@mentra/bluetooth-sdk 3.4.0-dev.965 → 3.4.0-dev.971

package/android/src/debug/java/com/mentra/bluetoothsdk/sgcs/NimoResourceDiagnostics.kt

@@ -8,6 +8,7 @@ import android.os.Build
 import android.os.Handler
 import android.os.Looper
 import android.os.Process
+import android.os.SystemClock
 import com.mentra.bluetoothsdk.BuildConfig
 import com.mentra.bluetoothsdk.DeviceManager
 import org.json.JSONObject
@@ -18,6 +19,7 @@ import java.util.UUID
 /** Fixed, DUMP-protected debug commands. Expected address is comparison-only, never a connection target.
  * No packet, device-command, caller path, reset, bond or radio inputs are accepted. */
 internal object NimoResourceDiagnostics {
+    const val CLOCK_PROTOCOL = "nimo-monotonic-receipt-v1"
     const val ACTION = "com.mentra.bluetoothsdk.NIMO_RESOURCE_LIFECYCLE"
     private val main = Handler(Looper.getMainLooper())
     private val processInstanceId = UUID.randomUUID().toString()
@@ -28,7 +30,8 @@ internal object NimoResourceDiagnostics {
     private val requests = linkedSetOf<String>()
     private data class Capture(val nonce: String, val name: String, val address: String,
         var instance: Nimo? = null, var cancelled: Boolean = false, var connectStarted: Boolean = false,
-        var transportStarted: Boolean = false)
+        var transportStarted: Boolean = false, val armedElapsedMs: Long,
+        var admittedElapsedMs: Long? = null)
     // One diagnostic attempt per app process. Cancellation is a process-lifetime fence.
     @Volatile private var capture: Capture? = null
     internal fun preArmCaptureRequired(buildType: String = BuildConfig.BUILD_TYPE): Boolean = buildType == "nimoDiagnostic"
@@ -87,16 +90,21 @@ internal object NimoResourceDiagnostics {
             owned.instance != null && owned.instance !== instance || owned.connectStarted) return false
         if (owned.instance == null) {
             if (!instance.resourceCaptureEligible()) return false
+            val candidateAdmittedElapsedMs = SystemClock.elapsedRealtime()
             owned.instance = instance
             // Immutable admission survives a setup timeout before any GATT session exists.
-            val app = application ?: return false
+            val app = application ?: run { owned.cancelled = true; return false }
             val root = File(app.filesDir, "nimo-lifecycle")
             val target = File(root, "${owned.nonce}.admission.json")
             if (target.exists()) { owned.cancelled = true; return false }
             val pending = File(root, "${owned.nonce}.admission.tmp")
             try {
-                pending.outputStream().use { it.write(captureSnapshot(owned).toString().toByteArray(Charsets.UTF_8)); it.flush() }
+                pending.outputStream().use { it.write(captureSnapshot(owned, candidateAdmittedElapsedMs).toString().toByteArray(Charsets.UTF_8)); it.flush() }
                 check(pending.renameTo(target))
+                // Durable admission is authoritative; no live clock may claim it
+                // before the original immutable receipt is safely committed.
+                instance.resourceCaptureAdmission(owned.nonce, owned.armedElapsedMs, candidateAdmittedElapsedMs)
+                owned.admittedElapsedMs = candidateAdmittedElapsedMs
             } catch (_: Exception) {
                 owned.cancelled = true
                 return false
@@ -124,7 +132,10 @@ internal object NimoResourceDiagnostics {
     }
 
