@glassly/bluetooth-sdk 0.1.0-dev.98 → 0.2.8-dev.444

package/ios/Source/sgcs/G2.swift

@@ -79,6 +79,7 @@ private enum ServiceID: UInt8 {
     case deviceSettings = 128 // 0x80 - UX_DEVICE_SETTINGS_APP_ID
     case evenHubCtrl = 129 // 0x81 - EvenHub CTRL channel (init/registration)
     case evenHub = 224 // 0xE0 - UI_BACKGROUND_EVENHUB_APP_ID
+    case cfwStream = 240 // 0xF0 - private Glassly CFW message streams (GLASSLYCFW/31)
 }
 
 /// EvenHub command IDs from EvenHub.proto
@@ -125,14 +126,18 @@ private enum OsEventType: Int32 {
     case abnormalExit = 6
     case systemExit = 7
     case imuDataReport = 8 // IMU_DATA_REPORT — Sys_ItemEvent carries imuData
-    // 9/10 are tap start/end on newer stock firmware. The Glassly CFW (older
-    // base) deliberately reuses the same values for its forwarded long-press /
-    // long-press-release SysEvents (ET_LONG=9 and ET_REL=10, emitted only while
-    // our fbguard lease is active), so CFW hold
-    // gestures arrive here as tap_start/tap_end with no extra mapping — just
-    // recognized on long-press instead of raw finger-down.
-    case tapStart = 9 // finger down on the touch bar
-    case tapEnd = 10 // finger lifted
+    // 9/10 are the SDK 0.0.14 LONG_PRESS/RELEASE pair. The 2.2.9 CFW forwards
+    // them (ET_LONG/ET_REL) while our fbguard lease is active; the gesture
+    // names stay tap_start/tap_end for API stability.
+    case tapStart = 9 // press recognized (hold start)
+    case tapEnd = 10 // released
+    case tapThenHold = 11 // CFW extension: 2.2.9 tap-then-hold (stock Menu gesture)
+    // 12 is head-up (delivered through the settings path, not here); 13 was an
+    // experimental temple edge and is burned. 14 is the Glassly CFW's ring
+    // touch-down (R1 subtype 0x0d, GLASSLYCFW/37 on 2.3.0.24). Only the ring
+    // produces it and the stock sender leaves source 0, so the id itself is the
+    // ring marker. Unknown ring wire types arrive as 127 and are dropped.
+    case ringTouchDown = 14
 }
 
 /// g2_settingCommandId from g2_setting.proto
@@ -479,7 +484,7 @@ private enum EvenHubProto {
         borderWidth: Int32 = 0, borderColor: Int32 = 0, borderRadius: Int32 = 0,
         paddingLength: Int32 = 0, containerID: Int32,
         containerName: String? = nil, isEventCapture: Bool = false,
-        content: String? = nil
+        content: String? = nil, textColor: Int32? = nil
     ) -> Data {
         var w = ProtobufWriter()
         w.writeInt32Field(1, x) // XPosition
@@ -498,6 +503,12 @@ private enum EvenHubProto {
         if let content = content {
             w.writeStringField(12, content) // Content
         }
+        if let textColor = textColor {
+            // SDK 0.0.14 text brightness level 0-4 (4 = default). Field number
+            // is a guess: our proto dump is 2.1.0-era (last field 12) and the
+            // 2.2.9 firmware's tag isn't extracted — verify on-device.
+            w.writeInt32Field(13, textColor) // TextColor (unverified)
+        }
         return w.data
     }
 
@@ -1586,14 +1597,67 @@ private class G2ReceiveManager {
 /// All access is guarded by `lock`. Resuming a `CheckedContinuation` from any thread is safe, and
 /// `arm`/`resolve` clear the slot atomically so neither the duplicate L/R ACK nor the timeout can
 /// resume the same continuation twice.
-private final class ImgAckBox {
+final class ImgAckBox {
+    /// ImgResCmd scalar defaults are zero when omitted on the wire. In
+    /// particular, session zero is valid when our 8-bit session counter wraps.
+    /// Requiring field 3 discarded that ACK and stalled the sender until timeout.
+    static func decodeResult(_ data: Data) -> (session: Int, fragment: Int32, success: Bool)? {
+        var reader = ProtobufReader(data)
+        let fields = reader.parseFields()
+        guard let errorCode = fields[8] as? Int32 else { return nil }
+        guard fields[3] == nil || fields[3] is Int32,
+              fields[6] == nil || fields[6] is Int32 else { return nil }
+        return (
+            session: Int((fields[3] as? Int32) ?? 0),
+            fragment: (fields[6] as? Int32) ?? 0,
+            success: errorCode == 4
+        )
+    }
+
     private let lock = NSLock()
     private var session: Int?
     private var fragment: Int32?
     private var cont: CheckedContinuation<Bool, Never>?
+    /// Names the current arming. A timeout carries the token of the arming it was
+    /// started for, so a timer left over from an earlier transfer can never fail a
+    /// later one that happens to reuse the same (session, fragment) key.
+    private var token: UInt64 = 0
+    /// The timeout task of the current arming, cancelled once the ack lands.
+    private var timer: Task<Void, Never>?
     /// Wall-clock ms of the last successful fragment ack — a cheap page-liveness
     /// signal (a torn-down page cannot ack image transfers).
     private var lastSuccessMs: Int64 = 0
+    private var lastOutcome: (at: TimeInterval, reason: String)?
+
+    func outcome() -> (at: TimeInterval, reason: String)? {
+        lock.lock()
+        defer { lock.unlock() }
+        return lastOutcome
+    }
+
+    /// Arm before sending, including transports that can reply synchronously.
+    /// Cancellation resolves the waiter so shutdown never waits out an ACK timeout.
+    @MainActor
+    func wait(session: Int, fragment: Int32, timeoutNs: UInt64, send: () -> Void) async -> Bool {
+        await withTaskCancellationHandler {
+            await withCheckedContinuation { cont in
+                let token = arm(session: session, fragment: fragment, cont: cont)
+                guard !Task.isCancelled else {
+                    timeout(token: token)
+                    return
+                }
+                let timer = Task.detached { [self] in
+                    try? await Task.sleep(nanoseconds: timeoutNs)
+                    guard !Task.isCancelled else { return }
+                    timeout(token: token)
+                }
+                attachTimer(timer, token: token)
+                send()
+            }
+        } onCancel: {
+            self.resolve(session: session, fragment: fragment, success: false)
+        }
+    }
 
     /// Milliseconds since the last successful ack, or Int64.max if none yet.
     func msSinceLastSuccess() -> Int64 {
@@ -1604,13 +1668,49 @@ private final class ImgAckBox {
         return Int64(Date().timeIntervalSince1970 * 1000) - last
     }
 
-    /// Install the awaiting continuation for `(session, fragment)`.
-    func arm(session: Int, fragment: Int32, cont: CheckedContinuation<Bool, Never>) {
+    /// Install the awaiting continuation for `(session, fragment)`; returns the arming's token.
+    func arm(session: Int, fragment: Int32, cont: CheckedContinuation<Bool, Never>) -> UInt64 {
         lock.lock()
+        token &+= 1
+        let t = token
         self.session = session
         self.fragment = fragment
         self.cont = cont
+        lastOutcome = nil
+        let stale = timer
+        timer = nil
+        lock.unlock()
+        stale?.cancel()
+        return t
+    }
+
+    /// Attach the timeout task for `token`; a task for an arming that is already over is cancelled.
+    func attachTimer(_ task: Task<Void, Never>, token: UInt64) {
+        lock.lock()
+        let current = self.token == token && cont != nil
+        if current {
+            timer = task
+        }
+        lock.unlock()
+        if !current {
+            task.cancel()
+        }
+    }
+
+    /// Time out the arming named by `token`, if it is still the one awaiting an ack.
+    func timeout(token: UInt64) {
+        lock.lock()
+        guard self.token == token, let c = cont else {
+            lock.unlock()
+            return
+        }
+        session = nil
+        fragment = nil
+        cont = nil
+        timer = nil
+        lastOutcome = (ProcessInfo.processInfo.systemUptime, "timeout")
         lock.unlock()
+        c.resume(returning: false)
     }
 
     /// Resume the continuation if it matches `(session, fragment)`. Returns true if it fired.
@@ -1624,18 +1724,17 @@ private final class ImgAckBox {
         self.session = nil
         self.fragment = nil
         cont = nil
+        lastOutcome = (ProcessInfo.processInfo.systemUptime, success ? "ack" : "nack")
+        let t = timer
+        timer = nil
         if success {
             lastSuccessMs = Int64(Date().timeIntervalSince1970 * 1000)
         }
         lock.unlock()
+        t?.cancel()
         c.resume(returning: success)
         return true
     }
-
-    /// Time out the continuation for `(session, fragment)` (resumes false if still armed).
-    func timeout(session: Int, fragment: Int32) {
-        _ = resolve(session: session, fragment: fragment, success: false)
-    }
 }
 
 // MARK: - G2 Class (SGCManager implementation)
@@ -1704,31 +1803,104 @@ final class G2: NSObject, SGCManager {
     let hasMic = true
     nonisolated let firmwareFlasher = G2Flasher()
 
-    /// Glassly CFW advertises this capability string as top-level field 100 in
-    /// its G2 settings response. Stock firmware does not emit the field.
-    private var cfwCapabilityString: String?
-    /// True once the connection is classified either way (CFW detected, or a
-    /// definitive settings response without field 100). Until then legacy text
-    /// would race the classification and split draw/clear across render paths.
-    private var cfwClassified = false
-    private var cfwFeatures: Set<String> = []
-    /// "EVENCFW/NN" revision. Gates features with no capability token (mode-9 copies: revision 15).
-    private var cfwProtocolVersion = 0
+    /// nil until settings classify the connection as stock, upstream, or Glassly.
+    private struct SensorCommand {
+        let id: UUID
+        let data: Data
+        let complete: (Bool) -> Void
+    }
+
+    // Kept separate from scene coalescing: controls must never be dropped by a new frame.
+    private var sensorCommands: [SensorCommand] = []
+    private var sensorNavigationRecovering = false
+
+    func glassesSensorControl(sensor: String, operation: String, options: [String: Double]) async -> Bool {
+        guard supportsCfwTransport, !navigationModeActive,
+              sensorCommands.count < 8,
+              let data = G2Sensors.command(sensor: sensor, operation: operation, options: options) else { return false }
+        let id = UUID()
+        return await withCheckedContinuation { continuation in
+            sensorCommands.append(SensorCommand(id: id, data: data, complete: { continuation.resume(returning: $0) }))
+            signalDisplayDirty()
+            Task { @MainActor [weak self] in
+                try? await Task.sleep(nanoseconds: 10_000_000_000)
+                guard let self, let index = self.sensorCommands.firstIndex(where: { $0.id == id }) else { return }
+                self.sensorCommands.remove(at: index).complete(false)
+            }
+        }
+    }
+
+    private func cancelSensorCommands() {
+        sensorNavigationRecovering = false
+        let pending = sensorCommands
+        sensorCommands.removeAll()
+        for command in pending {
+            command.complete(false)
+        }
+    }
+
+    private var cfwClassification: G2CfwClassification?
+    private var cfwClassified: Bool {
+        cfwClassification != nil
+    }
+
+    private var cfwCapabilityString: String? {
+        cfwClassification?.capabilityString
+    }
+
     private var cfwSceneActive = false
     /// Rate limit on resurrecting the page for a blank scene; a non-blank one rebuilds immediately.
     private var cfwLastIdleResurrectAt: Date?
     private static let cfwIdleResurrectMinIntervalMs: Double = 5000
-    private static let cfwSceneContainerID: Int32 = 10
     private let cfwRenderer = G2CfwRenderer()
+    /// Private SID-0xf0 message transport (GLASSLYCFW/31): one deflate
+    /// context per connection, one stream per message, ACK-gated exactly like
+    /// the old image carrier was. Payloads still go out on the LEFT arm; the
+    /// right lens processes them over the frame bridge and its ACK returns
+    /// through the left. No EvenHub image container is involved any more.
+    private var cfwTransport = G2CfwTransport.Encoder()
+    private var cfwStreamSequence = UInt8.random(in: 0 ... 255)
+    private let cfwAckBox = G2CfwAckBox()
+    /// The container set is in CFW shape: the blank "dashboard" text object
+    /// only (touch capture + mic), no stock text or image containers.
+    private var cfwPageInstalled = false
     /// Deltas composite onto a shadow seeded by a mode-6 keyframe, so payloads drain in order.
     /// Kinds tag that chain: only `.full` may drop queued fulls/deltas; `.seed`/`.moveBundle` survive.
-    private enum CfwPayloadKind { case seed, full, delta, moveBundle, upload }
+    private enum CfwPayloadKind { case seed, full, delta, moveBundle, upload, scene }
     private struct CfwPayload {
         let kind: CfwPayloadKind
         let data: Data
+        /// Host frame this payload puts on the glasses — reported once acked.
+        var presents: SceneFrame.PresentTag? = nil
+        var originAt: TimeInterval?
+        var frameSeq = 0
+        var appId = ""
+        /// Lenses this payload is for (scene SHOWs split per lens once a frame uses element depth).
+        var lenses: UInt8 = G2CfwTransport.lensBoth
     }
 
     private var cfwPendingPayloads: [CfwPayload] = []
+    /// Bumped by every clear so an encoder suspended on its actor when the clear arrived is discarded.
+    private var cfwClearSerial = 0
+    /// Latest unencoded state. Only reconcileDisplay encodes it, once the
+    /// previous payload chain has drained, bounding work under backpressure.
+    private var cfwPendingFrame: SceneFrame? {
+        didSet {
+            if cfwPendingFrame != nil {
+                cfwPendingFrameAt = G2DisplayDiagnostics.now
+            }
+        }
+    }
+
+    private var cfwPendingFrameAt = G2DisplayDiagnostics.now
+    // Keep bounded render/BLE timings in phone logs so background stalls can
+    // be diagnosed from bug reports (one summary and at most one stall per second).
+    private let displayDiagnostics = G2DisplayDiagnostics(enabled: true)
+    private var diagnosticFrameSeq = 0
+    private var diagnosticAppId = ""
+    /// No-op frames may join the payload currently awaiting its last fragment ACK.
+    private var cfwInFlightPresentTag: SceneFrame.PresentTag?
+    private var cfwPayloadInFlight = false
     private var cfwShadowSeeded = false
     private var cfwLastFrame: SceneFrame?
     private var cfwLastBoxes: G2CfwRenderer.LensBoxes?
@@ -1764,40 +1936,62 @@ final class G2: NSObject, SGCManager {
     /// the CFW capability string is seen again.
     private var wakeLeaseWanted = false
 
-    private var supportsCfwSceneRendering: Bool {
-        cfwCapabilityString != nil
-            && ["img640", "imgz", "rle", "directfb"].allSatisfy(cfwFeatures.contains)
+    /// ANCS relay (CFW revision 24): field-125 record reassembly plus the 45 s
+    /// renewal of the firmware's fail-open 90 s relay lease. `ancsRelayLeaseHeld`
+    /// remembers whether the last control sent was ENABLE, so the notification
+    /// master toggle going off sends exactly one DISABLE.
+    private var ancsRelay = G2AncsRelay()
+    private var ancsRelayTask: Task<Void, Never>?
+    private var ancsRelayLeaseHeld = false
+    /// BLE keyboard bridge (CFW revision 39): one HID-over-GATT keyboard hosted
+    /// by the right lens, driven over settings fields 130/131 (G2KeyboardBridge).
+    private lazy var keyboardBridge = G2KeyboardBridge { [weak self] payload in
+        self?.sendKeyboardControl(payload)
+    }
+    private var notificationConfig: GlassesNotificationConfig?
+    private var notificationPhase = "idle"
+    /// Config last pushed on this connection. Device-ready and the engine's
+    /// connection watcher both apply on connect; the second identical apply
+    /// would re-push the allowlist file, which the glasses redisplay even on a
+    /// checksum cache hit.
+    private var lastAppliedNotificationConfig: GlassesNotificationConfig?
+
+    /// Glassly CFW at or above the supported revision. Anything else (stock,
+    /// upstream, older Glassly builds) is treated as stock.
+    private var supportsCfwTransport: Bool {
+        guard let classification = cfwClassification, classification.isGlassly else { return false }
+        return (classification.revision ?? 0) >= G2CfwClassification.minimumRevision
+    }
+
+    var supportsCfwSceneRendering: Bool {
+        supportsCfwTransport
             // Escape hatch (default ON): OFF falls back to stock containers. Reconnect to switch cleanly.
             && (DeviceStore.shared.get("bluetooth", "cfw_scene_renderer") as? Bool ?? true)
     }
 
-    private var hasCfwCarrier: Bool {
-        imageContainers.count == 1
-            && imageContainers[0].id == Self.cfwSceneContainerID
-            && imageContainers[0].x == 0 && imageContainers[0].y == 0
-            && imageContainers[0].width == 576 && imageContainers[0].height == 288
-    }
-
-    /// Mode-9 rect copies have no capability token; they shipped with
-    /// protocol revision 15 alongside the texture/font modes.
-    private var supportsCfwRectCopy: Bool {
-        cfwProtocolVersion >= 15
+    private var hasCfwPage: Bool {
+        cfwPageInstalled && textContainers.isEmpty && imageContainers.isEmpty
     }
 
-    /// Mode-15 builtin-font string draws (`font15` capability token).
-    private var supportsCfwBuiltinText: Bool {
-        cfwFeatures.contains("font15")
+    /// Glassly adds retained vector scenes and animation to upstream's raster protocol.
+    private var supportsCfwVectorScene: Bool {
+        supportsCfwSceneRendering && cfwClassification?.isGlassly == true
     }
 
-    /// Mode-12 uploads + mode-14 cached-glyph runs (mono text as draws).
-    private var supportsCfwTextureGlyphs: Bool {
-        cfwFeatures.contains("texcache12") && cfwFeatures.contains("texstr14")
-    }
+    /// Tagged commits report settings field 129 once the scene has settled.
+    private var supportsCfwSceneSettle: Bool { supportsCfwVectorScene }
 
