@mentra/bluetooth-sdk 3.2.1 → 3.3.0-beta.954

package/ios/Source/internal/BluetoothSdkUsageTracker.swift

@@ -0,0 +1,428 @@
+import Foundation
+
+/// Pure decision logic for the Mentra Live usage events: one event per photo,
+/// recording, stream, mic session, setup attempt, OTA attempt and timed-out
+/// glasses command. It owns no threads and no I/O; `BluetoothSdkAnalytics` feeds
+/// it facts and captures what it returns, and only when analytics is enabled.
+///
+/// Durations are measured on the phone's clock between the start and end
+/// statuses it observes. A recording or stream whose end never reaches this
+/// process (the app was killed mid-stream) produces only its start.
+struct BluetoothSdkUsageTracker {
+    static let eventPhotoTaken = "bluetooth_sdk_photo_taken"
+    static let eventVideoRecorded = "bluetooth_sdk_video_recorded"
+    static let eventStreamStarted = "bluetooth_sdk_stream_started"
+    static let eventStreamEnded = "bluetooth_sdk_stream_ended"
+    static let eventMicSession = "bluetooth_sdk_mic_session"
+    static let eventWifiSetup = "bluetooth_sdk_wifi_setup"
+    static let eventHotspotStarted = "bluetooth_sdk_hotspot_started"
+    static let eventOtaFinished = "bluetooth_sdk_ota_finished"
+    static let eventRequestFailed = "bluetooth_sdk_request_failed"
+
+    static let maxRequestTimeoutsDefault = 100
+    /// Glasses report button-capture photo failures under this request id (ASG MediaCaptureService).
+    static let localPhotoRequestId = "local"
+    /// Button-started recordings use `local_video_<ts>_<rand>` request ids on the glasses.
+    static let localVideoRequestPrefix = "local_video_"
+
+    private static let maxOpenRecordings = 16
+    private static let maxOtaSessions = 16
+    private static let maxDetailLength = 200
+    private static let triggerApi = "api"
+    private static let triggerButton = "button"
+    private static let otaComplete = "complete"
+    private static let otaFailed = "failed"
+    private static let otaIdle = "idle"
+    private static let legacyTerminalStreamStates: Set<String> = ["stopped", "reconnect_failed"]
+    private static let liveStreamStates: Set<String> = ["streaming", "reconnected"]
+    private static let urlPattern = try! NSRegularExpression(pattern: #"[A-Za-z][A-Za-z0-9+.\-]*://\S+"#)
+
+    private struct OpenRecording {
+        var startedAtMs: Int64?
+        var width: Int?
+        var height: Int?
+        var fps: Int?
+        var save: Bool?
+        var maxDurationMinutes: Int?
+        var stoppedByApp = false
+    }
+
+    private struct OpenStream {
+        let streamId: String
+        let streamProtocol: String
+        /// Set by the first live status; nil while the start is still pending.
+        var startedAtMs: Int64?
+        var reconnectAttempts = 0
+        var stoppedByApp = false
+        var bitrate: Int64?
+        var fps: Double?
+        var droppedFrames: Int64?
+        var temperatureC: Double?
+    }
+
+    private struct OpenOta {
+        let startedAtMs: Int64
+        let fromBuildNumber: String
+        let fromBesFirmwareVersion: String
+        let fromMtkFirmwareVersion: String
+    }
+
+    private let maxRequestTimeouts: Int
+    private var recordings = BoundedMap<String, OpenRecording>(capacity: BluetoothSdkUsageTracker.maxOpenRecordings)
+    private var stream: OpenStream?
+    private var micSource: String?
+    private var micStartedAtMs: Int64 = 0
+    private var micTranscribed = false
+    private var otaSessions = BoundedMap<String, OpenOta>(capacity: BluetoothSdkUsageTracker.maxOtaSessions)
+    private var finishedOtaSessions = BoundedMap<String, Bool>(capacity: BluetoothSdkUsageTracker.maxOtaSessions)
+    private var requestTimeouts = 0
+
+    init(maxRequestTimeouts: Int = BluetoothSdkUsageTracker.maxRequestTimeoutsDefault) {
+        self.maxRequestTimeouts = maxRequestTimeouts
+    }
+
+    func photoSettled(
+        size: String,
