@glassly/bluetooth-sdk 0.1.0-dev.99 → 0.2.8-dev.445

package/android/src/main/java/com/glassly/bluetoothsdk/sgcs/G2.kt

@@ -19,10 +19,18 @@ import android.graphics.Paint
 import android.graphics.Rect
 import android.os.Handler
 import android.os.Looper
+import android.os.SystemClock
 import android.util.Base64
 import com.glassly.bluetoothsdk.Bridge
 import com.glassly.bluetoothsdk.DeviceManager
 import com.glassly.bluetoothsdk.DeviceStore
+import com.glassly.bluetoothsdk.GlassesNotificationAccess
+import com.glassly.bluetoothsdk.GlassesNotificationConfig
+import com.glassly.bluetoothsdk.GlassesNotificationFeeds
+import com.glassly.bluetoothsdk.GlassesNotificationPhases
+import com.glassly.bluetoothsdk.GlassesNotificationStatus
+import com.glassly.bluetoothsdk.NotificationUploadOutcomes
+import com.glassly.bluetoothsdk.PhoneNotificationUpload
 import com.glassly.bluetoothsdk.utils.DeviceTypes
 import java.io.ByteArrayOutputStream
 import java.util.TimeZone
@@ -37,7 +45,11 @@ import kotlinx.coroutines.channels.Channel
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.isActive
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
 import kotlinx.coroutines.withTimeoutOrNull
+import kotlinx.coroutines.withContext
+import org.json.JSONObject
 
 // ---------- G2 Protocol Constants ----------
 
@@ -46,6 +58,10 @@ private object G2BLE {
     val CHAR_WRITE: UUID = UUID.fromString("00002760-08C2-11E1-9073-0E8AC72E5401")
     val CHAR_NOTIFY: UUID = UUID.fromString("00002760-08C2-11E1-9073-0E8AC72E5402")
     val AUDIO_NOTIFY: UUID = UUID.fromString("00002760-08C2-11E1-9073-0E8AC72E6402")
+    // File-transfer characteristics: notification content / allowlist pushes ride
+    // the 0xC4/0xC5 services here, not the main 5401 protocol char.
+    val FILE_WRITE: UUID = UUID.fromString("00002760-08C2-11E1-9073-0E8AC72E7401")
+    val FILE_NOTIFY: UUID = UUID.fromString("00002760-08C2-11E1-9073-0E8AC72E7402")
     val OTA_DATA_WRITE: UUID = UUID.fromString("00002760-08C2-11E1-9073-0E8AC72E0001")
     val OTA_DATA_NOTIFY: UUID = UUID.fromString("00002760-08C2-11E1-9073-0E8AC72E0002")
     val SERVICE_UUID: UUID = UUID.fromString("00002760-08C2-11E1-9073-0E8AC72E0000")
@@ -55,12 +71,17 @@ private object G2BLE {
     const val SOURCE_PHONE: Byte = 1
     const val DEST_GLASSES: Byte = 2
     const val MAX_PACKET_PAYLOAD: Int = 236
+
+    // File-transfer services, same AA-21 envelope as every other service.
+    const val FILE_SERVICE_CMD: Byte = 0xC4.toByte() // FILE_CHECK header, START (0x01), END (0x02)
+    const val FILE_SERVICE_DATA: Byte = 0xC5.toByte() // raw file bytes
 }
 
 // Service IDs from service_id_def.proto
 private enum class ServiceID(val value: Byte) {
     DASHBOARD(0x01), // UI_BACKGROUND_DASHBOARD_APP_ID
     MENU(0x03), // UI_FOREGROUND_MEUN_ID (typo is intentional — matches Even's proto)
+    NOTIFICATION(0x04), // UI_FOREGROUND_NOTIFICATION_ID
     EVEN_AI(0x07), // UI_FOREGROUND_EVEN_AI_ID
     NAVIGATION(0x08), // UI_BACKGROUND_NAVIGATION_ID (compass/heading lives here)
     G2_SETTING(0x09), // UI_SETTING_APP_ID
@@ -68,13 +89,28 @@ private enum class ServiceID(val value: Byte) {
     ONBOARDING(0x10), // UI_ONBOARDING_APP_ID
     DEVICE_SETTINGS(0x80.toByte()), // UX_DEVICE_SETTINGS_APP_ID
     EVEN_HUB_CTRL(0x81.toByte()), // EvenHub CTRL channel (init/registration)
-    EVEN_HUB(0xE0.toByte()); // UI_BACKGROUND_EVENHUB_APP_ID
+    EVEN_HUB(0xE0.toByte()), // UI_BACKGROUND_EVENHUB_APP_ID
+    CFW_STREAM(0xF0.toByte()); // private Glassly CFW message streams (GLASSLYCFW/31)
 
     companion object {
         fun fromByte(b: Byte): ServiceID? = entries.find { it.value == b }
     }
 }
 
+// eNotificationCommandId from notification.proto (service 0x04)
+private object NotificationCmd {
+    const val CTRL = 1 // NotificationControl in field 3
+    const val WHITELIST_CTRL = 3 // NotificationWhitelistCtrl in field 6
+}
+
+private const val FILE_START: Byte = 0x01
+private const val FILE_END: Byte = 0x02
+private const val MAX_PENDING_UPLOADS = 8
+
+// File-push pacing, matching what the firmware tolerates between phases.
+private const val FILE_HEADER_SETTLE_MS = 150L
+private const val FILE_PHASE_GAP_MS = 50L
+
 // EvenHub command IDs from EvenHub.proto
 private enum class EvenHubCmd(val value: Int) {
     CREATE_STARTUP_PAGE(0),
@@ -271,7 +307,12 @@ private enum class OsEventType(val value: Int) {
     // them while our fbguard lease is active. Names stay tap_start/tap_end.
     TAP_START(9), // press recognized (hold start)
     TAP_END(10), // released
-    TAP_THEN_HOLD(11); // CFW extension: 2.2.9 tap-then-hold (stock Menu gesture)
+    TAP_THEN_HOLD(11), // CFW extension: 2.2.9 tap-then-hold (stock Menu gesture)
+    // 12 is head-up (settings path), 13 is burned (experimental temple edge). 14 is
+    // the Glassly CFW's ring touch-down (R1 subtype 0x0d, GLASSLYCFW/37 on 2.3.0.24);
+    // only the ring produces it and the id itself marks ring provenance. Unknown
+    // ring wire types arrive as 127 and are dropped.
+    RING_TOUCH_DOWN(14);
 
     companion object {
         fun fromInt(v: Int): OsEventType? = entries.find { it.value == v }
@@ -1441,23 +1482,31 @@ class G2 : SGCManager() {
         hasMic = true
     }
 
-    /** Glassly CFW identity is sticky for one BLE connection and resets only on disconnect. */
-    private var cfwCapabilityString: String? = null
+    /** null until settings classify the connection as stock, upstream, or Glassly. */
+    private data class SensorCommand(val data: ByteArray, val result: CompletableDeferred<Boolean>)
+    private val sensorCommands = ArrayDeque<SensorCommand>()
+    private var sensorNavigationRecovering = false
 
-    /**
-     * True once the connection is classified either way (CFW detected, or a
-     * definitive settings response without field 100). Until then legacy text
-     * would race the classification and split draw/clear across render paths.
-     */
-    @Volatile private var cfwClassified = false
-    private val cfwFeatures = mutableSetOf<String>()
+    suspend fun glassesSensorControl(sensor: String, operation: String, options: Map<String, Double>): Boolean =
+        withContext(Dispatchers.Main) {
+            if (!supportsCfwTransport || navigationModeActive || sensorCommands.size >= 8)
+                return@withContext false
+            val data = G2Sensors.command(sensor, operation, options) ?: return@withContext false
+            val command = SensorCommand(data, CompletableDeferred())
+            sensorCommands.addLast(command)
+            signalDisplayDirty()
+            try { withTimeoutOrNull(10_000) { command.result.await() } ?: false }
+            finally { sensorCommands.remove(command) }
+        }
 
-    /**
-     * Protocol revision from the capability string's "EVENCFW/NN" token.
-     * Gates wire features that have no dedicated capability token (mode-9
-     * rect copies shipped with revision 15).
-     */
-    private var cfwProtocolVersion = 0
+    private fun cancelSensorCommands() {
+        sensorNavigationRecovering = false
+        while (sensorCommands.isNotEmpty()) sensorCommands.removeFirst().result.complete(false)
+    }
+
+    @Volatile private var cfwClassification: G2CfwClassification? = null
+    private val cfwClassified: Boolean get() = cfwClassification != null
+    private val cfwCapabilityString: String? get() = cfwClassification?.capabilityString
     private var cfwSceneActive = false
 
     /**
@@ -1467,7 +1516,19 @@ class G2 : SGCManager() {
      * down we back off instead of trading rebuilds with it once per tick.
      */
     private var cfwLastIdleResurrectAt: Long? = null
-    private val cfwSceneContainerId = 10
+
+    /**
+     * Private SID-0xf0 message transport (GLASSLYCFW/31): one deflate context
+     * per connection, one stream per message, ACK-gated exactly like the old
+     * image carrier was. Payloads still go out on the LEFT arm; the right lens
+     * processes them over the frame bridge and its ACK returns through the
+     * left. No EvenHub image container is involved any more.
+     */
+    private var cfwTransport = G2CfwTransport.Encoder()
+    private var cfwStreamSequence = (0..255).random()
+    private val cfwAckBox = G2CfwAckBox()
+    /** The container set is in CFW shape: no stock text or image containers. */
+    private var cfwPageInstalled = false
 
     /**
      * Queued CFW payloads are tagged so coalescing keeps the chain sound:
@@ -1476,9 +1537,16 @@ class G2 : SGCManager() {
      * fulls/deltas. SEED (mode-6 black) and MOVE_BUNDLE (blank of an old
      * window position) always survive.
      */
-    private enum class CfwPayloadKind { SEED, FULL, DELTA, MOVE_BUNDLE, UPLOAD }
+    private enum class CfwPayloadKind { SEED, FULL, DELTA, MOVE_BUNDLE, UPLOAD, SCENE }
 
-    private class CfwPayload(val kind: CfwPayloadKind, val data: ByteArray)
+    private class CfwPayload(
+            val kind: CfwPayloadKind,
+            val data: ByteArray,
+            /** Host frame this payload puts on the glasses — reported once acked. */
+            var presents: SceneFrame.PresentTag? = null,
+            /** Lenses this payload is for (scene SHOWs split per lens once a frame uses element depth). */
+            val lenses: Int = G2CfwTransport.LENS_BOTH,
+    )
 
     private val cfwPendingPayloads = ArrayDeque<CfwPayload>()
     private var cfwShadowSeeded = false
@@ -1537,40 +1605,45 @@ class G2 : SGCManager() {
     // CFW capability string is seen again.
     private var wakeLeaseWanted = false
 
-    private val supportsCfwSceneRendering: Boolean
-        get() =
-            cfwCapabilityString != null &&
-                listOf("img640", "imgz", "rle", "directfb").all { it in cfwFeatures } &&
-                // Escape hatch (default ON): OFF falls back to stock containers. Reconnect to switch cleanly.
-                (DeviceStore.get("bluetooth", "cfw_scene_renderer") as? Boolean ?: true)
-
-    private val hasCfwCarrier: Boolean
-        get() =
-            imageContainers.size == 1 &&
-                imageContainers[0].id == cfwSceneContainerId &&
-                imageContainers[0].x == 0 &&
-                imageContainers[0].y == 0 &&
-                imageContainers[0].width == 576 &&
-                imageContainers[0].height == 288
-
     /**
-     * Mode-9 rect copies have no capability token; they shipped with protocol
-     * revision 15 alongside the texture/font modes.
+     * Glassly CFW at or above the supported revision. Anything else (stock,
+     * upstream, older Glassly builds) is treated as stock.
      */
-    private val supportsCfwRectCopy: Boolean
-        get() = cfwProtocolVersion >= 15
-
-    /** Mode-15 builtin-font string draws (`font15` capability token). */
-    private val supportsCfwBuiltinText: Boolean
-        get() = "font15" in cfwFeatures
+    private val supportsCfwTransport: Boolean
+        get() {
+            val classification = cfwClassification ?: return false
+            return classification.isGlassly && (classification.revision ?: 0) >= G2CfwClassification.MINIMUM_REVISION
+        }
 
-    /** Mode-12 uploads + mode-14 cached-glyph runs (mono text as draws). */
-    private val supportsCfwTextureGlyphs: Boolean
-        get() = "texcache12" in cfwFeatures && "texstr14" in cfwFeatures
+    override val supportsCfwSceneRendering: Boolean
+        get() =
+            supportsCfwTransport &&
+                // Escape hatch (default ON): OFF falls back to stock containers. Reconnect to switch cleanly.
+                (DeviceStore.get("bluetooth", "cfw_scene_renderer") as? Boolean ?: true)
 
