Reject late hidden insulin history and prepare 0.1.11

Author: siriushex

AI_NOTES.md

@@ -1,3 +1,25 @@
+# Insulin History Knowledge Boundary And 0.1.11 - 2026-10-23
+
+- Main6a0a7894 CI39881365894 passed all three jobs. Native basal/profile source
+  and main integration are now verified; complete physical delivery is separate.
+- Three failing-first regressions reproduced an insulin inventory returning
+  earlier absence after a later edit moved the dose outside the query. Include
+  shortened/deleted rows, unrelated/empty snapshots and native Room cache/reopen.
+  Initial sandbox run could not access the existing Gradle cache; the authorized
+  rerun executed37tests and reproduced all three intended failures.
+- Check the retained collection revision before insulin-window filtering, matching
+  the profile-history knowledge boundary. No synthetic archive or old-dose fallback.
+- All131focused checks passed with one existing private-input skip and real SDK
+  TLS2.279s. Frozen full test/lint/compile/assemble passed in8m12s:6793passed,
+  six existing skips, zero failures/errors, real SDK TLS2.254s and zero lint errors
+  with382existing warnings/eight hints. All1431source hashes stayed unchanged.
+- Prepare0.1.11/code12 for existing internet updates:39,730,208bytes and the same
+  independently checked signing identity. APK retention passed. Exact-head CI/main
+  and public-download gates remain pending until independently verified.
+- No AAPS source/device, AI service, schema, dose, target, alarm or live recommended
+  eating-time admission is changed. Missing upstream/pump/clock receipts and
+  prospective forecast/controller validation cannot be replaced by software tests.
+
 # Native Reported Basal Segments - 2026-10-23
 
 - Continue from PR24/main4f1d173d. All six source checks passed and merged/tested

android-app/app/build.gradle.kts

@@ -17,8 +17,8 @@ android {
         applicationId = "io.aaps.predictivecopilot"
         minSdk = 31
         targetSdk = 36
-        versionCode = 11
-        versionName = "0.1.10"
+        versionCode = 12
+        versionName = "0.1.11"
 
         testInstrumentationRunner = "io.aaps.copilot.CopilotTestRunner"
         vectorDrawables.useSupportLibrary = true

android-app/app/src/main/kotlin/io/aaps/copilot/service/AapsV3InsulinInventory.kt

@@ -91,6 +91,8 @@ internal class AapsV3InsulinInventoryTimeline(snapshot: LocalV3RetainedSnapshot)
         if (fromMs !in 1..atMs || atMs > knownAtMs || knownAtMs > LocalNightscoutV3Store.MAX_TIME)
             return unavailable(AapsV3ObservedInsulinStatus.INVALID)
         failure?.let { return unavailable(it) }
+        // Latest retained versions cannot recover a record moved outside this earlier query.
+        if (revision > knownAtMs) return unavailable(AapsV3ObservedInsulinStatus.LATE_EVIDENCE)
         val relevant = entries.filter { it.atMs <= atMs &&
             (it.observation == null || it.atMs >= fromMs || it.observation.endAtMs > fromMs) }
         if (relevant.any { it.observation == null }) return unavailable(AapsV3ObservedInsulinStatus.INVALID)

android-app/app/src/test/kotlin/io/aaps/copilot/service/AapsV3EffectiveProfileSourceTest.kt

@@ -105,6 +105,29 @@ class AapsV3EffectiveProfileSourceTest {
         assertNull(read.profile.observation)
     }
 
+    @Test fun movedInsulinCorrectionCannotHideFromAsKnownReadAcrossReopen() = runBlocking {
+        store().create(input("profile", at - 60_000))
+        fun dose(time: Long) = LocalV3DocumentInput(LocalV3Collection.TREATMENTS, "dose", "local-v3-owner", time,
+            buildJsonObject { put("eventType", "Correction Bolus"); put("date", time); put("insulin", 2.2) }.toString())
+        val original = store().create(dose(at - 1)).document
+        val source = AapsV3EffectiveProfileSource(store())
+        val previousRevision = original.modifiedRevision
+        assertEquals(1, source.readEvidence(at - 30_000, at, previousRevision).insulin.records.size)
+        val changed = store().update(dose(at + 1), original.modifiedRevision).document
+        suspend fun verify(reader: AapsV3EffectiveProfileSource) {
+            val historical = reader.readEvidence(at - 30_000, at, previousRevision)
+            assertEquals(AapsV3ObservedInsulinStatus.LATE_EVIDENCE, historical.insulin.status)
+            assertTrue(historical.insulin.records.isEmpty())
+            assertFalse(historical.insulin.upstreamCompletenessVerified)
+            assertEquals(AapsV3ObservedInsulinStatus.NOT_OBSERVED,
+                reader.readEvidence(at - 30_000, at, changed.modifiedRevision).insulin.status)
+        }
+        verify(source)
+        db.close(); db = open()
+        verify(AapsV3EffectiveProfileSource(store()))
+        assertTrue(db.therapyDao().since(0).isEmpty())
+    }
+
     @Test fun cachedScheduleCannotBeModifiedByAReader() = runBlocking {
         store().create(input("profile"))
         val profile = observed(AapsV3EffectiveProfileSource(store()).read(at)).profile

android-app/app/src/test/kotlin/io/aaps/copilot/service/AapsV3InsulinInventoryTest.kt

@@ -130,6 +130,38 @@ class AapsV3InsulinInventoryTest {
         assertTrue(result.records.isEmpty())
     }
 
