..._mustStayFamilies}), isEmpty,
+    expect(keys.difference({..._mustTravel, ..._mustStay}), isEmpty,
         reason: 'new preference needs a policy decision in this test');
     final all = lib.map((f) => f.readAsStringSync()).join('\n');
     for (final e in _dynamicExamples.entries) {
@@ -189,10 +187,7 @@ void main() {
 
   test('required user settings and dynamic keys actually travel', () async {
     await env.wipe();
-    await setPrefs({
-      for (final key in {..._mustTravel, ..._mustStay, ..._mustStayFamilies})
-        key: 'audit value'
-    });
+    await setPrefs({for (final key in {..._mustTravel, ..._mustStay}) key: 'audit value'});
     final prefs = (await exportedPrefs(await LocalDb.exportCopy()))!;
     for (final key in _mustTravel) {
       expect(prefs[key], ('string', 'audit value'), reason: '$key must travel');
@@ -203,7 +198,7 @@ void main() {
     await env.wipe();
     // Typed as the app reads them: restore refuses a row of another type.
     await setPrefs({
-      for (final key in {..._mustTravel, ..._mustStay, ..._mustStayFamilies}) key: switch (expectedPrefType(key)) {
+      for (final key in {..._mustTravel, ..._mustStay}) key: switch (expectedPrefType(key)) {
         'bool' => true,
         'int' => 1,
         'double' => 1.5,
@@ -213,13 +208,13 @@ void main() {
     });
     final path = await LocalDb.exportCopy();
     final prefs = (await exportedPrefs(path))!;
-    for (final key in {..._mustStay, ..._mustStayFamilies}) {
+    for (final key in _mustStay) {
       expect(prefs, isNot(contains(key)), reason: '$key stays on the phone');
     }
     // Even an old or foreign export that carries blocked state cannot inject it.
     final copy = await databaseFactoryFfi.openDatabase(path,
         options: OpenDatabaseOptions(singleInstance: false));
-    for (final key in {..._mustStay, ..._mustStayFamilies}) {
+    for (final key in _mustStay) {
       await copy.insert('backup_prefs',
           {'key': key, 'type': 'string', 'value': 'foreign state'},
           conflictAlgorithm: ConflictAlgorithm.replace);
@@ -247,18 +242,6 @@ void main() {
     }
   });
 
-  test('each per-device family has a reason and a sample under it', () {
-    final families = policyMap('kPrefFamiliesNotBackedUp');
-    for (final e in families.entries) {
-      expect(e.value.length, greaterThan(10), reason: e.key);
-      expect(_mustStayFamilies.where((k) => k.startsWith(e.key)), isNotEmpty,
-          reason: '${e.key} has no sample in _mustStayFamilies');
-    }
-    for (final k in _mustStayFamilies) {
-      expect(families.keys.any(k.startsWith), isTrue, reason: k);
-    }
-  });
-
   test('a credential never sits in plain preferences', () {
     final credential = RegExp(r'api_key|secret|password|auth_token');
     expect(credential.hasMatch('coach_api_key'), isTrue);
diff --git a/test/health_weight_export_test.dart b/test/health_weight_export_test.dart
index ff5595963..af1e8a18f 100644
--- a/test/health_weight_export_test.dart
+++ b/test/health_weight_export_test.dart
@@ -285,20 +285,50 @@ void main() {
       expect(f.writes, [5000]);
     });
 
-    test('exported floor does not swallow a failed pending weighing', () async {
+    test('a full exported set: trimmed history stays unsent, a failed one retries',
+        () async {
       final f = _Fx()..weights = {100: 70, 200: 70};
       SharedPreferences.setMockInitialValues({
         healthWeightExportedKey('d1'): [
           for (var i = 0; i < kMaxExportedWeighings; i++) 10000 + i,
         ].toString(),
+        healthWeightTrimmedKey('d1'): '[200]',
         healthWeightAttemptsKey('d1'): '{"100":2}',
       });
-      // 100 is below the floor but failed before: retried. 200 is below the
-      // floor with no attempt record: treated as trimmed, not resurrected.
+      // 100 failed before and is retried. 200 was exported and aged out: it is
+      // in the trimmed record, so it is not sent again.
       await f.run();
       expect(f.writes, [100]);
     });
 
+    test('a backfilled older weighing below the exported history is still sent',
+        () async {
+      final f = _Fx()..weights = {100: 70, 20000: 71};
+      SharedPreferences.setMockInitialValues({
+        healthWeightExportedKey('d1'): [
+          for (var i = 0; i < kMaxExportedWeighings; i++) 10000 + i,
+        ].toString(),
+      });
+      // 100 has no export record anywhere: it arrived late, so it goes out.
+      await f.run();
+      expect(f.writes.toSet(), {100, 20000});
+    });
+
+    test('what the bound drops from the exported set is remembered', () async {
+      final f = _Fx()
+        ..weights = {
+          for (var i = 0; i < kMaxExportedWeighings + 3; i++) 10000 + i * 1000: 70,
+        };
+      while (await f.run() > 0) {} // the per-run cap spreads it over drains
+      final prefs = await SharedPreferences.getInstance();
+      expect(prefs.getString(healthWeightTrimmedKey('d1')),
+          '[10000,11000,12000]');
+      // Nothing is sent a second time, trimmed or not.
+      f.writes.clear();
+      await f.run();
+      expect(f.writes, isEmpty);
+    });
+
     test('attempt entries for vanished weighings are pruned', () async {
       SharedPreferences.setMockInitialValues({
         healthWeightAttemptsKey('d1'): '{"100":2,"1000":3}',
@@ -395,6 +425,22 @@ void main() {
     );
   });
 