-    /// Mode-12 uploads + mode-13 cached-image draws (repeated icons as draws).
-    private var supportsCfwTextureImages: Bool {
-        cfwFeatures.contains("texcache12") && cfwFeatures.contains("teximg13")
-    }
+    /// Residency on the glasses is unknown (a send failed): the next vector frame redefines what it shows.
+    private var cfwSceneInvalid = true
+    /// Object-cache session epoch shared by both lenses (GLASSLYCFW/38); 0 until
+    /// the RESET that opens a cache generation has been acknowledged.
+    private var cfwCacheEpoch: UInt16 = 0
+    /// Request id stamped into cache messages whose encoder left it 0.
+    private var cfwCacheRequest: UInt16 = 0
+    /// Cache generation whose RESET (and warm-up tween) went out.
+    private var cfwSceneWarmedGeneration = -1
+    /// Frames re-encoded after a MISSING reply, bounded per frame.
+    private var cfwMissingRetries = 0
 
     /// Connection state
     private var connectionState: String = ConnTypes.DISCONNECTED
@@ -1837,6 +2031,19 @@ final class G2: NSObject, SGCManager {
     private var recoveryInFlight = false
     private var lastRecoveryRebuildMs: Int64 = 0
     private let RECOVERY_DEBOUNCE_MS: Int64 = 1500
+    // A SHUTDOWN_PAGE we send is answered ~300 ms later by the firmware's
+    // teardown trio (shutdown notify, systemExit, 08011A00). Creating the next
+    // page before that lands makes the trio read as the NEW page dying:
+    // pageCreated flips false, the toggle recovers, and the firmware sees
+    // shutdown→create→create inside half a second — the rebuild storm the G2
+    // answers by dropping the link (GLASSLYCFW/29 died on every dashboard
+    // open this way). Resurrection and recovery wait out this window instead.
+    private var lastPageShutdownSentMs: Int64 = 0
+    private let PAGE_SHUTDOWN_SETTLE_MS: Int64 = 400
+    private var pageShutdownSettleWakeArmed = false
+    // Stock notifications panel hold: page rebuilds, fbguard lease and CFW frames stay
+    // down while the panel opens so EvenHub sends cannot snatch the screen back.
+    private var notificationsPanelHold = false
     // A systemExit that arrives while the page acked a carrier fragment this
     // recently is a phantom (the firmware emits exits even for healthy pages)
     // and is dropped entirely — see the SysEvent handler.
@@ -1965,7 +2172,7 @@ final class G2: NSObject, SGCManager {
     /// Current appId to associate EvenHub pages with (enables menu selection events)
     /// Set to the first menu item's appId so glasses know our page belongs to the menu
     private var activeMenuAppId: Int32?
-    private var lastClickTimestamp: Int64?
+    private var touchDebounce = G2TouchDebounce()
     private var lastEvenHubResponseTimestamp: Int64?
     private var lastMenuSelectTimestamp: Int64?
     private var lastGestureCtrlTimestamp: Int64?
@@ -1977,11 +2184,7 @@ final class G2: NSObject, SGCManager {
         let y: Int32
         let width: Int32
         let height: Int32
-        var name: String {
-            // The known-good CFW packet names its carrier "img00"; match it byte-for-byte
-            // (the name appears in both the page create and every image send).
-            id == G2.cfwSceneContainerID ? "img00" : "img-\(id)"
-        }
+        var name: String { "img-\(id)" }
 
         var bmpData: Data
         /// Set true when `bmpData` changes and the new pixels haven't been pushed to the glasses yet.
@@ -2092,39 +2295,34 @@ final class G2: NSObject, SGCManager {
 
     // MARK: - BLE Sending
 
-    // Per-side FIFO write queues, drained by a single paced async writer per side.
-    //
-    // We write `.withoutResponse` directly and pace with a small `Task.sleep` between packets —
-    // exactly like G1 (`G1.swift attemptSend`). We deliberately do NOT gate on
-    // `canSendWriteWithoutResponse` / wait for `peripheralIsReady(toSendWriteWithoutResponse:)`:
-    // iOS suppresses that "ready" callback for a backgrounded bluetooth-central app (G2 has no
-    // active AVAudioSession — glasses-mic audio arrives over BLE), so a gated drain DEADLOCKS in the
-    // background: the queue grows for the whole bg window and floods the glasses on resume — the
-    // captions "freeze in bg, then flood" bug. G1 never gates and never floods; this matches it.
-    // The pace replaces the gate's overflow protection (the original reason for gating). Any packet
-    // CoreBluetooth still drops self-heals: text is re-sent (TextContainer.pendingSends) and image
-    // fragments retry on their ACK (`awaitImageAck`).
-    private var leftWriteQueue: [Data] = []
-    private var rightWriteQueue: [Data] = []
+    /// Per-side FIFO writers. Stock and background CFW use 6 ms packet spacing.
+    /// Foreground CFW drains available credits in bounded bursts. Background
+    /// readiness can remain false for seconds, so polling it is insufficient.
+    /// Firmware ACKs, timeouts and resync still determine CFW delivery success.
+    private struct BleWrite {
+        let data: Data
+        let queuedAt: TimeInterval
+        let trace: G2DisplayDiagnostics.Fragment?
+        let isPending: (() -> Bool)?
+    }
+
+    private var leftWriteQueue: [BleWrite] = []
+    private var rightWriteQueue: [BleWrite] = []
     private var leftDraining = false
     private var rightDraining = false
-    // Pace between consecutive packets (~G1's chunk pacing). Off any external callback, so the drain
-    // keeps making progress in the background instead of waiting for a callback iOS won't deliver.
-    private let writePaceNanos: UInt64 = 6_000_000
-    // Diagnostic: warn if a side's queue ever backs up (it shouldn't now — the drainer is always
-    // making progress). Rate-limited. Prefixed "BGCAP:" so it's easy to grep/strip after validation.
-    private var bgcapDepthLogAt: Double = 0
-
-    private func sendToGlasses(_ packets: [Data], left: Bool = false, right: Bool = true) {
+    private let writePaceNanos = G2WritePacing.packetDelayNs
+    private func sendToGlasses(_ packets: [Data], left: Bool = false, right: Bool = true, trace: G2DisplayDiagnostics.Fragment? = nil, isPending: (() -> Bool)? = nil) {
         // OTA owns both links exclusively, including its short setup/teardown
         // windows. Normal display/settings/navigation traffic must not interleave.
         guard !firmwareFlashLifecycleActive, !firmwareFlasher.isActive else { return }
+        let queuedAt = G2DisplayDiagnostics.now
+        let writes = packets.map { BleWrite(data: $0, queuedAt: queuedAt, trace: trace, isPending: isPending) }
         if right {
-            rightWriteQueue.append(contentsOf: packets)
+            rightWriteQueue.append(contentsOf: writes)
             startDrain(right: true)
         }
         if left {
-            leftWriteQueue.append(contentsOf: packets)
+            leftWriteQueue.append(contentsOf: writes)
             startDrain(right: false)
         }
     }
@@ -2148,10 +2346,9 @@ final class G2: NSObject, SGCManager {
         }
     }
 
-    /// Drain one side's queue: write each packet directly (`.withoutResponse`), paced by a small
-    /// sleep. No `canSend` gate (see note above). Runs until the queue is empty, then clears the
-    /// per-side flag so the next enqueue restarts it.
+    /// Drain until empty, yielding after each CFW burst so UI/ACK work can run.
     private func drainLoop(right: Bool) async {
+        var burstCount = 0
         while true {
             guard let peripheral = right ? rightPeripheral : leftPeripheral,
                   let char = right ? rightWriteChar : leftWriteChar
@@ -2173,26 +2370,64 @@ final class G2: NSObject, SGCManager {
                 }
                 return
             }
-            if depth > 20 {
-                let now = Date().timeIntervalSince1970
-                if now - bgcapDepthLogAt >= 1.0 {
-                    Bridge.log("BGCAP: g2 write queue depth=\(depth) side=\(right ? "R" : "L") (draining, not blocked)")
-                    bgcapDepthLogAt = now
+            // ACK timeout/cancellation can happen before CoreBluetooth grants
+            // credits. Drop that stream before checking credits, so its stale
+            // packets cannot replay ahead of the recovery frame.
+            let next = right ? rightWriteQueue[0] : leftWriteQueue[0]
+            if let isPending = next.isPending, !isPending() {
+                if right {
+                    rightWriteQueue.removeFirst()
+                } else {
+                    leftWriteQueue.removeFirst()
                 }
+                displayDiagnostics.count("txExpiredPackets")
+                continue
+            }
+            // Re-evaluate on every iteration, including after a credit wait:
+            // backgrounding must release an already-blocked foreground drain.
+            let cfwEnabled = cfwCapabilityString != nil
+            let pacing = G2WritePacing(cfwEnabled: cfwEnabled, applicationState: UIApplication.shared.applicationState)
+            let peripheralReady = peripheral.canSendWriteWithoutResponse
+            if !pacing.canWrite(peripheralReady: peripheralReady) {
+                burstCount = 0
+                let stalledAt = G2DisplayDiagnostics.now
+                try? await Task.sleep(nanoseconds: writePaceNanos)
+                displayDiagnostics.timing(right ? "creditWaitMsR" : "creditWaitMsL", (G2DisplayDiagnostics.now - stalledAt) * 1000)
+                continue
             }
             let packet = right ? rightWriteQueue.removeFirst() : leftWriteQueue.removeFirst()
-            peripheral.writeValue(packet, for: char, type: .withoutResponse)
-            try? await Task.sleep(nanoseconds: writePaceNanos)
+            displayDiagnostics.timing("writeQueueMs", (G2DisplayDiagnostics.now - packet.queuedAt) * 1000)
+            peripheral.writeValue(packet.data, for: char, type: .withoutResponse)
+            packet.trace?.wrote()
+            if cfwEnabled, pacing == .timed {
+                displayDiagnostics.count("backgroundPacedPackets")
+                if !peripheralReady {
+                    displayDiagnostics.count("backgroundWritesWithoutCredit")
+                }
+            }
+            displayDiagnostics.count("txBytes", packet.data.count)
+            displayDiagnostics.count("txPackets")
+            displayDiagnostics.count(right ? "txBytesR" : "txBytesL", packet.data.count)
+            if pacing == .creditBurst {
+                burstCount += 1
+                if burstCount == 4 {
+                    burstCount = 0
+                    await Task.yield()
+                }
+            } else {
+                burstCount = 0
+                try? await Task.sleep(nanoseconds: writePaceNanos)
+            }
         }
     }
 
-    private func sendEvenHubCommand(_ payload: Data, left: Bool = false, right: Bool = true) {
+    private func sendEvenHubCommand(_ payload: Data, left: Bool = false, right: Bool = true, trace: G2DisplayDiagnostics.Fragment? = nil) {
         let packets = sendManager.buildPackets(
             serviceId: ServiceID.evenHub.rawValue,
             payload: payload,
             reserveFlag: true
         )
-        sendToGlasses(packets, left: left, right: right)
+        sendToGlasses(packets, left: left, right: right, trace: trace)
     }
 
     private func sendDevSettingsCommand(_ payload: Data, left: Bool = false, right: Bool = true) {
@@ -2454,11 +2689,10 @@ final class G2: NSObject, SGCManager {
             DeviceStore.shared.get("bluetooth", "calendar_events") as? [[String: Any]] ?? []
         sendCalendarEvents(calendarEvents)
 
-        // push ANCS notification config (display options + app filter) and
-        // surface the current ANCS authorization state to the UI
+        // re-push the stored notification config and surface the current ANCS
+        // authorization state to the UI
         publishAncsAuthorization()
-        sendNotificationCtrl()
-        sendNotificationFilter()
+        reapplyNotificationConfig()
     }
 
     // MARK: - Heartbeats
@@ -2496,6 +2730,7 @@ final class G2: NSObject, SGCManager {
                 try? await Task.sleep(nanoseconds: 100_000_000)
                 guard !Task.isCancelled else { break }
                 self?.displayDirtySignal?.yield()
+                self?.logDisplayDiagnostics()
             }
         }
         displayReconcileTask = Task { [weak self] in
@@ -2526,6 +2761,32 @@ final class G2: NSObject, SGCManager {
         displayDirtySignal?.yield()
     }
 
+    private func logDisplayDiagnostics() {
+        guard displayDiagnostics.isSampleDue else { return }
+        if let line = displayDiagnostics.session([
+            "cfw": cfwCapabilityString ?? "stock",
+            "fpsLimit": DeviceStore.shared.get("bluetooth", "display_max_fps") as? Int ?? 8,
+            "mtuL": leftPeripheral?.maximumWriteValueLength(for: .withoutResponse) ?? 0,
+            "mtuR": rightPeripheral?.maximumWriteValueLength(for: .withoutResponse) ?? 0,
+        ]) {
+            Bridge.log(line)
+        }
+        let busy = !leftWriteQueue.isEmpty || !rightWriteQueue.isEmpty || !cfwPendingPayloads.isEmpty || cfwPendingFrame != nil
+        if let line = displayDiagnostics.sample(context: [
+            "app": cfwLastFrame?.appId ?? "", "seq": cfwLastFrame?.seq ?? 0,
+            "page": pageCreated, "pageGeneration": pageGeneration,
+            "qL": leftWriteQueue.count, "qR": rightWriteQueue.count,
+            // Present only while that side has no write credit.
+            "blockedL": leftPeripheral?.canSendWriteWithoutResponse == false,
+            "blockedR": rightPeripheral?.canSendWriteWithoutResponse == false,
+            "payloadQueue": cfwPendingPayloads.count, "pendingFrame": cfwPendingFrame != nil,
+            "mic": evenHubMicIntent,
+            "background": UIApplication.shared.applicationState != .active,
+        ], busy: busy) {
+            Bridge.log(line)
+        }
+    }
+
     private func sendEvenHubHeartbeat() {
         let isFullyBooted = DeviceStore.shared.get("glasses", "fullyBooted") as? Bool ?? false
         guard isFullyBooted else { return }
@@ -2565,24 +2826,67 @@ final class G2: NSObject, SGCManager {
         setDashboardMenu(menuItems)
     }
 
-    // MARK: - Notifications (on-glass ANCS display options + app filter)
+    // MARK: - Notifications (SGCManager)
+
+    /// The config is stored whether or not it can be pushed now; device-ready
+    /// re-applies it against the firmware that actually came up.
+    func setGlassesNotificationConfig(_ config: GlassesNotificationConfig) throws {
+        notificationConfig = config
+        let ready = DeviceStore.shared.get("glasses", "fullyBooted") as? Bool ?? false
+        guard ready else {
+            notificationPhase = "stale"
+            publishNotificationStatus()
+            return
+        }
+        applyNotificationConfig(config)
+    }
+
+    func glassesNotificationStatus() -> GlassesNotificationStatus {
+        GlassesNotificationStatus(
+            supported: true,
+            feed: "ancs",
+            access: ancsAccess,
+            phase: notificationPhase,
+            config: notificationConfig,
+            error: nil
+        )
+    }
+
+    /// The glasses run their own ANCS client, so content never crosses the phone link.
+    func uploadPhoneNotification(_: PhoneNotificationUpload) throws {
+        throw GlassesNotificationError.unsupported
+    }
+
+    /// Whether the glasses may read the phone's notification stream. No
+    /// peripheral yet means the consent state is simply not known.
+    private var ancsAccess: String {
+        guard leftPeripheral != nil || rightPeripheral != nil else { return "unknown" }
+        let authorized = (leftPeripheral?.ancsAuthorized ?? false)
+            || (rightPeripheral?.ancsAuthorized ?? false)
+        return authorized ? "granted" : "denied"
+    }
+
+    private func reapplyNotificationConfig() {
+        guard let config = notificationConfig else { return }
+        applyNotificationConfig(config)
+    }
 
-    /// Push NotificationControl (master toggle, auto-display popup, on-screen
-    /// duration, avoid-disturb) from the DeviceStore `notification_ctrl` dict.
-    /// Full state is retransmitted on every change — that matches the stock app
+    /// Full state is retransmitted on every apply — that matches the stock app
     /// and the glasses echo it back as the ack.
-    func sendNotificationCtrl() {
-        let ctrl = DeviceStore.shared.get("bluetooth", "notification_ctrl") as? [String: Any] ?? [:]
-        let enabled = ctrl["enabled"] as? Bool ?? true
-        let autoDisplay = ctrl["auto_display"] as? Bool ?? true
-        let dispTime = ctrl["disp_time"] as? Int ?? 5
-        let avoidDisturb = ctrl["avoid_disturb"] as? Bool ?? true
+    private func applyNotificationConfig(_ config: GlassesNotificationConfig) {
+        if config == lastAppliedNotificationConfig {
+            return
+        }
+        lastAppliedNotificationConfig = config
+        notificationPhase = "applying"
+        publishNotificationStatus()
 
+        let dispTime = G2NotificationTuning.snapPopupSeconds(config.popupSeconds)
         var ctrlW = ProtobufWriter()
-        ctrlW.writeInt32Field(1, enabled ? 1 : 0) // notifEnable
-        ctrlW.writeInt32Field(2, autoDisplay ? 1 : 0) // autoDispEnable
-        ctrlW.writeInt32Field(3, Int32(dispTime)) // dispTime (0/5/7/10 s)
-        ctrlW.writeInt32Field(5, avoidDisturb ? 1 : 0) // avoidDisturbEnable
+        ctrlW.writeInt32Field(1, config.enabled ? 1 : 0) // notifEnable
+        ctrlW.writeInt32Field(2, config.popups ? 1 : 0) // autoDispEnable
+        ctrlW.writeInt32Field(3, dispTime) // dispTime (0/5/7/10 s)
+        ctrlW.writeInt32Field(5, config.holdDuringApps ? 1 : 0) // avoidDisturbEnable
 
         var pkg = ProtobufWriter()
         pkg.writeInt32Field(1, NotificationCmd.ctrl.rawValue)
@@ -2590,33 +2894,45 @@ final class G2: NSObject, SGCManager {
         pkg.writeMessageField(3, ctrlW.data)
         sendNotificationCommand(pkg.data)
         Bridge.log(
-            "G2: Sent notification ctrl enabled=\(enabled) autoDisplay=\(autoDisplay) dispTime=\(dispTime) avoidDisturb=\(avoidDisturb)"
+            "G2: Sent notification ctrl enabled=\(config.enabled) popups=\(config.popups) dispTime=\(dispTime) hold=\(config.holdDuringApps)"
         )
-    }
+        syncAncsRelay()
 
