refactor(ui): extract shared screen chrome into rf_shell, refine workout flow - #77

…g level (#76)

* Adds tests for screens

* Adds tests

* Adds comprehensive tests

* Adds new tests

* Updates test.yml to run on release branches

* Adds test and resolved the warnings and issues

* Updates tests and minor bug fixes

* Adds fixes for failing testsm and adds connection timeout safety for health connector

* Adds missing lines patch

* Updates the tests with analyse failures

* Updates tests and routine creator to use the common component

* Updates flutter version and adds tests

* Adds major genui Feature and renderer

* chore: remove patch_so script

* build: add --build-id=none for jni package in F-Droid metadata

* ci: add jni build-id sed step for future reproducible releases

* feat: assisted pullups, deload-aware ML, handle-scoped PRs, sleeping HR tool

Batches several in-flight features that were sitting uncommitted:

- Bodyweight/assisted pullup volume: (BW - assist + extra) * reps
- MLService reads the past 3 sessions and recovers from a deload week
  using the pre-deload baseline instead of the deload trough
- PRManager scopes records per handle variation (Rope vs Bar)
- CoachToolService.get_sleeping_hr_analytics: p5/p25/mean, stdev,
  variance and linear trend over the last N nights
- GenUI parser tolerates numeric StatCard values, loose trend words and
  Markdown code fences

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add A2UiProps alias-aware coercing property reader

Foundation for the genui refactor: a never-throwing view over raw
component prop maps that resolves keys by exact match, normalized
match (case/underscore/hyphen/space-insensitive), then semantic
alias, and coerces values to typed accessors with documented
fallbacks instead of throwing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add A2UiSpec contract, A2UiNode and A2UiRegistry

Adds the four-in-one component contract (A2UiSpec) that lets each UI
component name itself, parse its own props, build its own widget and
document itself for the LLM prompt on one object, plus the
A2UiRegistry lookup table that replaces the old allowedA2UiComponents
set and two parallel switch statements. Includes an A2UiTheme skeleton
(filled in by Task 4) and A2UiNode, the parsed-tree node type.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(genui): make A2UiRegistry throw on name/alias collisions

Code review found that A2UiRegistry's constructor loop silently
resolved canonical-name/alias collisions (last-writer-wins for names,
first-writer-wins for aliases), which would produce unreachable specs
or dropped aliases with no signal as more components are registered in
later tasks. The constructor now throws a StateError identifying both
colliding specs for any of: two specs sharing a canonical name, an
alias colliding with another spec's canonical name, or two specs
sharing an alias. Adds three regression tests using a new configurable
_NamedFakeSpec fake.

Also documents (doc-comment only, no behavior change) that
A2UiNode.children is not defensively copied, per the review's Minor
finding.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add A2UiParser with fence, envelope and alias repair

Adds the single gate that decides whether an LLM reply is a UI payload
or ordinary prose, and turns UI payloads into an A2UiNode tree. Handles
markdown fences, prose-wrapped JSON, flat vs props-wrapped shapes,
bare-array/envelope auto-wrapping into GridContainer, and recursive
children, without ever throwing.

Also promotes A2UiProps._asStringKeyed to a public static
A2UiProps.stringKeyed so the parser can re-key decoded JSON maps
without an awkward part-of coupling between the two libraries.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(genui): balanced-bracket JSON extraction and envelope singleton fix

_extractJson previously sliced from the first { to the last }, which
broke on any stray brace in surrounding prose (e.g. "add reps
{optional}"). Replace with a scan that tries jsonDecode on every
balanced {..}/[..] span found via a depth counter that correctly skips
brackets inside string literals, preferring the longest successful
decode as the actual payload.

Also fix _wrap's unconditional single-child collapse: an explicit
envelope key ({"components":[...]}) is a deliberate container request
and must still produce a GridContainer with one child, while a bare
top-level array with one item keeps collapsing since it's ambiguous
between "a list of one" and "just one component."

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): inject A2UiTheme and extract shared panel chrome

Adds A2UiThemeProvider (InheritedWidget, falls back to A2UiTheme.dark)
and the panel/title/empty-state/legend widgets every component spec
will share, plus lib/theme/a2ui_app_theme.dart mapping RepForge's real
design tokens onto A2UiTheme. This is the only file where the two
systems meet - lib/genui/ still imports nothing app-specific.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* test(genui): strengthen theme-injection and add A2UiPanel coverage

The injection test compared against repforgeA2UiTheme, which is
field-for-field identical to the A2UiThemeProvider.of fallback
(A2UiTheme.dark), so it passed even if the InheritedWidget lookup were
broken. Inject a fixture with distinct values instead, and assert a
sibling context still falls back to the default. Also add direct
coverage for A2UiPanel's padding, decoration, and child rendering,
previously only exercised indirectly via A2UiEmptyPanel.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add A2UiSeries as the shared categorical data shape

A2UiSeries.extract() and maxValue() give line/bar/pie and radar chart
components one common {name, values} shape to consume, so a model that
learns {labels, series} once can drive all four components.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(genui): cover fallback path in A2UiSeries.extract, fix negative-max bug

Address code review findings on A2UiSeries:
- Add tests pinning down the series->values fallback when every series
  entry drops to empty/unparseable values, and when series is an empty
  list — the risky path the brief called out but left untested.
- Rename the misleading 'reads the axes alias' test; it only exercised
  stringified-number coercion inside series values, not alias resolution.
- Fix maxValue() to track whether any value has been seen instead of
  seeding with 0.0, so all-negative series report their true max
  instead of silently clamping to 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add StatCardSpec with typed props and trend synonyms

