Merge PR #31: preserve insulin clock and Combo start evidence

Preserve insulin clock provenance and Combo start uncertainty

Author: siriushex

AI_NOTES.md

@@ -1,3 +1,28 @@
+# Native Insulin Clock And Combo Anchors - 2026-10-23
+
+- Verified current main6a3921d2 and all three CI39930202544 jobs.
+- Reproduced three pure timestamp/offset failures. The first Room test exposed
+  a missing app field in its synthetic fixture; after correcting that fixture,
+  accepted wire data reproduced the intended OBSERVED-versus-INVALID failure.
+- Preserve original optional UTC offsets without shifting epoch dates. Verify
+  retained aliases, millisecond precision and the emulated child's own clock.
+  Contradictions reject before time-window filtering; no partial basal result.
+- Combo-labelled boluses now retain explicit unverified-start semantics. This
+  reflects the pinned driver's infused/finished event path, not proof of the
+  installed driver, complete delivery, meal intent or a clinically safe interval.
+- Existing owner diagnostics expose only active uncertain-start/missing-offset
+  counts and retain lifecycle cleanup. No new workers, API, schema or authority.
+- Initial full quality passed6815tests/six existing skips in6m38s. Review then
+  strengthened the old mixed-child fixture with a valid date and positive control
+  so the new clock guard could not mask its intended form validation.
+- Final frozen full test/lint/compile/assemble passed in2m44s:6815passed/six existing
+  skips, all ten new cases executed, real stock SDK TLS2.708s, zero lint errors,
+  382existing warnings/eight hints. All1431source hashes stayed unchanged and
+  all7178application classes were retained in the40,670,995byte local APK.
+  Exact-source CI and main integration remain separate gates. See
+  AAPS4_INSULIN_TIME_EVIDENCE.md for the source contract and remaining limits.
+- No AAPS, phone, server, live timer, target, dose or alert change.
+
 # Meal Research Interval Inventory - 2026-10-23
 
 - Main bdf7b070 has all three successful Verify jobs in run 39918968049.

android-app/app/src/main/kotlin/io/aaps/copilot/service/AapsV3InsulinInventory.kt

@@ -5,12 +5,14 @@ import io.aaps.copilot.data.repository.HistoryJson
 import io.aaps.copilot.data.repository.LocalNightscoutV3Store
 import io.aaps.copilot.data.repository.LocalV3RetainedSnapshot
 import java.security.MessageDigest
+import java.time.Instant
 import java.util.Collections
 import kotlinx.serialization.json.*
 
 enum class AapsV3ObservedInsulinStatus { UNCHECKED, OBSERVED, PARTIAL_CONTEXT, NOT_OBSERVED, INVALID, CONFLICTING, LATE_EVIDENCE, LIMIT_REACHED, ERROR }
 
 internal enum class AapsV3TempBasalType { NORMAL, EMULATED_PUMP_SUSPEND, PUMP_SUSPEND, SUPERBOLUS, FAKE_EXTENDED }
+internal enum class AapsV3InsulinAnchorKind { UNSPECIFIED_EVENT, COMBO_BOLUS_START_UNVERIFIED, REPORTED_INTERVAL_START }
 
 internal sealed class AapsV3InsulinDose {
     data class Bolus(val units: Double, val type: String, val basalInsulin: Boolean,
@@ -25,7 +27,9 @@ internal sealed class AapsV3InsulinDose {
 internal data class AapsV3InsulinObservation(
     val identifier: String, val eventAtMs: Long, val availableAtMs: Long,
     val createdRevision: Long, val modifiedRevision: Long, val invalidated: Boolean,
-    val pumpRecordIdentity: String?, val pumpEndId: Long?, val dose: AapsV3InsulinDose
+    val pumpRecordIdentity: String?, val pumpEndId: Long?, val dose: AapsV3InsulinDose,
+    val recordedUtcOffsetMinutes: Int? = null,
+    val anchorKind: AapsV3InsulinAnchorKind = AapsV3InsulinAnchorKind.UNSPECIFIED_EVENT
 ) {
     val endAtMs: Long get() = eventAtMs + when (dose) {
         is AapsV3InsulinDose.Bolus -> 0
@@ -44,7 +48,8 @@ internal class AapsV3InsulinRead(val status: AapsV3ObservedInsulinStatus, val re
 