     @Synchronized
-    private fun captureSnapshot(owned: Capture): JSONObject = JSONObject()
+    private fun captureSnapshot(owned: Capture, admittedElapsedMs: Long? = owned.admittedElapsedMs): JSONObject = JSONObject()
+        .put("clockProtocol", CLOCK_PROTOCOL)
+        .put("clock", JSONObject().put("kind", "android-elapsed-realtime-v1").put("armedElapsedMs", owned.armedElapsedMs)
+            .put("admittedElapsedMs", admittedElapsedMs ?: JSONObject.NULL).put("observedElapsedMs", SystemClock.elapsedRealtime()))
         .put("version", "nimo-preconnect-capture-v1").put("nonce", owned.nonce)
         .put("captureRequiredBeforeArm", preArmCaptureRequired())
         .put("expectedPair", JSONObject().put("name", owned.name).put("bluetoothAddress", owned.address))
@@ -166,6 +177,7 @@ internal object NimoResourceDiagnostics {
     @Synchronized
     internal fun execute(intent: Intent) {
         check(Looper.myLooper() == main.looper)
+        val requestReceivedElapsedMs = SystemClock.elapsedRealtime()
         val nonce = intent.getStringExtra("nonce") ?: return
         if (!uuid(nonce) || nonce in requests) return
         val app = application ?: return
@@ -181,7 +193,9 @@ internal object NimoResourceDiagnostics {
             .put("instanceId", instanceId ?: JSONObject.NULL).put("sessionGeneration", if (generation >= 0) generation else JSONObject.NULL)
         fun save(session: JSONObject?, error: String? = null): Boolean {
             val current = DeviceManager.getInstance().sgc
-            val receipt = JSONObject().put("schemaVersion", 1).put("request", request).put("observedAtEpochMs", System.currentTimeMillis())
+            val receipt = JSONObject().put("clockProtocol", CLOCK_PROTOCOL)
+                .put("clock", JSONObject().put("kind", "android-elapsed-realtime-v1").put("requestReceivedElapsedMs", requestReceivedElapsedMs).put("observedElapsedMs", SystemClock.elapsedRealtime()))
+                .put("schemaVersion", 1).put("request", request).put("observedAtEpochMs", System.currentTimeMillis())
                 .put("appPid", Process.myPid()).put("processInstanceId", processInstanceId)
                 .put("currentManager", JSONObject().put("type", current?.type ?: JSONObject.NULL)
                     .put("instanceId", (current as? Nimo)?.resourceInstanceId ?: JSONObject.NULL))
@@ -207,7 +221,7 @@ internal object NimoResourceDiagnostics {
                 if (capture != null || captureNonce != nonce || manager != null) {
                     save(null, "capture-arm-refused-existing-owner"); return
                 }
-                capture = Capture(captureNonce, expectedName, address)
+                capture = Capture(captureNonce, expectedName, address, armedElapsedMs = requestReceivedElapsedMs)
             }
             val owned = capture
             if (owned == null || owned.nonce != captureNonce || owned.name != expectedName || owned.address != address) {
@@ -224,7 +238,7 @@ internal object NimoResourceDiagnostics {
             val original = owned.instance
             if (original == null) { captureReceipt(); return }
             if (DeviceManager.getInstance().sgc !== original) { captureReceipt(original.resourceSnapshot(), "capture-cancel-refused-replacement"); return }
-            original.releaseCapturedResource({ DeviceManager.getInstance().sgc === original }) { result -> captureReceipt(result) }
+            original.releaseCapturedResource({ DeviceManager.getInstance().sgc === original }, { result -> captureReceipt(result) }, nonce, requestReceivedElapsedMs)
             return
         }
         if (mode !in listOf("status", "release") || !Regex("^[0-9A-F]{2}(:[0-9A-F]{2}){5}$").matches(address) ||
@@ -250,10 +264,10 @@ internal object NimoResourceDiagnostics {
         if (instanceId == null || generation < 1 || instance == null || instance !== current) {
             save(snapshot, "release-refused-replaced-or-unowned-target"); return
         }
-        instance.releaseResource(generation, { DeviceManager.getInstance().sgc === instance }) { result ->
+        instance.releaseResource(generation, { DeviceManager.getInstance().sgc === instance }, { result ->
             track(instance)
             if (result.has("error")) save(instance.resourceSnapshot(), result.getString("error")) else save(result)
-        }
+        }, nonce, requestReceivedElapsedMs)
     }
 
     private fun uuid(value: String): Boolean = try { UUID.fromString(value).toString() == value } catch (_: IllegalArgumentException) { false }

package/android/src/main/java/com/mentra/bluetoothsdk/GeneratedReleaseMetadata.kt

@@ -3,9 +3,9 @@ package com.mentra.bluetoothsdk
 /** Generated by release CI. Do not edit in a release checkout. */
 internal object GeneratedReleaseMetadata {
     const val FAMILY_BASE_VERSION: String = "3.4.0"
-    const val RELEASE_IDENTITY: String = "3.4.0-dev.965"
-    const val RELEASE_SET_ID: String = "mentra-3.4.0-dev.965"
-    const val SOURCE_COMMIT: String = "7909ffb46c61953874fffacdc737f8070be28f06"
-    const val OTA_MANIFEST_URL: String = "https://artifactscdn.mentraglass.com/Mentra-Community/MentraOS/releases/mentra-builds-v3.4.0/mentra-live-ota-3.4.0-dev.965.json"
-    const val OTA_MANIFEST_SHA256: String = "798e597eba66ca395abd7a77cffdb86e9f6ffa7702625361b52aba8ba434f594"
+    const val RELEASE_IDENTITY: String = "3.4.0-dev.971"
+    const val RELEASE_SET_ID: String = "mentra-3.4.0-dev.971"
+    const val SOURCE_COMMIT: String = "c72b7ecf63112a98579639fc4fdb126aedbf425d"
+    const val OTA_MANIFEST_URL: String = "https://artifactscdn.mentraglass.com/Mentra-Community/MentraOS/releases/mentra-builds-v3.4.0/mentra-live-ota-3.4.0-dev.971.json"
+    const val OTA_MANIFEST_SHA256: String = "5be88fa1406efdd5024b94ae18c9124f33ed1cd8e1661f5bcfbabc522a120037"
 }

package/android/src/main/java/com/mentra/bluetoothsdk/sgcs/Nimo.kt

@@ -969,6 +969,40 @@ class Nimo : SGCManager() {
     private var resourceClosingGatt: BluetoothGatt? = null
     private var resourceReleaseResult = "not-requested"
 