+  group('a disabled scale still guards the delete', () {
+    test('reset does not delete beside a disabled scale\'s sample', () async {
+      final f = _Fx()
+        ..devices = [
+          {'id': 'd1', 'adapter_id': 'thermometer'},
+          {'id': 'd2', 'adapter_id': 'miscale2'},
+        ]
+        // d2 is switched off; its sample 300 ms away is still in Health.
+        ..enabledFn = ((a) async => a == 'thermometer')
+        ..loader = ((id) async => id == 'd1' ? {1000: 70} : {1300: 71});
+      await f.run(reset: true);
+      expect(f.deletes, isEmpty);
+      expect(f.writes, [1000]);
+    });
+  });
+
   group('timed-out and half-done writes', () {
     test('a write that timed out is cleared before the retry, across a restart',
         () async {

From ca5ecd1c6ff0c906213f0e0bb4324dde01f237b1 Mon Sep 17 00:00:00 2001
From: abdulsaheel <abdulsaheel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 14:28:39 +0530
Subject: [PATCH 12/12] weight export: a trimmed mark removed by a failed reset
 rewrite is saved too

the trimmed set was only written when the bound evicted something, so after a reset deleted an aged-out sample and the rewrite failed, the old mark came back on restart and the weighing looked exported. it is saved whenever it changes now. the cap's comment says what is forgotten past it.
---
 lib/health/health_weight_export.dart | 11 ++++++++++-
 test/health_weight_export_test.dart  | 20 ++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/lib/health/health_weight_export.dart b/lib/health/health_weight_export.dart
index 170c978cf..50487378d 100644
--- a/lib/health/health_weight_export.dart
+++ b/lib/health/health_weight_export.dart
@@ -86,7 +86,9 @@ const int kMaxWeighingsPerRun = 200;
 /// Bound on the exported set per device (newest kept).
 const int kMaxExportedWeighings = 2000;
 
-/// Bound on the aged-out exported history per device (newest kept).
+/// Bound on the aged-out exported history per device (newest kept). Past
+/// kMaxExportedWeighings + kMaxTrimmedWeighings weighings on one scale the
+/// oldest aged-out instant is forgotten, and a reset would send it again.
 const int kMaxTrimmedWeighings = 10000;
 
 /// Failed attempts after which a weighing is no longer retried. Mirrors
@@ -383,6 +385,7 @@ Future<int> exportScaleWeighings({
         final trimmed = _decodeSet(
           prefs.getString(healthWeightTrimmedKey(id)),
         );
+        var persistedTrimmed = {...trimmed};
         Future<void> save() async {
           // What the bound drops from the exported set is remembered, so an
           // old exported weighing is not sent again as if it were new.
@@ -391,6 +394,12 @@ Future<int> exportScaleWeighings({
           if (evicted.isNotEmpty) {
             trimmed.addAll(evicted);
             exported.removeAll(evicted);
+          }
+          // Also when a removal changed it (a reset deleted a trimmed sample
+          // and its replacement failed): a stale mark would read as exported.
+          if (trimmed.length != persistedTrimmed.length ||
+              !trimmed.containsAll(persistedTrimmed)) {
+            persistedTrimmed = {...trimmed};
             await prefs.setString(
               healthWeightTrimmedKey(id),
               jsonEncode(_bounded(trimmed, kMaxTrimmedWeighings)),
diff --git a/test/health_weight_export_test.dart b/test/health_weight_export_test.dart
index af1e8a18f..7c9f50be5 100644
--- a/test/health_weight_export_test.dart
+++ b/test/health_weight_export_test.dart
@@ -314,6 +314,26 @@ void main() {
       expect(f.writes.toSet(), {100, 20000});
     });
 
+    test('a reset that deletes a trimmed weighing and fails to rewrite it '
+        'leaves it pending after a restart', () async {
+      final f = _Fx()..weights = {100: 70};
+      SharedPreferences.setMockInitialValues({
+        healthWeightExportedKey('d1'): [
+          for (var i = 0; i < kMaxExportedWeighings; i++) 10000 + i,
+        ].toString(),
+        healthWeightTrimmedKey('d1'): '[100]',
+      });
+      f.failAt.add(100);
+      await f.run(reset: true);
+      expect(f.deletes, [100]);
+      // The persisted state, not memory, decides what a new run sends.
+      final prefs = await SharedPreferences.getInstance();
+      expect(prefs.getString(healthWeightTrimmedKey('d1')), '[]');
+      final g = _Fx()..weights = {100: 70};
+      expect(await g.run(forceRetry: true), 1);
+      expect(g.writes, [100]);
+    });
+
     test('what the bound drops from the exported set is remembered', () async {
       final f = _Fx()
         ..weights = {