 internal class AapsV3InsulinInventoryTimeline(snapshot: LocalV3RetainedSnapshot) {
     val revision = snapshot.collectionRevision
-    private data class Entry(val atMs: Long, val observation: AapsV3InsulinObservation?)
+    private data class Entry(val atMs: Long, val observation: AapsV3InsulinObservation?, val conflictingTime: Boolean = false)
+    private data class RecordedClock(val atMs: Long, val offsetMinutes: Int?)
     private val entries: List<Entry>
     private val failure: AapsV3ObservedInsulinStatus?
 
@@ -68,8 +73,17 @@ internal class AapsV3InsulinInventoryTimeline(snapshot: LocalV3RetainedSnapshot)
                 val dose = dose(body) ?: return@mapNotNull null
                 val identityBody = if (dose is AapsV3InsulinDose.Extended && string(body, "eventType") == "Temp Basal")
                     HistoryJson.obj(body.getValue("extendedEmulated")) else body
-                val at = HistoryJson.long(body.getValue("date"))
-                require(at == row.eventAtMs && at in 1..LocalNightscoutV3Store.MAX_TIME)
+                val clock = try {
+                    val outer = recordedClock(body)
+                    require(outer.atMs == row.eventAtMs)
+                    if (identityBody === body) outer else recordedClock(identityBody).also { child ->
+                        require(child.atMs == outer.atMs)
+                        require(child.offsetMinutes == null || outer.offsetMinutes == null || child.offsetMinutes == outer.offsetMinutes)
+                    }
+                } catch (_: Exception) {
+                    return@mapNotNull Entry(checkNotNull(row.eventAtMs), null, conflictingTime = true)
+                }
+                val at = clock.atMs
                 val duration = when (dose) {
                     is AapsV3InsulinDose.Bolus -> 0
                     is AapsV3InsulinDose.TempBasal -> dose.durationMs
@@ -79,7 +93,12 @@ internal class AapsV3InsulinInventoryTimeline(snapshot: LocalV3RetainedSnapshot)
                 Entry(at, AapsV3InsulinObservation(row.identifier, at, row.modifiedRevision,
                     row.createdRevision, row.modifiedRevision, row.deleted || boolean(body, "isValid") == false ||
                         boolean(identityBody, "isValid") == false,
-                    pumpIdentity(identityBody, dose), identityBody["endId"]?.takeUnless { it == JsonNull }?.let(HistoryJson::long), dose))
+                    pumpIdentity(identityBody, dose), identityBody["endId"]?.takeUnless { it == JsonNull }?.let(HistoryJson::long), dose,
+                    clock.offsetMinutes, when {
+                        dose !is AapsV3InsulinDose.Bolus -> AapsV3InsulinAnchorKind.REPORTED_INTERVAL_START
+                        string(identityBody, "pumpType") == "ACCU_CHEK_COMBO" -> AapsV3InsulinAnchorKind.COMBO_BOLUS_START_UNVERIFIED
+                        else -> AapsV3InsulinAnchorKind.UNSPECIFIED_EVENT
+                    }))
             } catch (_: Exception) {
                 Entry(checkNotNull(row.eventAtMs), null)
             }
@@ -93,6 +112,8 @@ internal class AapsV3InsulinInventoryTimeline(snapshot: LocalV3RetainedSnapshot)
         failure?.let { return unavailable(it) }
         // Latest retained versions cannot recover a record moved outside this earlier query.
         if (revision > knownAtMs) return unavailable(AapsV3ObservedInsulinStatus.LATE_EVIDENCE)
+        // A contradictory anchor cannot establish that its delivery lies outside this window.
+        if (entries.any { it.conflictingTime }) return unavailable(AapsV3ObservedInsulinStatus.INVALID)
         val relevant = entries.filter { it.atMs <= atMs &&
             (it.observation == null || it.atMs >= fromMs || it.observation.endAtMs > fromMs) }
         if (relevant.any { it.observation == null }) return unavailable(AapsV3ObservedInsulinStatus.INVALID)
@@ -195,6 +216,22 @@ internal class AapsV3InsulinInventoryTimeline(snapshot: LocalV3RetainedSnapshot)
         return MessageDigest.getInstance("SHA-256").digest(identity.toByteArray()).joinToString("") { "%02x".format(it.toInt() and 255) }
     }
 