-    /// Push the ANCS app allowlist from the DeviceStore `notification_filter`
-    /// dict ({enabled, apps: [{id, name}]}). The list travels as the
-    /// `user/notify_whitelist.json` file (the protobuf whitelist message only
-    /// carries the enable toggle); the WHITELIST_CTRL toggle goes after the
-    /// file so the firmware reloads with the new list in place.
-    func sendNotificationFilter() {
-        let filter = DeviceStore.shared.get("bluetooth", "notification_filter") as? [String: Any] ?? [:]
-        let enabled = filter["enabled"] as? Bool ?? false
-        let apps = filter["apps"] as? [[String: Any]] ?? []
         Task { [weak self] in
-            await self?.pushNotificationFilter(enabled: enabled, apps: apps)
+            let landed = await self?.pushNotificationFilter(for: config) ?? false
+            await MainActor.run {
+                guard let self else { return }
+                // A push that never reached the glasses must not dedupe the retry.
+                if !landed, self.lastAppliedNotificationConfig == config {
+                    self.lastAppliedNotificationConfig = nil
+                }
+                self.notificationPhase = "applied"
+                self.publishNotificationStatus()
+            }
         }
     }
 
-    private func pushNotificationFilter(enabled: Bool, apps: [[String: Any]]) async {
-        let entries = apps.compactMap { app -> (id: String, name: String)? in
-            guard let id = app["id"] as? String, !id.isEmpty else { return nil }
-            return (id: id, name: app["name"] as? String ?? id)
-        }
+    /// The allowlist travels as the `user/notify_whitelist.json` file (the
+    /// protobuf whitelist message only carries the enable toggle); the
+    /// WHITELIST_CTRL toggle goes after the file so the firmware reloads with
+    /// the new list in place.
+    /// Returns whether the allowlist file reached the glasses.
+    private func pushNotificationFilter(for config: GlassesNotificationConfig) async -> Bool {
+        let enabled = G2NotificationTuning.filterEnabled(for: config)
+        let entries = config.allowedApps.map { (id: $0.id, name: $0.name) }
         // The file is written even when filtering is off so a later enable
         // toggles against the user's current list, not a stale one.
         let json = G2NotifyFile.whitelistJson(filterEnabled: enabled, apps: entries)
-        await sendNotifyFile(named: G2NotifyFile.whitelistFilename, content: json)
+        let pushed = await sendNotifyFile(
+            named: G2NotifyFile.whitelistFilename, content: json, fileType: .whitelist
+        )
+        // Enabling against a list that never landed (flash in progress, file characteristic not
+        // yet discovered) would filter on whatever is on flash — absent means every notification
+        // is dropped. Leave the firmware toggle alone; device-ready re-pushes the whole config.
+        if enabled, !pushed {
+            Bridge.log("G2: notification filter enable deferred — whitelist file not pushed")
+            return false
+        }
 
         var wlW = ProtobufWriter()
         wlW.writeInt32Field(1, enabled ? 0 : 1) // whitelistDisable (disabled = fail-open)
@@ -2626,20 +2942,37 @@ final class G2: NSObject, SGCManager {
         pkg.writeMessageField(6, wlW.data)
         sendNotificationCommand(pkg.data)
         Bridge.log("G2: Sent notification filter enabled=\(enabled) apps=\(entries.count)")
+        return pushed
+    }
+
+    private func publishNotificationStatus() {
+        Bridge.sendTypedMessage(
+            "glasses_notification_status", body: glassesNotificationStatus().dictionary
+        )
     }
 
     /// File-transfer push (services 0xC4/0xC5 on the dedicated file
     /// characteristic): FILE_CHECK header → START → DATA → END, per arm. The
     /// glasses cache by checksum but still expect the data packets either way,
     /// so no branching on the CACHE_HIT/MISS response is needed.
-    private func sendNotifyFile(named filename: String, content: Data) async {
-        guard !firmwareFlashLifecycleActive, !firmwareFlasher.isActive else { return }
-        let header = G2NotifyFile.fileCheckHeader(filename: filename, content: content)
+    /// Returns false when the file was skipped for any connected arm (flash in
+    /// progress, file characteristic not discovered) so callers don't act on it.
+    @discardableResult
+    private func sendNotifyFile(
+        named filename: String, content: Data, fileType: G2NotifyFile.FileType
+    ) async -> Bool {
+        guard !firmwareFlashLifecycleActive, !firmwareFlasher.isActive else { return false }
+        let header = G2NotifyFile.fileCheckHeader(
+            filename: filename, content: content, fileType: fileType
+        )
         var pushedSides: [String] = []
+        var skippedArm = false
         for right in [true, false] {
-            guard let peripheral = right ? rightPeripheral : leftPeripheral,
-                  let char = right ? rightFileWriteChar : leftFileWriteChar
-            else { continue }
+            guard let peripheral = right ? rightPeripheral : leftPeripheral else { continue }
+            guard let char = right ? rightFileWriteChar : leftFileWriteChar else {
+                skippedArm = true
+                continue
+            }
             let writeType: CBCharacteristicWriteType =
                 char.properties.contains(.writeWithoutResponse) ? .withoutResponse : .withResponse
 
@@ -2663,6 +2996,7 @@ final class G2: NSObject, SGCManager {
         Bridge.log(
             "G2: Pushed \(filename) (\(content.count) bytes) to [\(pushedSides.joined(separator: ","))]"
         )
+        return !pushedSides.isEmpty && !skippedArm
     }
 
     // MARK: - SGCManager: Display Control
@@ -2705,9 +3039,7 @@ final class G2: NSObject, SGCManager {
         // Bridge.log("G2: sendTextWall(\(text.prefix(50))...)")
 
         // ignore events while the ER dashboard is open:
-        let useNativeDashboard =
-            DeviceStore.shared.get("bluetooth", "use_native_dashboard") as? Bool ?? false
-        if useNativeDashboard && dashboardShowing > 0 {
+        if dashboardShowing > 0 {
             return
         }
 
@@ -2731,7 +3063,7 @@ final class G2: NSObject, SGCManager {
         if supportsCfwSceneRendering {
             if text.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
                 // A blank wall is the idle state: keep the carrier alive for touch and mic.
-                let carrierWasConfigured = installCfwCarrierIfNeeded()
+                let carrierWasConfigured = installCfwPageIfNeeded()
                 cfwClear()
                 if !carrierWasConfigured, pageCreated {
                     // Carrier just replaced live stock containers (see clearDisplay).
@@ -2740,7 +3072,7 @@ final class G2: NSObject, SGCManager {
                 return
             }
             let frame = SceneFrame(
-                appId: "legacy-text", epoch: 0, replay: true,
+                appId: "legacy-text", epoch: 0, replay: false,
                 elements: [
                     SceneElement(
                         id: "legacy-text", type: "text", x: rx, y: ry, w: rw, h: rh,
@@ -2780,9 +3112,6 @@ final class G2: NSObject, SGCManager {
                 )
                 return
             }
-            Bridge.log(
-                "G2: sendText() - reusing container \(container.id) for rect \(rx),\(ry) \(rw)x\(rh)"
-            )
             return
         }
 
@@ -2803,7 +3132,6 @@ final class G2: NSObject, SGCManager {
     }
 
     func sendDoubleTextWall(_ top: String, _ bottom: String) async {
-        Bridge.log("G2: sendDoubleTextWall() - top: \(top), bottom: \(bottom)")
         // G2 doesn't have native double text wall, combine them
         let combined = top + "\n\n" + bottom
         await sendTextWall(combined)
@@ -2909,6 +3237,8 @@ final class G2: NSObject, SGCManager {
             Bridge.log("G2: applySceneFrame — structural changes, ONE coalesced rebuild for the whole frame")
             await coalescedPageRebuild()
         }
+        // Stock firmware: text sends are unacked; the awaited verbs above are the best signal there is.
+        frame.reportPresented(true)
     }
 
     /// Render `frame` phone-side and queue it for the CFW carrier. Installs the
@@ -2916,15 +3246,21 @@ final class G2: NSObject, SGCManager {
     /// rebuilds the page; `rebuildState` re-seeds and re-queues from
     /// `cfwLastFrame` once the new page is up.
     private func applyCfwScene(_ frame: SceneFrame) async {
-        let carrierWasConfigured = installCfwCarrierIfNeeded()
+        displayDiagnostics.count("framesIn")
+        if cfwPendingFrame != nil {
+            displayDiagnostics.count("coalesced")
+        }
+        // Held: retain the frame so the post-hold rebuild re-sends it, but paint nothing now.
+        if notificationsPanelHold {
+            cfwLastFrame = frame
+            return
+        }
+        let carrierWasConfigured = installCfwPageIfNeeded()
         cfwLastFrame = frame
         // Lease before the frame: a fresh FB_ACQUIRE resets preservation, and
         // the frame queued below is what re-arms it.
         startFbLease()
-        guard await enqueueCfwFrame(frame) else {
-            Bridge.log("G2: CFW scene encode failed; retaining the previous frame")
-            return
-        }
+        cfwPendingFrame = frame
         cfwSceneActive = true
         signalDisplayDirty()
 
@@ -2934,17 +3270,13 @@ final class G2: NSObject, SGCManager {
         }
     }
 
-    /// Stock's window placement for the current height/depth settings.
-    /// `pinDepth` forces depth level 1, the only level where both lenses share
-    /// an x offset — required whenever the frame uses mode-15 text draws,
-    /// which have no per-lens variant and would otherwise land 16 px apart
-    /// from the window content (double vision). Height still follows the user.
-    private func cfwBoxes(for frame: SceneFrame, pinDepth: Bool) -> G2CfwRenderer.LensBoxes {
+    /// Apply the global placement to every scene; miniapps only supply relative element depth.
+    private func cfwBoxes(for frame: SceneFrame) -> G2CfwRenderer.LensBoxes {
         let height = DeviceStore.shared.get("bluetooth", "dashboard_height") as? Int ?? 4
-        let depth = pinDepth ? 1 : (DeviceStore.shared.get("bluetooth", "dashboard_depth") as? Int ?? 2)
+        let depth = DeviceStore.shared.get("bluetooth", "dashboard_depth") as? Int ?? 2
         return G2CfwRenderer.lensBoxes(
             canvasWidth: frame.canvasWidth, canvasHeight: frame.canvasHeight,
-            heightLevel: height, depthLevel: depth
+            heightLevel: height, depthLevel: G2CfwRenderer.depthLevel(forSetting: depth)
         )
     }
 
@@ -2957,15 +3289,21 @@ final class G2: NSObject, SGCManager {
     }
 
     /// Forget the on-glass shadow: the next frame is preceded by a black keyframe.
-    private func cfwResetShadow() {
+    /// `keepCache` keeps the object-cache session; the caller forgets the uploads it drops.
+    private func cfwResetShadow(keepCache: Bool = false) {
+        displayDiagnostics.count("resync")
+        cfwPendingFrame = nil
         cfwPendingPayloads.removeAll()
+        cfwSceneInvalid = true
         cfwShadowSeeded = false
         cfwLastBoxes = nil
         cfwPrevRaster = nil
         cfwLastTextDraws = []
         cfwDeltasSinceFull = 0
-        // Dropped queued uploads leave glyph residency unknown; make the cache model re-learn.
+        guard !keepCache else { return }
+        // Dropped queued uploads leave residency unknown; make the cache model re-learn.
         cfwCacheGeneration += 1
+        cfwCacheEpoch = 0
     }
 
     /// The CFW context is PER LENS — each arm runs its own firmware instance
@@ -2982,14 +3320,17 @@ final class G2: NSObject, SGCManager {
         sendToGlasses(packets, left: true, right: true)
     }
 
-    /// Acquire the fbguard lease and keep renewing it while CFW scene
-    /// rendering owns the panel. A fresh acquire resets the firmware's
-    /// preservation (the next presented direct frame re-arms it), so this runs
-    /// BEFORE the frame is queued. Stops with a release as soon as scene mode
-    /// is inactive or the page went down, so a stock surface (dashboard, nav)
-    /// is never frozen under a preserved direct frame.
+    /// Acquire the fbguard lease and keep renewing it for as long as our CFW
+    /// page is up, as upstream Faceclaw does for its whole session. A fresh
+    /// acquire resets the firmware's preservation (the next presented direct
+    /// frame re-arms it), so this runs BEFORE the frame is queued. The lease
+    /// is deliberately NOT tied to `cfwSceneActive`: a blank panel (HIDE)
+    /// keeps the on-glass object cache, and releasing the lease would free it,
+    /// turning the next dashboard open into a cold RESET + full upload. Stock
+    /// surfaces (dashboard, nav, notifications) release explicitly before they
+    /// take the panel, so nothing is frozen under a preserved direct frame.
     private func startFbLease() {
-        guard fbLeaseTask == nil else { return }
+        guard fbLeaseTask == nil, !notificationsPanelHold else { return }
         sendFaceclawFbControl(acquire: true)
         fbLeaseTask = Task { @MainActor [weak self] in
             while !Task.isCancelled {
@@ -2998,7 +3339,7 @@ final class G2: NSObject, SGCManager {
                 // supportsCfwSceneRendering: the cfw_scene_renderer escape
                 // hatch may have been flipped off mid-session — without this
                 // check the lease renews forever while frames go stock.
-                if self.cfwSceneActive, self.pageCreated, self.dashboardShowing == 0,
+                if self.pageCreated, self.dashboardShowing == 0, !self.navigationModeActive,
                    self.supportsCfwSceneRendering
                 {
                     self.sendFaceclawFbControl(acquire: true)
@@ -3016,8 +3357,9 @@ final class G2: NSObject, SGCManager {
         if sendRelease {
             sendFaceclawFbControl(acquire: false)
         }
-        // Lease end frees the on-glass texture cache; the model must re-learn.
+        // Lease end frees the on-glass object cache; the model must re-learn.
         cfwCacheGeneration += 1
+        cfwCacheEpoch = 0
     }
 
     /// Enable or disable Glassly ownership of the stock wake paths. While the
@@ -3076,6 +3418,276 @@ final class G2: NSObject, SGCManager {
         }
     }
 