Establishes the pattern for Tasks 7-13: a typed props record, an
A2UiSpec bundling name/aliases/doc/parseProps/buildWidget, and
never-throwing parsing that degrades to documented fallbacks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add MetricGaugeSpec with safe progress and null value

Fixes the validator/renderer contradiction where a String value was
accepted but cast to num, and the min == max NaN sweep angle bug.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add DynamicChartSpec for line, bar and pie

Adds the most-used and most complex A2UI component so far, covering
line/bar/pie rendering over the shared {labels, series} shape with
never-throwing prop parsing and label padding to prevent out-of-range
axis lookups.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add ScatterPlotSpec with point repair and safe bounds

Adds paired x/y observation plotting with an optional correlation badge,
following the Task 6-8 A2UiSpec pattern. Malformed points are dropped
rather than throwing, and bounds widen degenerate axes so fl_chart never
sees a zero-span range.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add RadarChartSpec sharing the labels/series shape

Task 10 of the a2ui/genui refactor: RadarChart consumes the same
{labels, series} shape as DynamicChart, with `axes` kept as a
backward-compatible alias for `labels`. Every series is truncated
or zero-padded to labels.length at parse time so fl_chart's radar
never sees a mismatched entry count.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add DataListGroupSpec with row repair and optional title

Adds a titled list-of-rows component with a defensive row-extraction
fallback chain: named fields, bare scalars, first-stringifiable-value
fallback, and silent drop of rows with nothing displayable.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add FilterChipsSpec with nullable active option

Renders a decorative, non-interactive row of scope chips (e.g. "7d /
30d / 90d") and fixes the old renderer's `activeOption as String`
crash by matching case-insensitively and falling back to null instead
of throwing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): add GridContainerSpec, default registry and renderer

Task 13: assembles all eight leaf components into defaultA2UiRegistry,
adds the GridContainerSpec layout wrapper, the public A2UiRenderer
widget, and the lib/genui/a2ui.dart barrel file that will be the only
import path the rest of the app uses going forward.

fix(genui): make structural children lookup exact, not alias-resolved

Cross-task fix to a2ui_parser.dart (a Task 3 file), discovered during
Task 13 registry integration. A2UiParser._parseChildren and
_declaresChildren resolved the structural `children` key through
A2UiProps' alias-aware lookup(), which treats `items` as an alias for
`children`. That collided with DataListGroupSpec, whose own canonical
data-row key is also `items`: a DataListGroup node's `items` list of
{primaryText, ...} maps was mistaken for child components, none of
them parsed as one, and the whole node was then discarded as an
emptied-out container. Reading the literal `children` key only fixes
this and matches the precision _envelopeKeys already had (it does not
include `items` as a synonym for `children` either).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(genui): generate the A2UI prompt section from the registry

Replaces hand-written component-schema prose in the coach system
prompt with a section generated from defaultA2UiRegistry, so the
vocabulary advertised to the model can never drift from what the
parser/renderer actually support.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* refactor(genui): wire coach screen to the A2UI package, drop legacy renderer

Replaces private _CoachMessageContent with a public, stateful
CoachMessageContent that memoizes parsing per text value and shows a
"Building dashboard..." placeholder for partial JSON while streaming,
instead of letting raw braces scroll past or losing prose on a mixed
reply. Wraps the app root in A2UiThemeProvider(theme: repforgeA2UiTheme)
so the renderer picks up RepForge's design tokens. Deletes the
superseded lib/genui/a2ui_component.dart and lib/genui/a2ui_renderer.dart,
and drops test/new_features_test.dart's GenUI Component Resilience Tests
group, whose two cases are already covered more thoroughly by
test/genui/a2ui_parser_test.dart.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(genui): bracket negative-value ranges in DynamicChart line/bar axes

minY was hardcoded to 0 while maxY derived from the true series max, so an
all-negative dataset (e.g. [-10, -5, -3]) produced a visible axis range of
[0, 1] with every real data point falling outside it — a silent blank
chart despite valid, non-empty data. Adds A2UiSeries.minValue mirroring
the existing maxValue, and a shared _yBounds helper used by both _line and
_bar so the two renderers can't diverge on axis math. Also covers
multi-series label padding, which was previously only exercised through
series[0].

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* test(genui): cover all-negative bounds and malformed point entries

Task 9 review flagged that ScatterPlotProps.bounds had no regression pin
for all-negative-coordinate spreads (same failure class as Task 8's
DynamicChartSpec axis bug) and that point-parsing had no test for
structurally invalid entries (nested objects, raw lists). Adds both.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(genui): widen per-node children lookup back to components/elements/content

Follow-up to the Task 13 a2ui_parser.dart fix: restricting the per-node
_parseChildren/_declaresChildren lookup to the literal 'children' key
was narrower than intended. It regressed 'components'/'elements'/
'content' as per-node child-list keys, which never collided with
anything (only 'items' did, via DataListGroup's own canonical data key).
A payload like {"component":"GridContainer","props":{"columns":1,
"components":[...]}} resolved fine before the original bug and silently
rendered blank (zero children, no null fallback) after the first fix,
since _declaresChildren no longer recognized 'components' as a
children-declaring key either.

Adds a _childKeys constant (children/components/elements/content,
still excluding items) mirroring _envelopeKeys' existing tolerance, and
routes both _parseChildren and _declaresChildren through a shared
_firstChildList literal (non-alias) lookup over that key set.