-    /** Mode-12 uploads + mode-13 cached-image draws (repeated icons as draws). */
-    private val supportsCfwTextureImages: Boolean
-        get() = "texcache12" in cfwFeatures && "teximg13" in cfwFeatures
+    private val hasCfwPage: Boolean
+        get() = cfwPageInstalled && textContainers.isEmpty() && imageContainers.isEmpty()
+
+    /** Glassly adds retained vector scenes and animation to upstream's raster protocol. */
+    private val supportsCfwVectorScene: Boolean
+        get() = supportsCfwSceneRendering && cfwClassification?.isGlassly == true
+
+    /** Tagged commits report settings field 129 once the scene has settled. */
+    private val supportsCfwSceneSettle: Boolean
+        get() = supportsCfwVectorScene
+
+    /** The on-glass slot table must be re-SET on the next vector frame. */
+    private var cfwSceneInvalid = true
+    /** Texture-cache generation whose first vector frame was preceded by the warm-up tween. */
+    private var cfwSceneWarmedGeneration = -1
+    /** Object-cache session epoch shared by both lenses (GLASSLYCFW/38); 0 until the generation's RESET was acknowledged. */
+    private var cfwCacheEpoch = 0
+    /** Request id stamped into cache messages whose encoder left it 0. */
+    private var cfwCacheRequest = 0
+    /** Frames re-encoded after a MISSING reply, bounded per frame. */
+    private var cfwMissingRetries = 0
+    /** Bumped by every clear so an encoder suspended when the clear arrived is discarded. */
+    private var cfwClearSerial = 0
 
     // BLE
     private val context: Context
@@ -1588,6 +1661,8 @@ class G2 : SGCManager() {
     private var rightOtaDataNotifyChar: BluetoothGattCharacteristic? = null
     private var leftAudioChar: BluetoothGattCharacteristic? = null
     private var rightAudioChar: BluetoothGattCharacteristic? = null
+    private var leftFileWriteChar: BluetoothGattCharacteristic? = null
+    private var rightFileWriteChar: BluetoothGattCharacteristic? = null
     private var leftInitialized: Boolean = false
     private var rightInitialized: Boolean = false
     private var isDisconnecting = false
@@ -1734,12 +1809,26 @@ class G2 : SGCManager() {
     private var recoveryInFlight = false
     private var lastRecoveryRebuildMs: Long = 0
     private val RECOVERY_DEBOUNCE_MS: Long = 1500
+    // A SHUTDOWN_PAGE we send is answered ~300 ms later by the firmware's
+    // teardown trio (shutdown notify, systemExit, 08011A00). Creating the next
+    // page before that lands makes the trio read as the NEW page dying:
+    // pageCreated flips false, the toggle recovers, and the firmware sees
+    // shutdown→create→create inside half a second — the rebuild storm the G2
+    // answers by dropping the link (GLASSLYCFW/29 died on every dashboard
+    // open this way). Resurrection and recovery wait out this window instead.
+    private var lastPageShutdownSentMs: Long = 0
+    private val PAGE_SHUTDOWN_SETTLE_MS: Long = 400
+    private var pageShutdownSettleWakeArmed = false
+    // Stock notifications panel hold: page rebuilds, fbguard lease and CFW frames stay
+    // down while the panel opens so EvenHub sends cannot snatch the screen back.
+    @Volatile private var notificationsPanelHold = false
 
     // Dashboard menu state
     private var menuAppIdToPackageName: MutableMap<Int, String> = mutableMapOf()
     private var dashboardMenuItems: MutableList<MenuProto.MenuItem> = mutableListOf()
     private var activeMenuAppId: Int? = null
-    private var lastClickTimestamp: Long? = null
+    private var touchDebounce = G2TouchDebounce()
+    private val displayDiagnostics = G2DisplayDiagnostics(SystemClock.elapsedRealtime())
     /** Last IMU report arrival — the data stream doubles as IMU-control delivery confirmation. */
     private var lastImuReportTimestamp: Long? = null
     private var lastEvenHubResponseTimestamp: Long? = null
@@ -1935,7 +2024,10 @@ class G2 : SGCManager() {
                 rightGatt?.let { gatt ->
                     char.value = packet
                     char.writeType = BluetoothGattCharacteristic.WRITE_TYPE_NO_RESPONSE
-                    bgcapNoteWriteResult(gatt.writeCharacteristic(char)) // BGCAP
+                    val accepted = gatt.writeCharacteristic(char)
+                    bgcapNoteWriteResult(accepted)
+                    displayDiagnostics.count(if (accepted) "txPackets" else "writeRejected")
+                    if (accepted) displayDiagnostics.count("txBytes", packet.size)
                 }
             }
         }
@@ -1944,7 +2036,10 @@ class G2 : SGCManager() {
                 leftGatt?.let { gatt ->
                     char.value = packet
                     char.writeType = BluetoothGattCharacteristic.WRITE_TYPE_NO_RESPONSE
-                    bgcapNoteWriteResult(gatt.writeCharacteristic(char)) // BGCAP
+                    val accepted = gatt.writeCharacteristic(char)
+                    bgcapNoteWriteResult(accepted)
+                    displayDiagnostics.count(if (accepted) "txPackets" else "writeRejected")
+                    if (accepted) displayDiagnostics.count("txBytes", packet.size)
                 }
             }
         }
@@ -1953,7 +2048,8 @@ class G2 : SGCManager() {
     private fun sendToGlasses(
         packets: List<ByteArray>,
         left: Boolean = false,
-        right: Boolean = true
+        right: Boolean = true,
+        isPending: () -> Boolean = { true }
     ) {
         // OTA owns both links exclusively. Normal heartbeats/display/settings traffic must not
         // interleave with its AA21 frame stream.
@@ -1962,6 +2058,10 @@ class G2 : SGCManager() {
         if (packets.isEmpty()) return
         // Single-packet sends (the common case for text/settings) go straight through.
         if (packets.size == 1) {
+            if (!isPending()) {
+                displayDiagnostics.count("txExpiredPackets")
+                return
+            }
             writeOnePacket(packets[0], left, right)
             return
         }
@@ -1969,8 +2069,14 @@ class G2 : SGCManager() {
         // write thread with a blocking gap between packets, so the Android BLE stack can drain each
         // write before the next is queued WITHOUT occupying the main looper (which also carries the
         // image ACK and would otherwise starve it under load — see [bleWriteExecutor]).
+        val queuedAt = SystemClock.elapsedRealtime()
         bleWriteExecutor.execute {
             for (i in packets.indices) {
+                if (!isPending()) {
+                    displayDiagnostics.count("txExpiredPackets", packets.size - i)
+                    return@execute
+                }
+                if (i == 0) displayDiagnostics.timing("writeQueueMs", SystemClock.elapsedRealtime() - queuedAt)
                 writeOnePacket(packets[i], left, right)
                 if (i < packets.size - 1) {
                     try {
@@ -2197,6 +2303,7 @@ class G2 : SGCManager() {
 
         sendMenuApps()
         sendStoredCalendarEvents()
+        reapplyStoredNotificationConfig()
 
         // Re-apply the IMU preference: the store only pushes imu_enabled to the glasses when
         // the value changes, so after a reconnect an already-on IMU would otherwise stay off
@@ -2277,6 +2384,15 @@ class G2 : SGCManager() {
             displayScope.launch {
                 while (isActive) {
                     delay(EVEN_HUB_QUEUE_TICK_MS)
+                    val now = SystemClock.elapsedRealtime()
+                    val wallTime = System.currentTimeMillis()
+                    displayDiagnostics.session(now, wallTime, mapOf(
+                        "platform" to "android", "cfw" to (cfwCapabilityString ?: "stock"),
+                    ))?.let { Bridge.log("G2PERF " + JSONObject(it).toString()) }
+                    displayDiagnostics.sample(now, wallTime, mapOf(
+                        "app" to (cfwLastFrame?.appId ?: ""), "seq" to (cfwLastFrame?.seq ?: 0),
+                        "payloadQueue" to cfwPendingPayloads.size, "page" to pageCreated,
+                    ), busy = cfwPendingPayloads.isNotEmpty())?.let { Bridge.log("G2PERF " + JSONObject(it).toString()) }
                     signal.trySend(Unit)
                 }
             }
@@ -2353,6 +2469,263 @@ class G2 : SGCManager() {
         sendCalendarEvents(calendarEvents)
     }
 