+        mode: String,
+        compress: String,
+        save: Bool,
+        transferMethod: String,
+        latencyMs: Int64,
+        fileSizeBytes: Int64?,
+        errorCode: String?
+    ) -> AnalyticsEvent {
+        var properties: [String: Any] = ["trigger": Self.triggerApi]
+        Self.putOutcome(&properties, errorCode)
+        properties["latency_ms"] = latencyMs
+        properties["photo_size"] = size
+        properties["photo_mode"] = mode
+        properties["compress"] = compress
+        properties["save_to_gallery"] = save
+        properties["transfer_method"] = transferMethod
+        if let fileSizeBytes, fileSizeBytes > 0 { properties["file_size_bytes"] = fileSizeBytes }
+        return AnalyticsEvent(name: Self.eventPhotoTaken, properties: properties)
+    }
+
+    /// A button photo the glasses could not take; successful button photos never reach the phone.
+    func buttonPhotoFailed(errorCode: String?) -> AnalyticsEvent {
+        var properties: [String: Any] = ["trigger": Self.triggerButton]
+        Self.putOutcome(&properties, errorCode ?? "photo_request_failed")
+        return AnalyticsEvent(name: Self.eventPhotoTaken, properties: properties)
+    }
+
+    /// Records the API parameters of a recording so its end event can report them.
+    mutating func videoRequested(requestId: String, width: Int, height: Int, fps: Int, save: Bool, maxDurationMinutes: Int) {
+        recordings[requestId] = OpenRecording(
+            width: width > 0 ? width : nil,
+            height: height > 0 ? height : nil,
+            fps: fps > 0 ? fps : nil,
+            save: save,
+            maxDurationMinutes: maxDurationMinutes > 0 ? maxDurationMinutes : nil
+        )
+    }
+
+    mutating func videoStopRequested(requestId: String) {
+        guard var recording = recordings[requestId] else { return }
+        recording.stoppedByApp = true
+        recordings[requestId] = recording
+    }
+
+    /// Glasses report every recording, button-started ones included, through
+    /// `video_recording_status`. A recording is reported once: when it stops, or
+    /// when a command for it fails. `not_recording` answers a stop for a recording
+    /// that already ended and is not a recording of its own.
+    mutating func videoStatus(requestId: String, status: String, success: Bool, nowMs: Int64) -> AnalyticsEvent? {
+        guard !requestId.isBlank else { return nil }
+        if success {
+            switch status {
+            case "recording_started":
+                var recording = recordings[requestId] ?? OpenRecording()
+                if recording.startedAtMs == nil { recording.startedAtMs = nowMs }
+                recordings[requestId] = recording
+                return nil
+            case "recording_stopped":
+                guard let recording = recordings.removeValue(forKey: requestId) else { return nil }
+                return videoEvent(requestId: requestId, recording: recording, nowMs: nowMs, errorCode: nil)
+            default:
+                return nil
+            }
+        }
+        if status == "not_recording" {
+            recordings.removeValue(forKey: requestId)
+            return nil
+        }
+        let recording = recordings.removeValue(forKey: requestId) ?? OpenRecording()
+        return videoEvent(
+            requestId: requestId,
+            recording: recording,
+            nowMs: nowMs,
+            errorCode: status.isBlank ? "video_recording_failed" : status
+        )
+    }
+
+    private func videoEvent(requestId: String, recording: OpenRecording, nowMs: Int64, errorCode: String?) -> AnalyticsEvent {
+        var properties: [String: Any] = [
+            "trigger": requestId.hasPrefix(Self.localVideoRequestPrefix) ? Self.triggerButton : Self.triggerApi,
+        ]
+        Self.putOutcome(&properties, errorCode)
+        if let startedAtMs = recording.startedAtMs { properties["duration_ms"] = max(nowMs - startedAtMs, 0) }