Adds regression tests in a2ui_renderer_test.dart: per-node
components/elements/content resolve to real children, and items stays
excluded at the per-node level.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(genui): widen looksLikeUi to catch prose-prefixed fences, fix vacuous memoization test

looksLikeUi only checked whether the text, after stripping a *leading*
fence, started with `{`/`[`. A model that writes a sentence before
opening a fenced payload (e.g. "Here is your data:\n```json\n{...")
fell through undetected, so CoachMessageContent showed the raw partial
JSON instead of the streaming placeholder -- the exact symptom this
task exists to fix. Now also treats an unclosed ``` fence found
anywhere in the streamed-so-far text as a UI signal, while plain prose
with no JSON or fence anywhere still returns false.

Also fixes the memoization regression test in
test/screens/ai_coach_genui_test.dart: the second observation was
taken after a bare `tester.pump()`, which doesn't mark the element
dirty and never actually calls build() again, so the test could not
distinguish memoized parsing from a widget that never rebuilds at all.
It now pumps a second CoachMessageContent instance with identical text
at the same tree location, which reuses the existing State and
genuinely triggers didUpdateWidget/build.

Adds regression tests for both the prose-prefixed-fence case and the
plain-prose-no-json case in test/genui/a2ui_parser_test.dart, plus a
widget-level test in test/screens/ai_coach_genui_test.dart confirming
the placeholder (not raw JSON) renders end-to-end.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* refactor(genui): drop presentation payload from tools, add purity and fuzz suites

The sleeping-HR analytics tool was hand-constructing an A2UI DynamicChart
payload directly, leaking presentation decisions into the data layer.
Replace `genui_chart_props` with neutral `labels`/`series` keys so the
prompt — not the tool — decides how to present the data.

Add two permanent guard suites: a2ui_purity_test.dart proves lib/genui/
never imports app-specific code (theme/models/services/screens) and its
component renderers never cast raw model data; a2ui_robustness_test.dart
fuzzes the parser and renderer against ~26 hostile/malformed LLM payloads
to confirm nothing throws.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(genui): depth-agnostic purity regex, pin two silent-visual regressions

Review of the previous commit found the purity test's forbidden-import
check was depth-blind: its literal needle list only covered one and two
../ hops, but components live three levels below lib/, so a real
../../../theme/... import passed undetected. Replace it with a regex
that matches any number of ../ hops (or a package:repforge/ prefix),
covering import and export directives alike, and add a self-test that
proves the regex catches every relevant depth/form without touching real
source files.

Also widen the no-raw-casts check to include bool/Object/dynamic, make
the components-directory scan recursive, and pin down the two historical
silent-visual regressions (Task 8's chart axis-bounds clamp, Task 13's
GridContainer child-key aliasing) with positive assertions in the fuzz
suite, since neither throws and the existing no-throw checks structurally
can't catch either.

Reword analyze_health_workout_correlation's tool declaration to drop
direct component names, closing the same presentation-leak class this
task already fixed for the sleeping-HR tool.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(genui): propagate registry through recursion, pin prompt drift, close review findings

Final whole-branch review fix wave for the A2UI genui refactor:

- A2UiRenderer's registry override used to be silently dropped past one
  level of nesting because GridContainerSpec recurses via bare
  A2UiRenderer(node: ...) calls. Mirror the existing theme-injection
  pattern with a new A2UiRegistryProvider InheritedWidget so an explicit
  registry override at any level propagates ambiently to everything below
  it (explicit param > inherited provider > defaultA2UiRegistry fallback).
- Pin the hand-written "WHICH COMPONENT TO REACH FOR" prose in
  gemini_context_builder.dart against silent drift: every component name
  it mentions must resolve in defaultA2UiRegistry, and the registry's
  spec count is asserted directly.
- Delete A2UiProps.object()/has() — confirmed zero call sites.
- Repurpose the orphaned Task 3 scaffolding test
  (a2ui_parser_stub_test.dart, redundant with a2ui_parser_test.dart) into
  a2ui_custom_registry_test.dart, the regression coverage the registry-
  propagation fix needed.
- Add scanned-file-count floors to the purity test's two directory scans
  so an empty/unreachable directory can't produce a vacuous pass.
- Document FilterChips' SizedBox.shrink() as a deliberate exception to
  the plan's "always A2UiEmptyPanel" rule (decorative chrome, not data).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs: add design spec for Hive->SQLite migration + coach SQL query tool

* fix: persist assisted-load volume correctly, tighten exercise-handle scoping

- WorkoutSet now snapshots bodyweight/assist/extra at logging time instead
  of recomputing effective load from the CURRENT profile bodyweight on every
  read, which was silently corrupting historical volume whenever a user
  updated their weight. ExerciseLog.totalVolume and the workout_flow_screen
  logging path thread the snapshot through.
- Exercise-handle matching (workout_provider) now requires an exact handle
  match whenever a handle is set, falling back to legacy behavior only when
  no exact match exists — a null-handle log was previously matching ANY
  requested handle, surfacing the wrong variation's "last session" data.
- Handle selector no longer visually pre-selects an unpersisted handle, and
  setExerciseHandle no longer retroactively relabels already-logged sets.
- Assisted-load display values now respect the user's unit preference; the
  assisted-exercise classification is computed once and shared instead of
  drifting between two separate predicates.
- Body-weight input (settings_provider) now rejects non-finite/non-positive
  values on both the load and set paths, falling back to 70.0 when invalid.
- ml_service: deload-recovery reasoning no longer hardcodes "kg" regardless
  of unit settings; recovery detection now requires the comparison session
  to be recent and uses effective (not raw) load for assisted exercises.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: bound sleep-analytics window, drop fabricated data, resolve muscle groups by id