+    // ---------- Glasses Notifications (phone-uploaded content) ----------
+
+    private val notificationScope = CoroutineScope(Dispatchers.IO + SupervisorJob())
+    private val filePushMutex = Mutex()
+    private val messageIds = NotificationMessageIds()
+    private val uploadQueue = ArrayDeque<PhoneNotificationUpload>()
+    private var uploadWorker: Job? = null
+    private var notificationConfig: GlassesNotificationConfig? = null
+    private var notificationPhase: String = GlassesNotificationPhases.IDLE
+    private var notificationError: String? = null
+
+    /** Firmware popup durations; anything else is snapped to the nearest, ties up. */
+    private val popupDurations = listOf(5, 7, 10)
+
+    override fun setGlassesNotificationConfig(config: GlassesNotificationConfig) {
+        synchronized(uploadQueue) { notificationConfig = config }
+        if (!config.enabled) {
+            cancelQueuedUploads("disabled")
+        }
+        applyNotificationConfig(config)
+    }
+
+    override fun glassesNotificationStatus(): GlassesNotificationStatus =
+        synchronized(uploadQueue) {
+            GlassesNotificationStatus(
+                supported = true,
+                feed = GlassesNotificationFeeds.PHONE_UPLOAD,
+                access = GlassesNotificationAccess.NOT_NEEDED,
+                phase = notificationPhase,
+                config = notificationConfig,
+                error = notificationError
+            )
+        }
+
+    override fun uploadPhoneNotification(upload: PhoneNotificationUpload) {
+        val config =
+            synchronized(uploadQueue) { notificationConfig }
+                ?: throw IllegalStateException("Glasses notification config has not been applied")
+        if (!config.enabled) {
+            throw IllegalStateException("Glasses notifications are disabled")
+        }
+        val dropped =
+            synchronized(uploadQueue) {
+                var evicted: PhoneNotificationUpload? = null
+                if (uploadQueue.size >= MAX_PENDING_UPLOADS) {
+                    evicted = uploadQueue.removeFirstOrNull()
+                }
+                uploadQueue.addLast(upload)
+                evicted
+            }
+        dropped?.let {
+            reportUpload(it.notificationId, NotificationUploadOutcomes.DROPPED, "queue full")
+        }
+        startUploadWorker()
+    }
+
+    private fun startUploadWorker() {
+        synchronized(uploadQueue) {
+            if (uploadWorker?.isActive == true) return
+            uploadWorker =
+                notificationScope.launch {
+                    while (true) {
+                        val next = synchronized(uploadQueue) { uploadQueue.removeFirstOrNull() } ?: break
+                        deliverUpload(next)
+                    }
+                }
+        }
+    }
+
+    private suspend fun deliverUpload(upload: PhoneNotificationUpload) {
+        val msgId = messageIds.idFor(upload.notificationId)
+        val json =
+            G2NotificationFile.notificationJson(upload, msgId, System.currentTimeMillis())
+        val pushed =
+            try {
+                pushFile(G2NotificationFile.FILENAME, json, G2NotificationFile.FILE_TYPE_NOTIFICATION)
+            } catch (e: Exception) {
+                Bridge.log("G2: notification upload failed for ${upload.packageName}: ${e.message}")
+                reportUpload(upload.notificationId, NotificationUploadOutcomes.FAILED, e.message ?: "push threw")
+                return
+            }
+        if (pushed) {
+            reportUpload(upload.notificationId, NotificationUploadOutcomes.SENT, "pushed")
+        } else {
+            reportUpload(upload.notificationId, NotificationUploadOutcomes.FAILED, "file push unavailable")
+        }
+    }
+
+    private fun cancelQueuedUploads(detail: String) {
+        val pending = synchronized(uploadQueue) {
+            val copy = uploadQueue.toList()
+            uploadQueue.clear()
+            copy
+        }
+        pending.forEach {
+            reportUpload(it.notificationId, NotificationUploadOutcomes.CANCELLED, detail)
+        }
+    }
+
+    private fun reportUpload(notificationId: String, outcome: String, detail: String) {
+        Bridge.sendTypedMessage(
+            "notification_upload_result",
+            mapOf("notificationId" to notificationId, "outcome" to outcome, "detail" to detail)
+        )
+    }
+
+    private fun publishNotificationStatus() {
+        val body = glassesNotificationStatus().toMap().mapNotNull { (key, value) ->
+            value?.let { key to it }
+        }.toMap()
+        Bridge.sendTypedMessage("glasses_notification_status", body)
+    }
+
+    /** 0 stays 0 (firmware default); anything else snaps to 5/7/10, ties up. */
+    private fun snapPopupSeconds(seconds: Int): Int {
+        if (seconds <= 0) return 0
+        var best = popupDurations.first()
+        var bestDistance = Int.MAX_VALUE
+        for (candidate in popupDurations) {
+            val distance = kotlin.math.abs(candidate - seconds)
+            if (distance < bestDistance || (distance == bestDistance && candidate > best)) {
+                best = candidate
+                bestDistance = distance
+            }
+        }
+        return best
+    }
+
+    private fun sendNotificationCommand(payload: ByteArray) {
+        val packets =
+            sendManager.buildPackets(
+                serviceId = ServiceID.NOTIFICATION.value,
+                payload = payload,
+                reserveFlag = true
+            )
+        sendToGlasses(packets)
+    }
+
+    private fun applyNotificationConfig(config: GlassesNotificationConfig) {
+        if (leftGatt == null && rightGatt == null) {
+            synchronized(uploadQueue) {
+                notificationPhase = GlassesNotificationPhases.STALE
+                notificationError = null
+            }
+            publishNotificationStatus()
+            return
+        }
+        try {
+            val ctrl = ProtobufWriter()
+            ctrl.writeInt32Field(1, if (config.enabled) 1 else 0) // notifEnable
+            ctrl.writeInt32Field(2, if (config.popups) 1 else 0) // autoDispEnable
+            ctrl.writeInt32Field(3, snapPopupSeconds(config.popupSeconds)) // dispTime
+            ctrl.writeInt32Field(5, if (config.holdDuringApps) 1 else 0) // avoidDisturbEnable
+
+            val ctrlPkg = ProtobufWriter()
+            ctrlPkg.writeInt32Field(1, NotificationCmd.CTRL)
+            ctrlPkg.writeInt32Field(2, sendManager.nextMagicRandom())
+            ctrlPkg.writeMessageField(3, ctrl.toByteArray())
+            sendNotificationCommand(ctrlPkg.toByteArray())
+
+            // The phone filters before upload, so the on-glass allowlist stays off
+            // and no allowlist file is pushed.
+            val whitelist = ProtobufWriter()
+            whitelist.writeInt32Field(1, 1) // whitelistDisable
+            val whitelistPkg = ProtobufWriter()
+            whitelistPkg.writeInt32Field(1, NotificationCmd.WHITELIST_CTRL)
+            whitelistPkg.writeInt32Field(2, sendManager.nextMagicRandom())
+            whitelistPkg.writeMessageField(6, whitelist.toByteArray())
+            sendNotificationCommand(whitelistPkg.toByteArray())
+
+            synchronized(uploadQueue) {
+                notificationPhase = GlassesNotificationPhases.APPLIED
+                notificationError = null
+            }
+            Bridge.log(
+                "G2: applied notification config enabled=${config.enabled} popups=${config.popups} " +
+                    "seconds=${snapPopupSeconds(config.popupSeconds)} blocked=${config.blockedApps.size}"
+            )
+        } catch (e: Exception) {
+            synchronized(uploadQueue) {
+                notificationPhase = GlassesNotificationPhases.ERROR
+                notificationError = e.message ?: "apply failed"
+            }
+            Bridge.log("G2: notification config apply failed: ${e.message}")
+        }
+        publishNotificationStatus()
+    }
+
+    private fun reapplyStoredNotificationConfig() {
+        val config = synchronized(uploadQueue) { notificationConfig } ?: return
+        applyNotificationConfig(config)
+    }
+
+    /**
+     * FILE_CHECK header → START → DATA → END on the file characteristic, per
+     * arm (right first). Returns false while a flash owns the links or a
+     * connected arm never discovered the characteristic.
+     */
+    private suspend fun pushFile(filename: String, content: ByteArray, fileType: Int): Boolean =
+        filePushMutex.withLock {
+            if (firmwareFlasher.active) return@withLock false
+            val header = G2NotificationFile.fileCheckHeader(filename, content, fileType)
+            var pushedRight = false
+            var skippedArm = false
+            // Right arm carries the display; left is kept in sync when it has the char.
+            for (right in listOf(true, false)) {
+                val gatt = (if (right) rightGatt else leftGatt) ?: continue
+                val char = (if (right) rightFileWriteChar else leftFileWriteChar)
+                if (char == null) {
+                    skippedArm = true
+                    continue
+                }
+                writeFilePackets(gatt, char, G2BLE.FILE_SERVICE_CMD, header)
+                delay(FILE_HEADER_SETTLE_MS)
+                writeFilePackets(gatt, char, G2BLE.FILE_SERVICE_CMD, byteArrayOf(FILE_START))
+                delay(FILE_PHASE_GAP_MS)
+                writeFilePackets(gatt, char, G2BLE.FILE_SERVICE_DATA, content)
+                delay(FILE_PHASE_GAP_MS)
+                writeFilePackets(gatt, char, G2BLE.FILE_SERVICE_CMD, byteArrayOf(FILE_END))
+                delay(FILE_PHASE_GAP_MS)
+                if (right) pushedRight = true
+            }
+            Bridge.log("G2: pushed $filename (${content.size} bytes) right=$pushedRight skipped=$skippedArm")
+            pushedRight && !skippedArm
+        }
+
+    @Suppress("deprecation")
+    private suspend fun writeFilePackets(
+        gatt: BluetoothGatt,
+        char: BluetoothGattCharacteristic,
+        serviceId: Byte,
+        payload: ByteArray
+    ) {
+        val packets = sendManager.buildPackets(serviceId = serviceId, payload = payload)
+        for (packet in packets) {
+            withContext(Dispatchers.Main) {
+                char.value = packet
+                char.writeType = BluetoothGattCharacteristic.WRITE_TYPE_NO_RESPONSE
+                gatt.writeCharacteristic(char)
+            }
+            delay(BLE_PACKET_GAP_MS)
+        }
+    }
+
+    private fun resetNotificationsOnDisconnect() {
+        cancelQueuedUploads("disconnected")
+        uploadWorker?.cancel()
+        uploadWorker = null
+        leftFileWriteChar = null
+        rightFileWriteChar = null
+        synchronized(uploadQueue) {
+            notificationPhase = GlassesNotificationPhases.STALE
+            notificationError = null
+        }
+        publishNotificationStatus()
+    }
+
     // ---------- SGCManager: Display Control ----------
 
     override fun sendText(text: String) {
@@ -2415,9 +2788,7 @@ class G2 : SGCManager() {
         // Bridge.log("G2: sendTextWall(${text.take(50)}...)")
 
         // ignore events while the ER dashboard is open:
-        val useNativeDashboard =
-            DeviceStore.get("bluetooth", "use_native_dashboard") as? Boolean ?: false
-        if (useNativeDashboard && dashboardShowing > 0) {
+        if (dashboardShowing > 0) {
             return
         }
 
@@ -2440,7 +2811,7 @@ class G2 : SGCManager() {
         if (supportsCfwSceneRendering) {
             if (text.isBlank()) {
                 // A blank wall is the idle state: keep the carrier alive for touch and mic.
-                val carrierWasConfigured = installCfwCarrierIfNeeded()
+                val carrierWasConfigured = installCfwPageIfNeeded()
                 cfwClear()
                 if (!carrierWasConfigured && pageCreated) {
                     // Carrier just replaced live stock containers (see clearDisplay).
@@ -2548,7 +2919,7 @@ class G2 : SGCManager() {
             // Idle on CFW = the black carrier page, kept up for touch + mic.
             // Install it even on a first-ever clear (no scene rendered yet) so
             // the idle state is the same page everywhere.
-            val carrierWasConfigured = installCfwCarrierIfNeeded()
+            val carrierWasConfigured = installCfwPageIfNeeded()
             cfwClear()
             if (!carrierWasConfigured || !pageCreated) signalDisplayDirty()
             if (!carrierWasConfigured && pageCreated) {
@@ -2628,8 +2999,7 @@ class G2 : SGCManager() {
         val rh = height ?: defaultImgHeight
 
         // ignore events while the ER dashboard is open:
-        val useNativeDashboard = DeviceStore.get("bluetooth", "use_native_dashboard") as? Boolean ?: false
-        if (useNativeDashboard && dashboardShowing > 0) {
+        if (dashboardShowing > 0) {
             return false
         }
 
@@ -2837,6 +3207,8 @@ class G2 : SGCManager() {
                     coalescedPageRebuild()
                 }
             }
+            // Stock firmware: text sends are unacked; the verbs above are the best signal there is.
+            frame.reportPresented(true)
         }
     }
 
@@ -2846,23 +3218,13 @@ class G2 : SGCManager() {
      * page. Returns true if it was ALREADY configured, so callers can tell
      * whether they need a page rebuild.
      */
-    private fun installCfwCarrierIfNeeded(): Boolean {
-        if (textContainers.isEmpty() && hasCfwCarrier) return true
+    private fun installCfwPageIfNeeded(): Boolean {
+        if (hasCfwPage) return true
         textContainers.clear()
         sceneTextByElement.clear()
         sceneImageByElement.clear()
         imageContainers.clear()
-        imageContainers.add(
-            ImgContainer(
-                id = cfwSceneContainerId,
-                x = 0,
-                y = 0,
-                width = 576,
-                height = 288,
-                bmpData = ByteArray(0),
-                dirty = false,
-            )
-        )
+        cfwPageInstalled = true
         cfwResetShadow()
         return false
     }
@@ -2885,13 +3247,23 @@ class G2 : SGCManager() {
 
     /** Install the single carrier and render the whole scene through CFW mode 3. */
     private suspend fun applyCfwScene(frame: SceneFrame) {
-        val carrierWasConfigured = installCfwCarrierIfNeeded()
+        displayDiagnostics.count("framesIn")
+        // Held: retain the frame so the post-hold rebuild re-sends it, but paint nothing now.
+        if (notificationsPanelHold) {
+            cfwLastFrame = frame
+            return
+        }
+        val carrierWasConfigured = installCfwPageIfNeeded()
         cfwLastFrame = frame
         // Lease before the frame: a fresh FB_ACQUIRE resets preservation, and
         // the frame queued below is what re-arms it.
         startFbLease()
-        if (!enqueueCfwFrame(frame)) {
+        val encodeAt = SystemClock.elapsedRealtime()
+        val encoded = enqueueCfwFrame(frame)
+        displayDiagnostics.timing("encodeMs", SystemClock.elapsedRealtime() - encodeAt)
+        if (!encoded) {
             Bridge.log("G2: CFW scene encode failed; retaining the previous frame")
+            frame.reportPresented(false, "scene encode failed")
             return
         }
         cfwSceneActive = true
@@ -2902,21 +3274,12 @@ class G2 : SGCManager() {
         }
     }
 
-    /**
-     * Stock's window placement for the current height/depth settings.
-     * `pinDepth` forces depth level 1, the only level where both lenses share
-     * an x offset — required whenever the frame uses mode-15 text draws,
-     * which have no per-lens variant and would otherwise land 16 px apart
-     * from the window content (double vision). Height still follows the user.
-     */
-    private fun cfwBoxes(frame: SceneFrame, pinDepth: Boolean): G2CfwRenderer.LensBoxes {
+    /** Apply global placement to every scene; miniapps only supply relative element depth. */
+    private fun cfwBoxes(frame: SceneFrame): G2CfwRenderer.LensBoxes {
         val height = (DeviceStore.get("bluetooth", "dashboard_height") as? Number)?.toInt() ?: 4
-        val depth = if (pinDepth) 1 else (DeviceStore.get("bluetooth", "dashboard_depth") as? Number)?.toInt() ?: 2
+        val depth = (DeviceStore.get("bluetooth", "dashboard_depth") as? Number)?.toInt() ?: 2
         return G2CfwRenderer.lensBoxes(
-            frame.canvasWidth,
-            frame.canvasHeight,
-            height,
-            depth,
+            frame.canvasWidth, frame.canvasHeight, height, G2CfwRenderer.depthLevelForSetting(depth),
         )
     }
 
@@ -2928,16 +3291,21 @@ class G2 : SGCManager() {
         return cfwFrameId
     }
 
-    private fun cfwResetShadow() {
+    /** `keepCache` keeps the object-cache session; the caller forgets the uploads it drops. */
+    private fun cfwResetShadow(keepCache: Boolean = false) {
+        displayDiagnostics.count("resync")
         cfwPendingPayloads.clear()
+        cfwSceneInvalid = true
         cfwShadowSeeded = false
         cfwLastBoxes = null
         cfwPrevRaster = null
         cfwLastTextDraws = emptyList()
         cfwDeltasSinceFull = 0
-        // Queued (unsent) uploads were just dropped, so glyph residency is
+        if (keepCache) return
+        // Queued (unsent) uploads were just dropped, so residency is
         // unknown — make the renderer's cache model re-learn.
         cfwCacheGeneration += 1
+        cfwCacheEpoch = 0
     }
 