+    // MARK: - BLE link speed (CFW revision 26)
+
+    /// Revision 26 lets the phone choose the connection profile: stock (the
+    /// default: 15-30 ms, then the one-minute slow-mode timer) or fast (7.5 ms,
+    /// latency 0, slow mode suppressed). Each lens has its own link, so the
+    /// control (G2BleLink, field 127) goes to both arms. The flag lives in lens
+    /// RAM and boots stock, so a wanted FAST is re-sent on every CFW detection.
+    private var supportsBleLinkControl: Bool { supportsCfwTransport }
+
+    /// The debug setting: caller intent, read at send time.
+    private var fastBleWanted: Bool {
+        DeviceStore.shared.get("bluetooth", "cfw_fast_ble") as? Bool ?? false
+    }
+
+    /// Last field-128 status seen, so only changes are logged.
+    private var lastBleLinkStatus: G2BleLink.Status?
+
+    private func sendBleLinkControl(_ op: G2BleLink.Op) {
+        let packets = sendManager.buildPackets(
+            serviceId: ServiceID.g2Setting.rawValue,
+            payload: G2BleLink.controlPacket(op: op),
+            reserveFlag: true
+        )
+        sendToGlasses(packets, left: true, right: true)
+        Bridge.log("G2: BLE link control -> \(op)")
+    }
+
+    /// Push the setting after CFW detection. Only a wanted FAST is sent: the
+    /// firmware boots on the stock profile, so STOCK would be a no-op.
+    private func syncBleLink() {
+        guard supportsBleLinkControl, fastBleWanted else { return }
+        sendBleLinkControl(.fast)
+    }
+
+    /// Live cfw_fast_ble switch. A stock device, an older CFW, or a
+    /// pre-classification connect reads the setting later on detection.
+    func cfwFastBleToggled(_ enabled: Bool) async {
+        guard supportsBleLinkControl else {
+            Bridge.log("G2: cfw_fast_ble \(enabled ? "ON" : "OFF") — no link control on this firmware; applies on next CFW detection")
+            return
+        }
+        sendBleLinkControl(enabled ? .fast : .stock)
+    }
+
+    // MARK: - ANCS relay (CFW revision 24)
+
+    /// The stock firmware reads the phone's notifications over ANCS on the
+    /// right lens but only reports the source app; revision 24 relays the
+    /// whole notification as sid-0x09 field-125 records (G2AncsRelay). Only the
+    /// right lens subscribes to ANCS and only it can notify the phone, so the
+    /// control packets go to that arm alone.
+    private var supportsAncsRelay: Bool {
+        cfwClassification?.isGlassly == true
+    }
+
+    /// The user's notification master toggle, the same one pushed on-glass with
+    /// the config: with it off the relay stays disabled so no notification
+    /// traffic crosses the link.
+    private var ancsRelayWanted: Bool {
+        notificationConfig?.enabled ?? true
+    }
+
+    private func sendAncsControl(_ payload: Data) {
+        let packets = sendManager.buildPackets(
+            serviceId: ServiceID.g2Setting.rawValue,
+            payload: payload,
+            reserveFlag: true
+        )
+        sendToGlasses(packets, left: false, right: true)
+    }
+
+    // MARK: - BLE keyboard bridge (CFW revision 39)
+
+    /// Keyboard controls are settings requests for the right lens alone: only
+    /// it hosts the keyboard link and only it emits field-131 events.
+    private func sendKeyboardControl(_ payload: Data) {
+        let packets = sendManager.buildPackets(
+            serviceId: ServiceID.g2Setting.rawValue,
+            payload: payload,
+            reserveFlag: true
+        )
+        sendToGlasses(packets, left: false, right: true)
+    }
+
+    func keyboardScan() async throws -> [[String: Any]] {
+        try await keyboardBridge.scan().map(G2KeyboardBridge.advertValues)
+    }
+
+    func keyboardConnect(address: String, addressType: Int, name: String) async throws {
+        try await keyboardBridge.connect(address: address, addressType: addressType, name: name)
+    }
+
+    func keyboardReconnect() async throws {
+        try await keyboardBridge.reconnect()
+    }
+
+    func keyboardDisconnect() async throws {
+        try await keyboardBridge.disconnect()
+    }
+
+    func keyboardForget() async {
+        await keyboardBridge.forget()
+    }
+
+    func keyboardPasskey(_ pin: Int) async throws {
+        try await keyboardBridge.passkey(pin)
+    }
+
+    func keyboardCompare(_ accept: Bool) async throws {
+        try await keyboardBridge.compare(accept)
+    }
+
+    func keyboardStatus() async -> [String: Any] {
+        await keyboardBridge.status()
+    }
+
+    /// Arm the relay lease and keep it renewed every 45 s inside the firmware's
+    /// 90 s expiry. ENABLE doubles as the renewal: the firmware treats it as a
+    /// plain extension while the lease is live, and unlike RENEW it also
+    /// recovers a lease the glasses lost (lens reset, missed first packet).
+    private func startAncsRelay() {
+        guard supportsAncsRelay, ancsRelayTask == nil else { return }
+        ancsRelay.reset()
+        ancsRelayLeaseHeld = false
+        ancsRelayTask = Task { @MainActor [weak self] in
+            while !Task.isCancelled {
+                try? await Task.sleep(nanoseconds: 45_000_000_000)
+                guard let self, !Task.isCancelled else { return }
+                self.ancsRelay.prune(olderThan: 30)
+                self.syncAncsRelay()
+            }
+        }
+        syncAncsRelay()
+    }
+
+    /// ENABLE while the master toggle is on; one DISABLE when it goes off.
+    /// Runs on every renewal tick and whenever the toggle is pushed on-glass;
+    /// a no-op until CFW detection has started the relay.
+    private func syncAncsRelay() {
+        guard ancsRelayTask != nil else { return }
+        if ancsRelayWanted {
+            sendAncsControl(G2AncsRelay.controlPacket(op: .enable))
+            ancsRelayLeaseHeld = true
+        } else if ancsRelayLeaseHeld {
+            sendAncsControl(G2AncsRelay.controlPacket(op: .disable))
+            ancsRelayLeaseHeld = false
+        }
+    }
+
+    private func stopAncsRelay(sendDisable: Bool) {
+        ancsRelayTask?.cancel()
+        ancsRelayTask = nil
+        if sendDisable, ancsRelayLeaseHeld {
+            sendAncsControl(G2AncsRelay.controlPacket(op: .disable))
+        }
+        ancsRelayLeaseHeld = false
+        ancsRelay.reset()
+    }
+
+    /// Perform a relayed notification's positive (open) or negative (clear)
+    /// action on the phone through the glasses' ANCS control point.
+    func ancsNotificationAction(notificationId: String, positive: Bool) {
+        guard supportsAncsRelay, notificationId.hasPrefix("ancs-"),
+              let uid = UInt32(notificationId.dropFirst("ancs-".count))
+        else { return }
+        sendAncsControl(G2AncsRelay.actionPacket(uid: uid, positive: positive))
+    }
+
+    /// One field-125 record from the right lens. Completed notifications feed
+    /// the same phone_notification / phone_notification_dismissed events as
+    /// Android's listener and Mentra Live's relay; APP records feed the
+    /// seen-apps store behind the notification filter UI.
+    private func handleAncsRelayRecord(_ record: Data) {
+        guard let event = ancsRelay.ingest(record) else { return }
+        let now = Int64(Date().timeIntervalSince1970 * 1000)
+        switch event {
+        case let .notification(n):
+            // iOS replays every existing notification when the lens
+            // subscribes; those are not new arrivals and would flood the glass.
+            if n.flags.contains(.preExisting) {
+                Bridge.log("G2: ANCS relay skipping pre-existing \(n.notificationId) from \(n.appIdentifier)")
+                return
+            }
+            let content = [n.subtitle, n.message].filter { !$0.isEmpty }.joined(separator: "\n")
+            Bridge.sendTypedMessage(
+                "phone_notification",
+                body: [
+                    "notificationId": n.notificationId,
+                    "app": ancsRelay.appNames[n.appIdentifier] ?? n.appIdentifier,
+                    "title": n.title,
+                    "content": content,
+                    "priority": n.flags.contains(.important) ? "1" : "0",
+                    "timestamp": G2AncsRelay.timestampMs(date: n.date),
+                    "packageName": n.appIdentifier,
+                ]
+            )
+        case let .removed(uid, appIdentifier):
+            Bridge.sendTypedMessage(
+                "phone_notification_dismissed",
+                body: [
+                    "notificationId": "ancs-\(uid)",
+                    "notificationKey": "ancs-\(uid)",
+                    "packageName": appIdentifier ?? "",
+                    "timestamp": now,
+                ]
+            )
+        case let .appName(appIdentifier, displayName):
+            Bridge.sendTypedMessage(
+                "notification_app_seen",
+                body: ["appId": appIdentifier, "displayName": displayName, "timestamp": now]
+            )
+        case let .status(s):
+            Bridge.log(
+                "G2: ANCS relay status enabled=\(s.enabled) side=\(s.side) sent=\(s.sent) drops=\(s.drops) sendErrors=\(s.sendErrors)"
+            )
+        }
+    }
+
+    /// Queue `frame` as a retained-scene patch: the firmware keeps the slots,
+    /// tweens transitions itself, and renders every frame into its own buffer.
+    /// Returns false when the frame does not fit, so the raster path takes it.
+    private func enqueueCfwVectorFrame(_ frame: SceneFrame) async -> Bool {
+        let generation = cfwCacheGeneration
+        let clearSerial = cfwClearSerial
+        let boxes = cfwBoxes(for: frame)
+        let backlogged = cfwPendingPayloads.filter { $0.kind == .scene }.count >= Self.cfwMaxQueuedUpdates
+        if backlogged {
+            cfwPendingPayloads.removeAll { $0.kind == .scene }
+            cfwSceneInvalid = true
+        }
+        if cfwLastBoxes != boxes {
+            cfwSceneInvalid = true
+        }
+        guard let encoded = await cfwRenderer.encodeVector(
+            frame, boxes: boxes, cacheGeneration: cfwCacheGeneration, invalidate: cfwSceneInvalid,
+            inlineText: true, tag: supportsCfwSceneSettle ? frame.seq & 0xFFFF : nil
+        ) else {
+            displayDiagnostics.count("vectorFallback")
+            cfwSceneInvalid = true
+            return false
+        }
+        guard generation == cfwCacheGeneration, clearSerial == cfwClearSerial else { return false }
+        cfwSceneInvalid = false
+        displayDiagnostics.count("vectorFrames")
+        cfwLastBoxes = boxes
+        // A later raster frame must start from a keyframe: the panel shows the scene, not the shadow.
+        cfwDeltasSinceFull = Self.cfwMaxDeltasBetweenFullFrames
+        if encoded.uploads.isEmpty, !encoded.changed,
+           Date().timeIntervalSince1970 - cfwLastPayloadQueuedAt < Self.cfwIdleRefreshSeconds
+        {
+            cfwAttachPresentTag(frame)
+            return true
+        }
+        for upload in encoded.uploads {
+            cfwPendingPayloads.append(CfwPayload(kind: .upload, data: upload))
+        }
+        displayDiagnostics.count("cachePuts", encoded.puts)
+        displayDiagnostics.count("cacheHits", encoded.hits)
+        if encoded.shows.count > 1 { displayDiagnostics.count("stereoFrames") }
+        // The frame is on the glasses once its last SHOW is acked.
+        for (index, show) in encoded.shows.enumerated() {
+            cfwPendingPayloads.append(CfwPayload(
+                kind: .scene, data: show.payload,
+                presents: index == encoded.shows.count - 1 ? frame.presentTag : nil, lenses: show.lenses
+            ))
+        }
+        cfwLastPayloadQueuedAt = Date().timeIntervalSince1970
+        return true
+    }
+
     /// Encode `frame` and queue the smallest update that reproduces it: dirty
     /// mode-3 rect deltas against the previous raster, a mode-9 rect copy when
     /// a vertical scroll is detected, and mode-15 builtin-font text draws for
@@ -3085,13 +3697,28 @@ final class G2: NSObject, SGCManager {
     /// change is large, the queue backed up, or on the periodic insurance
     /// keyframe. Seeds the shadow with mode-6 black when it is fresh.
     private func enqueueCfwFrame(_ frame: SceneFrame) async -> Bool {
-        let useBuiltinText = supportsCfwBuiltinText
-            && frame.elements.contains { $0.type == "text" && $0.font == "builtin" }
-        // Modes 13/14 have no per-lens variant, so they need the lens-equal window.
-        let useTextureGlyphs = supportsCfwTextureGlyphs
-            && frame.elements.contains { $0.type == "text" && $0.font == "mono" }
-        let pinDepth = useBuiltinText || useTextureGlyphs
-        let boxes = cfwBoxes(for: frame, pinDepth: pinDepth)
+        let generation = cfwCacheGeneration
+        // Mono text rides the scene as TEXT_CACHED runs (glyphs upload once per
+        // lease), so any frame that fits the slot table takes the vector path.
+        if supportsCfwVectorScene, !G2CfwScene.prefersRaster(frame), await enqueueCfwVectorFrame(frame) {
+            return true
+        }
+        // Raster fallback cannot preserve SVG contours or rotation. Report a dropped frame instead.
+        if frame.elements.contains(where: { $0.type == "svg" || $0.rotationQ8 != 0 }) {
+            return false
+        }
+        guard generation == cfwCacheGeneration else { return false }
+        // A later vector frame must restore its slots after the raster path
+        // takes panel ownership (including a switch back from bitmap playback).
+        cfwSceneInvalid = true
+        let hasMonoText = frame.elements.contains { $0.type == "text" && $0.font == "mono" }
+        displayDiagnostics.count("rasterFrames")
+        let boxes = cfwBoxes(for: frame)
+        let lensEqual = boxes.left == boxes.right
+        // Absolute text/cache draws cannot shift per eye. Bake text into the
+        // stereo raster at non-neutral depth instead of overriding global placement.
+        let useBuiltinText = lensEqual && frame.elements.contains { $0.type == "text" && $0.font == "builtin" }
+        let useTextureGlyphs = lensEqual && hasMonoText
         let movedBoxes = cfwLastBoxes != nil && cfwLastBoxes != boxes
         let backlogged = cfwPendingPayloads
             .filter { $0.kind != .seed && $0.kind != .upload }.count >= Self.cfwMaxQueuedUpdates
@@ -3114,7 +3741,7 @@ final class G2: NSObject, SGCManager {
             // phone's metrics under-measured can spill into the outer panel
             // margin, where no in-window rect or full frame ever repaints.
             // Blank the old window's right margin whenever draws change.
-            // (Builtin frames pin depth, so the old window is lens-equal.)
+            // (Builtin draws are only used when the old window is lens-equal.)
             if !cfwLastTextDraws.isEmpty, let last = cfwLastBoxes, last.left == last.right {
                 let edgeX = Int32(last.left.x) + last.width
                 let bandW = Int32(G2CfwRenderer.frameWidth) - edgeX
@@ -3129,7 +3756,7 @@ final class G2: NSObject, SGCManager {
         }
         let fids = (0 ..< G2CfwRenderer.requiredFidCount).map { _ in nextCfwFrameId() }
         // Copies would smear firmware-drawn glyphs the raster knows nothing about.
-        let allowCopy = supportsCfwRectCopy && textDraws.isEmpty
+        let allowCopy = textDraws.isEmpty
         guard let update = await cfwRenderer.encodeUpdate(
             frame, boxes: boxes,
             previousRaster: mustFull ? nil : cfwPrevRaster,
@@ -3139,10 +3766,11 @@ final class G2: NSObject, SGCManager {
             marginBlankBoxes: marginBlank,
             omitBuiltinText: useBuiltinText,
             textureGlyphsEnabled: useTextureGlyphs,
-            textureImagesEnabled: supportsCfwTextureImages && pinDepth,
+            textureImagesEnabled: useBuiltinText || useTextureGlyphs,
             cacheGeneration: cfwCacheGeneration
         ) else { return false }
 
+        guard generation == cfwCacheGeneration else { return false }
         cfwPrevRaster = update.raster
         cfwLastTextDraws = textDraws
         cfwLastBoxes = boxes
@@ -3151,7 +3779,9 @@ final class G2: NSObject, SGCManager {
             cfwPendingPayloads.append(CfwPayload(kind: .upload, data: upload))
         }
         guard let payload = update.payload else {
-            // Visually identical frame — the shadow already shows it.
+            // Visually identical frame — the shadow already shows it, or a
+            // queued payload is about to.
+            cfwAttachPresentTag(frame)
             return true
         }
         if update.usedFullFrame {
@@ -3174,7 +3804,8 @@ final class G2: NSObject, SGCManager {
                 cfwPendingPayloads.append(CfwPayload(kind: .seed, data: seed))
                 cfwShadowSeeded = true
                 if textDraws.isEmpty {
-                    cfwPendingPayloads.removeAll { $0.kind == .full || $0.kind == .delta }
+                    cfwPendingPayloads.removeAll { $0.kind == .full || $0.kind == .delta || $0.kind == .scene }
+                    cfwPendingPayloads[cfwPendingPayloads.count - 1].presents = frame.presentTag
                     cfwLastPayloadQueuedAt = Date().timeIntervalSince1970
                     return true
                 }
@@ -3185,34 +3816,46 @@ final class G2: NSObject, SGCManager {
         }
         if update.usedFullFrame {
             // A full overwrites the window; seeds, uploads, and move-blanks must still survive.
-            cfwPendingPayloads.removeAll { $0.kind == .full || $0.kind == .delta }
+            cfwPendingPayloads.removeAll { $0.kind == .full || $0.kind == .delta || $0.kind == .scene }
             let kind: CfwPayloadKind = movedBoxes ? .moveBundle : .full
-            cfwPendingPayloads.append(CfwPayload(kind: kind, data: payload))
+            cfwPendingPayloads.append(CfwPayload(kind: kind, data: payload, presents: frame.presentTag))
         } else {
-            cfwPendingPayloads.append(CfwPayload(kind: .delta, data: payload))
+            cfwPendingPayloads.append(CfwPayload(kind: .delta, data: payload, presents: frame.presentTag))
         }
         cfwLastPayloadQueuedAt = Date().timeIntervalSince1970
         return true
     }
 
-    /// Make the container set the CFW carrier shape (one 576×288 image container,
-    /// no text) — the shape `createPageWithContainers` recognises as the carrier
-    /// page. Returns true if it was ALREADY configured, so callers can tell
-    /// whether they need a page rebuild.
+    /// A frame that needs no payload of its own is on the glasses once the
+    /// last queued frame-carrying payload is acked; with nothing queued it is
+    /// there already. Frame numbers only go up, so the tag can be overwritten.
+    private func cfwAttachPresentTag(_ frame: SceneFrame) {
+        displayDiagnostics.count("noop")
+        guard let tag = frame.presentTag else { return }
+        if let i = cfwPendingPayloads.lastIndex(where: { $0.kind != .upload }) {
+            cfwPendingPayloads[i].presents = tag
+        } else if cfwPayloadInFlight {
+            cfwInFlightPresentTag = tag
+        } else {
+            frame.reportPresented(true)
+        }
+    }
+
+    /// Make the container set the CFW page shape (no stock text or image
+    /// containers; `createPageWithContainers` then emits only the blank
+    /// "dashboard" text object for touch capture and the mic). Payloads ride the
+    /// SID-0xf0 transport, which needs no container at all. Returns true if it
+    /// was ALREADY configured, so callers can tell whether they need a rebuild.
     @discardableResult
-    private func installCfwCarrierIfNeeded() -> Bool {
-        if textContainers.isEmpty && hasCfwCarrier {
+    private func installCfwPageIfNeeded() -> Bool {
+        if hasCfwPage {
             return true
         }
         textContainers.removeAll()
         sceneTextByElement.removeAll()
         sceneImageByElement.removeAll()
-        imageContainers = [
-            ImgContainer(
-                id: Self.cfwSceneContainerID, x: 0, y: 0, width: 576, height: 288,
-                bmpData: Data(), dirty: false
-            ),
-        ]
+        imageContainers.removeAll()
+        cfwPageInstalled = true
         cfwResetShadow()
         return false
     }
@@ -3232,7 +3875,10 @@ final class G2: NSObject, SGCManager {
         return true
     }
 