- get_sleeping_hr_analytics clamps the model-provided days window instead of
  looping unbounded; get_health_metrics now honors the requested days window
  instead of always querying one week, and both its and the correlation
  tool's declarations no longer advertise fields (resting HR, readiness)
  that aren't actually backed by implementation.
- analyze_health_workout_correlation no longer fabricates synthetic sleep
  data points to pad out insufficient real pairs — returns the existing
  insufficient-data error instead, so correlation/regression/chart output is
  never partly made up.
- get_muscle_group_volume now resolves requested names to ids via
  _resolveMuscleGroup and compares ids (also aggregating secondary muscle
  activations) instead of raw display-name substring matching.
- CoachToolService's optional HealthHistoryManager is now a named parameter.
- gemini_ai_service: daily-quota classification narrowed to actual
  daily-limit identifiers so minute-scale rate limits go through normal
  retry-delay handling instead of being misclassified as daily exhaustion;
  function-call ids are now preserved and matched into their responses;
  the fallback path now builds a thinkingConfig compatible with whichever
  model was actually selected. Mirrored in scripts/test_gemini_api.py.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(genui): pie negative-value filtering, overflow guard, stat-card unit match

- DynamicChart's pie mode now filters to positive values before computing
  percentages/sections (preserving original index alignment with labels and
  series colors), falling back to an empty panel when nothing positive
  remains, instead of rendering a nonsense chart from negative/zero data.
- A2UiPanelTitle's trailing label is now Flexible with maxLines/ellipsis so
  a long model-provided string can't overflow the row.
- StatCard's unit-already-present check now requires a trailing-suffix
  match instead of any substring, fixing a false positive like unit "s"
  matching inside value "10 reps".
- MetricGauge's arc painter now also compares `track` in shouldRepaint, so
  a background-color-only change still triggers a repaint.
- A2UiTheme.seriesColor asserts a non-empty palette before the modulo index
  that would otherwise throw on one.
- A2UiParser: props/outer-children now merge (props wins on conflict) so a
  model writing children as a sibling of props isn't silently dropped; adds
  a whole-text jsonDecode fast path ahead of the balanced-span scan.
- A2UiRenderer logs the unresolved component name via the app's existing
  debugPrint/kDebugMode convention before falling back to an empty widget.
- a2ui_app_theme now imports A2UiTheme via the public genui barrel instead
  of an internal src path.
- CI: the release workflow's linker-patch step now requires and quotes
  PUB_CACHE, restricts the patch to resolved jni-*/src/CMakeLists.txt
  targets, is idempotent against re-runs, and fails the build instead of
  silently continuing when no target is found or patching fails.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* test: close vacuous-test gaps and pin already-fixed regressions

Fixes tests that would pass identically whether the behavior they claim to
verify was correct or broken:
- stat_card_test's pump() helper now actually threads its props argument
  into the rendered node (it previously always rendered empty props).
- new_features_test's assisted-pullups case now uses distinguishable
  weight/assistWeight values, so the test fails if the wrong field is used.

Tightens two guardrail-class tests to actually detect what they claim to:
- a2ui_prompt_test's worked-example extraction is now bounded to the region
  after the "WORKED EXAMPLE:" marker via balanced-brace matching, instead of
  the last '}' anywhere in the whole prompt.
- a2ui_purity_test's forbidden-import regex now also guards lib/data/.
- a2ui_robustness_test's negative-axis assertion now requires minY to
  actually bracket the dataset's true minimum, not just be below -10.
- a2ui_theme_test's panel-decoration finders are scoped to the panel under
  test rather than the first Container anywhere in the tree.

Adds regression coverage pinning fixes already shipped in prior commits:
DynamicChart pie's negative-value filtering, StatCard's unit-suffix match,
and CoachToolService's days-window/insufficient-data/muscle-id fixes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs: add implementation plan for Hive->SQLite migration + coach SQL tool

* chore: add sqflite dependencies for SQLite storage migration

* feat: add SqliteStorageService with schema and workout session CRUD

* fix: persist bodyWeightAtLog in SqliteStorageService sets table

* feat: implement routine and target CRUD in SqliteStorageService

* feat: implement muscle group and custom exercise CRUD in SqliteStorageService

* feat: implement settings, PR, training program, and conversation CRUD in SqliteStorageService

* feat: implement export/import in SqliteStorageService, completing IStorageService

* feat: add settings enumeration helper to StorageService for migration

* feat: add StorageMigrationService for one-time Hive-to-SQLite migration

* feat: resolve Hive-vs-SQLite storage backend in main() before runApp

* feat: add SqlQueryService for read-only SQL execution

* feat: wire run_sql_query tool into CoachToolService

* fix: fall back to fresh StorageService when app is constructed without going through main()

* fix: block run_sql_query from reading settings/sqlite_master (credential exposure)

SELECT * FROM settings or sqlite_master passed all existing run_sql_query
validation and would leak the migrated Gemini API key into model context
and persisted chat history. Add a second denylist of restricted table/
schema identifiers, checked the same way as the existing forbidden-keyword
list, plus a substring guard against SQLite's pragma_* table-valued
functions.

* fix: prevent trailing SQL comment from breaking LIMIT wrapper

A model-submitted query ending in a `--` line comment swallowed the
wrapper's closing paren when concatenated onto one line, producing an
avoidable syntax error. Put the closing `) LIMIT ?` on its own line.