     /**
@@ -2958,15 +3326,18 @@ class G2 : SGCManager() {
     }
 
     /**
-     * Acquire the fbguard lease and keep renewing it while CFW scene rendering
-     * owns the panel. A fresh acquire resets the firmware's preservation (the
-     * next presented direct frame re-arms it), so this runs BEFORE the frame is
-     * queued. Stops with a release as soon as scene mode is inactive or the
-     * page went down, so a stock surface (dashboard, nav) is never frozen
-     * under a preserved direct frame.
+     * Acquire the fbguard lease and keep renewing it for as long as our CFW page
+     * is up, as upstream Faceclaw does for its whole session. A fresh acquire
+     * resets the firmware's preservation (the next presented direct frame
+     * re-arms it), so this runs BEFORE the frame is queued. The lease is
+     * deliberately NOT tied to cfwSceneActive: a blank panel (HIDE) keeps the
+     * on-glass object cache, and releasing the lease would free it, turning the
+     * next dashboard open into a cold RESET + full upload. Stock surfaces
+     * (dashboard, nav, notifications) release explicitly before they take the
+     * panel, so nothing is frozen under a preserved direct frame.
      */
     private fun startFbLease() {
-        if (fbLeaseJob != null) return
+        if (fbLeaseJob != null || notificationsPanelHold) return
         sendFaceclawFbControl(acquire = true)
         fbLeaseJob =
             displayScope.launch {
@@ -2976,7 +3347,7 @@ class G2 : SGCManager() {
                     // hatch may have been flipped off mid-session — without
                     // this check the lease renews forever while frames go
                     // stock.
-                    if (cfwSceneActive && pageCreated && dashboardShowing == 0 &&
+                    if (pageCreated && dashboardShowing == 0 && !navigationModeActive &&
                         supportsCfwSceneRendering
                     ) {
                         sendFaceclawFbControl(acquire = true)
@@ -2992,8 +3363,9 @@ class G2 : SGCManager() {
         fbLeaseJob?.cancel()
         fbLeaseJob = null
         if (sendRelease) sendFaceclawFbControl(acquire = false)
-        // Lease end frees the on-glass texture cache; the model must re-learn.
+        // Lease end frees the on-glass object cache; the model must re-learn.
         cfwCacheGeneration += 1
+        cfwCacheEpoch = 0
     }
 
     /**
@@ -3048,10 +3420,13 @@ class G2 : SGCManager() {
     }
 
     private fun resetCfwConnectionState() {
-        cfwCapabilityString = null
-        cfwClassified = false
-        cfwFeatures.clear()
-        cfwProtocolVersion = 0
+        cancelSensorCommands()
+        cfwClassification = null
+        cfwTransport = G2CfwTransport.Encoder()
+        cfwStreamSequence = (0..255).random()
+        cfwPageInstalled = false
+        publishRingBattery(G2RingBattery.DISCONNECTED)
+        onKeyboardThread { keyboardBridge.linkLost() } // the remembered keyboard reconnects on CFW re-detection
         cfwSceneActive = false
         // Fresh connection gets a fresh idle-resurrect budget.
         cfwLastIdleResurrectAt = null
@@ -3072,14 +3447,64 @@ class G2 : SGCManager() {
      * change is large, the queue backed up, or on the periodic insurance
      * keyframe. Seeds the shadow with mode-6 black when it is fresh.
      */
+    /**
+     * Queue [frame] as a retained-scene patch: the firmware keeps the slots,
+     * tweens transitions itself, and renders every frame into its own buffer.
+     * Returns false when the frame does not fit, so the raster path takes it.
+     */
+    private suspend fun enqueueCfwVectorFrame(frame: SceneFrame): Boolean {
+        val generation = cfwCacheGeneration
+        val clearSerial = cfwClearSerial
+        val boxes = cfwBoxes(frame)
+        val backlogged = cfwPendingPayloads.count { it.kind == CfwPayloadKind.SCENE } >= CFW_MAX_QUEUED_UPDATES
+        if (backlogged) {
+            cfwPendingPayloads.removeAll { it.kind == CfwPayloadKind.SCENE }
+            cfwSceneInvalid = true
+        }
+        if (cfwLastBoxes != boxes) cfwSceneInvalid = true
+        val invalidate = cfwSceneInvalid
+        val encoded =
+            kotlinx.coroutines.withContext(Dispatchers.Default) {
+                G2CfwRenderer.encodeVector(
+                    frame, boxes, cfwCacheGeneration, invalidate, inlineText = true,
+                    tag = if (supportsCfwSceneSettle) frame.seq and 0xFFFF else null,
+                )
+            }
+        if (encoded == null) {
+            Bridge.log("G2: vector scene does not fit; using the raster path for this frame")
+            cfwSceneInvalid = true
+            return false
+        }
+        if (generation != cfwCacheGeneration || clearSerial != cfwClearSerial) return false
+        cfwSceneInvalid = false
+        cfwLastBoxes = boxes
+        // A later raster frame must start from a keyframe: the panel shows the scene, not the shadow.
+        cfwDeltasSinceFull = CFW_MAX_DELTAS_BETWEEN_FULL_FRAMES
+        for (upload in encoded.uploads) {
+            cfwPendingPayloads.addLast(CfwPayload(CfwPayloadKind.UPLOAD, upload))
+        }
+        // The frame is on the glasses once its last SHOW is acked.
+        encoded.shows.forEachIndexed { index, show ->
+            val presents = if (index == encoded.shows.lastIndex) frame.presentTag else null
+            cfwPendingPayloads.addLast(CfwPayload(CfwPayloadKind.SCENE, show.payload, presents, show.lenses))
+        }
+        cfwLastPayloadQueuedAt = System.currentTimeMillis()
+        return true
+    }
+
     private suspend fun enqueueCfwFrame(frame: SceneFrame): Boolean {
-        val useBuiltinText =
-            supportsCfwBuiltinText && frame.elements.any { it.type == "text" && it.font == "builtin" }
-        // Modes 13/14 have no per-lens variant, so they need the lens-equal window.
-        val useTextureGlyphs =
-            supportsCfwTextureGlyphs && frame.elements.any { it.type == "text" && it.font == "mono" }
-        val pinDepth = useBuiltinText || useTextureGlyphs
-        val boxes = cfwBoxes(frame, pinDepth = pinDepth)
+        // Mono text rides the scene as TEXT_CACHED runs (glyphs upload once per
+        // lease), so any frame that fits the slot table takes the vector path.
+        if (supportsCfwVectorScene && enqueueCfwVectorFrame(frame)) return true
+        // Raster fallback cannot preserve SVG contours or rotation. Report a dropped frame instead.
+        if (frame.elements.any { it.type == "svg" || it.rotationQ8 != 0 }) return false
+        val hasMonoText = frame.elements.any { it.type == "text" && it.font == "mono" }
+        val boxes = cfwBoxes(frame)
+        val lensEqual = boxes.leftX == boxes.rightX && boxes.leftY == boxes.rightY
+        // Absolute text/cache draws cannot shift per eye. Bake text into the
+        // stereo raster at non-neutral depth instead of overriding global placement.
+        val useBuiltinText = lensEqual && frame.elements.any { it.type == "text" && it.font == "builtin" }
+        val useTextureGlyphs = lensEqual && hasMonoText
         val previousBoxes = cfwLastBoxes
         val movedBoxes = previousBoxes != null && previousBoxes != boxes
         val backlogged =
@@ -3104,8 +3529,8 @@ class G2 : SGCManager() {
         // Mode 15 doesn't clip at the window's right edge: a line the phone's
         // metrics under-measured can spill into the outer panel margin, where
         // no in-window rect or full frame ever repaints. Blank the old
-        // window's right margin whenever draws change. (Builtin frames pin
-        // depth, so the old window is lens-equal.)
+        // window's right margin whenever draws change. (Builtin draws are only
+        // used when the old window is lens-equal.)
         val marginBlank =
             cfwLastBoxes?.takeIf {
                 textDraws != cfwLastTextDraws && cfwLastTextDraws.isNotEmpty() &&
@@ -3122,7 +3547,7 @@ class G2 : SGCManager() {
         val fids = List(G2CfwRenderer.REQUIRED_FID_COUNT) { nextCfwFrameId() }
         // Copies are unsafe around firmware-drawn text (they would smear
         // glyphs the raster knows nothing about), so text frames skip them.
-        val allowCopy = supportsCfwRectCopy && textDraws.isEmpty()
+        val allowCopy = textDraws.isEmpty()
         val update =
             kotlinx.coroutines.withContext(Dispatchers.Default) {
                 G2CfwRenderer.encodeUpdate(
@@ -3137,7 +3562,7 @@ class G2 : SGCManager() {
                     marginBlankBoxes = marginBlank,
                     omitBuiltinText = useBuiltinText,
                     textureGlyphsEnabled = useTextureGlyphs,
-                    textureImagesEnabled = supportsCfwTextureImages && pinDepth,
+                    textureImagesEnabled = useBuiltinText || useTextureGlyphs,
                     cacheGeneration = cfwCacheGeneration,
                 )
             } ?: return false
@@ -3149,7 +3574,12 @@ class G2 : SGCManager() {
         for (upload in update.uploads) {
             cfwPendingPayloads.addLast(CfwPayload(CfwPayloadKind.UPLOAD, upload))
         }
-        val payload = update.payload ?: return true // visually identical frame
+        val payload = update.payload
+        if (payload == null) {
+            // Visually identical frame — the shadow already shows it, or a queued payload is about to.
+            cfwAttachPresentTag(frame)
+            return true
+        }
         if (update.usedFullFrame) cfwDeltasSinceFull = 0 else cfwDeltasSinceFull += 1
         if (!cfwShadowSeeded) {
             // Seed with the frame itself composited on black when the window
@@ -3171,8 +3601,10 @@ class G2 : SGCManager() {
                 cfwShadowSeeded = true
                 if (textDraws.isEmpty()) {
                     cfwPendingPayloads.removeAll {
-                        it.kind == CfwPayloadKind.FULL || it.kind == CfwPayloadKind.DELTA
+                        it.kind == CfwPayloadKind.FULL || it.kind == CfwPayloadKind.DELTA ||
+                            it.kind == CfwPayloadKind.SCENE
                     }
+                    cfwPendingPayloads.last().presents = frame.presentTag
                     cfwLastPayloadQueuedAt = System.currentTimeMillis()
                     return true
                 }
@@ -3185,16 +3617,29 @@ class G2 : SGCManager() {
         }
         if (update.usedFullFrame) {
             // A full overwrites the window; seeds, uploads, and move-blanks must still survive.
-            cfwPendingPayloads.removeAll { it.kind == CfwPayloadKind.FULL || it.kind == CfwPayloadKind.DELTA }
+            cfwPendingPayloads.removeAll {
+                it.kind == CfwPayloadKind.FULL || it.kind == CfwPayloadKind.DELTA || it.kind == CfwPayloadKind.SCENE
+            }
             val kind = if (movedBoxes) CfwPayloadKind.MOVE_BUNDLE else CfwPayloadKind.FULL
-            cfwPendingPayloads.addLast(CfwPayload(kind, payload))
+            cfwPendingPayloads.addLast(CfwPayload(kind, payload, frame.presentTag))
         } else {
-            cfwPendingPayloads.addLast(CfwPayload(CfwPayloadKind.DELTA, payload))
+            cfwPendingPayloads.addLast(CfwPayload(CfwPayloadKind.DELTA, payload, frame.presentTag))
         }
         cfwLastPayloadQueuedAt = System.currentTimeMillis()
         return true
     }
 