-    /// Blank the panel (mode-6 black also seeds the shadow) and drop retained scene state.
+    /// Blank the panel and drop the phone's frame state. The object cache on
+    /// the glasses is KEPT: a HIDE freezes and blanks, so the next scene (a
+    /// reopened dashboard, say) is one SHOW of references. On firmware without
+    /// the cache a mode-6 black keyframe blanks and seeds the shadow instead.
     ///
     /// The carrier container itself is deliberately NOT torn down: on CFW the
     /// idle screen is the black carrier page, which keeps absorbing touch events
@@ -3240,10 +3886,28 @@ final class G2: NSObject, SGCManager {
     /// still goes false — that tracks "a miniapp scene is on glass", which
     /// gates reposition/replay, not the page's existence.
     private func cfwClear() {
+        cfwPendingFrame?.reportPresented(false, reason: "cleared")
+        cfwPendingFrame = nil
+        // Invalidate an encoder suspended on its actor when clear arrived.
+        cfwClearSerial += 1
         cfwLastFrame = nil
         cfwSceneActive = false
-        cfwPendingPayloads.removeAll { $0.kind != .seed }
-        if let seed = G2CfwRenderer.blackPayload() {
+        for payload in cfwPendingPayloads {
+            payload.presents?.report(false, reason: "cleared")
+        }
+        // A blank supersedes every unsent operation, including older blanks.
+        // Repeated blank captions must not build a queue of black frames.
+        cfwPendingPayloads.removeAll()
+        if supportsCfwVectorScene {
+            // The object cache on the glasses is KEPT: a HIDE freezes and blanks,
+            // so the next scene (a reopened dashboard) is one SHOW of references.
+            // `cfwLastBoxes` therefore stays: nulling it would make the next frame
+            // invalidate the scene model and redefine every object. A PUT dropped
+            // from the queue above is caught by the MISSING reply and retried.
+            cfwPendingPayloads.append(CfwPayload(kind: .seed, data: G2CfwScene.hidePayload))
+            Task { await cfwRenderer.sceneHidden() }
+            cfwShadowSeeded = true   // HIDE clears the shadow to black, like a keyframe
+        } else if let seed = G2CfwRenderer.blackPayload() {
             cfwPendingPayloads.append(CfwPayload(kind: .seed, data: seed))
             cfwShadowSeeded = true
             cfwLastBoxes = nil
@@ -3266,10 +3930,10 @@ final class G2: NSObject, SGCManager {
         // its normal paths.
         guard cfwClassified, cfwCapabilityString != nil else { return }
         if enabled {
-            if installCfwCarrierIfNeeded() {
+            if installCfwPageIfNeeded() {
                 return
-            } // already the carrier page
-            Bridge.log("G2: cfw_scene_renderer ON — swapping stock containers for the CFW carrier")
+            } // already the CFW page
+            Bridge.log("G2: cfw_scene_renderer ON — swapping stock containers for the CFW page")
             await requestPageRebuild()
         } else {
             Bridge.log("G2: cfw_scene_renderer OFF — exiting CFW surface to a blank stock page")
@@ -3277,7 +3941,8 @@ final class G2: NSObject, SGCManager {
             cfwLastFrame = nil
             cfwSceneActive = false
             cfwResetShadow()
-            imageContainers.removeAll() // drops the carrier
+            cfwPageInstalled = false
+            imageContainers.removeAll()
             textContainers.removeAll()
             sceneTextByElement.removeAll()
             sceneImageByElement.removeAll()
@@ -3288,12 +3953,8 @@ final class G2: NSObject, SGCManager {
     /// Height/depth changed: re-place the retained frame (stock moves its window the same way).
     private func cfwReposition() {
         guard supportsCfwSceneRendering, cfwSceneActive, let frame = cfwLastFrame else { return }
-        Task { [weak self] in
-            guard let self else { return }
-            if await self.enqueueCfwFrame(frame) {
-                self.signalDisplayDirty()
-            }
-        }
+        cfwPendingFrame = frame
+        signalDisplayDirty()
     }
 
     func onSceneReplay(_: String) async {
@@ -3493,7 +4154,7 @@ final class G2: NSObject, SGCManager {
     /// applySceneFrame batch — without batching, each remove would rebuild).
     func clearSceneElements(_ elementIds: [String]) async {
         if supportsCfwSceneRendering {
-            let carrierWasConfigured = installCfwCarrierIfNeeded()
+            let carrierWasConfigured = installCfwPageIfNeeded()
             cfwClear()
             if !carrierWasConfigured, pageCreated {
                 // Carrier just replaced live stock containers (see clearDisplay).
@@ -3554,7 +4215,7 @@ final class G2: NSObject, SGCManager {
             // Idle on CFW = the black carrier page, kept up for touch + mic.
             // Install it even on a first-ever clear (no scene rendered yet) so
             // the idle state is the same page everywhere.
-            let carrierWasConfigured = installCfwCarrierIfNeeded()
+            let carrierWasConfigured = installCfwPageIfNeeded()
             cfwClear()
             if !carrierWasConfigured || !pageCreated {
                 signalDisplayDirty()
@@ -3609,35 +4270,27 @@ final class G2: NSObject, SGCManager {
         }
     }
 
-    /// Send a bitmap to an image container as fragmented updateImageRawData packets. Stock
-    /// firmware silently drops the first stream after a fresh page, so its first real transfer is
-    /// preceded by a sacrificial copy. The CFW carrier bypasses that workaround.
+    /// Send a bitmap to a stock image container as fragmented updateImageRawData
+    /// packets. Stock firmware silently drops the first stream after a fresh page,
+    /// so its first real transfer is preceded by a sacrificial copy.
     @discardableResult
     private func sendImageData(containerID: Int32, containerName: String, bmpData: Data) async -> Bool {
         guard !bmpData.isEmpty else { return true }
 
-        let isCfwCarrier = containerID == Self.cfwSceneContainerID
-        if !isCfwCarrier, !stockImageStreamWarmedUp {
+        if !stockImageStreamWarmedUp {
             let warmupOk = await sendImageTransfer(
-                containerID: containerID,
-                containerName: containerName,
-                bmpData: bmpData,
-                isCfwCarrier: false
+                containerID: containerID, containerName: containerName, bmpData: bmpData
             )
             guard warmupOk else { return false }
             stockImageStreamWarmedUp = true
         }
 
         return await sendImageTransfer(
-            containerID: containerID,
-            containerName: containerName,
-            bmpData: bmpData,
-            isCfwCarrier: isCfwCarrier
+            containerID: containerID, containerName: containerName, bmpData: bmpData
         )
     }
 
-    /// Perform one logical image stream, retrying the whole transfer with a fresh session after a
-    /// failed fragment ACK.
+    /// Perform one logical stock image stream, retrying with a fresh session.
     ///
     /// The glasses reply ONCE per fragment with an ImgResCmd ErrorCode (4=success, 5=failed).
     /// All fragments in an attempt share a session id, and each fragment awaits its own ACK for up
@@ -3645,21 +4298,13 @@ final class G2: NSObject, SGCManager {
     /// counts as a failure and the entire image is re-sent with a fresh session up to
     /// `IMG_MAX_ATTEMPTS` times, backing off `IMG_RETRY_DELAY_NS` before each re-attempt.
     /// On exhausting all attempts it logs a warning and returns false.
-    private func sendImageTransfer(
-        containerID: Int32, containerName: String, bmpData: Data, isCfwCarrier: Bool
-    ) async -> Bool {
-        // CFW carrier transfers use the verified wire format: 3800-byte
-        // fragments, MapSessionId pinned to the container id instead of using
-        // the rotating session counter, and frames
-        // written to the LEFT arm (acks still return on the right). Stock
-        // containers keep the shipped 4096/rotating-session/right-arm shape.
-        let fragmentSize = isCfwCarrier ? 3800 : 4096
+    private func sendImageTransfer(containerID: Int32, containerName: String, bmpData: Data) async -> Bool {
+        let fragmentSize = 4096
         let totalSize = Int32(bmpData.count)
         let fragmentCount = (bmpData.count + fragmentSize - 1) / fragmentSize
-
-        // Bridge.log(
-        //     "G2: sendImageData(\(containerName)) - \(fragmentCount) fragments, \(bmpData.count) bytes"
-        // )
+        let transferStarted = G2DisplayDiagnostics.now
+        defer { displayDiagnostics.timing("transferMs", (G2DisplayDiagnostics.now - transferStarted) * 1000) }
+        let generation = pageGeneration
 
         for attempt in 1 ... IMG_MAX_ATTEMPTS {
             // Back off before each RE-attempt: the ack didn't come, so the link
@@ -3667,21 +4312,20 @@ final class G2: NSObject, SGCManager {
             if attempt > 1 {
                 try? await Task.sleep(nanoseconds: IMG_RETRY_DELAY_NS)
             }
+            guard !Task.isCancelled, pageGeneration == generation else { return false }
             // One session id per WHOLE image transfer (per attempt). The glasses key their
             // reassembly buffer on MapSessionId, so every fragment of this image must reuse the
             // same session id with an incrementing MapFragmentIndex; the per-fragment ACK is
-            // correlated by the (session, fragmentIndex) pair. A retry uses a fresh session so a
-            // stale ACK from a prior attempt can't match.
+            // correlated by the (session, fragmentIndex) pair. Every transfer takes a fresh
+            // session so a stale ACK from an earlier transfer can never be mistaken for this one's.
             imageSessionCounter = (imageSessionCounter + 1) % 256
-            let sessionId = isCfwCarrier ? Int(containerID) : imageSessionCounter
+            let sessionId = imageSessionCounter
 
             var fragmentIndex: Int32 = 0
             var offset = 0
             var transferOk = true
-            // if attempt > 1 {
-            //     Bridge.log("G2: sendImageData(\(containerName)) - attempt \(attempt) starting")
-            // }
             while offset < bmpData.count {
+                guard !Task.isCancelled, pageGeneration == generation else { return false }
                 let end = min(offset + fragmentSize, bmpData.count)
                 let fragment = bmpData[offset ..< end]
 
@@ -3695,21 +4339,30 @@ final class G2: NSObject, SGCManager {
                     mapFragmentPacketSize: Int32(fragment.count),
                     mapRawData: Data(fragment)
                 )
-                // Send the fragment directly: the reconcile loop already serializes whole image
-                // sends, and the per-fragment ACK gate below provides pacing — no transmit queue.
-                // Carrier frames go to the LEFT arm; the ack still returns on
-                // the right and our notify path is
-                // arm-agnostic); everything else keeps the right arm.
-                sendEvenHubCommand(msg, left: isCfwCarrier, right: !isCfwCarrier)
-                // Bridge.log("G2: img_sen: session=\(sessionId) fragment=\(fragmentIndex)")
-
                 // Gate on THIS fragment's ACK before sending the next (the ACK provides pacing).
                 // Timeout/img_failed → abandon the attempt and retry the whole image.
-                let ok = await awaitImageAck(sessionId: sessionId, fragmentIndex: fragmentIndex)
+                let trace = G2DisplayDiagnostics.Fragment()
+                let ok = await awaitImageAck(sessionId: sessionId, fragmentIndex: fragmentIndex) {
+                    // Register before enqueueing: notifications arrive on the BLE
+                    // queue and can beat this task's next main-actor continuation.
+                    sendEvenHubCommand(msg, trace: trace)
+                }
+                let outcome = imgAckBox.outcome()
+                let reason = Task.isCancelled ? "cancelled" : (outcome?.reason ?? "unknown")
+                displayDiagnostics.count("fragments")
+                if !ok {
+                    displayDiagnostics.count("errors")
+                    if reason == "timeout" { displayDiagnostics.count("timeouts") }
+                    if reason == "nack" { displayDiagnostics.count("nacks") }
+                    if let line = displayDiagnostics.stall(fields: [
+                        "session": sessionId, "fragment": fragmentIndex, "fragments": fragmentCount,
+                        "bytes": fragment.count, "result": reason, "attempt": attempt, "page": pageCreated,
+                    ]) {
+                        Bridge.log(line)
+                    }
+                }
+                guard !Task.isCancelled, pageGeneration == generation else { return false }
                 if !ok {
-                    Bridge.log(
-                        "G2: img_sen: session=\(sessionId) fragment=\(fragmentIndex) failed"
-                    )
                     transferOk = false
                     break
                 }
@@ -3719,33 +4372,131 @@ final class G2: NSObject, SGCManager {
             }
 
             if transferOk {
-                // Bridge.log("G2: img_sen: container=\(containerName) - success=true")
                 return true
             }
         }
 
-        Bridge.log("G2: img_sen: container=\(containerName) - failed after \(IMG_MAX_ATTEMPTS) attempts")
         return false
     }
 
+    /// Send one custom message over the SID-0xf0 transport to the lenses
+    /// `lenses` selects (both by default) and wait for their processing ACKs.
+    /// Always written to the LEFT arm; the right lens receives it over the
+    /// frame bridge and its reply returns through the left. Deltas, rect copies
+    /// and tweens are not safe to replay after an ambiguous loss, so a failure
+    /// is reported (the caller resyncs from a keyframe) and the deflate context
+    /// restarts, as the glasses have already dropped theirs on a NACK.
+    private func sendCfwMessage(_ original: Data, lenses: UInt8 = G2CfwTransport.lensBoth) async -> Bool {
+        guard !original.isEmpty else { return true }
+        var message = original
+        if G2CfwTransport.isCacheMessage(original) {
+            cfwCacheRequest = cfwCacheRequest >= 0xFFFE ? 1 : cfwCacheRequest + 1
+            message = G2CfwTransport.stamp(original, epoch: cfwCacheEpoch, request: cfwCacheRequest)
+        }
+        let started = G2DisplayDiagnostics.now
+        defer { displayDiagnostics.timing("transferMs", (G2DisplayDiagnostics.now - started) * 1000) }
+        guard let record = cfwTransport.record(message, targets: lenses) else {
+            displayDiagnostics.count("encodeErrors")
+            return false
+        }
+        let streamId = cfwStreamSequence
+        let packets = G2CfwTransport.packets(stream: record, sequence: streamId, targets: lenses)
+        cfwStreamSequence &+= UInt8(truncatingIfNeeded: packets.count)
+        let trace = G2DisplayDiagnostics.Fragment()
+        let timeout = G2CfwTransport.ackTimeoutNs(streamBytes: record.count)
+        let ok = await cfwAckBox.wait(streamId: streamId, lenses: lenses, timeoutNs: timeout) { isPending in
+            // Arm before enqueueing: replies arrive on the BLE queue and can beat
+            // this task's next main-actor continuation.
+            sendToGlasses(packets, left: true, right: false, trace: trace, isPending: isPending)
+        }
+        let resumedAt = G2DisplayDiagnostics.now
+        let outcome = cfwAckBox.outcome()
+        let reason = Task.isCancelled ? "cancelled" : (outcome?.reason ?? "unknown")
+        let totalMs = (resumedAt - trace.queuedAt) * 1000
+        displayDiagnostics.count("fragments")
+        displayDiagnostics.count("streamBytes", record.count)
+        if let first = trace.firstWrite, let last = trace.lastWrite {
+            displayDiagnostics.timing("submitMs", (first - trace.queuedAt) * 1000)
+            displayDiagnostics.timing("writeMs", (last - first) * 1000)
+            if let outcome {
+                displayDiagnostics.timing("ackMs", (outcome.at - last) * 1000)
+                displayDiagnostics.timing("resumeMs", (resumedAt - outcome.at) * 1000)
+            }
+        }
+        if !ok {
+            displayDiagnostics.count("errors")
+            if reason == "timeout" { displayDiagnostics.count("timeouts") }
+            if reason == "nack" { displayDiagnostics.count("nacks") }
+            // The glasses drop their inflater on any failure; ours must follow.
+            cfwTransport.resetContext()
+        }
+        if totalMs >= 200 || !ok, let line = displayDiagnostics.stall(fields: [
+            "app": diagnosticAppId, "seq": diagnosticFrameSeq,
+            "stream": Int(streamId), "packets": packets.count, "lenses": Int(lenses),
+
+            "mode": Int(message.first ?? 0), "bytes": message.count, "wire": record.count,
+            "totalMs": Int(totalMs), "result": reason,
+            "written": trace.lastWrite != nil, "qL": leftWriteQueue.count, "qR": rightWriteQueue.count,
+            "page": pageCreated,
+        ]) {
+            Bridge.log(line)
+        }
+        return ok
+    }
+
+    /// The object cache's session: before the first cache message of a
+    /// generation both lenses are RESET to a fresh phone-chosen epoch and the
+    /// warm-up tween runs. Returns false when the reset itself failed.
+    private func cfwEnsureCacheSession() async -> Bool {
+        guard supportsCfwVectorScene else { return true }
+        if cfwCacheEpoch != 0, cfwSceneWarmedGeneration == cfwCacheGeneration { return true }
+        let generation = cfwCacheGeneration
+        cfwCacheEpoch = UInt16.random(in: 1 ... 0xFFFE)
+        var reset = G2CfwScene.resetPayload
+        reset.append(UInt8(min(255, G2CfwTransport.maxChunkBytes + 10)))   // reply capacity of this link
+        guard await sendCfwMessage(reset), generation == cfwCacheGeneration else {
+            cfwCacheEpoch = 0
+            return false
+        }
+        var store = Int.max
+        for reply in cfwAckBox.cacheReplies().values {
+            if reply.epoch != cfwCacheEpoch {
+                Bridge.log("G2: cache reset kept epoch \(reply.epoch) on lens \(reply.lens)")
+                cfwCacheEpoch = 0
+                return false
+            }
+            if reply.storeBytes > 0 { store = min(store, reply.storeBytes) }
+        }
+        if store != Int.max { await cfwRenderer.setStoreCapacity(bytes: store) }
+        cfwSceneWarmedGeneration = generation
+        _ = await sendCfwMessage(G2CfwScene.warmUpShow)
+        return true
+    }
+
+    /// Outcome of a cache message beyond its ACK: what the lenses replied.
+    private enum CfwCacheOutcome { case applied, stale, missing([UInt32]), refused(String) }
+
+    private func cfwCacheOutcome() -> CfwCacheOutcome {
+        var missing: [UInt32] = []
+        for reply in cfwAckBox.cacheReplies().values {
+            switch reply.status {
+            case G2CfwTransport.CacheReply.stale: return .stale
+            case G2CfwTransport.CacheReply.missing: missing.append(contentsOf: reply.missingIds)
+            case G2CfwTransport.CacheReply.applied, G2CfwTransport.CacheReply.unchanged,
+                 G2CfwTransport.CacheReply.delta, G2CfwTransport.CacheReply.snapshot: continue
+            default: return .refused("lens \(reply.lens): \(reply.summary)")
+            }
+        }
+        return missing.isEmpty ? .applied : .missing(missing)
+    }
+
     /// Suspend until correlateImageAck() resolves the ACK for this `(sessionId, fragmentIndex)`, or
     /// `IMG_ACK_TIMEOUT_NS` elapses (whichever comes first). Returns whether the fragment was acked
     /// successfully; a timeout returns false. All fragments of one image share a session id, so the
     /// fragment index distinguishes their ACKs. The continuation lives in [ImgAckBox], whose lock
     /// makes the ACK-resolve and the timeout mutually exclusive — exactly one resumes it.
-    private func awaitImageAck(sessionId: Int, fragmentIndex: Int32) async -> Bool {
-        let timeoutNs = IMG_ACK_TIMEOUT_NS
-        let box = imgAckBox
-        return await withCheckedContinuation { (cont: CheckedContinuation<Bool, Never>) in
-            box.arm(session: sessionId, fragment: fragmentIndex, cont: cont)
-
-            // Detached (not @MainActor): the timeout must fire on its own schedule regardless of how
-            // busy the main actor is. The box's lock makes racing with resolve() safe.
-            Task.detached {
-                try? await Task.sleep(nanoseconds: timeoutNs)
-                box.timeout(session: sessionId, fragment: fragmentIndex)
-            }
-        }
+    private func awaitImageAck(sessionId: Int, fragmentIndex: Int32, send: () -> Void) async -> Bool {
+        await imgAckBox.wait(session: sessionId, fragment: fragmentIndex, timeoutNs: IMG_ACK_TIMEOUT_NS, send: send)
     }
 