+    private fun recordedClock(body: JsonObject): RecordedClock {
+        val at = HistoryJson.long(body.getValue("date"))
+        require(at in 1..LocalNightscoutV3Store.MAX_TIME)
+        for (key in listOf("mills", "timestamp")) {
+            body[key]?.takeUnless { it == JsonNull }?.let { require(HistoryJson.long(it) == at) }
+        }
+        string(body, "created_at")?.let {
+            val instant = Instant.parse(it)
+            require(instant.nano % 1_000_000 == 0 && instant.toEpochMilli() == at)
+        }
+        val offset = body["utcOffset"]?.takeUnless { it == JsonNull }?.let {
+            HistoryJson.signedLong(it).also { value -> require(value in -1440..1440) }.toInt()
+        }
+        return RecordedClock(at, offset)
+    }
+
     private fun number(body: JsonObject, key: String) = body[key]?.takeUnless { it == JsonNull }?.let(HistoryJson::double)
     private fun string(body: JsonObject, key: String) = body[key]?.takeUnless { it == JsonNull }?.let(HistoryJson::string)
     private fun boolean(body: JsonObject, key: String) = body[key]?.takeUnless { it == JsonNull }?.let(HistoryJson::bool)

android-app/app/src/main/kotlin/io/aaps/copilot/service/AapsV3TargetChannel.kt

@@ -27,7 +27,9 @@ data class AapsV3ConnectionState(
     val profileHistoryIntervalCount: Int = 0,
     val observedBasal: AapsV3ReportedBasalStatus = AapsV3ReportedBasalStatus.UNCHECKED,
     val basalSegmentCount: Int = 0,
-    val basalGapCount: Int = 0
+    val basalGapCount: Int = 0,
+    val comboBolusStartUnverifiedCount: Int = 0,
+    val insulinMissingUtcOffsetCount: Int = 0
 )
 
 /** Foreground-runtime owner. Observation never commits a preview or replays a command. */
@@ -174,7 +176,13 @@ internal class AapsV3TargetChannel(
             if (showEvidence) evidence?.profileHistory?.intervals?.size ?: 0 else 0,
             if (showEvidence) evidence?.reportedBasal?.status ?: AapsV3ReportedBasalStatus.UNCHECKED else AapsV3ReportedBasalStatus.UNCHECKED,
             if (showEvidence) evidence?.reportedBasal?.segments?.size ?: 0 else 0,
-            if (showEvidence) evidence?.reportedBasal?.gaps?.size ?: 0 else 0)
+            if (showEvidence) evidence?.reportedBasal?.gaps?.size ?: 0 else 0,
+            if (showEvidence) evidence?.insulin?.records?.count {
+                !it.invalidated && it.anchorKind == AapsV3InsulinAnchorKind.COMBO_BOLUS_START_UNVERIFIED
+            } ?: 0 else 0,
+            if (showEvidence) evidence?.insulin?.records?.count {
+                !it.invalidated && it.recordedUtcOffsetMinutes == null
+            } ?: 0 else 0)
     }
 
     override suspend fun send(command: ActionCommand, deliveryGuard: suspend () -> String?): NativeTargetOutcome = commandMutex.withLock {

android-app/app/src/test/kotlin/io/aaps/copilot/service/AapsV3EffectiveProfileSourceTest.kt

@@ -248,6 +248,70 @@ class AapsV3EffectiveProfileSourceTest {
         assertTrue(moved.modifiedRevision > original.modifiedRevision)
     }
 