+        if let width = recording.width { properties["width"] = width }
+        if let height = recording.height { properties["height"] = height }
+        if let fps = recording.fps { properties["fps"] = fps }
+        if let save = recording.save { properties["save_to_gallery"] = save }
+        if let maxDurationMinutes = recording.maxDurationMinutes { properties["max_duration_minutes"] = maxDurationMinutes }
+        properties["stopped_by_app"] = recording.stoppedByApp
+        return AnalyticsEvent(name: Self.eventVideoRecorded, properties: properties)
+    }
+
+    /// Opens the stream as its start command is sent, so a status that arrives
+    /// before `startStream` returns is still attributed to it. A new start
+    /// supersedes a stream that was live (the glasses stop it), so that stream is
+    /// reported as `replaced`.
+    mutating func streamRequested(streamId: String, streamUrl: String, nowMs: Int64) -> AnalyticsEvent? {
+        var replaced: AnalyticsEvent?
+        if let open = stream, open.startedAtMs != nil, open.streamId != streamId {
+            replaced = Self.streamEndedEvent(open, endState: "replaced", errorDetails: nil, nowMs: nowMs)
+        }
+        stream = OpenStream(streamId: streamId, streamProtocol: Self.streamProtocol(streamUrl))
+        return replaced
+    }
+
+    func streamStartSettled(
+        streamUrl: String,
+        width: Int?,
+        height: Int?,
+        fps: Int?,
+        bitrate: Int?,
+        captureAudio: Bool,
+        glassesNetwork: String,
+        latencyMs: Int64,
+        errorCode: String?
+    ) -> AnalyticsEvent {
+        var properties: [String: Any] = [:]
+        Self.putOutcome(&properties, errorCode)
+        properties["protocol"] = Self.streamProtocol(streamUrl)
+        if let width { properties["width"] = width }
+        if let height { properties["height"] = height }
+        if let fps { properties["fps"] = fps }
+        if let bitrate { properties["bitrate"] = bitrate }
+        properties["capture_audio"] = captureAudio
+        properties["glasses_network"] = glassesNetwork
+        properties["latency_ms"] = latencyMs
+        return AnalyticsEvent(name: Self.eventStreamStarted, properties: properties)
+    }
+
+    mutating func streamStopRequested() {
+        stream?.stoppedByApp = true
+    }
+
+    /// Folds one accepted `stream_status` into the open stream and reports the
+    /// stream once, on its terminal status. Glasses with stream revisions flag the
+    /// terminal status; older glasses only send a final `stopped` or
+    /// `reconnect_failed`. A stream that never went live ends silently: its
+    /// `bluetooth_sdk_stream_started` already reported the failure.
+    mutating func streamStatus(
+        streamId: String?,
+        state: String,
+        terminal: Bool?,
+        reconnectAttempt: Int?,
+        bitrate: Int64?,
+        fps: Double?,
+        droppedFrames: Int64?,
+        temperatureC: Double?,
+        errorDetails: String?,
+        nowMs: Int64
+    ) -> AnalyticsEvent? {
+        guard var open = stream else { return nil }
+        if let streamId, !streamId.isBlank, streamId != open.streamId { return nil }
+        if Self.liveStreamStates.contains(state), open.startedAtMs == nil { open.startedAtMs = nowMs }
+        if let reconnectAttempt { open.reconnectAttempts = max(open.reconnectAttempts, reconnectAttempt) }
+        if let bitrate { open.bitrate = bitrate }
+        if let fps { open.fps = fps }
+        if let droppedFrames { open.droppedFrames = droppedFrames }
+        if let temperatureC { open.temperatureC = temperatureC }
+        let ended = terminal == true || (terminal == nil && Self.legacyTerminalStreamStates.contains(state))
+        guard ended else {
+            stream = open
+            return nil
+        }
+        stream = nil
+        guard open.startedAtMs != nil else { return nil }