     /// Resume the pending image-ACK continuation for `(session, fragmentIndex)` (if it matches the
@@ -3777,9 +4528,7 @@ final class G2: NSObject, SGCManager {
         let rh = height ?? G2.defaultImgContainer.height
 
         // ignore events while the ER dashboard is open:
-        let useNativeDashboard =
-            DeviceStore.shared.get("bluetooth", "use_native_dashboard") as? Bool ?? false
-        if useNativeDashboard && dashboardShowing > 0 {
+        if dashboardShowing > 0 {
             return false
         }
 
@@ -3844,18 +4593,57 @@ final class G2: NSObject, SGCManager {
         return true
     }
 
-    /// Push pending display state to the glasses: dirty text containers first (one updateText each,
-    /// with a redundant resend per `pendingSends`), then dirty image containers one at a time. The
-    /// loop awaits this, and this awaits each `sendImageData` in turn, so image sends never overlap
-    /// and `imgAckBox` is never clobbered. A failed image send leaves the container dirty for the
-    /// next cycle; if its bytes changed mid-send, the flag stays set so the newer image is sent next.
+    /// Transport completion, not on-glass animation completion or observed display FPS.
+    private func recordCfwPayloadAck(_ payload: CfwPayload) {
+        guard let origin = payload.originAt else { return }
+        displayDiagnostics.count("framesAcked")
+        displayDiagnostics.timing("frameMs", (G2DisplayDiagnostics.now - origin) * 1000)
+    }
+
+    /// Serializes image transfers and coalesces pending scenes before encoding.
     private func reconcileDisplay() async {
+        guard !Task.isCancelled else { return }
         // Native nav mode owns the screen: hold ALL EvenHub display sends (text,
         // images, page resurrection). Container state keeps accumulating; the
         // nav-exit recovery rebuilds the page and flushes it.
         if navigationModeActive {
             return
         }
+        if !notificationsPanelHold, cfwPendingPayloads.isEmpty, let frame = cfwPendingFrame {
+            let originAt = cfwPendingFrameAt
+            cfwPendingFrame = nil
+            let started = G2DisplayDiagnostics.now
+            let encoded = await enqueueCfwFrame(frame)
+            let encodeMs = (G2DisplayDiagnostics.now - started) * 1000
+            displayDiagnostics.timing("encodeMs", encodeMs)
+            displayDiagnostics.timing("frameQueueMs", (started - originAt) * 1000)
+            displayDiagnostics.count("framesEncoded")
+            displayDiagnostics.count("elements", frame.elements.count)
+            displayDiagnostics.count("animatedElements", frame.elements.filter { $0.transitionMs > 0 }.count)
+            if encoded {
+                for i in cfwPendingPayloads.indices {
+                    cfwPendingPayloads[i].frameSeq = frame.seq
+                    cfwPendingPayloads[i].appId = frame.appId
+                    displayDiagnostics.count("payloadBytes", cfwPendingPayloads[i].data.count)
+                    if cfwPendingPayloads[i].kind == .upload {
+                        displayDiagnostics.count("uploadBytes", cfwPendingPayloads[i].data.count)
+                    }
+                }
+                if !cfwPendingPayloads.isEmpty {
+                    cfwPendingPayloads[cfwPendingPayloads.count - 1].originAt = originAt
+                }
+            } else {
+                displayDiagnostics.count("encodeErrors")
+                frame.reportPresented(false, reason: "scene encode failed or invalidated")
+            }
+            if encodeMs >= 100, let line = displayDiagnostics.stall(fields: [
+                "stage": "encode", "seq": frame.seq, "app": frame.appId,
+                "encodeMs": Int(encodeMs), "elements": frame.elements.count, "ok": encoded,
+            ]) {
+                Bridge.log(line)
+            }
+        }
+        guard !Task.isCancelled else { return }
         // Page is dead but content is waiting (e.g. captions kept arriving while iOS had us
         // suspended and the firmware tore the session down). Rebuild the page ONCE here — the
         // reconcile loop is coalesced (1-deep signal buffer), so a burst of buffered sendText
@@ -3863,8 +4651,6 @@ final class G2: NSObject, SGCManager {
         // rebuildState() recreates the page, re-pushes the current text/image, and re-arms the
         // mic iff intent says so. Skip while the native dashboard owns the screen.
         if !pageCreated {
-            let useNativeDashboard =
-                DeviceStore.shared.get("bluetooth", "use_native_dashboard") as? Bool ?? false
             // Stock path: only resurrect for non-blank content — don't rebuild just to render a
             // clearDisplay's blank, or a clear burst churns the page back up pointlessly.
             // (CFW is the exception below: its blank IS the idle page.)
@@ -3879,39 +4665,28 @@ final class G2: NSObject, SGCManager {
             // Idle carrier: the black seed alone. This is what the
             // rebuild→systemExit→rebuild storm guard used to block, so it is
             // rate-limited below rather than allowed once per reconcile tick.
-            let cfwIdleCarrier = !cfwPendingPayloads.isEmpty && !cfwHasScene && hasCfwCarrier
+            let cfwIdleCarrier = !cfwPendingPayloads.isEmpty && !cfwHasScene && cfwPageInstalled
             let hasPendingImage = imageContainers.contains { $0.dirty && !$0.bmpData.isEmpty }
                 || cfwHasScene
             let wants = hasPendingText || hasPendingImage || cfwIdleCarrier
             // Consume the idle-resurrect slot ONLY when this tick would actually
             // rebuild — burning it behind the dashboard gate would stall a real
             // resurrection for the whole backoff window.
-            if wants, !(useNativeDashboard && dashboardShowing > 0),
+            if wants, dashboardShowing == 0,
                hasPendingText || hasPendingImage || cfwIdlePageResurrectAllowed()
             {
-                // Probe-before-rebuild: a phantom exit may have marked a healthy
-                // page dead (static pages give the ack-window filter nothing to
-                // go on). Try the queued carrier payload against the "dead" page
-                // first — an ack proves it alive and skips the shutdown+create
-                // whose own teardown would elicit the next exit. A timeout
-                // confirms real death and falls through to the rebuild.
-                if cfwHasScene || cfwIdleCarrier,
-                   let carrier = imageContainers.first(where: { $0.id == Self.cfwSceneContainerID }),
-                   let probe = cfwPendingPayloads.first
-                {
-                    let ok = await sendImageData(
-                        containerID: carrier.id, containerName: carrier.name, bmpData: probe.data
+                // Our own SHUTDOWN_PAGE is still being answered: creating now
+                // would race the teardown trio (see lastPageShutdownSentMs).
+                let settle = pageShutdownSettleRemainingMs()
+                if settle > 0 {
+                    Bridge.log(
+                        "G2: reconcileDisplay() - page down, \(settle)ms left in the shutdown settle window; deferring the rebuild"
                     )
-                    if ok {
-                        Bridge.log("G2: page-down probe acked — phantom exit, page alive (no rebuild)")
-                        pageCreated = true
-                        if !cfwPendingPayloads.isEmpty {
-                            cfwPendingPayloads.removeFirst()
-                        }
-                        signalDisplayDirty() // drain the rest normally
-                        return
-                    }
+                    armPageShutdownSettleWake(afterMs: settle)
+                    return
                 }
+                // (Transport ACKs need no page, so they cannot probe a "dead" page
+                // the way carrier image ACKs once did.)
                 Bridge.log("G2: reconcileDisplay() - page down with pending content, rebuilding once")
                 await rebuildState()
             }
@@ -3921,11 +4696,8 @@ final class G2: NSObject, SGCManager {
         // Text: synchronous, no ACK. Send one update per container with pending sends and decrement.
         for i in textContainers.indices where textContainers[i].pendingSends > 0 {
             let container = textContainers[i]
-            // Byte-exact content log (debugDescription escapes \n and non-ASCII)
-            // — artifact forensics: match on-glass rendering to what was sent.
-            Bridge.log(
-                "G2: updateText id=\(container.id) rect=\(container.x),\(container.y) \(container.width)x\(container.height) bytes=\(container.content.utf8.count) content=\(container.content.debugDescription)"
-            )
+            displayDiagnostics.count("stockTextWrites")
+            displayDiagnostics.count("stockTextBytes", container.content.utf8.count)
             let msg = EvenHubProto.updateTextMessage(
                 containerID: container.id,
                 containerName: container.name,
@@ -3937,16 +4709,82 @@ final class G2: NSObject, SGCManager {
             textContainers[i].pendingSends -= 1
         }
 
-        // CFW carrier: ordered payload queue (keyframe before deltas). Bounded per pass so a
+        var sensorsDrained = 0
+        while pageCreated, !navigationModeActive, !sensorNavigationRecovering, sensorsDrained < 4, !sensorCommands.isEmpty,
+              supportsCfwTransport
+        {
+            sensorsDrained += 1
+            let command = sensorCommands.removeFirst()
+            let ok = await sendCfwMessage(command.data)
+            command.complete(ok)
+        }
+
+        // CFW transport: ordered payload queue (keyframe before deltas). Bounded per pass so a
         // fast producer can't starve the ticker; the remainder goes out on the next cycle.
-        if let carrier = imageContainers.first(where: { $0.id == Self.cfwSceneContainerID }) {
+        if supportsCfwSceneRendering, cfwPageInstalled {
             var drained = 0
             while pageCreated, drained < 4, !cfwPendingPayloads.isEmpty {
                 drained += 1
                 let payload = cfwPendingPayloads.removeFirst()
-                let ok = await sendImageData(
-                    containerID: carrier.id, containerName: carrier.name, bmpData: payload.data
-                )
+                cfwPayloadInFlight = true
+                cfwInFlightPresentTag = payload.presents
+                diagnosticFrameSeq = payload.frameSeq
+                diagnosticAppId = payload.appId
+                var ok = true
+                if G2CfwTransport.isCacheMessage(payload.data) {
+                    ok = await cfwEnsureCacheSession()
+                }
+                if ok {
+                    ok = await sendCfwMessage(payload.data, lenses: payload.lenses)
+                }
+                var recover: (() -> Void)?
+
+                if ok, G2CfwTransport.isCacheMessage(payload.data) {
+                    switch cfwCacheOutcome() {
+                    case .applied:
+                        cfwMissingRetries = 0
+                    case .stale:
+                        // A lens lost its cache (lease lapse, reboot): new session, redefine everything.
+                        displayDiagnostics.count("cacheStale")
+                        ok = false
+                        recover = { [self] in cfwCacheGeneration += 1; cfwCacheEpoch = 0; cfwSceneInvalid = true }
+                    case let .missing(ids):
+                        displayDiagnostics.count("cacheMissing")
+                        ok = false
+                        let retry = cfwMissingRetries < 2
+                        cfwMissingRetries += 1
+                        recover = { [self] in
+                            Task { await cfwRenderer.forget(ids: ids) }
+                            if !retry { cfwSceneInvalid = true }
+                        }
+                    case let .refused(why):
+                        displayDiagnostics.count("cacheRefused")
+                        Bridge.log("G2: cache message refused: \(why)")
+                        ok = false
+                        recover = { [self] in cfwCacheGeneration += 1; cfwCacheEpoch = 0; cfwSceneInvalid = true }
+                    }
+                }
+                if ok {
+                    // Both lenses acked and applied: the firmware has executed the
+                    // payload and presents on its next frame tick.
+                    recordCfwPayloadAck(payload)
+                    cfwInFlightPresentTag?.report(true)
+                }
+                if !ok {
+                    cfwInFlightPresentTag?.report(false, reason: recover != nil ? "cache rejected" : "message transport failed")
+                }
+                cfwInFlightPresentTag = nil
+                cfwPayloadInFlight = false
+                if let recover {
+                    // Re-encode the last frame against the corrected mirror and try again.
+                    recover()
+                    cfwPendingPayloads.removeAll { $0.kind == .scene || $0.kind == .upload }
+                    if pageCreated, supportsCfwSceneRendering, cfwPageInstalled, let frame = cfwLastFrame {
+                        _ = await enqueueCfwFrame(frame)
+                    }
+                    break
+                }
+                guard !Task.isCancelled else { return }
                 if !ok {
                     // A lost payload leaves the on-glass shadow stale; further
                     // deltas would composite onto it and corrupt the panel.
@@ -3955,15 +4793,29 @@ final class G2: NSObject, SGCManager {
                     // the page down mid-transfer is re-seeded by rebuildState;
                     // refilling the queue here just fuels the page-resurrection
                     // loop (rebuild→systemExit→rebuild every debounce tick).
-                    if pageCreated, supportsCfwSceneRendering, hasCfwCarrier {
-                        cfwResetShadow()
+                    if pageCreated, supportsCfwSceneRendering, cfwPageInstalled {
+                        // A transport failure leaves the cache session intact (a lens
+                        // that lost it answers STALE), so only the uploads that may not
+                        // have landed are re-sent — not every asset. A failed session
+                        // RESET (epoch back to 0) still starts over.
+                        let keepCache = cfwCacheEpoch != 0
+                        let dropped = ([payload] + cfwPendingPayloads).filter { $0.kind == .upload }.map(\.data)
+                        cfwResetShadow(keepCache: keepCache)
                         if let frame = cfwLastFrame {
-                            _ = await enqueueCfwFrame(frame)
+                            cfwPendingFrame = frame
+                        }
+                        if keepCache {
+                            await cfwRenderer.forgetUploads(dropped)
                         }
                     }
                     break
                 }
             }
+            // A finite upload burst can exhaust the four-payload budget after
+            // its producer signal was consumed. Continue without a 100 ms tick gap.
+            if pageCreated, !cfwPendingPayloads.isEmpty || cfwPendingFrame != nil {
+                signalDisplayDirty()
+            }
         }
 
         // Images: ACK-gated, exactly one in flight. Cap iterations defensively so a container that
@@ -4058,6 +4910,7 @@ final class G2: NSObject, SGCManager {
 
     /// shutdown and rebuild everything, re-sends all data to the glasses:
     private func rebuildPage() async {
+        lastPageShutdownSentMs = Int64(Date().timeIntervalSince1970 * 1000)
         let msg = EvenHubProto.shutdownMessage()
         sendEvenHubCommand(msg)
         pageCreated = false
@@ -4073,15 +4926,19 @@ final class G2: NSObject, SGCManager {
             Bridge.log("G2: rebuildState() skipped — navigation mode owns the screen")
             return
         }
+        if notificationsPanelHold {
+            Bridge.log("G2: rebuildState() skipped — notifications panel hold")
+            return
+        }
         Bridge.log("G2: rebuildState()")
         // Stock containers left by a torn-down page would rebuild as the evt-0 page, not the carrier.
         if supportsCfwSceneRendering {
-            _ = installCfwCarrierIfNeeded()
+            _ = installCfwPageIfNeeded()
         }
         // A stray text container here means createPageWithContainers builds the evt-0 shape
-        // instead of the carrier, and every CFW payload is rejected (img_res errorCode=4).
+        // instead of the CFW page.
         Bridge.log(
-            "G2: rebuildState() post-carrier cfw=\(supportsCfwSceneRendering) carrier=\(hasCfwCarrier)"
+            "G2: rebuildState() post-install cfw=\(supportsCfwSceneRendering) cfwPage=\(hasCfwPage)"
                 + " text=\(textContainers.map { $0.id }) img=\(imageContainers.map { $0.id })"
         )
         // recreate the containers (sets pageCreated = true; embeds text content directly):
@@ -4098,12 +4955,11 @@ final class G2: NSObject, SGCManager {
             )
             imageContainers[i].dirty = true
         }
-        // The CFW shadow lives in the carrier's display allocation, which the new
-        // page just re-created: seed it again and re-send the retained frame.
-        if supportsCfwSceneRendering, hasCfwCarrier {
+        // Re-seed the on-glass shadow and re-send the retained frame for the new page.
+        if supportsCfwSceneRendering, cfwPageInstalled {
             cfwResetShadow()
             if let frame = cfwLastFrame {
-                _ = await enqueueCfwFrame(frame)
+                cfwPendingFrame = frame
             } else if let seed = G2CfwRenderer.blackPayload() {
                 cfwPendingPayloads.append(CfwPayload(kind: .seed, data: seed))
                 cfwShadowSeeded = true
@@ -4123,6 +4979,30 @@ final class G2: NSObject, SGCManager {
         restartMicIfAlreadyEnabled()
     }
 