+    private var resourceCaptureNonce: String? = null
+    private var resourceArmedElapsedMs: Long? = null
+    private var resourceAdmittedElapsedMs: Long? = null
+    private var resourceSessionStartedElapsedMs: Long? = null
+    private var resourceReleaseNonce: String? = null
+    private var resourceReleaseStartedElapsedMs: Long? = null
+    private var firmwareElapsedMs: Long? = null
+    private var twsElapsedMs: Long? = null
+    private var handshakeTwsElapsedMs: Long? = null
+    private var timeWriteStartedElapsedMs: Long? = null
+    private var timeAckElapsedMs: Long? = null
+    private var micStopStartedElapsedMs: Long? = null
+    private var micStopMarkerElapsedMs: Long? = null
+    private var micStopWrittenElapsedMs: Long? = null
+    private var displayExitElapsedMs: Long? = null
+
+    // Keep paired clock sampling in this class even when the triggering callback
+    // is an escaping Kotlin lambda. This preserves event timing and permits APK
+    // bytecode inspection without treating an unrelated elapsed clock call as proof.
+    private fun recordResourceFirmwareClock() { resourceFirmwareAt = System.currentTimeMillis(); firmwareElapsedMs = android.os.SystemClock.elapsedRealtime() }
+    private fun recordResourceTwsClock() { resourceTwsAt = System.currentTimeMillis(); twsElapsedMs = android.os.SystemClock.elapsedRealtime() }
+    private fun recordResourceTimeWriteClock() { resourceTimeWriteStartedAt = System.currentTimeMillis(); timeWriteStartedElapsedMs = android.os.SystemClock.elapsedRealtime() }
+    private fun recordResourceTimeAckClock() { resourceTimeAckAt = System.currentTimeMillis(); timeAckElapsedMs = android.os.SystemClock.elapsedRealtime() }
+    private fun recordResourceMicStopStartedClock() { resourceMicStopStartedAt = System.currentTimeMillis(); micStopStartedElapsedMs = android.os.SystemClock.elapsedRealtime() }
+    private fun recordResourceMicStopMarkerClock() { resourceMicStopMarkerAt = System.currentTimeMillis(); micStopMarkerElapsedMs = android.os.SystemClock.elapsedRealtime() }
+    private fun recordResourceMicStopWrittenClock() { resourceMicStopWrittenAt = System.currentTimeMillis(); micStopWrittenElapsedMs = android.os.SystemClock.elapsedRealtime() }
+    private fun recordResourceExitClock() { resourceExitAt = System.currentTimeMillis(); displayExitElapsedMs = android.os.SystemClock.elapsedRealtime() }
+
+    internal fun resourceCaptureAdmission(nonce: String, armed: Long, admitted: Long) {
+        check(Looper.myLooper() == mainHandler.looper)
+        check(resourceCaptureNonce == null && admitted >= armed)
+        resourceCaptureNonce = nonce; resourceArmedElapsedMs = armed; resourceAdmittedElapsedMs = admitted
+    }
+
     internal fun resourceCaptureEligible(): Boolean {
         val snapshot = resourceSnapshot()
         return resourceSessionGeneration == 0L && discoveryReceiver == null &&
@@ -982,6 +1016,20 @@ class Nimo : SGCManager() {
         check(Looper.myLooper() == mainHandler.looper)
         val pending = writes.pendingCount() + canvasEncoder.pendingCount() + audioClient.lifecyclePending() + resourcePostedWrites.get() + pendingAcks.size + canvas.pendingCount()
         return JSONObject().put("observedAtEpochMs", System.currentTimeMillis()).put("sessionObservationCurrent", true).put("instanceId", resourceInstanceId).put("sessionGeneration", resourceSessionGeneration)
+            .put("clock", JSONObject().put("kind", "android-elapsed-realtime-v1").put("observedElapsedMs", android.os.SystemClock.elapsedRealtime())
+                .put("captureNonce", resourceCaptureNonce ?: JSONObject.NULL).put("armedElapsedMs", resourceArmedElapsedMs ?: JSONObject.NULL)
+                .put("admittedElapsedMs", resourceAdmittedElapsedMs ?: JSONObject.NULL).put("sessionStartedElapsedMs", resourceSessionStartedElapsedMs ?: JSONObject.NULL)
+                .put("releaseNonce", resourceReleaseNonce ?: JSONObject.NULL).put("releaseStartedElapsedMs", resourceReleaseStartedElapsedMs ?: JSONObject.NULL)
+                .put("firmwareElapsedMs", firmwareElapsedMs ?: JSONObject.NULL)
+                .put("twsElapsedMs", twsElapsedMs ?: JSONObject.NULL)
+                .put("handshakeTwsElapsedMs", handshakeTwsElapsedMs ?: JSONObject.NULL)
+                .put("timeWriteStartedElapsedMs", timeWriteStartedElapsedMs ?: JSONObject.NULL)
+                .put("timeAckElapsedMs", timeAckElapsedMs ?: JSONObject.NULL)
+                .put("micStopStartedElapsedMs", micStopStartedElapsedMs ?: JSONObject.NULL)
+                .put("micStopMarkerElapsedMs", micStopMarkerElapsedMs ?: JSONObject.NULL)
+                .put("micStopWrittenElapsedMs", micStopWrittenElapsedMs ?: JSONObject.NULL)
+                .put("displayExitElapsedMs", displayExitElapsedMs ?: JSONObject.NULL)
+            )
             .put("pair", JSONObject().put("name", resourcePairName ?: lastDeviceName ?: JSONObject.NULL)
                 .put("bluetoothAddress", resourcePairAddress ?: lastDeviceAddress ?: JSONObject.NULL))
             .put("handshake", handshakeState.name).put("managedSessionPresent", gatt != null)
@@ -1003,21 +1051,32 @@ class Nimo : SGCManager() {
 
     /** Exact original instance only. Never delegates to the manager's current device. */
     internal fun releaseResource(expectedGeneration: Long, isCurrent: () -> Boolean, completed: (JSONObject) -> Unit) =
-        releaseOriginalResource(expectedGeneration, false, isCurrent, completed)
+        releaseOriginalResource(expectedGeneration, false, isCurrent, completed, null, null)
+
+    internal fun releaseResource(expectedGeneration: Long, isCurrent: () -> Boolean, completed: (JSONObject) -> Unit, requestNonce: String, requestReceivedElapsedMs: Long) =
+        releaseOriginalResource(expectedGeneration, false, isCurrent, completed, requestNonce, requestReceivedElapsedMs)
 
     /** Only the private admitted capture may cancel an original pre-GATT generation-zero attempt. */
     internal fun releaseCapturedResource(isCurrent: () -> Boolean, completed: (JSONObject) -> Unit) =
-        releaseOriginalResource(resourceSessionGeneration, true, isCurrent, completed)
+        releaseOriginalResource(resourceSessionGeneration, true, isCurrent, completed, null, null)
+
+    internal fun releaseCapturedResource(isCurrent: () -> Boolean, completed: (JSONObject) -> Unit, requestNonce: String, requestReceivedElapsedMs: Long) =
+        releaseOriginalResource(resourceSessionGeneration, true, isCurrent, completed, requestNonce, requestReceivedElapsedMs)
 