+        return Self.streamEndedEvent(open, endState: state, errorDetails: errorDetails, nowMs: nowMs)
+    }
+
+    private static func streamEndedEvent(_ open: OpenStream, endState: String, errorDetails: String?, nowMs: Int64) -> AnalyticsEvent {
+        var properties: [String: Any] = [
+            "protocol": open.streamProtocol,
+            "end_state": endState,
+            "stopped_by_app": open.stoppedByApp,
+            "reconnect_attempts": open.reconnectAttempts,
+        ]
+        if let startedAtMs = open.startedAtMs { properties["duration_ms"] = max(nowMs - startedAtMs, 0) }
+        if let detail = Self.sanitizedDetail(errorDetails) { properties["error_code"] = detail }
+        if let bitrate = open.bitrate { properties["bitrate"] = bitrate }
+        if let fps = open.fps { properties["fps"] = fps }
+        if let droppedFrames = open.droppedFrames { properties["dropped_frames"] = droppedFrames }
+        if let temperatureC = open.temperatureC { properties["temperature_c"] = temperatureC }
+        return AnalyticsEvent(name: Self.eventStreamEnded, properties: properties)
+    }
+
+    /// Follows the active mic source. A session ends when the source turns off or
+    /// changes; `local_transcription` is true if on-device transcription ran at
+    /// any point during it.
+    mutating func observeMic(currentMic: String, transcribing: Bool, nowMs: Int64) -> AnalyticsEvent? {
+        let next: String? = currentMic.isBlank ? nil : currentMic
+        let previous = micSource
+        if next == previous {
+            if next != nil, transcribing { micTranscribed = true }
+            return nil
+        }
+        let ended = previous.map {
+            AnalyticsEvent(
+                name: Self.eventMicSession,
+                properties: [
+                    "duration_ms": max(nowMs - micStartedAtMs, 0),
+                    "mic_source": $0,
+                    "local_transcription": micTranscribed,
+                ]
+            )
+        }
+        micSource = next
+        micStartedAtMs = nowMs
+        micTranscribed = next != nil && transcribing
+        return ended
+    }
+
+    func wifiSetupSettled(latencyMs: Int64, errorCode: String?) -> AnalyticsEvent {
+        var properties: [String: Any] = [:]
+        Self.putOutcome(&properties, errorCode)
+        properties["latency_ms"] = latencyMs
+        return AnalyticsEvent(name: Self.eventWifiSetup, properties: properties)
+    }
+
+    func hotspotStartSettled(latencyMs: Int64, errorCode: String?) -> AnalyticsEvent {
+        var properties: [String: Any] = [:]
+        Self.putOutcome(&properties, errorCode)
+        properties["latency_ms"] = latencyMs
+        return AnalyticsEvent(name: Self.eventHotspotStarted, properties: properties)
+    }
+
+    /// One event per OTA session, on `complete` or `failed`. The "from" versions are
+    /// the glasses versions when this process first saw the session in progress.
+    mutating func otaStatus(
+        sessionId: String,
+        status: String,
+        stepType: String,
+        totalSteps: Int,
+        errorMessage: String?,
+        fromBuildNumber: String,
+        fromBesFirmwareVersion: String,
+        fromMtkFirmwareVersion: String,
+        nowMs: Int64
+    ) -> AnalyticsEvent? {
+        if finishedOtaSessions.contains(sessionId) { return nil }
+        if status != Self.otaComplete, status != Self.otaFailed {
+            if status != Self.otaIdle, !otaSessions.contains(sessionId) {
+                otaSessions[sessionId] = OpenOta(
+                    startedAtMs: nowMs,
+                    fromBuildNumber: fromBuildNumber,
+                    fromBesFirmwareVersion: fromBesFirmwareVersion,
+                    fromMtkFirmwareVersion: fromMtkFirmwareVersion
+                )
+            }
+            return nil
+        }
+        finishedOtaSessions[sessionId] = true
+        let open = otaSessions.removeValue(forKey: sessionId)