+    /// Milliseconds left in the settle window after a SHUTDOWN_PAGE we sent; 0 outside it.
+    private func pageShutdownSettleRemainingMs() -> Int64 {
+        guard lastPageShutdownSentMs > 0 else { return 0 }
+        let elapsed = Int64(Date().timeIntervalSince1970 * 1000) - lastPageShutdownSentMs
+        return max(0, PAGE_SHUTDOWN_SETTLE_MS - elapsed)
+    }
+
+    /// Once the settle window ends, bring the page back exactly once: through
+    /// recovery when the mic needs a live page, else through the reconcile
+    /// loop, which only resurrects for real content (a blank stays down).
+    private func armPageShutdownSettleWake(afterMs: Int64) {
+        guard !pageShutdownSettleWakeArmed else { return }
+        pageShutdownSettleWakeArmed = true
+        DispatchQueue.main.asyncAfter(deadline: .now() + .milliseconds(Int(afterMs) + 10)) { [weak self] in
+            guard let self else { return }
+            self.pageShutdownSettleWakeArmed = false
+            if !self.pageCreated, self.evenHubMicIntent {
+                self.recoverPageAndMic(reason: "shutdown-settled")
+            } else {
+                self.signalDisplayDirty()
+            }
+        }
+    }
+
     /// Single coalesced recovery: rebuild the page + re-arm sensor streams from intent, but never
     /// stack rebuilds. The firmware spams systemExit/dashboard-close ~1×/sec; without this
     /// guard each one triggered a rebuild that was torn down again → rebuild→exit→rebuild
@@ -4134,6 +5014,15 @@ final class G2: NSObject, SGCManager {
         if navigationModeActive {
             return
         }
+        // The firmware is still answering our own SHUTDOWN_PAGE (its systemExit
+        // and 08011A00 land ~300 ms after it): this is the old page dying, not
+        // something to recover from. The settle wake brings the page back once.
+        let settle = pageShutdownSettleRemainingMs()
+        if settle > 0 {
+            Bridge.log("G2: recover(\(reason)) skipped — \(settle)ms left in the shutdown settle window")
+            armPageShutdownSettleWake(afterMs: settle)
+            return
+        }
         let now = Int64(Date().timeIntervalSince1970 * 1000)
         // If the page is already alive and the mic matches intent, there's nothing to recover —
         // this is a spurious/phantom firmware event (it spams close/exit even when our page is
@@ -4512,8 +5401,11 @@ final class G2: NSObject, SGCManager {
     }
 
     func setDashboardDepthOnly(_ depth: Int) {
-        let clamped = Int32(min(max(depth, 0), 2))
-        Bridge.log("G2: setDashboardDepthOnly(\(clamped))")
+        // The setting is 1-based (1..3, see the position screen); the firmware's
+        // xCoordinateLevel is 0..2. Sending the setting straight collapsed the
+        // two far levels onto one.
+        let clamped = Int32(G2CfwRenderer.depthLevel(forSetting: depth))
+        Bridge.log("G2: setDashboardDepthOnly(depth=\(depth) level=\(clamped))")
         let msg = G2SettingProto.setScreenDepth(
             magicRandom: sendManager.nextMagicRandom(),
             level: clamped
@@ -4535,19 +5427,15 @@ final class G2: NSObject, SGCManager {
     // MARK: - Private Display Helpers
 
     private func createPageWithContainers() {
-        // CFW carrier page: byte-identical to the known-good mixed-image page packet.
-        // One full-canvas "dashboard" text widget (id 1, content " ", event
-        // capture, exact compact field shape with no border/padding fields) plus
-        // the 576×288 carrier image container, and widgetId 10000 on the page.
-        // Our generic shape (1×1 evt-0 stub, extra fields, no widgetId) is what
-        // the known-good client does NOT send.
-        // With CFW scene rendering active the ONLY legal page is the carrier
-        // shape: one 576×288 image container (id 10) and no stock text
-        // containers. A stray stock container here rebuilds the evt-0 page
-        // shape and the firmware then rejects every CFW payload (img_res
-        // errorCode=4). Every rebuild path funnels through this function, so
-        // enforce the invariant here rather than trusting each caller to have
-        // run installCfwCarrierIfNeeded() first.
+        // CFW page: one full-canvas "dashboard" text widget (id 1, content " ",
+        // event capture, exact compact field shape with no border/padding
+        // fields) and widgetId 10000 on the page — the blank text container the
+        // firmware keeps for touch forwarding and the mic. Custom payloads ride
+        // the SID-0xf0 transport and need no image container. With CFW scene
+        // rendering active this is the ONLY legal page: a stray stock container
+        // here would rebuild the evt-0 page shape. Every rebuild path funnels
+        // through this function, so enforce the invariant here rather than
+        // trusting each caller to have run installCfwPageIfNeeded() first.
         if supportsCfwSceneRendering {
             if !textContainers.isEmpty {
                 Bridge.log(
@@ -4555,21 +5443,16 @@ final class G2: NSObject, SGCManager {
                 )
                 textContainers.removeAll()
             }
-            let strayImages = imageContainers.filter { $0.id != Self.cfwSceneContainerID }
-            if !strayImages.isEmpty {
+            if !imageContainers.isEmpty {
                 Bridge.log(
-                    "G2: CFW page — dropping stray image containers \(strayImages.map { $0.id })"
+                    "G2: CFW page — dropping stray image containers \(imageContainers.map { $0.id })"
                 )
-                imageContainers.removeAll { $0.id != Self.cfwSceneContainerID }
-            }
-            if !hasCfwCarrier {
-                _ = installCfwCarrierIfNeeded()
+                imageContainers.removeAll()
             }
+            cfwPageInstalled = true
         }
 
-        let isCfwCarrierPage = textContainers.isEmpty
-            && imageContainers.count == 1
-            && imageContainers[0].id == Self.cfwSceneContainerID
+        let isCfwCarrierPage = supportsCfwSceneRendering && textContainers.isEmpty && imageContainers.isEmpty
 
         // Dedicated event-capture container: id 0, 1x1, borderless, empty — the
         // designated event-capture slot per the RE demos ("container 0 is
@@ -4624,15 +5507,6 @@ final class G2: NSObject, SGCManager {
         // iterate all image containers, remove any entrys with duplicate id's, and ensure the ids in the imageContainerIDPool is up-to-date:
         var seenIDs = Set<Int32>()
         imageContainers = imageContainers.filter { c in
-            // The CFW carrier is INTENTIONALLY empty: its pixels ride the
-            // ordered payload queue (cfwPendingPayloads), never bmpData. The
-            // empty-container prune below silently dropped it from every page
-            // since the queue rework — the firmware then had no container to
-            // receive ANY CFW payload (mode 3/6/8, even plain BMPs), so all
-            // direct rendering went dark while stock text kept working.
-            if c.id == Self.cfwSceneContainerID {
-                return seenIDs.insert(c.id).inserted
-            }
             guard !c.bmpData.isEmpty else {
                 Bridge.log("G2: removing empty image container \(c.id)")
                 return false
@@ -4749,17 +5623,18 @@ final class G2: NSObject, SGCManager {
         // Intent is "mic on". The mic only exists inside a live EvenHub page, so we
         // toggle it off then back on (the firmware needs the off→on edge to re-arm).
         evenHubMicIntent = true
+        // Held: intent is recorded; the post-hold rebuild re-arms the mic.
+        if notificationsPanelHold {
+            return
+        }
         DeviceStore.shared.apply("glasses", "micEnabled", true)
         let msg = EvenHubProto.audioControlMessage(enable: false)
         sendEvenHubCommand(msg)
         DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) { [weak self] in
             guard let self = self else { return }
-            let useNativeDashboard =
-                DeviceStore.shared.get("bluetooth", "use_native_dashboard") as? Bool ?? false
-            // Bridge.log("G2: setMicEnabled - useNativeDashboard=\(useNativeDashboard), dashboardShowing=\(dashboardShowing)")
             // Dashboard owns the screen + session right now — don't arm the mic into a
             // page the dashboard has taken over; recovery re-arms on dashboard close.
-            if useNativeDashboard && dashboardShowing > 0 {
+            if dashboardShowing > 0 {
                 return
             }
             // Never send audioControl(enable:true) without a live page — no page means no
@@ -4870,13 +5745,15 @@ final class G2: NSObject, SGCManager {
         startupPageCreated = false
         pageCreated = false
         stockImageStreamWarmedUp = false
+        cfwTransport = G2CfwTransport.Encoder()
+        cfwStreamSequence = UInt8.random(in: 0 ... 255)
         dashboardShowing = 0
         dashboardOpening = false
+        notificationsPanelHold = false
         heartbeatCounter = 0
-        cfwCapabilityString = nil
-        cfwClassified = false
-        cfwFeatures.removeAll()
-        cfwProtocolVersion = 0
+        cancelSensorCommands()
+        cfwClassification = nil
+        publishRingBattery(.disconnected)
         cfwSceneActive = false
         // Fresh connection gets a fresh idle-resurrect budget.
         cfwLastIdleResurrectAt = nil
@@ -4884,6 +5761,11 @@ final class G2: NSObject, SGCManager {
         cfwResetShadow()
         stopFbLease(sendRelease: false) // link is gone; the leases fail open in 90 s
         stopWakeLease(sendRelease: false) // wakeLeaseWanted persists; re-armed on CFW re-detection
+        stopAncsRelay(sendDisable: false) // re-armed on CFW re-detection
+        keyboardBridge.linkLost() // the remembered keyboard reconnects on CFW re-detection
+        notificationPhase = "stale"
+        lastAppliedNotificationConfig = nil // the next connection gets a full re-push
+        publishNotificationStatus()
         DeviceStore.shared.apply("glasses", "connected", false)
         DeviceStore.shared.apply("glasses", "fullyBooted", false)
     }
@@ -5012,9 +5894,19 @@ final class G2: NSObject, SGCManager {
     ///   3. SKILL{skillId=NOTIFICATION, skillParam=show, ...} — dispatches the intent
     /// The SKILL step alone is ignored by firmware; the preceding ENTER+ASK
     /// supply the session context that lets the glasses act on the SKILL.
+    /// Our EvenHub page is torn down first and every path that would bring it
+    /// back (recovery rebuilds, fbguard lease, CFW frames, mic re-arm) is held
+    /// for 3 s, or the sends race the stock panel for the screen.
     func showNotificationsPanel() async {
         Bridge.log("G2: showNotificationsPanel()")
 
+        notificationsPanelHold = true
+        stopFbLease(sendRelease: true)
+        sendEvenHubCommand(EvenHubProto.shutdownMessage())
+        pageCreated = false
+        // Page death takes the mic with it; intent is untouched so the post-hold rebuild re-arms.
+        DeviceStore.shared.apply("glasses", "micEnabled", false)
+
         let enterPayload = EvenAIProto.aiCtrl(
             magicRandom: sendManager.nextMagicRandom(),
             status: 2 // EVEN_AI_ENTER
@@ -5035,26 +5927,25 @@ final class G2: NSObject, SGCManager {
             text: " ",
             streamEnable: 1, fTextEnd: 1
         )
+
+        try? await Task.sleep(nanoseconds: 3_000_000_000)
+        notificationsPanelHold = false
+        Bridge.log("G2: notifications resurrect re-enabled")
     }
 
-    func dbg1() {
-        Task { await showNotificationsPanel() }
-        // setCalendarWidgetFirst()
-        // toggleHeyEven()
+    func dbg1() {}
+
+    func dbg2() {}
+
+    /// Raw wake lease start — no durable intent; a reconnect drops it.
+    func dbg3() {
+        Bridge.log("G2: dbg3() — start wake lease")
+        startWakeLease()
     }
 
-    func dbg2() {
-        Task {
-            dashboardShowing = 1
-            dashboardOpening = true
-            let msg = EvenHubProto.shutdownMessage()
-            sendEvenHubCommand(msg)
-            pageCreated = false
-            try? await Task.sleep(nanoseconds: 300_000_000) // 300ms to settle
-            await showNotificationsPanel()
-        }
-        // navigationModeActive ? exitNavigationMode(arrived: false) : enterNavigationMode()
-        // Task { await runAuthSequence() }
+    func dbg4() {
+        Bridge.log("G2: dbg4() — stop wake lease")
+        stopWakeLease(sendRelease: true)
     }
 
     // MARK: - Native navigation mode (service 0x08)
@@ -5110,6 +6001,7 @@ final class G2: NSObject, SGCManager {
     func exitNavigationMode(arrived: Bool) {
         guard navigationModeActive else { return }
         Bridge.log("G2: exitNavigationMode(arrived: \(arrived))")
+        sensorNavigationRecovering = true
         navHeartbeatTask?.cancel()
         navHeartbeatTask = nil
         navigationModeActive = false
@@ -5136,6 +6028,7 @@ final class G2: NSObject, SGCManager {
             await MainActor.run {
                 guard let self = self, !self.navigationModeActive else { return }
                 self.pageCreated = false
+                self.sensorNavigationRecovering = false
                 self.recoverPageAndMic(reason: "nav-exit")
             }
         }
@@ -5505,12 +6398,15 @@ final class G2: NSObject, SGCManager {
         startupPageCreated = false
         pageCreated = false
         stockImageStreamWarmedUp = false
+        cfwTransport = G2CfwTransport.Encoder()
+        cfwStreamSequence = UInt8.random(in: 0 ... 255)
+        cfwPageInstalled = false
         dashboardShowing = 0
         dashboardOpening = false
-        cfwCapabilityString = nil
-        cfwClassified = false
-        cfwFeatures.removeAll()
-        cfwProtocolVersion = 0
+        cancelSensorCommands()
+        cfwClassification = nil
+        publishRingBattery(.disconnected)
+        keyboardBridge.linkLost()
         cfwSceneActive = false
         cfwLastIdleResurrectAt = nil
         cfwLastFrame = nil
@@ -5696,9 +6592,8 @@ final class G2: NSObject, SGCManager {
 
     // MARK: - Incoming Data Handling
 
-    private func handleNotifyData(_ data: Data, from peripheral: CBPeripheral) async {
+    private func handleNotifyData(_ data: Data, sourceKey: String, arrival: G2InputArrival) {
         // Distinguish left vs right peripheral so multi-packet reassembly doesn't collide
-        let sourceKey = peripheral === leftPeripheral ? "L" : "R"
         guard let result = receiveManager.handlePacket(data, sourceKey: sourceKey) else { return }
         // Bridge.log(
         //     "G2: handleNotifyData() - serviceId=\(result.serviceId), payload=\(result.payload.count) bytes"
@@ -5707,7 +6602,7 @@ final class G2: NSObject, SGCManager {
         // Route based on service ID
         switch result.serviceId {
         case ServiceID.evenHub.rawValue:
-            handleEvenHubResponse(result.payload)
+            handleEvenHubResponse(result.payload, arrival: arrival)
         case ServiceID.deviceSettings.rawValue:
             handleDevSettingsResponse(result.payload, sourceKey: sourceKey)
         case ServiceID.g2Setting.rawValue:
@@ -5717,7 +6612,7 @@ final class G2: NSObject, SGCManager {
         case ServiceID.dashboard.rawValue:
             handleDashboardResponse(result.payload)
         case ServiceID.gestureCtrl.rawValue:
-            await handleGestureCtrl(result.payload)
+            Task { await handleGestureCtrl(result.payload) }
         case ServiceID.navigation.rawValue:
             handleNavigationResponse(result.payload)
         case ServiceID.evenAI.rawValue:
@@ -5726,6 +6621,8 @@ final class G2: NSObject, SGCManager {
             handleEvenHubCtrlResponse(result.payload)
         case ServiceID.notification.rawValue:
             handleNotificationResponse(result.payload)
+        case ServiceID.cfwStream.rawValue:
+            break // ACK/NACK and cache replies are correlated inline in correlateCfwAck()
         default:
             Bridge.log(
                 "G2: Unhandled service \(result.serviceId) (\(result.payload.count) bytes): \(result.payload.map { String(format: "%02X", $0) }.joined())"
@@ -5806,18 +6703,18 @@ final class G2: NSObject, SGCManager {
                         "timestamp": now,
                     ]
                 )
-                Bridge.sendTypedMessage(
-                    "phone_notification",
-                    body: [
-                        "notificationId": "ancs-\(appID)-\(now)",
-                        "app": name.isEmpty ? appID : name,
-                        "title": "",
-                        "content": "",
-                        "priority": "0",
-                        "timestamp": now,
-                        "packageName": appID,
-                    ]
-                )
+                // Bridge.sendTypedMessage(
+                //     "phone_notification",
+                //     body: [
+                //         "notificationId": "ancs-\(appID)-\(now)",
+                //         "app": name.isEmpty ? appID : name,
+                //         "title": "",
+                //         "content": "",
+                //         "priority": "0",
+                //         "timestamp": now,
+                //         "packageName": appID,
+                //     ]
+                // )
             }
         }
     }
@@ -5858,16 +6755,13 @@ final class G2: NSObject, SGCManager {
             guard let compassData = fields[10] as? Data else { return }
             var cReader = ProtobufReader(compassData)
             let cFields = cReader.parseFields()
-            guard let heading = cFields[1] as? Int32 else { return }
-            // Heading in degrees, 0…359.
-            Bridge.log("G2: compass heading=\(heading)°")
-            Bridge.sendTypedMessage(
-                "compass_heading",
-                body: [
-                    "heading": Int(heading),
-                    "timestamp": Int64(Date().timeIntervalSince1970 * 1000),
-                ]
-            )
+            // Proto3 omits the scalar for magnetic north (zero degrees).
+            guard let heading = G2Sensors.heading(cFields) else { return }
+            var body: [String: Any] = ["heading": Int(heading), "timestamp": Int64(Date().timeIntervalSince1970 * 1000)]
+            if let data = fields[100] as? Data, let diagnostics = G2Sensors.compass(data) {
+                body["diagnostics"] = diagnostics
+            }
+            Bridge.sendTypedMessage("compass_heading", body: body)
 
         case NavigationCmd.osNotifyCompassCalibrateStart.rawValue:
             Bridge.log("G2: compass calibration started — wearer should look around")
@@ -5908,7 +6802,7 @@ final class G2: NSObject, SGCManager {
         }
     }
 
-    private func handleEvenHubResponse(_ payload: Data) {
+    private func handleEvenHubResponse(_ payload: Data, arrival: G2InputArrival) {
         // Parse evenhub_main_msg_ctx: field 1 = Cmd (varint), field 13 = DevEvent (submessage)
         var reader = ProtobufReader(payload)
         let fields = reader.parseFields()
@@ -5931,7 +6825,7 @@ final class G2: NSObject, SGCManager {
         if cmdValue == EvenHubResponseCmd.osNotifyEventToApp.rawValue {
             // Device event from glasses (touch/gesture or sensor data)
             guard let devEventData = fields[13] as? Data else { return }
-            handleTouchEvent(devEventData)
+            handleTouchEvent(devEventData, arrival: arrival)
         } else if cmdValue == 17 {
             // Miniapp selection from glasses dashboard menu (cmdId=17)
             // Dedup: L and R peripherals both deliver this event, so debounce or
@@ -6074,15 +6968,15 @@ final class G2: NSObject, SGCManager {
         return (x, y, z)
     }
 
-    private func handleTouchEvent(_ devEventData: Data) {
+    private func handleTouchEvent(_ devEventData: Data, arrival: G2InputArrival) {
         // Parse SendDeviceEvent: field 1=ListEvent, field 2=TextEvent, field 3=SysEvent
         var reader = ProtobufReader(devEventData)
         let fields = reader.parseFields()
 