-    private fun releaseOriginalResource(expectedGeneration: Long, captured: Boolean, isCurrent: () -> Boolean, completed: (JSONObject) -> Unit) {
+    private fun releaseOriginalResource(expectedGeneration: Long, captured: Boolean, isCurrent: () -> Boolean, completed: (JSONObject) -> Unit, requestNonce: String?, requestReceivedElapsedMs: Long?) {
         check(Looper.myLooper() == mainHandler.looper)
         if (!isCurrent() || expectedGeneration != resourceSessionGeneration || (!captured && expectedGeneration < 1) || resourceReleasePending || resourceReceiptPending) {
             completed(JSONObject().put("error", "target-mismatch-or-release-pending")); return
         }
         if (resourceReleased) { completed(resourceSnapshot()); return }
+        if (requestReceivedElapsedMs != null && android.os.SystemClock.elapsedRealtime() < requestReceivedElapsedMs) {
+            completed(JSONObject().put("error", "invalid-request-clock")); return
+        }
+        resourceReleaseNonce = requestNonce
+        resourceReleaseStartedElapsedMs = android.os.SystemClock.elapsedRealtime()
         resourceReleasePending = true
         resourceReleaseResult = "draining"
-        resourceExitStatus = null; resourceExitAt = null; resourceMicStopStartedAt = null; resourceMicStopMarkerAt = null; resourceMicStopWrittenAt = null
+        resourceExitStatus = null; resourceExitAt = null; displayExitElapsedMs = null; resourceMicStopStartedAt = null; micStopStartedElapsedMs = null; resourceMicStopMarkerAt = null; micStopMarkerElapsedMs = null; resourceMicStopWrittenAt = null; micStopWrittenElapsedMs = null
         resourceExitRequired = canvas.active() || canvas.pendingCount() > 0
         resourceInitialLaunchPendingAtRelease = !canvas.active() && canvas.launchPending()
         isDisconnecting = true
@@ -1035,7 +1094,7 @@ class Nimo : SGCManager() {
         val mic = micChar
         resourceMicStopRequired = original != null && mic != null
         if (original != null && mic != null) {
-            writes.enqueue(original, mic, listOf(byteArrayOf(0x52, 0, 0, 0)), finalStarted = { resourceMicStopStartedAt = System.currentTimeMillis() }, completed = { resourceMicStopWrittenAt = System.currentTimeMillis() })
+            writes.enqueue(original, mic, listOf(byteArrayOf(0x52, 0, 0, 0)), finalStarted = { recordResourceMicStopStartedClock() }, completed = { recordResourceMicStopWrittenClock() })
         }
         canvas.exit()
         val deadline = android.os.SystemClock.elapsedRealtime() + 15_000
@@ -1099,7 +1158,7 @@ class Nimo : SGCManager() {
         { Bridge.log("NIMO: canvas rejected status=$it; not a render ACK") },
         { diagnostics?.cancelHeldCapture("Canvas scope takeover preempted held capture", resumeCanvas = false) },
         { key, status ->
-            if (key == 3) { resourceExitStatus = status; resourceExitAt = System.currentTimeMillis() }
+            if (key == 3) { resourceExitStatus = status; recordResourceExitClock() }
             if (resourceReleasePending && resourceInitialLaunchPendingAtRelease && key == 1) {
                 // An explicit rejected initial Launch never acquired canvas ownership.
                 // Status 2 is transport-ambiguous and must retain the unknown fence.
@@ -1869,15 +1928,17 @@ class Nimo : SGCManager() {
         // for system-paired dual-mode accessories).
         Bridge.log("NIMO: connecting GATT over BR/EDR to ${device.address}")
         resourceSessionGeneration++
-        resourceExitStatus = null; resourceExitAt = null; resourceMicStopWrittenAt = null
-        resourceMicStopStartedAt = null; resourceMicStopMarkerAt = null; resourceTransportFailure = false; resourceClosingGatt = null
+        resourceSessionStartedElapsedMs = android.os.SystemClock.elapsedRealtime()
+        resourceReleaseNonce = null; resourceReleaseStartedElapsedMs = null
+        resourceExitStatus = null; resourceExitAt = null; displayExitElapsedMs = null; resourceMicStopWrittenAt = null; micStopWrittenElapsedMs = null
+        resourceMicStopStartedAt = null; micStopStartedElapsedMs = null; resourceMicStopMarkerAt = null; micStopMarkerElapsedMs = null; resourceTransportFailure = false; resourceClosingGatt = null
         resourceClosedWithPending = false; resourceReleaseResult = "not-requested"
         resourceMicStopRequired = false; resourceExitRequired = false; resourceInitialLaunchPendingAtRelease = false
         resourceReleased = false
         resourcePairAddress = peer.address
         resourcePairName = try { device.name ?: "" } catch (_: SecurityException) { "" }
-        resourceFirmwareAt = null; resourceFirmwareVersion = null
-        resourceTwsAt = null; resourceHandshakeTwsAt = null; resourceTimeAckAt = null; resourceTimeCommandId = null; resourceTimeWriteStartedAt = null
+        resourceFirmwareAt = null; firmwareElapsedMs = null; resourceFirmwareVersion = null
+        resourceTwsAt = null; twsElapsedMs = null; resourceHandshakeTwsAt = null; handshakeTwsElapsedMs = null; resourceTimeAckAt = null; timeAckElapsedMs = null; resourceTimeCommandId = null; resourceTimeWriteStartedAt = null; timeWriteStartedElapsedMs = null
         resourceCloseCalled = false; resourceCloseObserved = false; resourceDisconnectCallbackStatus = null; resourceCloseError = null
         NimoResourceDiagnostics.track(this)
         DeviceStore.apply("glasses", "connectionState", ConnTypes.CONNECTING)
@@ -2121,8 +2182,9 @@ class Nimo : SGCManager() {
                                 handleRxPacket(data)
                             }
                             NimoBLE.CHAR_MIC -> {
-                                if (resourceReleasePending && resourceMicStopStartedAt != null && data.contentEquals(byteArrayOf(0x52, 0, 0, 0)))
-                                    resourceMicStopMarkerAt = System.currentTimeMillis()
+                                if (resourceReleasePending && resourceMicStopStartedAt != null && data.contentEquals(byteArrayOf(0x52, 0, 0, 0))) {
+                                    recordResourceMicStopMarkerClock()
+                                }
                                 audioClient.enqueue(data)
                             }
                         }
@@ -2180,7 +2242,7 @@ class Nimo : SGCManager() {
             resourcePostedWrites.decrementAndGet()
             if (gatt !== expectedGatt || resourceReleasePending || resourceReleased) return@post
             writes.enqueue(expectedGatt, char, listOf(bytes), finalStarted = {
-                if (timeCommand != null && timeCommand == resourceTimeCommandId) resourceTimeWriteStartedAt = System.currentTimeMillis()
+                if (timeCommand != null && timeCommand == resourceTimeCommandId) { recordResourceTimeWriteClock() }
             })
         }
     }
@@ -2294,7 +2356,7 @@ class Nimo : SGCManager() {
     private fun proceedToTimeSync() {
         if (handshakeState != HandshakeState.AWAITING_TWS) return
         cancelTwsTimeout()
-        resourceHandshakeTwsAt = resourceTwsAt
+        resourceHandshakeTwsAt = resourceTwsAt; handshakeTwsElapsedMs = twsElapsedMs
         handshakeState = HandshakeState.AWAITING_TIME_ACK
         Bridge.log("NIMO: TWS OK — sending setTime (awaiting ACK)")
         setTimeAttempts = 0
@@ -2306,7 +2368,7 @@ class Nimo : SGCManager() {
         val expectedGatt = gatt
         setTimeAttempts++
         resourceTimeCommandId = UUID.randomUUID().toString()
-        resourceTimeWriteStartedAt = null
+        resourceTimeWriteStartedAt = null; timeWriteStartedElapsedMs = null
         sendAwaitingAck(
                 NimoProtocol.CMD_SET_PARAMETER,
                 NimoProtocol.SET_TIME,
@@ -2319,7 +2381,7 @@ class Nimo : SGCManager() {
                 return@sendAwaitingAck
             }
             if (ok) {
-                resourceTimeAckAt = System.currentTimeMillis()
+                recordResourceTimeAckClock()
                 finishHandshake()
             } else if (setTimeAttempts < SET_TIME_MAX_ATTEMPTS &&
                             handshakeState == HandshakeState.AWAITING_TIME_ACK &&
@@ -2544,7 +2606,7 @@ class Nimo : SGCManager() {
     }
 