+    @Test fun acceptedEmulatedTimeConflictBlocksBasalAndSurvivesReopenUntilCorrected() = runBlocking {
+        val from = at - 3_600_000
+        store().create(input("profile", from))
+        val api = LocalNightscoutV3EntriesApi(db) { at + 100_000 }
+        fun body(childAt: Long) = buildJsonObject {
+            put("app", "AAPS")
+            put("date", from); put("utcOffset", 240); put("eventType", "Temp Basal")
+            put("absolute", 1.0); put("duration", 60)
+            put("extendedEmulated", buildJsonObject {
+                put("date", childAt); put("utcOffset", 240); put("eventType", "Combo Bolus")
+                put("enteredinsulin", 0.5); put("duration", 60); put("isEmulatingTempBasal", true)
+            })
+        }
+        val response = api.handle("POST", "/api/v3/treatments", emptyMap()) { body(at + 60_000).toString().toByteArray() }
+        assertEquals(201, response.status)
+        val source = AapsV3EffectiveProfileSource(store())
+        fun rejected(read: AapsV3ObservedClinicalRead) {
+            assertEquals(AapsV3ObservedInsulinStatus.INVALID, read.insulin.status)
+            assertTrue(read.insulin.records.isEmpty())
+            assertEquals(AapsV3ReportedBasalStatus.INPUT_UNAVAILABLE, read.reportedBasal.status)
+            assertTrue(read.reportedBasal.segments.isEmpty())
+        }
+        rejected(source.readEvidence(from, at, at + 200_000))
+        db.close(); db = open()
+        val reopened = AapsV3EffectiveProfileSource(store())
+        rejected(reopened.readEvidence(from, at, at + 200_000))
+        val record = store().retainedSnapshot(LocalV3Collection.TREATMENTS, 100, 1_000_000)
+            .let { it as LocalV3RetainedSnapshot.Complete }.documents.single { it.identifier != "profile" }
+        store().update(LocalV3DocumentInput(LocalV3Collection.TREATMENTS, record.identifier, record.source,
+            from, body(from).toString()), record.modifiedRevision)
+        val corrected = reopened.readEvidence(from, at, at + 200_000)
+        assertEquals(AapsV3ObservedInsulinStatus.OBSERVED, corrected.insulin.status)
+        assertEquals(AapsV3ReportedBasalStatus.OBSERVED_WINDOW, corrected.reportedBasal.status)
+        assertEquals(0.5, corrected.reportedBasal.segments.single().reportedComponentUnits!!, 1e-12)
+        assertFalse(corrected.insulin.upstreamCompletenessVerified)
+        assertTrue(db.therapyDao().since(0).isEmpty())
+    }
+
+    @Test fun comboRecordedClockAndStartUncertaintySurviveStorageCacheAndReopen() = runBlocking {
+        val api = LocalNightscoutV3EntriesApi(db) { at + 100_000 }
+        val body = buildJsonObject {
+            put("app", "AAPS"); put("date", at); put("utcOffset", -300)
+            put("eventType", "Meal Bolus"); put("insulin", 2.2); put("type", "NORMAL")
+            put("pumpId", 42); put("pumpType", "ACCU_CHEK_COMBO"); put("pumpSerial", "fixture-pump")
+        }.toString()
+        val accepted = api.handle("POST", "/api/v3/treatments", emptyMap()) { body.toByteArray() }
+        assertEquals(201, accepted.status)
+        suspend fun verify(reader: AapsV3EffectiveProfileSource) {
+            val result = reader.readEvidence(at - 60_000, at, at + 200_000).insulin
+            assertEquals(AapsV3ObservedInsulinStatus.PARTIAL_CONTEXT, result.status)
+            val record = result.records.single()
+            assertEquals(at, record.eventAtMs)
+            assertEquals(-300, record.recordedUtcOffsetMinutes)
+            assertEquals(AapsV3InsulinAnchorKind.COMBO_BOLUS_START_UNVERIFIED, record.anchorKind)
+            assertFalse(result.upstreamCompletenessVerified)
+        }
+        val source = AapsV3EffectiveProfileSource(store())
+        verify(source); verify(source)
+        db.close(); db = open()
+        verify(AapsV3EffectiveProfileSource(store()))
+        assertTrue(db.therapyDao().since(0).isEmpty())
+        assertTrue(db.actionCommandDao().latest(10).isEmpty())
+    }
+
     @Test fun latestDeletionBlocksFallbackAndSurvivesDatabaseReopen() = runBlocking {
         store().create(input("earlier"))
         val last = store().create(input("last", at + 10_000)).document