+    @Test fun lateMovedShortenedOrDeletedDeliveryCannotBecomeEarlierAbsence() {
+        val changed = listOf(
+            row(time = at + 1, revision = at + 10),
+            row(time = at - 7_200_000, revision = at + 10),
+            row(time = at - 7_200_000, revision = at + 10, fields = buildJsonObject {
+                put("eventType", "Temp Basal"); put("duration", 1); put("absolute", 0.8)
+            }),
+            row(time = at + 1, revision = at + 10, deleted = true)
+        )
+        for (source in changed) {
+            val result = read(source)
+            assertEquals(AapsV3ObservedInsulinStatus.LATE_EVIDENCE, result.status)
+            assertTrue(result.records.isEmpty())
+            assertFalse(result.upstreamCompletenessVerified)
+        }
+    }
+
+    @Test fun newerEmptyOrUnrelatedSnapshotCannotReconstructEarlierInventory() {
+        val unrelated = row("note", time = at + 1, revision = at + 10,
+            fields = buildJsonObject { put("eventType", "Note") })
+        for (rows in listOf(emptyList(), listOf(unrelated), listOf(row(), unrelated))) {
+            val timeline = AapsV3InsulinInventoryTimeline(LocalV3RetainedSnapshot.Complete(at + 10, rows))
+            val historical = timeline.read(at - 3_600_000, at, at)
+            assertEquals(AapsV3ObservedInsulinStatus.LATE_EVIDENCE, historical.status)
+            assertTrue(historical.records.isEmpty())
+            val current = timeline.read(at - 3_600_000, at, at + 10)
+            assertEquals(if (rows.size == 2) AapsV3ObservedInsulinStatus.OBSERVED
+                else AapsV3ObservedInsulinStatus.NOT_OBSERVED, current.status)
+            assertFalse(current.upstreamCompletenessVerified)
+        }
+    }
+
     @Test fun emptyAndOverLimitAreExplicitAndNeverProveCoverage() {
         val empty = read()
         assertEquals(AapsV3ObservedInsulinStatus.NOT_OBSERVED, empty.status)

docs/AAPS4_INSULIN_OBSERVATIONS.md

@@ -21,6 +21,10 @@ insulin indexes for the same retained revision and then drops raw JSON.
 Unknown bolus ICfg stays unknown. Contradictory bolus duration, malformed amounts,
 invalid source metadata or duplicate pump keys reject without partial success.
 Late retained revisions cannot be used as data available to an earlier prediction.
+This check applies to the entire collection revision before filtering the window,
+including empty or unrelated snapshots. A later edit can move, shorten or delete
+the only relevant dose, so checking the returned rows alone cannot establish
+earlier absence. Latest retained versions are not a historical version archive.
 Queries include intervals that start before the requested window and overlap it.
 Malformed records cannot be declared expired using an unknown duration.
 

docs/ARCHITECTURE.md

@@ -33,6 +33,9 @@ and counts without an additional worker. Native schedule lookup uses the device'
 system clock, so serialized profile timezone cannot attest historical clock
 changes. No observed interval can create MealBasalHistory or unlock meal advice
 without separate coverage/clock/delivery admission. See AAPS4_REPORTED_BASAL.md.
+The insulin index, like profile history, rejects a newer retained collection
+revision before window filtering. Revisions of excluded rows must not erase
+exposure from an earlier as-known query; this is not a versioned history archive.
 
 ## RC1 Target Transaction Boundary
 

docs/INVARIANTS.md

@@ -42,6 +42,9 @@
   cannot attest historical device-clock changes. Do not reapply EPS modifiers.
 - Immutable reported spans/quantities remain observational, not physical delivery,
   complete source/pump coverage, MealBasalHistory or live timer/therapy permission.
+- As-known insulin reads reject a collection revision newer than knowledge time
+  before filtering. A moved/shortened/deleted dose, unrelated change or empty
+  latest snapshot cannot be used to reconstruct an earlier absence of delivery.
 
 ## RC1 Target Admission
 

docs/PLAN.md

@@ -1,5 +1,17 @@
 # PLAN
 
+## Insulin History Knowledge Boundary And 0.1.11 (2026-10-23)
+
+- [x] Confirm main6a0a7894 CI39881365894 passed all three jobs.
+- [x] Reproduce three failures for hidden late insulin edits and native Room reopen.
+- [x] Reject the newer collection revision before filtering insulin windows.
+- [x] Pass131focused checks/one existing skip and6793full checks/six existing
+      skips;actual SDK TLS, zero lint errors, frozen source and APK retention pass.
+- [ ] Verify exact source CI and integrate the identical tested tree into main.
+- [ ] Publish and independently verify0.1.11/code12 over the existing update route.
+- Latest retained rows cannot prove earlier absence or full upstream/pump/clock
+  coverage. Live meal recommendation, targets, doses and alarms remain unchanged.
+
 ## Native Reported Basal Segments (2026-10-23)
 
 - [x] Reproduce contradictory-rate/type and duplicate-identity/privacy defects.
@@ -8,7 +20,8 @@
 - [x] Complete pure, Room/reopen/owner and actual pristine SDK TLS checks.
 - [x] Frozen full quality:6790passed/six existing skips, actual SDK TLS, zero lint
       errors, unchanged1431source hashes and all7176app classes retained.
-- [ ] Verify exact-head CI and integrate the matching tested tree into main.
+- [x] Pass six exact-source checks, integrate6a0a7894 with matching tree and verify
+      all three main CI39881365894 jobs.
 - Reported spans do not establish source/pump/clock completeness or authorize live
   meal advice. See AAPS4_REPORTED_BASAL.md for units and remaining admission.