     private fun onTwsState(connected: Boolean) {
-        resourceTwsAt = System.currentTimeMillis()
+        recordResourceTwsClock()
         twsConnected = connected
         if (connected && handshakeState == HandshakeState.AWAITING_TWS) {
             proceedToTimeSync()
@@ -2617,7 +2679,7 @@ class Nimo : SGCManager() {
                     val micro = (v ushr 12) and 0x1FF
                     val build = v and 0xFFF
                     firmwareVersionPacked = "$major.$minor.$micro.$build"
-                    resourceFirmwareVersion = firmwareVersionPacked; resourceFirmwareAt = System.currentTimeMillis()
+                    resourceFirmwareVersion = firmwareVersionPacked; recordResourceFirmwareClock()
                     emitVersionInfo()
                 }
             }
@@ -2626,7 +2688,7 @@ class Nimo : SGCManager() {
                 while (end > 0 && data[end - 1].toInt() == 0) end--
                 firmwareVersionDetail = String(data, 0, end, Charsets.UTF_8).trim()
                 if (firmwareVersionDetail.isNotEmpty() && firmwareVersionDetail.length <= 240) {
-                    resourceFirmwareVersion = firmwareVersionDetail; resourceFirmwareAt = System.currentTimeMillis()
+                    resourceFirmwareVersion = firmwareVersionDetail; recordResourceFirmwareClock()
                 }
                 emitVersionInfo()
             }

package/android/src/testDebug/java/com/mentra/bluetoothsdk/sgcs/NimoLifecycleTest.kt

@@ -120,6 +120,63 @@ class NimoLifecycleTest {
       .set(null, previousManager)
   }
 