Also finishes staging test/sql_query_service_test.dart, which now covers
both this fix (trailing-comment query succeeds) and the settings/
sqlite_master restricted-table rejections from the previous commit.

* docs: warn model against SELECT * across joins in run_sql_query

sqflite's row maps are keyed by column name, so a natural join query like
"SELECT * FROM sessions s JOIN exercise_logs l ON ..." silently drops
duplicate columns (e.g. id, notes) from one side with no error. Steer the
model's generated SQL toward explicit aliased columns instead.

* refactor: extract testable storage backend resolution logic; guard sqliteStorage.init()

- lib/main.dart: sqliteStorage.init() was outside the try/catch on the
  path every existing user hits on first launch after this update —
  disk-space/sandbox/SQLite-build failures propagated out of main()
  before runApp(), so the app never booted even though the working Hive
  storage right above it was fine. Now guarded with its own fallback to
  Hive. Also documents why Hive.initFlutter() stays unconditional post-
  cutover: ApiService reads/writes an installation id directly against
  this settings box, independent of IStorageService.
- lib/services/storage_backend_resolver.dart (new): extracts the
  Hive-vs-SQLite decision (migrate-or-fallback, flag write) out of
  main.dart's untestable _resolveStorageBackend into a pure, directly
  testable top-level function.
- test/storage_backend_resolver_test.dart (new): covers the two
  real-world paths every user takes — already-migrated relaunch, and
  fresh-install migration success. The forced-migration-failure case is
  intentionally omitted; there's no way to make
  StorageMigrationService.migrate() throw with SqliteStorageService's
  current public API without adding production surface purely for
  testability, and that path is exercised indirectly by
  storage_migration_service_test.dart.

* docs: add design spec for syncing sleep/HR data into SQLite for coach SQL joins

Lets run_sql_query join workout data against sleep/HR history instead of
requiring separate live Health Connect tool calls per question.

* docs: add implementation plan for syncing sleep/HR data into SQLite

Five-task TDD plan: schema + upsert methods, HealthDataSyncService,
launch-time wiring, manual sync button, and the coach's schema description.

* feat: add health_samples/sleep_sessions tables + upsert methods to SqliteStorageService

- Add schema v2 with three new tables: health_samples, sleep_sessions, sleep_stage_intervals
- Add upsertHealthSamples() and upsertSleepSessions() methods for health data sync
- Add onUpgrade callback for v1->v2 schema migration
- Use temporary files for in-memory test databases to support read-only connections
- All tests passing (35/35)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: prevent run_sql_query from closing the app's shared database connection

openReadOnlyDatabase(path) with the default singleInstance:true returns the
app's existing shared connection when called against the same path as
SqliteStorageService's live database, so the coach's per-query
finally { db.close() } was tearing down the app's only connection after
the first query. Pass singleInstance:false to force a genuinely separate
connection.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: address Task 1 review findings

- Remove _isTestDatabase path-substring flag; production init() no longer
  branches on test-fixture path content
- Remove the unconditional health-schema fallback loop that made onUpgrade
  untested/redundant; onCreate and onUpgrade are now the only paths that
  create the health tables
- Revert IF NOT EXISTS back to plain CREATE TABLE/CREATE INDEX, matching
  the existing schema statement convention
- Use a const list spread (..._healthSchemaStatements) instead of a
  duplicated inline copy in _schemaStatements
- :memory: overrides still resolve to temp files (needed for read-only
  secondary connections in tests), but now via an explicit Finalizer-based
  cleanup keyed on the constructor's _databasePathOverride parameter
  rather than sniffing the resulting path string

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: replace Finalizer with deterministic tearDown cleanup

- Remove Finalizer mechanism and unused imports (dart:async)
- Remove _tempDatabasePath and _generatedTempPath fields
- Simplify init() to convert :memory: to temp files without tracking
- Add deterministic tearDown() in test to close database and delete temp files
- Verified: no temp file leaks, all 35 tests passing

Closes: finding #5 from previous review

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat: add HealthDataSyncService to pull sleep/HR data into SQLite

* feat: sync health data into SQLite once per app launch

Wires HealthDataSyncService into the composition root, guarded to
only exist post-SQLite-cutover (mirrors the CoachToolService sqlQuery
guard). Fired fire-and-forget from AppInitializer._initializeApp()
alongside readiness.refresh() so it never blocks app startup.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat: add manual 'Sync coach data now' action to Profile screen

Lets the user force a Health Connect -> coach SQLite sync on demand
from the Health Connect section, instead of waiting for the next
app launch.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat: teach run_sql_query about the new health_samples/sleep_sessions tables

Extends the schema description in CoachToolService's run_sql_query
declaration with health_samples, sleep_sessions, and
sleep_stage_intervals so the coach LLM knows these tables exist and
can join against them. Adds a test asserting the description text
mentions the new tables (nothing else would catch a typo/omission
there), plus a regression test for the join shape the coach will run.