+        let success = status == Self.otaComplete
+        var properties: [String: Any] = ["success": success]
+        if !success {
+            if !stepType.isBlank { properties["failed_step_type"] = stepType }
+            if let detail = Self.sanitizedDetail(errorMessage) { properties["error_message"] = detail }
+        }
+        if totalSteps > 0 { properties["total_steps"] = totalSteps }
+        if let open {
+            properties["duration_ms"] = max(nowMs - open.startedAtMs, 0)
+            if !open.fromBuildNumber.isBlank { properties["from_build_number"] = open.fromBuildNumber }
+            if !open.fromBesFirmwareVersion.isBlank { properties["from_bes_firmware_version"] = open.fromBesFirmwareVersion }
+            if !open.fromMtkFirmwareVersion.isBlank { properties["from_mtk_firmware_version"] = open.fromMtkFirmwareVersion }
+        }
+        return AnalyticsEvent(name: Self.eventOtaFinished, properties: properties)
+    }
+
+    /// At most `maxRequestTimeouts` per SDK instance, so a failure loop cannot run up event volume.
+    mutating func requestTimedOut(operation: String) -> AnalyticsEvent? {
+        guard requestTimeouts < maxRequestTimeouts else { return nil }
+        requestTimeouts += 1
+        return AnalyticsEvent(
+            name: Self.eventRequestFailed,
+            properties: ["operation": operation, "error_code": "request_timeout"]
+        )
+    }
+
+    /// Mirrors the glasses' scheme mapping in ASG StreamCommandHandler.
+    static func streamProtocol(_ streamUrl: String) -> String {
+        let trimmed = streamUrl.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard let separator = trimmed.range(of: "://") else { return "unknown" }
+        switch trimmed[..<separator.lowerBound].lowercased() {
+        case "srt": return "srt"
+        case "rtmp", "rtmps": return "rtmp"
+        case "http", "https": return "whip"
+        default: return "unknown"
+        }
+    }
+
+    /// Free-text details may carry stream or upload URLs; those never leave the phone.
+    static func sanitizedDetail(_ value: String?) -> String? {
+        guard let value else { return nil }
+        let range = NSRange(value.startIndex..., in: value)
+        let replaced = urlPattern.stringByReplacingMatches(in: value, range: range, withTemplate: "<url>")
+        let trimmed = replaced.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !trimmed.isEmpty else { return nil }
+        return String(trimmed.prefix(maxDetailLength))
+    }
+
+    private static func putOutcome(_ properties: inout [String: Any], _ errorCode: String?) {
+        properties["success"] = errorCode == nil
+        if let detail = sanitizedDetail(errorCode) { properties["error_code"] = detail }
+    }
+}
+
+/// Insertion-ordered map that drops its oldest entry beyond `capacity`, so a
+/// stream of ids whose end never arrives cannot grow without bound.
+private struct BoundedMap<Key: Hashable, Value> {
+    private let capacity: Int
+    private var order: [Key] = []
+    private var storage: [Key: Value] = [:]
+
+    init(capacity: Int) {
+        self.capacity = capacity
+    }
+
+    func contains(_ key: Key) -> Bool {
+        storage[key] != nil
+    }
+
+    subscript(key: Key) -> Value? {
+        get { storage[key] }
+        set {
+            guard let newValue else {
+                removeValue(forKey: key)
+                return
+            }
+            if storage.updateValue(newValue, forKey: key) == nil {
+                order.append(key)
+                if order.count > capacity {
+                    storage.removeValue(forKey: order.removeFirst())
+                }
+            }
+        }
+    }
+
+    @discardableResult
+    mutating func removeValue(forKey key: Key) -> Value? {
+        guard let removed = storage.removeValue(forKey: key) else { return nil }
+        order.removeAll { $0 == key }
+        return removed
+    }
+}