+  @Test fun monotonicSnapshotRetainsOriginalAdmissionWhenWallMarkersJumpBothDirections() {
+    val armed = android.os.SystemClock.elapsedRealtime()
+    val nonce = java.util.UUID.randomUUID().toString()
+    org.robolectric.shadows.ShadowSystemClock.advanceBy(25, TimeUnit.MILLISECONDS)
+    val admitted = android.os.SystemClock.elapsedRealtime()
+    nimo.resourceCaptureAdmission(nonce, armed, admitted)
+    setField("resourceSessionStartedElapsedMs", admitted)
+    setField("resourceSessionGeneration", 1L)
+    setField("twsElapsedMs", admitted)
+    setField("handshakeTwsElapsedMs", admitted)
+    setField("timeWriteStartedElapsedMs", admitted)
+    org.robolectric.shadows.ShadowSystemClock.advanceBy(10, TimeUnit.MILLISECONDS)
+    val ack = android.os.SystemClock.elapsedRealtime()
+    setField("timeAckElapsedMs", ack)
+    // Model independent phone epoch jumps: neither direction can rewrite causal time.
+    for (epoch in listOf(1L, 4_000_000_000_000L)) {
+      setField("resourceTwsAt", epoch)
+      setField("resourceHandshakeTwsAt", epoch)
+      setField("resourceTimeWriteStartedAt", epoch)
+      setField("resourceTimeAckAt", epoch)
+      val clock = nimo.resourceSnapshot().getJSONObject("clock")
+      assertEquals("android-elapsed-realtime-v1", clock.getString("kind"))
+      assertEquals(nonce, clock.getString("captureNonce"))
+      assertEquals(armed, clock.getLong("armedElapsedMs"))
+      assertEquals(admitted, clock.getLong("admittedElapsedMs"))
+      assertEquals(ack, clock.getLong("timeAckElapsedMs"))
+      assertTrue(clock.getLong("observedElapsedMs") >= ack)
+    }
+  }
+
+  @Test fun originalReleaseClockAndNonceSurviveLaterStatusAndRepeatedRelease() {
+    manager.sgc = nimo
+    NimoResourceDiagnostics.start(context)
+    setField("resourceSessionGeneration", 1L)
+    setField("resourcePairAddress", "00:11:22:33:44:55")
+    val nonce = java.util.UUID.randomUUID().toString()
+    val received = android.os.SystemClock.elapsedRealtime()
+    var first: JSONObject? = null
+    nimo.releaseResource(1L, { true }, { first = it }, nonce, received)
+    Shadows.shadowOf(Looper.getMainLooper()).idleFor(300, TimeUnit.MILLISECONDS)
+    val original = requireNotNull(first).getJSONObject("clock")
+    assertEquals(nonce, original.getString("releaseNonce"))
+    assertTrue(original.getLong("releaseStartedElapsedMs") >= received)
+    org.robolectric.shadows.ShadowSystemClock.advanceBy(10, TimeUnit.SECONDS)
+    val status = resourceCommand("status")
+    assertEquals("nimo-monotonic-receipt-v1", status.getString("clockProtocol"))
+    val statusClock = status.getJSONObject("clock")
+    assertTrue(statusClock.getLong("observedElapsedMs") >= statusClock.getLong("requestReceivedElapsedMs"))
+    var repeated: JSONObject? = null
+    nimo.releaseResource(1L, { true }, { repeated = it }, java.util.UUID.randomUUID().toString(), android.os.SystemClock.elapsedRealtime())
+    for (snapshot in listOf(status.getJSONObject("session"), requireNotNull(repeated))) {
+      val clock = snapshot.getJSONObject("clock")
+      assertEquals(nonce, clock.getString("releaseNonce"))
+      assertEquals(original.getLong("releaseStartedElapsedMs"), clock.getLong("releaseStartedElapsedMs"))
+    }
+  }
+
   @Test fun offMainDisconnectCompletesOnMainAndInterruptsActiveCapture() {
     runOffMain { nimo.disconnect() }
     assertDisconnectedOnMain()
@@ -303,12 +360,16 @@ class NimoLifecycleTest {
     assertEquals(0, snapshot.getJSONObject("timeAck").getInt("statusCode"))
     assertFalse(snapshot.getJSONObject("timeAck").isNull("writeStartedAtEpochMs"))
     assertEquals("READY", snapshot.getString("handshake"))
-    val causalTws = snapshot.getJSONObject("tws").getLong("handshakeAtEpochMs")
+    val causalTws = snapshot.getJSONObject("clock").getLong("handshakeTwsElapsedMs")
     Shadows.shadowOf(Looper.getMainLooper()).idleFor(100, TimeUnit.MILLISECONDS)
     Nimo::class.java.getDeclaredMethod("onTwsState", Boolean::class.javaPrimitiveType).apply { isAccessible = true }.invoke(nimo, true)
     val heartbeat = nimo.resourceSnapshot()
-    assertEquals(causalTws, heartbeat.getJSONObject("tws").getLong("handshakeAtEpochMs"))
-    assertTrue(heartbeat.getJSONObject("tws").getLong("atEpochMs") > heartbeat.getJSONObject("timeAck").getLong("atEpochMs"))
+    // Raw phone epochs are diagnostics; event order belongs to phone elapsed time.
+    assertFalse(heartbeat.getJSONObject("tws").isNull("atEpochMs"))
+    assertFalse(heartbeat.getJSONObject("timeAck").isNull("atEpochMs"))
+    val clock = heartbeat.getJSONObject("clock")
+    assertEquals(causalTws, clock.getLong("handshakeTwsElapsedMs"))
+    assertTrue(clock.getLong("twsElapsedMs") > clock.getLong("timeAckElapsedMs"))
     assertEquals("READY", heartbeat.getString("handshake"))
   }
 
@@ -393,9 +454,34 @@ class NimoLifecycleTest {
     File(context.filesDir, "nimo-lifecycle/$nonce.admission.tmp").mkdir()
     assertFalse(NimoResourceDiagnostics.admit(nimo, "Nimo-test", true))
     assertFalse(NimoResourceDiagnostics.allowManagerConnect("NIMO", "Nimo-test"))
+    assertFalse(NimoResourceDiagnostics.beginTransport(nimo, "00:11:22:33:44:55", true))
+    assertFalse(NimoResourceDiagnostics.admit(nimo, "Nimo-test", true))
+    assertFalse(File(context.filesDir, "nimo-lifecycle/$nonce.admission.json").exists())
+    val clock = nimo.resourceSnapshot().getJSONObject("clock")
+    assertTrue(clock.isNull("captureNonce")); assertTrue(clock.isNull("admittedElapsedMs"))
+    val capture = captureCommand("capture-status", nonce).getJSONObject("session").getJSONObject("capture")
+    assertTrue(capture.getBoolean("cancelled"))
+    assertTrue(capture.getJSONObject("clock").isNull("admittedElapsedMs"))
     assertEquals(0L, nimo.resourceSnapshot().getLong("sessionGeneration"))
   }
 