* fix: remove overly broad auto-close from init, add explicit close to upgrade test

- Remove auto-close block from init() that was closing database for any
  explicit file path, breaking coach_tool_service_test and other callers
- Add explicit await upgraded.close() in upgrade test before file deletion
- Regression: coach_tool_service_test now passes again
- All related tests verified: sqlite_storage_service (35), coach_tool_service (11),
  health_data_sync_service (6), sql_query_service (10)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: address final review findings for health sync + coach SQL tool

- Skip syncing a health stream entirely when its HealthReadType isn't
  granted, and leave its watermark untouched — prevents watermarks
  from silently advancing to `now` on first launch before the user
  has opted into Health Connect, which was breaking the 90-day
  backfill for essentially every user.
- Store health_samples/sleep_sessions timestamps as local time
  (.toLocal() before .toIso8601String()) to match the local-naive
  convention used by `sessions.date`, fixing day-bucketing joins for
  non-UTC users.
- Wrap the already-migrated SQLite init() branch in main.dart with a
  Hive fallback, mirroring the fresh-migration branch, so a partial
  upgrade failure can't crash app startup.
- Add IF NOT EXISTS to the health-schema DDL so a retried onUpgrade
  after a partial failure doesn't blow up on already-created tables.
- Add missing tearDown to health_data_sync_service_test.dart to stop
  leaking temp db files, guard a profile_screen snackbar with mounted
  for consistency, and reset _initialized on close() so a
  close()+init() cycle actually reopens the connection.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: address migration/SQL-tool review findings from PR #66

Fixes CodeRabbit findings scoped to the hive->sqflite migration and
coach SQL tool work on this branch (genui and docs findings deferred
to their own branches):

- gemini_ai_service: rebuild generationConfig.thinkingConfig after a
  daily-quota model fallback, so the retried request matches whichever
  model it's about to hit instead of the previous model's shape
- health_data_sync_service: named constructor/_syncSamples params;
  guard grantedReadTypes() so a Health Connect failure doesn't abort
  the whole sync instead of degrading per-stream
- ml_service: recommendSets now falls back to the first non-empty
  pastSessions entry when lastSession is empty, instead of returning
  no recommendations
- sqlite_storage_service: guard close() against a never-initialized
  db; filter getCustomExercises() by is_custom; order exercise_logs/
  sets by rowid instead of the synthetic text id, which sorted "_10"
  before "_2" and silently misordered sets/exercises past 9 per group
- workout_provider: removeLastSet preserves the exercise log's handle;
  handle-fallback lookups only match legacy handle-less logs instead
  of any handle
- test_gemini_api.py: clamp the parsed retry delay to match the Dart
  implementation's bounds
- add coverage: 11+ set/exercise ordering, migration-failure fallback
  path, training-program/growth-rate migration, and the id/type-only
  storage-service call sites

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: address second round of CodeRabbit findings on PR #66

Fixes real findings from the fresh review CodeRabbit ran after the
r2.1.0 merge. Three heavy-lift data-integrity/product-decision items
are tracked separately instead of guessed at here: #67 (assisted-BW
volume encoding mismatch across the upgrade boundary), #68 (assisted
exercise IDs assume the wrong load direction for push-ups/weighted
variants), #69 (PersonalRecord.exerciseId stores a composite handle
key, needs a schema change on both storage backends).

- main.dart: catch errors from the fire-and-forget health data sync
  instead of leaving them unhandled
- models.dart: const Exercise/ExerciseLog constructors; moved
  isAssistedBodyweightExercise out of a widget file into the domain
  model, since workout_flow_screen.dart's persistence logic depended
  on it
- profile_sections.dart: disable "Sync coach data now" while a sync
  is already in flight
- pr_manager.dart: compare effectiveWeight, not raw weight, for PR
  detection — an assisted set with more assistance (an easier set)
  was registering as a new weight PR
- coach_tool_service.dart: clamp days in the health/muscle-group
  tools; use month sleep-bar granularity for correlation windows
  over 7 days (the default 60-day window was returning "insufficient
  data" almost every time since week granularity only covers 7 days)
- gemini_ai_service.dart: match thinkingConfig by model family, not
  the single 'gemini-2.5-flash' id, so a persisted legacy model id
  still gets a working config; named the extended-retry constant
- sql_query_service.dart: block sqlite_temp_schema/sqlite_dbpage/
  sqlite_stat1-4 in the coach's SQL tool denylist
- health_data_sync_service.dart: collapse three parallel per-stream
  maps into one table; add an in-flight guard so the launch-time
  sync and manual "sync now" can't race
- ml_service.dart: inject the clock for the deload-recency check,
  named the deload thresholds
- sqlite_storage_service.dart: drop a duplicate index; var -> final
- storage_service.dart: exportAllData reuses
  getAllSettingsForMigration instead of duplicating the loop
- workout_provider.dart: getRecentSessionsForExercise returns []
  for limit <= 0; when no handle is requested at all, both lookup
  methods now return sessions across every handle instead of only
  legacy handle-less ones
- test_gemini_api.py: guard an empty candidates list
- test hygiene: close the SQLite connection before deleting its file
  in coach_tool_service_test.dart; storage_backend_resolver_test.dart
  now resets the shared Hive flag and closes sqliteStorage after
  every test instead of depending on test declaration order

Verified: flutter analyze clean, 947/947 tests pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat: make coach tool-call round limit configurable, surface invoked tools in chat

The coach's tool-resolution loop was hard-capped at 5 rounds, silently
truncating complex multi-step requests. It's now user-adjustable (3-25)
via a slider in Profile -> AI Features, persisted through SettingsProvider
and wired into GeminiAiService at startup.

Also show which tools the coach called while producing a reply, both live
while streaming and on saved messages, so tool usage isn't a black box.

* feat: overhaul workout recommendation engine with recovery, readiness, and fatigue awareness

Wires recovery/deload signals that were already computed but never reached
the live recommendation call (dead code fixed), splits MLService into SOLID
collaborators (GrowthCurveFitter, RecoveryCalculator, an ordered
ProgressionRule chain), and adds three previously-missing inputs: estimated
per-set effort (no manual RPE entry), whole-day readiness modulation, and
same-session fatigue awareness.