package/ios/Source/sgcs/MentraLive.swift

@@ -923,7 +923,7 @@ extension MentraLive: CBCentralManagerDelegate {
             self.isConnecting = false
 
             self.connectedPeripheral = nil
-            self.fullyBooted = false
+            self.clearPhysicalReadiness()
             self.connected = false
             self.glassesSessionId = nil // Fresh BLE session starts with no sid known
             self.streamControlVersion = 0
@@ -1349,7 +1349,7 @@ class MentraLive: NSObject, SGCManager {
             // Queued writes are session-bound: transmitting them into the NEXT session
             // (e.g. a stale handshake whose reply activates v2 before the new session
             // negotiated) is the bug class this clear removes.
-            Task { await commandQueue.removeAll() }
+            commandQueue.removeAll()
             stopSignalStrengthPolling()
             DeviceStore.shared.apply("glasses", "signalStrength", -1)
             DeviceStore.shared.apply("glasses", "signalStrengthUpdatedAt", 0)
@@ -1617,6 +1617,16 @@ class MentraLive: NSObject, SGCManager {
         set { DeviceStore.shared.apply("glasses", "connected", newValue) }
     }
 
+    private func clearPhysicalReadiness() {
+        let readinessWasPending = connected && !fullyBooted
+        fullyBooted = false
+        if readinessWasPending {
+            // Logical ASG readiness already emitted false without disconnecting.
+            // The real disconnect must still perform the cleanup apply deduplicates.
+            DeviceManager.shared.handleDeviceDisconnected()
+        }
+    }
+
     // Queue Management
     private let commandQueue = CommandQueue()
     private let bluetoothQueue = DispatchQueue(label: "MentraLiveBluetooth", qos: .userInitiated)
@@ -1744,8 +1754,8 @@ class MentraLive: NSObject, SGCManager {
         // Publish disconnect immediately for Phone A UI. didDisconnectPeripheral may lag
         // or race with cancelPeripheralConnection; do not wait on it for stand-down.
         isConnecting = false
+        clearPhysicalReadiness()
         connected = false
-        fullyBooted = false
         glassesSessionId = nil
         streamControlVersion = 0
         readinessCompletedThisBleSession = false
@@ -2123,8 +2133,7 @@ class MentraLive: NSObject, SGCManager {
         /// Wire-session generation at enqueue time; the drain loop drops entries from a
         /// previous session so a stale write (worst case: an old handshake whose reply
         /// would activate v2 pre-negotiation) can never cross a session boundary. This is
-        /// the deterministic guard - the async removeAll() on disconnect is best-effort
-        /// cleanup that may land after a reconnect has already resumed the drain loop.
+        /// the deterministic guard if a consumer already dequeued a previous-session write.
         let generation: Int
     }
 
@@ -2166,7 +2175,7 @@ class MentraLive: NSObject, SGCManager {
         Bridge.log("LIVE: Cleared pending ACK mId \(pendingMessage.id) because \(reason)")
     }
 
-    actor CommandQueue {
+    @MainActor final class CommandQueue {
         private var commands: [PendingMessage] = []
 
         func enqueue(_ command: PendingMessage) -> Int {
@@ -2282,15 +2291,11 @@ class MentraLive: NSObject, SGCManager {
             )
 
             // Push to front of queue for immediate retry
-            Task {
-                let queueSize = await self.commandQueue.pushToFront(retryMessage)
-                await MainActor.run {
-                    self.logBleWriteTrace("retry_queued", retryMessage.trace, extra: [
-                        "retryDelayMs": 0,
-                        "queueSizeAfterAdd": queueSize,
-                    ])
-                }
-            }
+            let queueSize = commandQueue.pushToFront(retryMessage)
+            logBleWriteTrace("retry_queued", retryMessage.trace, extra: [
+                "retryDelayMs": 0,
+                "queueSizeAfterAdd": queueSize,
+            ])
 
             Bridge.log(
                 "🔄 Retrying message mId: \(pendingMessage.id) (attempt \(retryMessage.retries)/3)"
@@ -2528,8 +2533,8 @@ class MentraLive: NSObject, SGCManager {
             Bridge.log("LIVE: Maximum reconnection attempts reached (\(MAX_RECONNECT_ATTEMPTS))")
             reconnectAttempts = 0
             updateConnectionState(ConnTypes.DISCONNECTED)
+            clearPhysicalReadiness()
             connected = false
-            fullyBooted = false
             glassesSessionId = nil
             streamControlVersion = 0
             readinessCompletedThisBleSession = false
@@ -3143,6 +3148,11 @@ class MentraLive: NSObject, SGCManager {
             if type.hasPrefix("version_info") {
                 Bridge.log("LIVE: Received \(type)")
 