-        let timestamp = Int64(Date().timeIntervalSince1970 * 1000)
+        let timestamp = arrival.timestamp
 
         // Classify IMU reports before applying the click debounce. Keepalive samples arrive
-        // continuously and must not update `lastClickTimestamp`, or a real gesture delivered
+        // continuously and must not update the debounce, or a real gesture delivered
         // within 100 ms of a sample can be dropped.
         var parsedSysFields: [Int: Any]?
         if let sysData = fields[3] as? Data {
@@ -6090,13 +6984,14 @@ final class G2: NSObject, SGCManager {
             let sysFields = sysReader.parseFields()
             if (sysFields[1] as? Int32) == OsEventType.imuDataReport.rawValue {
                 lastImuReportTimestamp = timestamp
+                displayDiagnostics.count("imuReceived")
                 let shouldForwardSamples =
                     DeviceStore.shared.get("bluetooth", "imu_enabled") as? Bool ?? false
                 if shouldForwardSamples,
                    let imuData = sysFields[3] as? Data,
                    let imu = parseImuReportData(imuData)
                 {
-                    Bridge.log("G2: IMU data report: \(imu.x), \(imu.y), \(imu.z)")
+                    displayDiagnostics.count("imuSamples")
                     Bridge.sendAccelEvent(x: imu.x, y: imu.y, z: imu.z, timestamp: timestamp)
                 }
                 return
@@ -6104,20 +6999,31 @@ final class G2: NSObject, SGCManager {
             parsedSysFields = sysFields
         }
 
-        // tap_start/tap_end bracket every gesture: the end edge lands within the
-        // debounce window of its own start, and the click event fires right after
-        // tap_end. Exempt the edges from the debounce (check AND update) or they
-        // either get dropped or swallow the real gesture that follows.
         let sysEventTypeRaw = parsedSysFields?[1] as? Int32
-        let isTapEdge =
-            sysEventTypeRaw == OsEventType.tapStart.rawValue
-                || sysEventTypeRaw == OsEventType.tapEnd.rawValue
-        if !isTapEdge {
-            if lastClickTimestamp != nil && timestamp - lastClickTimestamp! < 100 {
-                // Bridge.log("G2: Double click ignored (too soon)")
-                return
-            }
-            lastClickTimestamp = timestamp
+        let ring = parsedSysFields.flatMap { G2RingInput(fields: $0) }
+        let accepted = touchDebounce.accepts(event: sysEventTypeRaw, ring: ring, receivedAt: arrival.uptime)
+        // One compact record per input (including dropped inputs), with native
+        // receipt and processing times independent of delayed JS log delivery.
+        var inputLog: [String: Any] = [
+            "receivedAt": timestamp,
+            "handledAt": Int64(Date().timeIntervalSince1970 * 1000),
+            "dispatchMs": ((G2DisplayDiagnostics.now - arrival.uptime) * 1000).rounded(),
+            "accepted": accepted,
+        ]
+        inputLog["event"] = sysEventTypeRaw
+        inputLog["source"] = parsedSysFields?[2] as? Int32
+        if let ring {
+            inputLog["wireType"] = Int(ring.wireType)
+            inputLog["ringTick"] = Int64(ring.tick)
+        }
+        if let encoded = try? JSONSerialization.data(withJSONObject: inputLog, options: [.sortedKeys]),
+           let line = String(data: encoded, encoding: .utf8)
+        {
+            Bridge.log("G2INPUT " + line)
+        }
+        if !accepted {
+            displayDiagnostics.count("touchDebounced")
+            return
         }
 
         // if we are receiving touch events we are fully booted:
@@ -6155,10 +7061,11 @@ final class G2: NSObject, SGCManager {
             // whose own shutdown elicits the next exit: the 1-2s
             // rebuild→systemExit→rebuild loop. Drop the event entirely — no
             // state change, no touch-stream forward to miniapps.
+            // (Only stock image ACKs count: SID-0xf0 replies need no page.)
             if eventType == .systemExit || eventType == .abnormalExit, pageCreated {
                 let sinceAck = imgAckBox.msSinceLastSuccess()
                 if sinceAck < PHANTOM_EXIT_ACK_WINDOW_MS {
-                    Bridge.log("G2: \(eventType) ignored — carrier acked \(sinceAck)ms ago (phantom exit)")
+                    Bridge.log("G2: \(eventType) ignored — a stock image acked \(sinceAck)ms ago (phantom exit)")
                     return
                 }
             }
@@ -6173,7 +7080,6 @@ final class G2: NSObject, SGCManager {
                 timestamp: timestamp,
                 source: eventSource
             )
-            Bridge.log("G2: SysEvent → \(eventType) \(eventSource)")
 
             if eventSource == 2 {
                 // controller must be connected and fully booted:
@@ -6247,6 +7153,8 @@ final class G2: NSObject, SGCManager {
         case .systemExit: return "system_exit"
         case .tapStart: return "tap_start"
         case .tapEnd: return "tap_end"
+        case .tapThenHold: return "tap_then_hold"
+        case .ringTouchDown: return "touch_down"
         case .imuDataReport: return nil
         case .abnormalExit: return nil // don't report abnormal exits as gestures
         }
@@ -6376,6 +7284,12 @@ final class G2: NSObject, SGCManager {
         }
     }
 
+    private func publishRingBattery(_ battery: G2RingBattery) {
+        DeviceStore.shared.apply("glasses", "ringConnected", battery.connected)
+        DeviceStore.shared.apply("glasses", "ringBatteryLevel", battery.level)
+        DeviceStore.shared.apply("glasses", "ringCharging", battery.charging)
+    }
+
     private func handleG2SettingResponse(_ payload: Data) {
         // Parse G2SettingPackage: field 1=commandId, field 4=DeviceReceiveRequestFromAPP (response), field 5=DeviceSendInfoToAPP
         var reader = ProtobufReader(payload)
@@ -6396,6 +7310,28 @@ final class G2: NSObject, SGCManager {
             if let sendData = fields[5] as? Data {
                 parseDeviceSendToApp(sendData)
             }
+            if let data = fields[105] as? Data, var reading = G2Sensors.light(data) {
+                reading["timestamp"] = Int64(Date().timeIntervalSince1970 * 1000)
+                Bridge.sendTypedMessage("light_sensor", body: reading)
+            }
+            if let data = fields[106] as? Data, let battery = G2RingBattery.decode(data) {
+                publishRingBattery(battery)
+            }
+            if let record = fields[125] as? Data {
+                handleAncsRelayRecord(record)
+            }
+            if let data = fields[129] as? Data, data.count >= 2 {
+                Bridge.sendSceneSettled(tag: Int(data[data.startIndex]) | (Int(data[data.startIndex + 1]) << 8))
+            }
+            if let data = fields[128] as? Data, let status = G2BleLink.decodeStatus(data),
+               status != lastBleLinkStatus
+            {
+                lastBleLinkStatus = status
+                Bridge.log("G2: BLE link \(status.summary)")
+            }
+            if let data = fields[131] as? Data {
+                keyboardBridge.accept(data)
+            }
 
             // Firmware identity is connection-sticky: firmware cannot change
             // without a reboot/disconnect, while individual settings packets can
@@ -6419,6 +7355,8 @@ final class G2: NSObject, SGCManager {
         let active = supportsCfwSceneRendering
         DeviceStore.shared.apply("glasses", "sceneCanvasWidth", active ? 576 : 0)
         DeviceStore.shared.apply("glasses", "sceneCanvasHeight", active ? 288 : 0)
+        DeviceStore.shared.apply("glasses", "sceneVector", supportsCfwVectorScene)
+        DeviceStore.shared.apply("glasses", "sceneSettle", supportsCfwSceneSettle)
     }
 
     private func updateCfwCapabilities(_ data: Data?, definitive: Bool) {
@@ -6429,19 +7367,20 @@ final class G2: NSObject, SGCManager {
                 field100: data, definitive: definitive, currentCapability: cfwCapabilityString
             )
         else { return }
-        cfwClassified = true
+        let wasDifferent = result != cfwClassification
+        cfwClassification = result
         if result.isCfw {
-            let wasDifferent = result.capabilityString != cfwCapabilityString
-            cfwCapabilityString = result.capabilityString
-            cfwFeatures = result.features
-            cfwProtocolVersion = result.protocolVersion
             if wasDifferent {
-                Bridge.log("G2: Glassly CFW detected — \(result.capabilityString ?? "")")
+                Bridge.log("G2: CFW detected — \(result.capabilityString ?? "")")
                 rearmWakeLeaseIfWanted()
+                startAncsRelay()
+                syncBleLink()
+                keyboardBridge.cfwDetected(revision: result.revision)
             }
         } else {
-            cfwFeatures.removeAll(keepingCapacity: true)
-            cfwProtocolVersion = 0
+            publishRingBattery(.disconnected)
+            stopAncsRelay(sendDisable: false)
+            keyboardBridge.linkLost()
         }
     }
 
@@ -6460,8 +7399,8 @@ final class G2: NSObject, SGCManager {
             DeviceStore.shared.get("glasses", "rightFirmwareVersion") as? String
                 ?? DeviceStore.shared.get("glasses", "leftFirmwareVersion") as? String ?? ""
         let displayVersion: String
-        if cfwCapabilityString != nil {
-            displayVersion = baseVersion.isEmpty ? "Glassly CFW" : "\(baseVersion) (Glassly CFW)"
+        if let name = cfwClassification?.displayName {
+            displayVersion = baseVersion.isEmpty ? name : "\(baseVersion) (\(name))"
         } else {
             displayVersion = baseVersion
         }
@@ -6514,18 +7453,12 @@ final class G2: NSObject, SGCManager {
         }
     }
 
-    private func handleMenuResponse(_ data: Data) {
+    private func handleMenuResponse(_: Data) {
         // meun_main_msg_ctx response from glasses (ack of our menu send)
         // (informational only)
-        Bridge.log(
-            "G2: menu response: \(data.prefix(32).map { String(format: "%02X", $0) }.joined())"
-        )
     }
 
     private func handleDashboardResponse(_ payload: Data) {
-        Bridge.log(
-            "G2: dashboard response: \(payload.map { String(format: "%02X", $0) }.joined())"
-        )
         var reader = ProtobufReader(payload)
         let fields = reader.parseFields()
         let cmd = fields[1] as? Int32 ?? -1
@@ -6554,11 +7487,8 @@ final class G2: NSObject, SGCManager {
         }
     }
 
-    private func handleEvenHubCtrlResponse(_ data: Data) {
+    private func handleEvenHubCtrlResponse(_: Data) {
         // EvenHub CTRL channel response (informational only)
-        Bridge.log(
-            "G2: evenHubCtrl response: \(data.prefix(8).map { String(format: "%02X", $0) }.joined())"
-        )
     }
 
     private func handleGestureCtrl(_ data: Data) async {
@@ -6771,6 +7701,7 @@ extension G2: CBCentralManagerDelegate {
         let authorized = (leftPeripheral?.ancsAuthorized ?? false)
             || (rightPeripheral?.ancsAuthorized ?? false)
         DeviceStore.shared.apply("glasses", "ancsAuthorized", authorized)
+        publishNotificationStatus()
     }
 
     nonisolated func centralManager(_: CBCentralManager, didConnect peripheral: CBPeripheral) {
@@ -6861,12 +7792,14 @@ extension G2: CBCentralManagerDelegate {
             self.startupPageCreated = false
             self.pageCreated = false
             self.stockImageStreamWarmedUp = false
+            self.cfwTransport = G2CfwTransport.Encoder()
+            self.cfwStreamSequence = UInt8.random(in: 0 ... 255)
+            self.cfwPageInstalled = false
             self.dashboardShowing = 0
             self.dashboardOpening = false
-            self.cfwCapabilityString = nil
-            self.cfwClassified = false
-            self.cfwFeatures.removeAll()
-            self.cfwProtocolVersion = 0
+            self.cancelSensorCommands()
+            self.cfwClassification = nil
+            self.publishRingBattery(.disconnected)
             self.cfwSceneActive = false
             // Fresh connection gets a fresh idle-resurrect budget.
             self.cfwLastIdleResurrectAt = nil
@@ -6877,6 +7810,8 @@ extension G2: CBCentralManagerDelegate {
             // after the reconnect.
             self.stopFbLease(sendRelease: false) // link is gone; the leases fail open in 90 s
             self.stopWakeLease(sendRelease: false) // wakeLeaseWanted persists; re-armed on CFW re-detection
+            self.stopAncsRelay(sendDisable: false)
+            self.keyboardBridge.linkLost()
             DeviceStore.shared.apply("glasses", "connected", false)
             DeviceStore.shared.apply("glasses", "fullyBooted", false)
 
@@ -6933,26 +7868,6 @@ extension G2: CBPeripheralDelegate {
 
             for char in characteristics {
                 let uuid = char.uuid
-                let props = char.properties
-
-                // Log all characteristics with their properties for debugging
-                var propStr: [String] = []
-                if props.contains(.read) {
-                    propStr.append("read")
-                }
-                if props.contains(.write) {
-                    propStr.append("write")
-                }
-                if props.contains(.writeWithoutResponse) {
-                    propStr.append("writeNoResp")
-                }
-                if props.contains(.notify) {
-                    propStr.append("notify")
-                }
-                if props.contains(.indicate) {
-                    propStr.append("indicate")
-                }
-                Bridge.log("G2: \(side) char \(uuid) props=[\(propStr.joined(separator: ","))]")
 
                 if uuid == G2BLE.CHAR_WRITE {
                     Bridge.log("G2: Found WRITE char on \(side)")
@@ -7020,6 +7935,7 @@ extension G2: CBPeripheralDelegate {
         error: Error?
     ) {
         guard let data = characteristic.value, error == nil else { return }
+        let arrival = G2InputArrival()
 
         if characteristic.uuid == G2Flasher.dataNotifyUUID {
             firmwareFlasher.receive(
@@ -7044,21 +7960,28 @@ extension G2: CBPeripheralDelegate {
         // intermittent "glasses stopped responding to image sends". See [ImgAckBox].
         if characteristic.uuid == G2BLE.CHAR_NOTIFY {
             correlateImageAck(data)
+            correlateCfwAck(data)
         }
 
-        Task { @MainActor [weak self] in
-            guard let self = self else { return }
-
-            if characteristic.uuid == G2BLE.AUDIO_NOTIFY {
-                // Audio data - forward to mic system
-                await self.handleAudioData(data)
-            } else if characteristic.uuid == G2BLE.CHAR_NOTIFY {
-                // Protocol data
-                await self.handleNotifyData(data, from: peripheral)
-            } else if characteristic.uuid == G2BLE.FILE_NOTIFY {
-                // File-transfer responses (CACHE_HIT/MISS, transfer status) —
-                // observability for the notify-whitelist push.
-                let side = peripheral === self.leftPeripheral ? "L" : "R"
+        if characteristic.uuid == G2BLE.AUDIO_NOTIFY {
+            Task { @MainActor [weak self] in
+                await self?.handleAudioData(data)
+            }
+            return
+        }
+        let isProtocol = characteristic.uuid == G2BLE.CHAR_NOTIFY
+        let isFile = characteristic.uuid == G2BLE.FILE_NOTIFY
+        let peripheralID = peripheral.identifier
+        // Preserve the serial BLE callback order through protobuf reassembly
+        // and gesture dispatch. Independent Tasks need not start FIFO.
+        DispatchQueue.main.async { [weak self] in
+            guard let self else { return }
+            let side = peripheralID == self.leftPeripheral?.identifier ? "L" : "R"
+            if isProtocol {
+                self.displayDiagnostics.timing("notifyDispatchMs", (G2DisplayDiagnostics.now - arrival.uptime) * 1000)
+                self.handleNotifyData(data, sourceKey: side, arrival: arrival)
+            } else if isFile {
+                // File-transfer responses (CACHE_HIT/MISS, transfer status).
                 Bridge.log(
                     "G2: FILE notify (\(side)): \(data.map { String(format: "%02X", $0) }.joined())"
                 )
@@ -7097,20 +8020,25 @@ extension G2: CBPeripheralDelegate {
         var reader = ProtobufReader(payload)
         let fields = reader.parseFields()
         guard let resData = fields[6] as? Data else { return } // field 6 = ImgResCmd
-        var resReader = ProtobufReader(resData)
-        let resFields = resReader.parseFields()
-        guard let errorCode = resFields[8] as? Int32,
-              let ackSession = resFields[3] as? Int32
-        else { return }
-        let ackFragment = (resFields[6] as? Int32) ?? 0
-        Bridge.log(
-            "G2: img_res: session=\(ackSession) fragment=\(ackFragment) errorCode=\(errorCode) success=\(errorCode == 4)"
-        )
+        guard let ack = ImgAckBox.decodeResult(resData) else { return }
         completeImageAck(
-            session: Int(ackSession), fragmentIndex: ackFragment, success: errorCode == 4
+            session: ack.session, fragmentIndex: ack.fragment, success: ack.success
         )
     }
 
+    /// Read-only, SINGLE-PACKET parse of a raw notify frame that resolves an in-flight SID-0xf0
+    /// ACK/NACK directly (off the main actor). Replies always fit one packet. Idempotent via
+    /// [G2CfwAckBox]; the main-thread path ignores the service.
+    nonisolated func correlateCfwAck(_ rawData: Data) {
+        guard let body = G2CfwTransport.replyBody(fromNotifyFrame: rawData) else { return }
+        if let reply = G2CfwTransport.parseCacheReply(body) {
+            cfwAckBox.record(reply)
+            return
+        }
+        guard let ack = G2CfwTransport.parseAck(body) else { return }
+        cfwAckBox.resolve(ack)
+    }
+
     nonisolated func peripheral(
         _: CBPeripheral, didWriteValueFor _: CBCharacteristic, error: Error?
     ) {
@@ -7128,8 +8056,10 @@ extension G2: CBPeripheralDelegate {
         Task { @MainActor [weak self] in
             guard let self = self else { return }
             if peripheral === self.rightPeripheral {
+                self.displayDiagnostics.count("readyCallbacksR")
                 self.startDrain(right: true)
             } else if peripheral === self.leftPeripheral {
+                self.displayDiagnostics.count("readyCallbacksL")
                 self.startDrain(right: false)
             }
         }