The fatigue signal was originally attributed per muscle group via each
exercise's hand-authored muscleActivations table, but investigating a real
report of order-dependent fatigue (rows/pulldowns/pull-ups) found that table
inconsistent and untrustworthy (e.g. two near-identical pulling exercises
tagged with different, non-aliased "primary" muscle ids). A backtest against
74 real logged sessions found no statistically significant same-session
order effect at any granularity finer than a single exercise-agnostic
scalar, so the accumulator now drops the muscle-activation dependency
entirely and uses one scalar, calibrated to verifiably match every real
historical case (0.0 change) until genuine order-variation data exists to
fit it against.

Full design rationale, real-data backtests, and task-by-task history in
docs/superpowers/plans/2026-08-18-recommendation-engine-upgrade.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* test: drop coverage for ApiService/SettingsScreen removed by main merge

Same cleanup as r2.1.0: the merge from main deletes ApiService and the
orphaned settings_screen.dart, so the tests that exclusively targeted
them no longer have anything to test. test_harness.dart drops its
ApiService provider registration, which nothing consumes anymore.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat: add per-model Gemini thinking level control

Adds a configurable thinking level for the Gemini coach, persisted alongside
the other AI settings and applied to the live service.

- gemini_ai_service: kThinkingLevels, supportedThinkingLevels(model) and
  clampThinkingLevel(model, level) so an unsupported level (e.g. "minimal" on
  gemini-3.7-flash, or any level on 2.x) degrades instead of erroring;
  updateThinkingLevel() applies the change without a restart.
- settings_provider: geminiThinkingLevel is loaded, clamped on read, and
  re-clamped whenever the model changes.
- profile_sections: the model picker becomes a dropdown, and a thinking-level
  slider appears only for models that support one.
- main.dart passes the persisted level into GeminiAiService at construction.
- pubspec: 2.1.0+34 for the r2.1.0 release line.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* test: cover the Gemini model picker's ids, default and fallback chain

Pins that the picker offers Gemini 3.7 Flash, that its ids are unique and
include kDefaultGeminiModel, and that getFallbackModel never points at an id
the picker doesn't offer — the quota fallback chain silently swaps _model at
runtime, so a dangling entry there would only surface as a live API error.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: address CodeRabbit review findings on PR #66

Inline threads:
- coach_tool_service: _analyzeHealthWorkoutCorrelation fetched a single
  calendar month of sleep bars, so with the default 60-day window every
  workout day before the 1st of this month got no x value and was dropped.
  Walk each month the window touches and merge the daily bars.
- ml_service: the deload recency check used Duration.inDays, which truncates,
  so a deload 21d23h old still read as 21 and stayed inside the window.
  Compare the full duration instead; boundary pinned both sides in tests.
- settings_provider: init only fell back to the default when parsing failed,
  so a stored "0" or "26" bypassed the bounds setGeminiMaxToolRounds
  enforces. Clamp on read as well as on write.
- profile_sections: _commitMaxToolRounds swallowed neither a storage failure
  nor disposal — onChangeEnd discards the Future and the await lets the
  widget go away before setState. try/catch + finally + mounted.
- ai_coach_screen: two static TextStyles are now const.
- sql_query_service_test: SQLITE_STAT1..4 were on the denylist but untested;
  added parameterized coverage so a typo can't reopen metadata access.

Review comments outside the diff:
- sqlite_storage_service: health rows were keyed by a local-time string with
  no offset, so a DST fall-back mapped two distinct instants onto one key and
  the upserts discarded one. Identity moves to the UTC instant (health_samples
  .utc_ts, sleep_sessions.id) while timestamp/start_ts/end_ts stay local
  wall-clock, matching workout_sessions.date so the coach's date joins don't
  skew. Schema v3 rebuilds the (cache-only) health tables and clears the sync
  watermarks so the next run re-pulls.
- scripts/test_gemini_api.py: thinking_config_for now matches the gemini-2
  family like the Dart it mirrors; urlopen has a finite timeout with backoff;
  the tool schema carries the optional days arg; and the script no longer
  exits 0 on a non-key 400, a missing tool call, or unparseable GenUI output.

Not changed: the PR-manager backfill finding assumes persisted records hold
raw assistance loads, but assistWeight/effectiveWeight have never shipped
(absent on main; introduced on this unreleased line), so no such record can
exist.

flutter analyze clean; 957 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: address CodeRabbit review findings on PR #76

Correctness / stability:
- workout_summary_screen: recordSessionEffort was fire-and-forget, so a
  failed write surfaced as an unhandled async error and left the chip
  showing a value that was never persisted. Awaited, with the previous
  selection restored on failure.
- workout_summary_screen: the effort chips were a GestureDetector around a
  bare Container — no focus, no role, no announced selected state, and they
  are the only way to answer the prompt. Now Semantics + InkWell.
- progression_rules: DoubleProgressionRule embedded "kg" in its reasoning,
  so a user on pounds read "add 5.0kg" beside a weight shown in pounds.
  Dropped the raw value, matching what PostDeloadRecoveryRule documents.