+  @Test fun preexistingAdmissionIsNeverOverwrittenOrStampedOntoLiveInstance() {
+    manager.sgc = null
+    NimoResourceDiagnostics.start(context)
+    val nonce = java.util.UUID.randomUUID().toString()
+    captureCommand("arm-capture", nonce, nonce)
+    manager.sgc = nimo
+    val original = File(context.filesDir, "nimo-lifecycle/$nonce.admission.json")
+    original.writeText("preexisting-immutable-evidence")
+    assertFalse(NimoResourceDiagnostics.admit(nimo, "Nimo-test", true))
+    assertEquals("preexisting-immutable-evidence", original.readText())
+    assertFalse(NimoResourceDiagnostics.allowManagerConnect("NIMO", "Nimo-test"))
+    assertFalse(NimoResourceDiagnostics.beginTransport(nimo, "00:11:22:33:44:55", true))
+    val clock = nimo.resourceSnapshot().getJSONObject("clock")
+    assertTrue(clock.isNull("captureNonce")); assertTrue(clock.isNull("admittedElapsedMs"))
+    assertTrue(captureCommand("capture-status", nonce).getJSONObject("session").getJSONObject("capture").getJSONObject("clock").isNull("admittedElapsedMs"))
+  }
+
   @Test fun capturedGenerationZeroCancellationDrainsOriginalAndFencesQueuedAdmission() {
     manager.sgc = null
     NimoResourceDiagnostics.start(context)

package/build/generated/releaseMetadata.js

@@ -1,10 +1,10 @@
 export const BLUETOOTH_SDK_RELEASE_METADATA = Object.freeze({
     "schemaVersion": 1,
     "familyBaseVersion": "3.4.0",
-    "releaseIdentity": "3.4.0-dev.965",
-    "releaseSetId": "mentra-3.4.0-dev.965",
-    "sourceCommit": "7909ffb46c61953874fffacdc737f8070be28f06",
-    "otaManifestUrl": "https://artifactscdn.mentraglass.com/Mentra-Community/MentraOS/releases/mentra-builds-v3.4.0/mentra-live-ota-3.4.0-dev.965.json",
-    "otaManifestSha256": "798e597eba66ca395abd7a77cffdb86e9f6ffa7702625361b52aba8ba434f594"
+    "releaseIdentity": "3.4.0-dev.971",
+    "releaseSetId": "mentra-3.4.0-dev.971",
+    "sourceCommit": "c72b7ecf63112a98579639fc4fdb126aedbf425d",
+    "otaManifestUrl": "https://artifactscdn.mentraglass.com/Mentra-Community/MentraOS/releases/mentra-builds-v3.4.0/mentra-live-ota-3.4.0-dev.971.json",
+    "otaManifestSha256": "5be88fa1406efdd5024b94ae18c9124f33ed1cd8e1661f5bcfbabc522a120037"
 });
 //# sourceMappingURL=releaseMetadata.js.map

package/build/generated/releaseMetadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"releaseMetadata.js","sourceRoot":"","sources":["../../src/generated/releaseMetadata.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,8BAA8B,GAA0C,MAAM,CAAC,MAAM,CAAC;IACjG,eAAe,EAAE,CAAC;IAClB,mBAAmB,EAAE,OAAO;IAC5B,iBAAiB,EAAE,eAAe;IAClC,cAAc,EAAE,sBAAsB;IACtC,cAAc,EAAE,0CAA0C;IAC1D,gBAAgB,EAAE,iIAAiI;IACnJ,mBAAmB,EAAE,kEAAkE;CACxF,CAAC,CAAA","sourcesContent":["/** Generated by release CI. Do not edit in a release checkout. */\nexport interface BluetoothSdkReleaseMetadata {\n  schemaVersion: 1\n  familyBaseVersion: string | null\n  releaseIdentity: string | null\n  releaseSetId: string | null\n  sourceCommit: string | null\n  otaManifestUrl: string | null\n  otaManifestSha256: string | null\n}\n\nexport const BLUETOOTH_SDK_RELEASE_METADATA: Readonly<BluetoothSdkReleaseMetadata> = Object.freeze({\n  \"schemaVersion\": 1,\n  \"familyBaseVersion\": \"3.4.0\",\n  \"releaseIdentity\": \"3.4.0-dev.965\",\n  \"releaseSetId\": \"mentra-3.4.0-dev.965\",\n  \"sourceCommit\": \"7909ffb46c61953874fffacdc737f8070be28f06\",\n  \"otaManifestUrl\": \"https://artifactscdn.mentraglass.com/Mentra-Community/MentraOS/releases/mentra-builds-v3.4.0/mentra-live-ota-3.4.0-dev.965.json\",\n  \"otaManifestSha256\": \"798e597eba66ca395abd7a77cffdb86e9f6ffa7702625361b52aba8ba434f594\"\n})\n"]}
+{"version":3,"file":"releaseMetadata.js","sourceRoot":"","sources":["../../src/generated/releaseMetadata.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,8BAA8B,GAA0C,MAAM,CAAC,MAAM,CAAC;IACjG,eAAe,EAAE,CAAC;IAClB,mBAAmB,EAAE,OAAO;IAC5B,iBAAiB,EAAE,eAAe;IAClC,cAAc,EAAE,sBAAsB;IACtC,cAAc,EAAE,0CAA0C;IAC1D,gBAAgB,EAAE,iIAAiI;IACnJ,mBAAmB,EAAE,kEAAkE;CACxF,CAAC,CAAA","sourcesContent":["/** Generated by release CI. Do not edit in a release checkout. */\nexport interface BluetoothSdkReleaseMetadata {\n  schemaVersion: 1\n  familyBaseVersion: string | null\n  releaseIdentity: string | null\n  releaseSetId: string | null\n  sourceCommit: string | null\n  otaManifestUrl: string | null\n  otaManifestSha256: string | null\n}\n\nexport const BLUETOOTH_SDK_RELEASE_METADATA: Readonly<BluetoothSdkReleaseMetadata> = Object.freeze({\n  \"schemaVersion\": 1,\n  \"familyBaseVersion\": \"3.4.0\",\n  \"releaseIdentity\": \"3.4.0-dev.971\",\n  \"releaseSetId\": \"mentra-3.4.0-dev.971\",\n  \"sourceCommit\": \"c72b7ecf63112a98579639fc4fdb126aedbf425d\",\n  \"otaManifestUrl\": \"https://artifactscdn.mentraglass.com/Mentra-Community/MentraOS/releases/mentra-builds-v3.4.0/mentra-live-ota-3.4.0-dev.971.json\",\n  \"otaManifestSha256\": \"5be88fa1406efdd5024b94ae18c9124f33ed1cd8e1661f5bcfbabc522a120037\"\n})\n"]}