+    /**
+     * A frame that needs no payload of its own is on the glasses once the
+     * last queued frame-carrying payload is acked; with nothing queued it is
+     * there already. Frame numbers only go up, so the tag can be overwritten.
+     */
+    private fun cfwAttachPresentTag(frame: SceneFrame) {
+        val tag = frame.presentTag ?: return
+        val last = cfwPendingPayloads.lastOrNull { it.kind != CfwPayloadKind.UPLOAD }
+        if (last != null) last.presents = tag else frame.reportPresented(true)
+    }
+
     /**
      * Blank the panel (mode-6 black also seeds the shadow) and drop retained scene state.
      *
@@ -3205,13 +3650,29 @@ class G2 : SGCManager() {
      * gates reposition/replay, not the page's existence.
      */
     private fun cfwClear() {
+        cfwClearSerial += 1
         cfwLastFrame = null
         cfwSceneActive = false
-        cfwPendingPayloads.removeAll { it.kind != CfwPayloadKind.SEED }
-        G2CfwRenderer.blackPayload()?.let {
-            cfwPendingPayloads.addLast(CfwPayload(CfwPayloadKind.SEED, it))
-            cfwShadowSeeded = true
-            cfwLastBoxes = null
+        for (payload in cfwPendingPayloads) {
+            payload.presents?.report(false, "cleared")
+        }
+        // A blank supersedes every unsent operation, including older blanks.
+        cfwPendingPayloads.clear()
+        if (supportsCfwVectorScene) {
+            // The object cache on the glasses is KEPT: a HIDE freezes and blanks, so the
+            // next scene (a reopened dashboard) is one SHOW of references. cfwLastBoxes
+            // therefore stays: nulling it would make the next frame invalidate the scene
+            // model and redefine every object. A PUT dropped from the queue above is
+            // caught by the MISSING reply and retried.
+            cfwPendingPayloads.addLast(CfwPayload(CfwPayloadKind.SEED, G2CfwScene.HIDE_PAYLOAD))
+            G2CfwRenderer.sceneHidden()
+            cfwShadowSeeded = true   // HIDE clears the shadow to black, like a keyframe
+        } else {
+            G2CfwRenderer.blackPayload()?.let {
+                cfwPendingPayloads.addLast(CfwPayload(CfwPayloadKind.SEED, it))
+                cfwShadowSeeded = true
+                cfwLastBoxes = null
+            }
         }
         // The panel is (about to be) black — the diff base and any tracked
         // text draws no longer describe what is on glass.
@@ -3242,8 +3703,8 @@ class G2 : SGCManager() {
         // its normal paths.
         if (!cfwClassified || cfwCapabilityString == null) return
         if (enabled) {
-            if (installCfwCarrierIfNeeded()) return // already the carrier page
-            Bridge.log("G2: cfw_scene_renderer ON — swapping stock containers for the CFW carrier")
+            if (installCfwPageIfNeeded()) return // already the CFW page
+            Bridge.log("G2: cfw_scene_renderer ON — swapping stock containers for the CFW page")
             requestPageRebuild()
         } else {
             Bridge.log("G2: cfw_scene_renderer OFF — exiting CFW surface to a blank stock page")
@@ -3251,7 +3712,8 @@ class G2 : SGCManager() {
             cfwLastFrame = null
             cfwSceneActive = false
             cfwResetShadow()
-            imageContainers.clear() // drops the carrier
+            cfwPageInstalled = false
+            imageContainers.clear()
             textContainers.clear()
             sceneTextByElement.clear()
             sceneImageByElement.clear()
@@ -3546,7 +4008,7 @@ class G2 : SGCManager() {
      */
     override fun clearSceneElements(elementIds: List<String>) {
         if (supportsCfwSceneRendering) {
-            val carrierWasConfigured = installCfwCarrierIfNeeded()
+            val carrierWasConfigured = installCfwPageIfNeeded()
             cfwClear()
             if (!carrierWasConfigured && pageCreated) {
                 // Carrier just replaced live stock containers (see clearDisplay).
@@ -3636,6 +4098,7 @@ class G2 : SGCManager() {
      * callers no longer race a detached coroutine. Always invoke on [displayScope].
      */
     private suspend fun rebuildPage() {
+        lastPageShutdownSentMs = System.currentTimeMillis()
         val msg = EvenHubProto.shutdownMessage()
         sendEvenHubCommand(msg)
         pageCreated = false
@@ -3656,10 +4119,14 @@ class G2 : SGCManager() {
             Bridge.log("G2: rebuildState() skipped — navigation mode owns the screen")
             return
         }
+        if (notificationsPanelHold) {
+            Bridge.log("G2: rebuildState() skipped — notifications panel hold")
+            return
+        }
         Bridge.log("G2: rebuildState()")
         // Stock containers left by a torn-down page would rebuild as the evt-0 page, not the carrier.
         if (supportsCfwSceneRendering) {
-            installCfwCarrierIfNeeded()
+            installCfwPageIfNeeded()
         }
         // recreate the containers (sets pageCreated = true; embeds text content directly):
         createPageWithContainers()
@@ -3677,8 +4144,8 @@ class G2 : SGCManager() {
                 imageContainers[i].dirty = true
             }
         }
-        // A new page allocation has a fresh CFW shadow. Re-seed it before the retained scene.
-        if (supportsCfwSceneRendering && hasCfwCarrier) {
+        // Re-seed the on-glass shadow and re-send the retained frame for the new page.
+        if (supportsCfwSceneRendering && cfwPageInstalled) {
             cfwResetShadow()
             val frame = cfwLastFrame
             if (frame != null) {
@@ -3760,6 +4227,32 @@ class G2 : SGCManager() {
         )
     }
 
+    /** Milliseconds left in the settle window after a SHUTDOWN_PAGE we sent; 0 outside it. */
+    private fun pageShutdownSettleRemainingMs(): Long {
+        if (lastPageShutdownSentMs <= 0) return 0
+        val elapsed = System.currentTimeMillis() - lastPageShutdownSentMs
+        return maxOf(0, PAGE_SHUTDOWN_SETTLE_MS - elapsed)
+    }
+
+    /**
+     * Once the settle window ends, bring the page back exactly once: through recovery when the
+     * mic needs a live page, else through the reconcile loop, which only resurrects for real
+     * content (a blank stays down).
+     */
+    private fun armPageShutdownSettleWake(afterMs: Long) {
+        if (pageShutdownSettleWakeArmed) return
+        pageShutdownSettleWakeArmed = true
+        displayScope.launch {
+            delay(afterMs + 10)
+            pageShutdownSettleWakeArmed = false
+            if (!pageCreated && evenHubMicIntent) {
+                recoverPageAndMic("shutdown-settled")
+            } else {
+                signalDisplayDirty()
+            }
+        }
+    }
+
     /**
      * Single coalesced recovery: rebuild the page + re-arm the mic from intent, never stacking
      * rebuilds (the firmware spams systemExit/dashboard-close ~1×/sec). Skips when the page is
@@ -3772,6 +4265,15 @@ class G2 : SGCManager() {
         if (navigationModeActive) {
             return
         }
+        // The firmware is still answering our own SHUTDOWN_PAGE (its systemExit and 08011A00
+        // land ~300 ms after it): this is the old page dying, not something to recover from.
+        // The settle wake brings the page back once.
+        val settle = pageShutdownSettleRemainingMs()
+        if (settle > 0) {
+            Bridge.log("G2: recover($reason) skipped — ${settle}ms left in the shutdown settle window")
+            armPageShutdownSettleWake(settle)
+            return
+        }
         val now = System.currentTimeMillis()
         // Page alive and mic STATE matches INTENT → phantom firmware event, nothing to recover.
         val micState = DeviceStore.get("glasses", "micEnabled") as? Boolean ?: false
@@ -3817,7 +4319,6 @@ class G2 : SGCManager() {
         // the current text/image, and re-arms the mic iff intent says so. Skip while the native
         // dashboard owns the screen.
         if (!pageCreated) {
-            val useNativeDashboard = DeviceStore.get("bluetooth", "use_native_dashboard") as? Boolean ?: false
             // Stock path: only resurrect for non-blank content — don't rebuild just to render a
             // clearDisplay's blank, or a clear burst churns the page back up pointlessly.
             // (CFW is the exception below: its blank IS the idle page.)
@@ -3830,7 +4331,7 @@ class G2 : SGCManager() {
             // Idle carrier: the black seed alone. This is what the
             // rebuild→systemExit→rebuild storm guard used to block, so it is
             // rate-limited below rather than allowed once per reconcile tick.
-            val cfwIdleCarrier = cfwPendingPayloads.isNotEmpty() && !cfwHasScene && hasCfwCarrier
+            val cfwIdleCarrier = cfwPendingPayloads.isNotEmpty() && !cfwHasScene && cfwPageInstalled
             val hasPendingImage =
                 imageContainers.any { it.dirty && it.bmpData.isNotEmpty() } ||
                     cfwHasScene
@@ -3840,29 +4341,21 @@ class G2 : SGCManager() {
             // resurrection for the whole backoff window.
             if (
                 wants &&
-                !(useNativeDashboard && dashboardShowing > 0) &&
+                dashboardShowing == 0 &&
                 (hasPendingText || hasPendingImage || cfwIdlePageResurrectAllowed())
             ) {
-                // Probe-before-rebuild: a phantom exit may have marked a healthy
-                // page dead (static pages give the ack-window filter nothing to
-                // go on). Try the queued carrier payload against the "dead" page
-                // first — an ack proves it alive and skips the shutdown+create
-                // whose own teardown would elicit the next exit. A timeout
-                // confirms real death and falls through to the rebuild.
-                if (cfwHasScene || cfwIdleCarrier) {
-                    val carrier = imageContainers.firstOrNull { it.id == cfwSceneContainerId }
-                    val probe = cfwPendingPayloads.firstOrNull()
-                    if (carrier != null && probe != null) {
-                        val ok = sendImageData(carrier.id, carrier.name, probe.data)
-                        if (ok) {
-                            Bridge.log("G2: page-down probe acked — phantom exit, page alive (no rebuild)")
-                            pageCreated = true
-                            if (cfwPendingPayloads.isNotEmpty()) cfwPendingPayloads.removeFirst()
-                            signalDisplayDirty() // drain the rest normally
-                            return
-                        }
-                    }
+                // Our own SHUTDOWN_PAGE is still being answered: creating now
+                // would race the teardown trio (see lastPageShutdownSentMs).
+                val settle = pageShutdownSettleRemainingMs()
+                if (settle > 0) {
+                    Bridge.log(
+                        "G2: reconcileDisplay() - page down, ${settle}ms left in the shutdown settle window; deferring the rebuild",
+                    )
+                    armPageShutdownSettleWake(settle)
+                    return
                 }
+                // (Transport ACKs need no page, so they cannot probe a "dead" page
+                // the way carrier image ACKs once did.)
                 Bridge.log("G2: reconcileDisplay() - page down with pending content, rebuilding once")
                 rebuildState()
             }
@@ -3885,11 +4378,55 @@ class G2 : SGCManager() {
         }
 
         // CFW keyframes and deltas are ordered: a fresh mode-6 shadow must land before mode 3.
-        imageContainers.firstOrNull { it.id == cfwSceneContainerId }?.let { carrier ->
+        var sensorsDrained = 0
+        while (pageCreated && !navigationModeActive && !sensorNavigationRecovering && sensorsDrained < 4 && sensorCommands.isNotEmpty()) {
+            if (!supportsCfwTransport) break
+            sensorsDrained += 1
+            val command = sensorCommands.removeFirst()
+            command.result.complete(sendCfwMessage(command.data))
+        }
+
+        if (supportsCfwSceneRendering && cfwPageInstalled) {
             var drained = 0
             while (pageCreated && drained < 4 && cfwPendingPayloads.isNotEmpty()) {
                 drained += 1
-                val ok = sendImageData(carrier.id, carrier.name, cfwPendingPayloads.removeFirst().data)
+                val payload = cfwPendingPayloads.removeFirst()
+                val cacheMessage = G2CfwTransport.isCacheMessage(payload.data)
+                var ok = if (cacheMessage) cfwEnsureCacheSession() else true
+                if (ok) ok = sendCfwMessage(payload.data, payload.lenses)
+                var recover: (() -> Unit)? = null
+                if (ok && cacheMessage) {
+                    when (val outcome = cfwCacheOutcome()) {
+                        is CfwCacheOutcome.Applied -> cfwMissingRetries = 0
+                        is CfwCacheOutcome.Stale -> {
+                            ok = false
+                            recover = { cfwCacheGeneration += 1; cfwCacheEpoch = 0; cfwSceneInvalid = true }
+                        }
+                        is CfwCacheOutcome.Missing -> {
+                            ok = false
+                            val retry = cfwMissingRetries < 2
+                            cfwMissingRetries += 1
+                            recover = { G2CfwRenderer.forget(outcome.ids); if (!retry) cfwSceneInvalid = true }
+                        }
+                        is CfwCacheOutcome.Refused -> {
+                            Bridge.log("G2: cache message refused: ${outcome.why}")
+                            ok = false
+                            recover = { cfwCacheGeneration += 1; cfwCacheEpoch = 0; cfwSceneInvalid = true }
+                        }
+                    }
+                }
+                // Both lenses acked and applied: the firmware has executed the payload and presents on its next frame tick.
+                if (ok) payload.presents?.let {
+                    displayDiagnostics.count("framesAcked")
+                    it.report(true)
+                }
+                if (recover != null) {
+                    payload.presents?.report(false, "cache rejected")
+                    recover()
+                    cfwPendingPayloads.removeAll { it.kind == CfwPayloadKind.SCENE || it.kind == CfwPayloadKind.UPLOAD }
+                    if (pageCreated && supportsCfwSceneRendering && cfwPageInstalled) cfwLastFrame?.let { enqueueCfwFrame(it) }
+                    break
+                }
                 if (!ok) {
                     // A lost payload leaves the on-glass shadow stale; further
                     // deltas would composite onto it and corrupt the panel.
@@ -3898,8 +4435,17 @@ class G2 : SGCManager() {
                     // the page down mid-transfer is re-seeded by rebuildState;
                     // refilling the queue here just fuels the page-resurrection
                     // loop (rebuild→systemExit→rebuild every debounce tick).
-                    if (pageCreated && supportsCfwSceneRendering && hasCfwCarrier) {
-                        cfwResetShadow()
+                    if (pageCreated && supportsCfwSceneRendering && cfwPageInstalled) {
+                        // A transport failure leaves the cache session intact (a lens
+                        // that lost it answers STALE), so only the uploads that may not
+                        // have landed are re-sent — not every asset. A failed session
+                        // RESET (epoch back to 0) still starts over.
+                        val keepCache = cfwCacheEpoch != 0
+                        val dropped = (listOf(payload) + cfwPendingPayloads)
+                            .filter { it.kind == CfwPayloadKind.UPLOAD }
+                            .map { it.data }
+                        cfwResetShadow(keepCache)
+                        if (keepCache) G2CfwRenderer.forgetUploads(dropped)
                         cfwLastFrame?.let { enqueueCfwFrame(it) }
                     }
                     break
@@ -3962,13 +4508,7 @@ class G2 : SGCManager() {
         containerName: String,
         bmpData: ByteArray
     ): Boolean {
-        // CFW carrier transfers use the verified wire format: 3800-byte
-        // fragments, MapSessionId pinned to the container id instead of the
-        // rotating session counter, and frames written to the LEFT arm (acks
-        // still return on the right). Stock containers keep the shipped
-        // 4096/rotating-session/right-arm shape.
-        val isCfwCarrier = containerID == cfwSceneContainerId
-        val fragmentSize = if (isCfwCarrier) 3800 else 4096
+        val fragmentSize = 4096
         val totalSize = bmpData.size
         val fragmentCount = (bmpData.size + fragmentSize - 1) / fragmentSize
 