+                // A new process can report its build before glasses_ready resets the
+                // wire epoch. Publish its pending readiness before those version fields
+                // can complete OTA and trigger the next request.
+                handleGlassesSessionId(json)
+
                 // Extract all fields from JSON (except "type")
                 var fields: [String: Any] = [:]
                 fields["version_info_type"] = type
@@ -3215,7 +3225,6 @@ class MentraLive: NSObject, SGCManager {
                 // running them per chunk is safe.
                 parsePeerWireCaps(json)
                 maybeSendWireHandshake()
-                handleGlassesSessionId(json)
 
                 Bridge.sendVersionInfo(fields, responseChunk: type)
             } else {
@@ -3714,7 +3723,19 @@ class MentraLive: NSObject, SGCManager {
         sendJson(json, wakeUp: true)
     }
 
-    func sendIncidentId(_ incidentId: String, apiBaseUrl: String?) {
+    var incidentLogTransportReady: Bool {
+        connectedPeripheral?.state == .connected && txCharacteristic != nil
+    }
+
+    func sendIncidentId(_ incidentId: String, apiBaseUrl: String?) throws {
+        guard incidentLogTransportReady else {
+            throw BluetoothSdkError(code: "glasses_not_connected", message: "Cannot request incident logs because the glasses BLE link is not ready.")
+        }
+        // Token sync may happen after glasses_ready; never rely on the last pairing's token.
+        let coreToken = DeviceStore.shared.get("bluetooth", "core_token") as? String ?? ""
+        guard !coreToken.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else {
+            throw BluetoothSdkError(code: "core_token_unavailable", message: "Cannot request incident logs without the current Core access token.")
+        }
         var base = (apiBaseUrl ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
         if base.isEmpty {
             base = "https://api.mentra.glass"
@@ -3731,10 +3752,20 @@ class MentraLive: NSObject, SGCManager {
             fileBaseKey: lKey, incidentId: incidentId, apiBaseUrl: base, kind: .logcat
         )
 
-        Bridge.log(
-            "LIVE: Sending incidentId to glasses for log upload: \(incidentId) (BLE relay \(bKey), \(lKey))"
-        )
-        sendJson(["type": "upload_incident_logs", "incidentId": incidentId, "apiBaseUrl": base], wakeUp: true)
+        let auth: [String: Any] = [
+            "type": "auth_token", "coreToken": coreToken,
+            "timestamp": Int64(Date().timeIntervalSince1970 * 1000),
+        ]
+        // MainActor queue insertion preserves auth-before-upload order, including all fragments.
+        guard sendJson(auth, wakeUp: true, requireAck: true, bridgeLogging: true),
+              sendJson(["type": "upload_incident_logs", "incidentId": incidentId, "apiBaseUrl": base],
+                       wakeUp: true, requireAck: true, bridgeLogging: true)
+        else {
+            bleIncidentLogRelays.removeValue(forKey: bKey)
+            bleIncidentLogRelays.removeValue(forKey: lKey)
+            throw BluetoothSdkError(code: "incident_dispatch_failed", message: "Could not queue the glasses incident-log request.")
+        }
+        Bridge.log("LIVE: Queued incidentId to glasses for log upload: \(incidentId) (BLE relay \(bKey), \(lKey))")
     }
 
     private static func incidentBleFileBase(incidentId: String, prefix: Character) -> String {
@@ -4671,20 +4702,13 @@ class MentraLive: NSObject, SGCManager {
 