package/ios/Source/BluetoothSdkDefaults.swift

@@ -16,7 +16,7 @@ enum BluetoothSdkDefaults {
     /// silently disable it on every pair the app touches.
     static let autoPowerOffEnabled = false
     private static let infoSdkVersionKey = "MentraBluetoothSdkVersion"
-    private static let swiftPackageSdkVersion = "3.4.0-dev.965"
+    private static let swiftPackageSdkVersion = "3.4.0-dev.971"
     private static let swiftPackageSdkVersionPlaceholder = "__MENTRA" + "_BLUETOOTH_SDK_VERSION__"
 
     private static func normalizedSdkVersion(_ value: String?) -> String? {

package/ios/Source/GeneratedReleaseMetadata.swift

@@ -3,9 +3,9 @@ import Foundation
 /// Generated by release CI. Do not edit in a release checkout.
 enum GeneratedReleaseMetadata {
     static let familyBaseVersion = "3.4.0"
-    static let releaseIdentity = "3.4.0-dev.965"
-    static let releaseSetId = "mentra-3.4.0-dev.965"
-    static let sourceCommit = "7909ffb46c61953874fffacdc737f8070be28f06"
-    static let otaManifestUrl = "https://artifactscdn.mentraglass.com/Mentra-Community/MentraOS/releases/mentra-builds-v3.4.0/mentra-live-ota-3.4.0-dev.965.json"
-    static let otaManifestSha256 = "798e597eba66ca395abd7a77cffdb86e9f6ffa7702625361b52aba8ba434f594"
+    static let releaseIdentity = "3.4.0-dev.971"
+    static let releaseSetId = "mentra-3.4.0-dev.971"
+    static let sourceCommit = "c72b7ecf63112a98579639fc4fdb126aedbf425d"
+    static let otaManifestUrl = "https://artifactscdn.mentraglass.com/Mentra-Community/MentraOS/releases/mentra-builds-v3.4.0/mentra-live-ota-3.4.0-dev.971.json"
+    static let otaManifestSha256 = "5be88fa1406efdd5024b94ae18c9124f33ed1cd8e1661f5bcfbabc522a120037"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mentra/bluetooth-sdk",
-  "version": "3.4.0-dev.965",
+  "version": "3.4.0-dev.971",
   "description": "SDK for communicating with smart glasses",
   "main": "build/index.js",
   "react-native": "src/index.ts",
@@ -114,7 +114,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@mentra/cloud-protocol": "3.4.0-dev.965"
+    "@mentra/cloud-protocol": "3.4.0-dev.971"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",

package/src/generated/releaseMetadata.ts

@@ -12,9 +12,9 @@ export interface BluetoothSdkReleaseMetadata {
 export const BLUETOOTH_SDK_RELEASE_METADATA: Readonly<BluetoothSdkReleaseMetadata> = Object.freeze({
   "schemaVersion": 1,
   "familyBaseVersion": "3.4.0",
-  "releaseIdentity": "3.4.0-dev.965",
-  "releaseSetId": "mentra-3.4.0-dev.965",
-  "sourceCommit": "7909ffb46c61953874fffacdc737f8070be28f06",
-  "otaManifestUrl": "https://artifactscdn.mentraglass.com/Mentra-Community/MentraOS/releases/mentra-builds-v3.4.0/mentra-live-ota-3.4.0-dev.965.json",
-  "otaManifestSha256": "798e597eba66ca395abd7a77cffdb86e9f6ffa7702625361b52aba8ba434f594"
+  "releaseIdentity": "3.4.0-dev.971",
+  "releaseSetId": "mentra-3.4.0-dev.971",
+  "sourceCommit": "c72b7ecf63112a98579639fc4fdb126aedbf425d",
+  "otaManifestUrl": "https://artifactscdn.mentraglass.com/Mentra-Community/MentraOS/releases/mentra-builds-v3.4.0/mentra-live-ota-3.4.0-dev.971.json",
+  "otaManifestSha256": "5be88fa1406efdd5024b94ae18c9124f33ed1cd8e1661f5bcfbabc522a120037"
 })