@@ -3987,10 +4527,11 @@ class G2 : SGCManager() {
             }
             // One session id per WHOLE image transfer (per attempt). The glasses key their
             // reassembly buffer on MapSessionId, so every fragment reuses it with an incrementing
-            // MapFragmentIndex. A retry uses a fresh session so a stale ACK from a prior attempt
-            // can't match.
+            // MapFragmentIndex. Every transfer takes a fresh session — a retry, and the next
+            // payload on the CFW carrier too — so a stale ACK from an earlier transfer can never
+            // complete this one's await early (the timeout here is already per-await).
             imageSessionCounter = (imageSessionCounter + 1) % 256
-            val sessionId = if (isCfwCarrier) containerID else imageSessionCounter
+            val sessionId = imageSessionCounter
 
             var fragmentIndex = 0
             var offset = 0
@@ -4020,7 +4561,7 @@ class G2 : SGCManager() {
                         mapFragmentPacketSize = fragment.size,
                         mapRawData = fragment
                     )
-                sendEvenHubCommand(msg, left = isCfwCarrier, right = !isCfwCarrier)
+                sendEvenHubCommand(msg)
 
                 // Gate on THIS fragment's ACK before sending the next (the ACK provides pacing).
                 // null=timeout, false=img_failed → abandon the attempt and retry the whole image.
@@ -4050,6 +4591,110 @@ class G2 : SGCManager() {
         return false
     }
 
+    /**
+     * Send one custom message over the SID-0xf0 transport to the lenses [lenses]
+     * selects (both by default) and wait for their processing ACKs. Always
+     * written to the LEFT arm; the right lens
+
+     * receives it over the frame bridge and its reply returns through the
+     * left. Deltas, rect copies and tweens are not safe to replay after an
+     * ambiguous loss, so a failure is reported (the caller resyncs from a
+     * keyframe) and the deflate context restarts, as the glasses have already
+     * dropped theirs on a NACK.
+     */
+    private suspend fun sendCfwMessage(original: ByteArray, lenses: Int = G2CfwTransport.LENS_BOTH): Boolean {
+        if (original.isEmpty()) return true
+        var message = original
+        if (G2CfwTransport.isCacheMessage(original)) {
+            cfwCacheRequest = if (cfwCacheRequest >= 0xFFFE) 1 else cfwCacheRequest + 1
+            message = G2CfwTransport.stamp(original, cfwCacheEpoch, cfwCacheRequest)
+        }
+        val record = cfwTransport.record(message, lenses) ?: return false
+        val streamId = cfwStreamSequence
+        val packets = G2CfwTransport.packets(record, streamId, lenses)
+        cfwStreamSequence = (cfwStreamSequence + packets.size) and 0xFF
+        // Arm before enqueueing: replies arrive on the BLE callback thread and
+        // can beat this coroutine's next resumption.
+        val ack = cfwAckBox.arm(streamId, lenses)
+
+        val startedAt = SystemClock.elapsedRealtime()
+        var outcome = "cancelled"
+        val ok = try {
+            sendToGlasses(packets, left = true, right = false, isPending = { cfwAckBox.isPending(ack) })
+            val result = withTimeoutOrNull(G2CfwTransport.ackTimeoutMs(record.size)) { ack.await() }
+            outcome = if (result == null) "timeout" else if (result) "ack" else "nack"
+            result == true
+        } finally {
+            // Cancellation must expire queued writes too. Identity, rather than
+            // the wrapping stream ID, prevents a later send reviving old packets.
+            cfwAckBox.disarm(ack, outcome)
+            displayDiagnostics.timing("transferMs", SystemClock.elapsedRealtime() - startedAt)
+            if (outcome != "ack") {
+                cfwTransport.resetContext()
+                displayDiagnostics.count("errors")
+                if (outcome == "timeout") displayDiagnostics.count("timeouts")
+                if (outcome == "nack") displayDiagnostics.count("nacks")
+            }
+        }
+        if (!ok) {
+            Bridge.log(
+                "G2: cfw stream $streamId (${packets.size} packets, mode ${message[0].toInt() and 0xFF}, " +
+                    "${message.size} bytes) failed: ${cfwAckBox.lastOutcome.ifEmpty { "timeout" }}"
+            )
+        }
+        return ok
+    }
+
+    /**
+     * The object cache's session: before the first cache message of a generation both
+     * lenses are RESET to a fresh phone-chosen epoch and the warm-up tween runs.
+     */
+    private suspend fun cfwEnsureCacheSession(): Boolean {
+        if (!supportsCfwVectorScene) return true
+        if (cfwCacheEpoch != 0 && cfwSceneWarmedGeneration == cfwCacheGeneration) return true
+        val generation = cfwCacheGeneration
+        cfwCacheEpoch = (1..0xFFFE).random()
+        val reset = G2CfwScene.RESET_PAYLOAD + byteArrayOf(minOf(255, G2CfwTransport.MAX_CHUNK_BYTES + 10).toByte())
+        if (!sendCfwMessage(reset) || generation != cfwCacheGeneration) {
+            cfwCacheEpoch = 0
+            return false
+        }
+        var store = Int.MAX_VALUE
+        for (reply in cfwAckBox.cacheReplies().values) {
+            if (reply.epoch != cfwCacheEpoch) {
+                Bridge.log("G2: cache reset kept epoch ${reply.epoch} on lens ${reply.lens}")
+                cfwCacheEpoch = 0
+                return false
+            }
+            if (reply.storeBytes > 0) store = minOf(store, reply.storeBytes)
+        }
+        if (store != Int.MAX_VALUE) G2CfwRenderer.setStoreCapacity(store)
+        cfwSceneWarmedGeneration = generation
+        sendCfwMessage(G2CfwScene.WARM_UP_SHOW)
+        return true
+    }
+
+    private sealed class CfwCacheOutcome {
+        object Applied : CfwCacheOutcome()
+        object Stale : CfwCacheOutcome()
+        class Missing(val ids: List<Int>) : CfwCacheOutcome()
+        class Refused(val why: String) : CfwCacheOutcome()
+    }
+
+    private fun cfwCacheOutcome(): CfwCacheOutcome {
+        val missing = mutableListOf<Int>()
+        for (reply in cfwAckBox.cacheReplies().values) {
+            when (reply.status) {
+                G2CfwTransport.CacheReply.STALE -> return CfwCacheOutcome.Stale
+                G2CfwTransport.CacheReply.MISSING -> missing.addAll(reply.missingIds)
+                G2CfwTransport.CacheReply.APPLIED, G2CfwTransport.CacheReply.UNCHANGED,
+                G2CfwTransport.CacheReply.DELTA, G2CfwTransport.CacheReply.SNAPSHOT -> Unit
+                else -> return CfwCacheOutcome.Refused("lens ${reply.lens}: ${reply.summary}")
+            }
+        }
+        return if (missing.isEmpty()) CfwCacheOutcome.Applied else CfwCacheOutcome.Missing(missing)
+    }
+
     /// Bring the Even Realities dashboard (the OS-level home/idle screen) to
     /// the foreground by tearing down whatever EvenHub page we currently own.
     /// The glasses fall back to the dashboard automatically when no page is up.
@@ -4091,8 +4736,11 @@ class G2 : SGCManager() {
     }
 
     override fun setDashboardDepthOnly(depth: Int) {
-        val clamped = depth.coerceIn(0, 2)
-        Bridge.log("G2: setDashboardDepthOnly($clamped)")
+        // The setting is 1-based (1..3, see the position screen); the firmware's
+        // xCoordinateLevel is 0..2. Sending the setting straight collapsed the
+        // two far levels onto one.
+        val clamped = G2CfwRenderer.depthLevelForSetting(depth)
+        Bridge.log("G2: setDashboardDepthOnly(depth=$depth level=$clamped)")
         val msg = G2SettingProto.setScreenDepth(sendManager.nextMagicRandom(), clamped)
         sendG2SettingCommand(msg)
         cfwReposition()
@@ -4174,9 +4822,20 @@ class G2 : SGCManager() {
      *   3. SKILL{skillId=NOTIFICATION, skillParam=show, ...} — dispatches the intent
      * The SKILL step alone is ignored by firmware; the preceding ENTER+ASK
      * supply the session context that lets the glasses act on the SKILL.
+     * Our EvenHub page is torn down first and every path that would bring it
+     * back (recovery rebuilds, fbguard lease, CFW frames, mic re-arm) is held
+     * for 3 s, or the sends race the stock panel for the screen.
      */
     override suspend fun showNotificationsPanel() {
         Bridge.log("G2: showNotificationsPanel()")
+
+        notificationsPanelHold = true
+        stopFbLease(sendRelease = true)
+        sendEvenHubCommand(EvenHubProto.shutdownMessage())
+        pageCreated = false
+        // Page death takes the mic with it; intent is untouched so the post-hold rebuild re-arms.
+        DeviceStore.apply("glasses", "micEnabled", false)
+
         val enterPayload = EvenAIProto.aiCtrl(
             magicRandom = sendManager.nextMagicRandom(),
             status = 2 // EVEN_AI_ENTER
@@ -4201,6 +4860,10 @@ class G2 : SGCManager() {
             fTextEnd = 1
         )
         sendEvenAICommand(skillPayload)
+
+        delay(3_000)
+        notificationsPanelHold = false
+        Bridge.log("G2: notifications resurrect re-enabled")
     }
 
     override fun setBrightness(level: Int, autoMode: Boolean) {
@@ -4217,26 +4880,21 @@ class G2 : SGCManager() {
     // ---------- Private Display Helpers ----------
 
     private fun createPageWithContainers() {
-        // With CFW scene rendering active the ONLY legal page is the carrier
-        // shape: one 576×288 image container (the framebuffer) and no stock
-        // text containers. A stray stock container rebuilds the stock page
-        // shape and the firmware then rejects every CFW payload. Every rebuild
-        // path funnels through this function, so enforce the invariant here
-        // rather than trusting each caller to have run
-        // installCfwCarrierIfNeeded() first.
+        // With CFW scene rendering active the ONLY legal page has no stock text
+        // or image containers: custom payloads ride the SID-0xf0 transport, and
+        // the page exists for touch capture and the mic. Every rebuild path
+        // funnels through this function, so enforce the invariant here rather
+        // than trusting each caller to have run installCfwPageIfNeeded() first.
         if (supportsCfwSceneRendering) {
             if (textContainers.isNotEmpty()) {
                 Bridge.log("G2: CFW page — dropping stray text containers ${textContainers.map { it.id }}")
                 textContainers.clear()
             }
-            val strayImages = imageContainers.filter { it.id != cfwSceneContainerId }
-            if (strayImages.isNotEmpty()) {
-                Bridge.log("G2: CFW page — dropping stray image containers ${strayImages.map { it.id }}")
-                imageContainers.retainAll { it.id == cfwSceneContainerId }
-            }
-            if (!hasCfwCarrier) {
-                installCfwCarrierIfNeeded()
+            if (imageContainers.isNotEmpty()) {
+                Bridge.log("G2: CFW page — dropping stray image containers ${imageContainers.map { it.id }}")
+                imageContainers.clear()
             }
+            cfwPageInstalled = true
         }
 