     func queueSend(_ data: Data, id: String, trace: BleWriteTrace?) {
         let significantQueueSize = SIGNIFICANT_BLE_TRACE_QUEUE_SIZE
-        // Capture the epoch at enqueue-request time: the Task body may run after a
-        // session reset, and a pre-reset payload stamped with the new generation would
-        // defeat the stale-write guard in the drain loop.
+        // Insert synchronously on MainActor so fragments and dependent commands retain call order.
         let generation = wireSessionGeneration
-        Task {
-            let queueSize = await commandQueue.enqueue(PendingMessage(data: data, id: id, retries: 0, trace: trace, generation: generation))
-            guard trace != nil, queueSize >= significantQueueSize else {
-                return
-            }
-            await MainActor.run {
-                self.logBleChunkTrace("queued", trace, extra: [
-                    "queueSizeAfterAdd": queueSize,
-                ])
-            }
+        let queueSize = commandQueue.enqueue(PendingMessage(data: data, id: id, retries: 0, trace: trace, generation: generation))
+        if trace != nil, queueSize >= significantQueueSize {
+            logBleChunkTrace("queued", trace, extra: [
+                "queueSizeAfterAdd": queueSize,
+            ])
         }
     }
 
@@ -5201,7 +5225,10 @@ class MentraLive: NSObject, SGCManager {
                             bridgeLogging: bridgeLogging
                         )
                     }
-                    transportLog("LIVE: Sending data to glasses: \(jsonString)", bridgeLogging: bridgeLogging)
+                    // Credentials reach the wire unchanged; diagnostic logs omit their values.
+                    let loggedPayload = json["password"] == nil && json["coreToken"] == nil
+                        ? jsonString : "<\(commandInfo.commandType) with credentials omitted>"
+                    transportLog("LIVE: Sending data to glasses: \(loggedPayload)", bridgeLogging: bridgeLogging)
                     let packedData =
                         packJson(
                             jsonString,
@@ -5724,7 +5751,7 @@ class MentraLive: NSObject, SGCManager {
         stopReadinessCheckLoop()
 
         readinessCheckCounter = 0
-        fullyBooted = false
+        clearPhysicalReadiness()
         connected = false
         glassesSessionId = nil
         streamControlVersion = 0
@@ -5996,7 +6023,7 @@ class MentraLive: NSObject, SGCManager {
         // Stop all timers
         stopAllTimers()
         resetWireNegotiationState()
-        Task { await commandQueue.removeAll() } // stale writes die with the session
+        commandQueue.removeAll() // stale writes die with the session
         closeL2capFileChannel()
 
         // Disconnect BLE
@@ -6005,8 +6032,8 @@ class MentraLive: NSObject, SGCManager {
             centralManager?.cancelPeripheralConnection(peripheral)
         }
 
+        clearPhysicalReadiness()
         DeviceStore.shared.apply("glasses", "connected", false)
-        DeviceStore.shared.apply("glasses", "fullyBooted", false)
         DeviceStore.shared.apply("glasses", "wifiConnected", false)
         DeviceStore.shared.apply("glasses", "wifiSsid", "")
         DeviceStore.shared.apply("glasses", "wifiLocalIp", "")
@@ -6143,8 +6170,8 @@ extension MentraLive {
     /// pre-sid build) or differing from the recorded one = restart; same sid = no action.
     /// A restart is a LOGICAL session reset: send phone_ready immediately (bypassing the
     /// sr_hrt heartbeat's stale-readiness suppression); the returning glasses_ready runs
-    /// the full existing remote-wire-reset flow. fullyBooted is deliberately untouched -
-    /// the physical link never dropped, so the connection UI must not flap.
+    /// the full existing remote-wire-reset flow. Keep the physical connection intact,
+    /// but mark readiness pending until that new wire epoch has been established.
     private func handleGlassesSessionId(_ json: [String: Any]) {
         guard let sid = json["sid"] as? String, !sid.isEmpty else { return }
         let previous = glassesSessionId
@@ -6159,6 +6186,9 @@ extension MentraLive {
             "LIVE: 🔁 Glasses session changed (\(previous ?? "<pre-sid build>") -> \(sid)) - " +
                 "asg restarted under a live link, re-running readiness"
         )
+        // Emit the existing connected-but-not-ready status without invoking the
+        // physical-disconnect side effects of DeviceStore.apply(fullyBooted: false).
+        DeviceStore.shared.set("glasses", "fullyBooted", false)
         sendPhoneReady(reason: "glasses session changed")
         Bridge.sendTypedMessage(
             "glasses_session_changed",