         // Dedicated event-capture container: id 0, 1x1, borderless, empty — the
@@ -4287,15 +4945,6 @@ class G2 : SGCManager() {
         // and ensure the ids are still in the imageContainerIDPool:
         val seenIDs = mutableSetOf<Int>()
         imageContainers.retainAll { c ->
-            // The CFW carrier is INTENTIONALLY empty: its pixels ride the
-            // ordered payload queue (cfwPendingPayloads), never bmpData. The
-            // empty-container prune below silently dropped it from every page
-            // since the queue rework — the firmware then had no container to
-            // receive ANY CFW payload (mode 3/6/8, even plain BMPs), so all
-            // direct rendering went dark while stock text kept working.
-            if (c.id == cfwSceneContainerId) {
-                return@retainAll seenIDs.add(c.id)
-            }
             if (c.bmpData.isEmpty()) {
                 Bridge.log("G2: removing empty image container ${c.id}")
                 return@retainAll false
@@ -4514,15 +5163,15 @@ class G2 : SGCManager() {
         // Intent is "mic on". The mic only exists inside a live EvenHub page, so we toggle it
         // off then back on (the firmware needs the off→on edge to re-arm).
         evenHubMicIntent = true
+        // Held: intent is recorded; the post-hold rebuild re-arms the mic.
+        if (notificationsPanelHold) return
         DeviceStore.apply("glasses", "micEnabled", true)
         val msg = EvenHubProto.audioControlMessage(false)
         sendEvenHubCommand(msg)
         mainHandler.postDelayed({
-            val useNativeDashboard = DeviceStore.get("bluetooth", "use_native_dashboard") as? Boolean ?: false
-            // Bridge.log("G2: setMicEnabled - useNativeDashboard=$useNativeDashboard, dashboardShowing=$dashboardShowing")
             // Dashboard owns the screen + session right now — don't arm the mic into a page the
             // dashboard has taken over; recovery re-arms on dashboard close.
-            if (useNativeDashboard && dashboardShowing > 0) {
+            if (dashboardShowing > 0) {
                 return@postDelayed
             }
             // Never send audioControl(enable=true) without a live page — no page means no mic.
@@ -4666,16 +5315,18 @@ class G2 : SGCManager() {
         textContainers.clear()
         dashboardShowing = 0
         dashboardOpening = false
+        notificationsPanelHold = false
         heartbeatCounter = 0
         currentBitmapBase64 = ""
         menuAppIdToPackageName.clear()
         activeMenuAppId = null
-        lastClickTimestamp = null
+        touchDebounce = G2TouchDebounce()
         lastMenuSelectTimestamp = null
         leftOtaDataWriteChar = null
         rightOtaDataWriteChar = null
         leftOtaDataNotifyChar = null
         rightOtaDataNotifyChar = null
+        resetNotificationsOnDisconnect()
         resetCfwConnectionState()
         DeviceStore.apply("glasses", "connected", false)
         DeviceStore.apply("glasses", "fullyBooted", false)
@@ -4712,21 +5363,19 @@ class G2 : SGCManager() {
         sendEvenHubHeartbeat()
     }
 
-    override fun dbg1() {
-        displayScope.launch { showNotificationsPanel() }
-    }
+    override fun dbg1() {}
+
+    override fun dbg2() {}
 
-    private var compassRunning = false
+    /** Raw wake lease start — no durable intent; a reconnect drops it. */
+    override fun dbg3() {
+        Bridge.log("G2: dbg3() — start wake lease")
+        startWakeLease()
+    }
 
-    override fun dbg2() {
-        // compassRunning = !compassRunning
-        // Bridge.log("G2: dbg2() — ${if (compassRunning) "start" else "stop"} compass")
-        // if (compassRunning) {
-        //     startCompass()
-        // } else {
-        //     stopCompass()
-        // }
-        displayScope.launch { runAuthSequence() }
+    override fun dbg4() {
+        Bridge.log("G2: dbg4() — stop wake lease")
+        stopWakeLease(sendRelease = true)
     }
 
     // ---------- Native navigation mode (service 0x08) ----------
@@ -4776,6 +5425,7 @@ class G2 : SGCManager() {
     override fun exitNavigationMode(arrived: Boolean) {
         if (!navigationModeActive) return
         Bridge.log("G2: exitNavigationMode(arrived: $arrived)")
+        sensorNavigationRecovering = true
         navHeartbeatJob?.cancel()
         navHeartbeatJob = null
         navigationModeActive = false
@@ -4795,6 +5445,7 @@ class G2 : SGCManager() {
             delay(600)
             if (navigationModeActive) return@launch
             pageCreated = false
+            sensorNavigationRecovering = false
             recoverPageAndMic(reason = "nav-exit")
         }
     }
@@ -5437,6 +6088,7 @@ class G2 : SGCManager() {
                                 leftWriteChar = null
                                 leftNotifyChar = null
                                 leftAudioChar = null
+                                leftFileWriteChar = null
                                 leftOtaDataWriteChar = null
                                 leftOtaDataNotifyChar = null
                             } else {
@@ -5444,6 +6096,7 @@ class G2 : SGCManager() {
                                 rightWriteChar = null
                                 rightNotifyChar = null
                                 rightAudioChar = null
+                                rightFileWriteChar = null
                                 rightOtaDataWriteChar = null
                                 rightOtaDataNotifyChar = null
                             }
@@ -5463,6 +6116,8 @@ class G2 : SGCManager() {
                         rightNotifyChar = null
                         leftAudioChar = null
                         rightAudioChar = null
+                        leftFileWriteChar = null
+                        rightFileWriteChar = null
                         leftOtaDataWriteChar = null
                         rightOtaDataWriteChar = null
                         leftOtaDataNotifyChar = null
@@ -5544,6 +6199,17 @@ class G2 : SGCManager() {
                                     enqueueGattOp { enableNotifications(gatt, char) }
                                 }
 
+                                G2BLE.FILE_WRITE -> {
+                                    Bridge.log("G2: Found FILE WRITE char on $side")
+                                    if (side == "LEFT") leftFileWriteChar = char
+                                    else rightFileWriteChar = char
+                                }
+
+                                G2BLE.FILE_NOTIFY -> {
+                                    Bridge.log("G2: Found FILE NOTIFY char on $side")
+                                    enqueueGattOp { enableNotifications(gatt, char) }
+                                }
+
                                 G2BLE.OTA_DATA_WRITE -> {
                                     Bridge.log("G2: Found OTA DATA WRITE char on $side")
                                     if (side == "LEFT") leftOtaDataWriteChar = char
@@ -5586,7 +6252,8 @@ class G2 : SGCManager() {
                 gatt: BluetoothGatt,
                 characteristic: BluetoothGattCharacteristic
             ) {
-                val data = characteristic.value ?: return
+                val data = characteristic.value?.copyOf() ?: return
+                val arrival = G2InputArrival(SystemClock.elapsedRealtime(), System.currentTimeMillis())
 
                 val sourceKey = if (side == "LEFT") "L" else "R"
                 when (characteristic.uuid) {
@@ -5599,7 +6266,8 @@ class G2 : SGCManager() {
                         // promptly even while the main looper is busy draining a packet burst /
                         // heartbeats — the cause of the intermittent "glasses stopped responding".
                         correlateImageAck(data, sourceKey)
-                        mainHandler.post { handleNotifyData(data, sourceKey) }
+                        correlateCfwAck(data)
+                        mainHandler.post { handleNotifyData(data, sourceKey, arrival) }
                     }
                 }
             }
@@ -5703,7 +6371,19 @@ class G2 : SGCManager() {
         }
     }
 
-    private fun handleNotifyData(data: ByteArray, sourceKey: String) {
+    /**
+     * Read-only, single-packet parse of a raw notify frame that resolves an in-flight SID-0xf0
+     * ACK/NACK directly on the BLE callback thread. Replies always fit one packet.
+     */
+    private fun correlateCfwAck(rawData: ByteArray) {
+        val body = G2CfwTransport.replyBody(rawData) ?: return
+        G2CfwTransport.parseCacheReply(body)?.let { cfwAckBox.record(it); return }
+        val ack = G2CfwTransport.parseAck(body) ?: return
+        cfwAckBox.resolve(ack)
+    }
+
+    private fun handleNotifyData(data: ByteArray, sourceKey: String, arrival: G2InputArrival) {
+        displayDiagnostics.timing("notifyDispatchMs", SystemClock.elapsedRealtime() - arrival.elapsedMs)
         val result = receiveManager.handlePacket(data, sourceKey) ?: return
 
         val serviceId = result.first
@@ -5714,7 +6394,7 @@ class G2 : SGCManager() {
         // Bridge.log("G2: handleNotifyData() - serviceId=$serviceId, payload=${payload.take(32).joinToString("") { String.format("%02X", it) }}")
 
         when (serviceId) {
-            ServiceID.EVEN_HUB.value -> handleEvenHubResponse(payload)
+            ServiceID.EVEN_HUB.value -> handleEvenHubResponse(payload, arrival)
             ServiceID.DEVICE_SETTINGS.value -> handleDevSettingsResponse(payload, sourceKey)
             ServiceID.G2_SETTING.value -> handleG2SettingResponse(payload)
             ServiceID.MENU.value -> handleMenuResponse(payload)
@@ -5723,6 +6403,7 @@ class G2 : SGCManager() {
             ServiceID.NAVIGATION.value -> handleNavigationResponse(payload)
             ServiceID.EVEN_AI.value -> handleEvenAIResponse(payload)
             ServiceID.EVEN_HUB_CTRL.value -> handleEvenHubCtrlResponse(payload)
+            ServiceID.CFW_STREAM.value -> Unit // ACK/NACK replies are correlated inline in correlateCfwAck()
             else -> {
                 Bridge.log(
                     "G2: Unhandled service ${serviceId.toInt() and 0xFF} (${payload.size} bytes): ${
@@ -5781,16 +6462,11 @@ class G2 : SGCManager() {
                 val compassData = fields[10] as? ByteArray ?: return
                 val cReader = ProtobufReader(compassData)
                 val cFields = cReader.parseFields()
-                val heading = cFields[1] as? Int ?: return
-                // Heading in degrees, 0…359.
-                Bridge.log("G2: compass heading=$heading°")
-                Bridge.sendTypedMessage(
-                    "compass_heading",
-                    mapOf(
-                        "heading" to heading,
-                        "timestamp" to System.currentTimeMillis()
-                    )
-                )
+                // Proto3 omits the scalar for magnetic north (zero degrees).
+                val heading = G2Sensors.heading(cFields) ?: return
+                val body = mutableMapOf<String, Any>("heading" to heading, "timestamp" to System.currentTimeMillis())
+                (fields[100] as? ByteArray)?.let { G2Sensors.compass(it) }?.let { body["diagnostics"] = it }
+                Bridge.sendTypedMessage("compass_heading", body)
             }
 
             NavigationCmd.OS_NOTIFY_COMPASS_CALIBRATE_START.value -> {
@@ -5834,7 +6510,7 @@ class G2 : SGCManager() {
         }
     }
 
-    private fun handleEvenHubResponse(payload: ByteArray) {
+    private fun handleEvenHubResponse(payload: ByteArray, arrival: G2InputArrival) {
         val reader = ProtobufReader(payload)
         val fields = reader.parseFields()
 
@@ -5862,7 +6538,7 @@ class G2 : SGCManager() {
             // handleTouchEvent, AFTER IMU classification — running it here would let
             // continuous IMU keepalive traffic swallow real taps (matches iOS).
             val devEventData = fields[13] as? ByteArray ?: return
-            handleTouchEvent(devEventData)
+            handleTouchEvent(devEventData, arrival)
         } else if (cmdValue == 17) {
             // Miniapp selection from glasses dashboard menu (cmdId=17)
             // Dedup: L and R peripherals both deliver this event, so debounce or
@@ -6002,15 +6678,15 @@ class G2 : SGCManager() {
         return Triple(fx, fy, fz)
     }
 
-    private fun handleTouchEvent(devEventData: ByteArray) {
+    private fun handleTouchEvent(devEventData: ByteArray, arrival: G2InputArrival) {
         // Parse SendDeviceEvent: field 1=ListEvent, field 2=TextEvent, field 3=SysEvent
         val reader = ProtobufReader(devEventData)
         val fields = reader.parseFields()
 
-        val timestamp = System.currentTimeMillis()
+        val timestamp = arrival.timestamp
 
         // Classify IMU reports before applying the click debounce. Keepalive samples
-        // arrive continuously and must not update lastClickTimestamp, or a real gesture
+        // arrive continuously and must not update the debounce, or a real gesture
         // delivered within 100 ms of a sample gets dropped. A malformed IMU report still
         // returns here — it must never fall through into gesture mapping.
         val parsedSysFields =
@@ -6020,6 +6696,7 @@ class G2 : SGCManager() {
                 if ((sysFields[1] as? Int) == OsEventType.IMU_DATA_REPORT.value) {
                     // IMU_Report_Data { x, y, z } as 32-bit floats in field 3.
                     lastImuReportTimestamp = timestamp
+                    displayDiagnostics.count("imuReceived")
                     val forwardSamples =
                         DeviceStore.get("bluetooth", "imu_enabled") as? Boolean ?: false
                     val imuData = sysFields[3] as? ByteArray
@@ -6034,19 +6711,19 @@ class G2 : SGCManager() {
                 sysFields
             }
 
-        // tap_start/tap_end bracket every gesture: the end edge lands within the
-        // debounce window of its own start, and the click event fires right after
-        // tap_end. Exempt the edges from the debounce (check AND update) or they
-        // either get dropped or swallow the real gesture that follows.
         val sysEventTypeRaw = parsedSysFields?.get(1) as? Int
-        val isTapEdge =
-            sysEventTypeRaw == OsEventType.TAP_START.value || sysEventTypeRaw == OsEventType.TAP_END.value
-        if (!isTapEdge) {
-            val lastClick = lastClickTimestamp
-            if (lastClick != null && timestamp - lastClick < 100) {
-                return
-            }
-            lastClickTimestamp = timestamp
+        val ring = parsedSysFields?.let { G2RingInput.parse(it) }
+        val accepted = touchDebounce.accepts(sysEventTypeRaw, ring, arrival.elapsedMs)
+        val inputLog = JSONObject().put("receivedAt", timestamp)
+            .put("handledAt", System.currentTimeMillis())
+            .put("dispatchMs", SystemClock.elapsedRealtime() - arrival.elapsedMs)
+            .put("accepted", accepted).put("event", sysEventTypeRaw)
+            .put("source", parsedSysFields?.get(2) as? Int)
+        ring?.let { inputLog.put("wireType", it.wireType).put("ringTick", it.tick) }
+        Bridge.log("G2INPUT $inputLog")
+        if (!accepted) {
+            displayDiagnostics.count("touchDebounced")
+            return
         }
 
         // if we are receiving touch events we are fully booted:
@@ -6079,7 +6756,7 @@ class G2 : SGCManager() {
                 val last = lastImgAckSuccessMs
                 val sinceAck = if (last > 0) System.currentTimeMillis() - last else Long.MAX_VALUE
                 if (sinceAck < PHANTOM_EXIT_ACK_WINDOW_MS) {
-                    Bridge.log("G2: $eventType ignored — carrier acked ${sinceAck}ms ago (phantom exit)")
+                    Bridge.log("G2: $eventType ignored — a stock image acked ${sinceAck}ms ago (phantom exit)")
                     return@let
                 }
             }
@@ -6091,7 +6768,6 @@ class G2 : SGCManager() {
             }
 
             Bridge.sendTouchEvent(DeviceTypes.G2, gestureName, timestamp, eventSource)
-            Bridge.log("G2: SysEvent → $eventType $eventSource")
 
             if (eventSource == 2) {
                 // controller must be connected and fully booted:
@@ -6153,6 +6829,7 @@ class G2 : SGCManager() {
             OsEventType.TAP_START -> "tap_start"
             OsEventType.TAP_END -> "tap_end"
             OsEventType.TAP_THEN_HOLD -> "tap_then_hold"
+            OsEventType.RING_TOUCH_DOWN -> "touch_down"
             OsEventType.IMU_DATA_REPORT -> null
             OsEventType.ABNORMAL_EXIT -> null // don't report abnormal exits as gestures
         }
@@ -6302,6 +6979,12 @@ class G2 : SGCManager() {
         }
     }
 
+    private fun publishRingBattery(battery: G2RingBattery) {
+        DeviceStore.apply("glasses", "ringConnected", battery.connected)
+        DeviceStore.apply("glasses", "ringBatteryLevel", battery.level)
+        DeviceStore.apply("glasses", "ringCharging", battery.charging)
+    }
+
     private fun handleG2SettingResponse(payload: ByteArray) {
         val reader = ProtobufReader(payload)
         val fields = reader.parseFields()
@@ -6313,6 +6996,20 @@ class G2 : SGCManager() {
         ) {
             (fields[4] as? ByteArray)?.let { parseDeviceRequestResponse(it) }
             (fields[5] as? ByteArray)?.let { parseDeviceSendToApp(it) }
+            (fields[105] as? ByteArray)?.let { G2Sensors.light(it) }?.let {
+                Bridge.sendTypedMessage("light_sensor", it + ("timestamp" to System.currentTimeMillis()))
+            }
+            (fields[106] as? ByteArray)?.let { G2RingBattery.decode(it) }?.let { publishRingBattery(it) }
+            (fields[129] as? ByteArray)?.takeIf { it.size >= 2 }?.let {
+                Bridge.sendSceneSettled((it[0].toInt() and 0xFF) or ((it[1].toInt() and 0xFF) shl 8))
+            }
+            (fields[128] as? ByteArray)?.let { G2BleLink.decodeStatus(it) }?.let { status ->
+                if (status != lastBleLinkStatus) {
+                    lastBleLinkStatus = status
+                    Bridge.log("G2: BLE link ${status.summary}")
+                }
+            }
+            (fields[131] as? ByteArray)?.let { record -> onKeyboardThread { keyboardBridge.accept(record) } }
             updateCfwCapabilities(
                 fields[100] as? ByteArray,
                 definitive = cmdValue == G2SettingCommandId.DEVICE_RECEIVE_REQUEST.value,
@@ -6321,25 +7018,137 @@ class G2 : SGCManager() {
         }
     }
 
+    // ---------- BLE link speed (CFW revision 26) ----------
+
+    /**
+     * Revision 26 lets the phone choose the connection profile: stock (the
+     * default: 15-30 ms, then the one-minute slow-mode timer) or fast (7.5 ms,
+     * latency 0, slow mode suppressed). Each lens has its own link, so the
+     * control (G2BleLink, field 127) goes to both arms. The flag lives in lens
+     * RAM and boots stock, so a wanted FAST is re-sent on every CFW detection.
+     */
+    private val supportsBleLinkControl: Boolean
+        get() = supportsCfwTransport
+
+    /** The debug setting: caller intent, read at send time. */
+    private val fastBleWanted: Boolean
+        get() = DeviceStore.get("bluetooth", "cfw_fast_ble") as? Boolean ?: false
+
+    /** Last field-128 status seen, so only changes are logged. */
+    @Volatile private var lastBleLinkStatus: G2BleLink.Status? = null
+
+    // ---------- BLE keyboard bridge (CFW revision 39) ----------
+
+    /**
+     * One HID-over-GATT keyboard hosted by the right lens, driven over
+     * settings fields 130/131 (G2KeyboardBridge). The bridge is main-thread
+     * confined; BLE-thread callers post into it.
+     */
+    private val keyboardScope = CoroutineScope(Dispatchers.Main.immediate + SupervisorJob())
+    private val keyboardBridge: G2KeyboardBridge by lazy {
+        G2KeyboardBridge(keyboardScope, context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)) { payload ->
+            sendKeyboardControl(payload)
+        }
+    }
+
+    /** Keyboard controls are settings requests for the right lens alone. */
+    private fun sendKeyboardControl(payload: ByteArray) {
+        val packets =
+            sendManager.buildPackets(
+                serviceId = ServiceID.G2_SETTING.value,
+                payload = payload,
+                reserveFlag = true
+            )
+        sendToGlasses(packets, left = false, right = true)
+    }
+
+    private fun onKeyboardThread(block: () -> Unit) {
+        if (Looper.myLooper() == Looper.getMainLooper()) block() else mainHandler.post(block)
+    }
+
+    suspend fun keyboardScan(): List<Map<String, Any>> =
+        withContext(Dispatchers.Main.immediate) { keyboardBridge.scan().map(G2KeyboardBridge::advertValues) }
+
+    suspend fun keyboardConnect(address: String, addressType: Int, name: String) =
+        withContext(Dispatchers.Main.immediate) { keyboardBridge.connect(address, addressType, name) }
+
+    suspend fun keyboardReconnect() = withContext(Dispatchers.Main.immediate) { keyboardBridge.reconnect() }
+
+    suspend fun keyboardDisconnect() = withContext(Dispatchers.Main.immediate) { keyboardBridge.disconnect() }
+
+    suspend fun keyboardForget() = withContext(Dispatchers.Main.immediate) { keyboardBridge.forget() }
+
+    suspend fun keyboardPasskey(pin: Int) = withContext(Dispatchers.Main.immediate) { keyboardBridge.passkey(pin) }
+
+    suspend fun keyboardCompare(accept: Boolean) = withContext(Dispatchers.Main.immediate) { keyboardBridge.compare(accept) }
+
+    suspend fun keyboardStatus(): Map<String, Any> = withContext(Dispatchers.Main.immediate) { keyboardBridge.status() }
+
+    private fun sendBleLinkControl(op: G2BleLink.Op) {
+        val packets =
+            sendManager.buildPackets(
+                serviceId = ServiceID.G2_SETTING.value,
+                payload = G2BleLink.controlPacket(op),
+                reserveFlag = true
+            )
+        sendToGlasses(packets, left = true, right = true)
+        Bridge.log("G2: BLE link control -> $op")
+    }
+
+    /**
+     * Push the setting after CFW detection. Only a wanted FAST is sent: the
+     * firmware boots on the stock profile, so STOCK would be a no-op.
+     */
+    private fun syncBleLink() {
+        if (!supportsBleLinkControl || !fastBleWanted) return
+        sendBleLinkControl(G2BleLink.Op.FAST)
+    }
+
+    /**
+     * Live cfw_fast_ble switch. A stock device, an older CFW, or a
+     * pre-classification connect reads the setting later on detection.
+     */
+    override suspend fun cfwFastBleToggled(enabled: Boolean) {
+        if (!supportsBleLinkControl) {
+            Bridge.log("G2: cfw_fast_ble ${if (enabled) "ON" else "OFF"} — no link control on this firmware; applies on next CFW detection")
+            return
+        }
+        sendBleLinkControl(if (enabled) G2BleLink.Op.FAST else G2BleLink.Op.STOCK)
+    }
+
     private fun updateCfwCapabilities(data: ByteArray?, definitive: Boolean) {
         // The sticky/definitive rules live in G2CfwClassification (unit-tested);
         // null means the packet proved nothing and prior identity stands.
         val result = G2CfwClassification.classify(data, definitive, cfwCapabilityString) ?: return
-        cfwClassified = true
+        val changed = result != cfwClassification
+        cfwClassification = result
         if (result.isCfw) {
-            val changed = result.capabilityString != cfwCapabilityString
-            cfwCapabilityString = result.capabilityString
-            cfwFeatures.clear()
-            cfwFeatures.addAll(result.features)
-            cfwProtocolVersion = result.protocolVersion
             if (changed) {
-                Bridge.log("G2: Glassly CFW detected — ${result.capabilityString}")
+                Bridge.log("G2: CFW detected — ${result.capabilityString}")
                 rearmWakeLeaseIfWanted()
+                syncBleLink()
+                val revision = result.revision
+                onKeyboardThread { keyboardBridge.cfwDetected(revision) }
             }
         } else {
-            cfwFeatures.clear()
-            cfwProtocolVersion = 0
+            publishRingBattery(G2RingBattery.DISCONNECTED)
+            onKeyboardThread { keyboardBridge.linkLost() }
         }
+        publishSceneCanvas()
+    }
+
+    /**
+     * Publish the CFW scene canvas and vector-scene support into the glasses
+     * status once classification lands; zeros/false on stock so a stale value
+     * cannot survive a CFW→stock swap.
+     */
+    private fun publishSceneCanvas() {
+        if (!cfwClassified) return
+        val active = supportsCfwSceneRendering
+        DeviceStore.apply("glasses", "sceneCanvasWidth", if (active) 576 else 0)
+        DeviceStore.apply("glasses", "sceneCanvasHeight", if (active) 288 else 0)
+        DeviceStore.apply("glasses", "sceneVector", supportsCfwVectorScene)
+        DeviceStore.apply("glasses", "sceneSettle", supportsCfwSceneSettle)
     }
 
     /**
@@ -6360,9 +7169,10 @@ class G2 : SGCManager() {
         val baseVersion =
             (DeviceStore.get("glasses", "rightFirmwareVersion") as? String)
                 ?: (DeviceStore.get("glasses", "leftFirmwareVersion") as? String).orEmpty()
+        val name = cfwClassification?.displayName
         val displayVersion =
-            if (cfwCapabilityString != null) {
-                if (baseVersion.isEmpty()) "Glassly CFW" else "$baseVersion (Glassly CFW)"
+            if (name != null) {
+                if (baseVersion.isEmpty()) name else "$baseVersion ($name)"
             } else {
                 baseVersion
             }