Performance — getRecommendations runs from WorkoutFlowScreen's build, so it
ran per frame while rebuilding the exercise map and re-walking all sessions:
- RecoveryCalculator splits into lastTrainedPerMuscle (history-only, the
  expensive sort-and-scan) and recoveryScoresFrom (the clock-dependent
  decay, O(muscle groups)). computeMuscleRecoveryScores still composes both.
- WorkoutProvider and AnalyticsManager each cache the first half.
  recoveryRecommendationInputs takes an optional lastTrained so both call
  sites keep routing through the one helper.
- The provider's cache is keyed on an explicit revision counter, not list
  identity: _sessions is mutated in place (insert on finish, sort on edit),
  so identity would have gone stale silently.
- Corrected AnalyticsManager.getRecommendations' stale "O(1)" doc.

Cleanup:
- growth_curve_fitter: removed sessionsPerWeek, which nothing read and no
  caller passed — the projection is purely day-based.
- const constructors on the seven progression rules and their registry.

Tests — three were vacuous and are now able to fail:
- session_fatigue: the exclusion test compared 0.0 to 0.0 (one set per
  exercise never reaches _softCap). Loaded past the cap, where excluding an
  exercise moves the factor 0.5 -> 1.0.
- effort_estimator: the clamp test never reached the clamp, since z is
  already bounded to ±2. Driven past both bounds via calibrationOffset.
- workout_provider: the reload test called init() twice on one instance, so
  it could not tell persisted from retained state. Uses a fresh provider
  over the same storage.
- workout_provider: assert the exact held weight and reasoning so the test
  names which rule fired.
- effort_calibration: renamed a test whose body didn't match its name.

flutter analyze clean; 1036 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: address CodeRabbit review findings on PR #76

- AnalyticsManager: memoize the fallback exercise map on the `exercises`
  list identity. It was rebuilt every call, so the `_lastTrainedFor`
  identity check never hit and lastTrainedPerMuscle re-walked all
  sessions on every recommendation.
- AnalyticsManager.getRecommendations: forward readinessBand and
  sessionFatigueFactor to recommendSets, matching what
  WorkoutProvider.getRecommendations already passes.
- WorkoutProvider.recordSessionEffort: recompute the calibration offset
  from every stored answer in date order instead of folding the chip in
  incrementally. The chip is re-answerable, so changing your mind used
  to apply both answers.
- WorkoutProvider.recordSessionEffort: roll the session back if the
  offset write fails, so a partial failure can't leave the persisted
  session ahead of the persisted offset.
- SettingsProvider.init: fall back to kDefaultGeminiModel when the
  stored model is no longer in kGeminiModels — an id from an older build
  matched no dropdown item and tripped its assertion.
- SettingsProvider.setGeminiModel/setGeminiThinkingLevel: persist before
  committing in memory, so a failed write leaves the saved value active.
- Gemini model picker: handle a failed _selectModel instead of dropping
  the Future, and clamp the thinking-level slider's live index so a drag
  that outlives its level list can't exceed the new max.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: confirm AI settings saves with a toast

Pairs with the persist-before-commit change: now that a failed write
leaves the previous value active, the screen says so instead of just
appearing not to respond.

Uses the existing RFSnackBar design-system helper. Success toasts only
on the deliberate actions (Save on the API key, picking a model);
the thinking-level and tool-round sliders commit on every drag-release,
so they stay quiet unless the write fails. Every failure toasts.

Also gives the API key Save button a catch — it previously had a
try/finally with no handler, so a storage failure was an unhandled
error from the button's onPressed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: address CodeRabbit review findings on PR #76

Three partial-write / stale-state paths where storage and in-memory state
could disagree.

settings_provider: setGeminiModel writes the model, then the clamped
thinking level. A throw on the second left the new model persisted while
the provider kept the old one, so a selection the UI had reported as
failed became active on the next launch. Roll the model write back before
rethrowing. setGeminiMaxToolRounds also committed in memory before
persisting, unlike its two siblings; it now persists first.

profile_sections: both sliders push every intermediate value into the live
GeminiAiService during the drag, but neither catch block undid that, so a
failed save left requests using a value the user was just told wasn't
saved. Restore the service from the stored value on failure.

workout_provider: the summary chips stay tappable while a write is in
flight, and recordSessionEffort captures pre-call state for its rollback.
Overlapping taps let a failing first call restore that stale snapshot over
a second call that had already committed. Serialise the calls.

Adds failure injection to MockStorageService and three regression tests.
Each fails without its fix: the effort test ends with a null sessionEffort
in storage, and the settings tests see the model/limit survive a failed
write.

Not changed: the flagged num.clamp -> Slider.value typing at
profile_sections.dart:967. Dart special-cases the static return type of
num.clamp, so liveIndex is already double; a genuine num there would fail
compilation, and flutter analyze is clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* refactor(ui): extract shared screen chrome into rf_shell, refine workout flow (#77)

* refactor(ui): extract shared screen chrome into rf_shell, refine workout flow

Pulls the header/icon-button/screen chrome that each screen had been
rebuilding by hand into a single rf_shell.dart, then rewrites the workout
flow, coach, and summary screens on top of it.

- rf_shell: RFIconButton and RFScreenHeader — one fill, one size, tooltips
  required on icon-only buttons so they carry a screen-reader label.
- rf_widgets/rf_dialogs: shared dialog chrome, AmbientGlow with an
  AmbientMotionScope installed above the Navigator in main.dart so every
  route feeds the same glow.
- exercise_input_section: the set-entry UI no longer clips the weight field
  or overruns the assisted-load pill at large system font sizes; covered by
  exercise_input_section_text_scale_test across 3 widths x 3 text scales.
- workout_flow/workout_summary/ai_coach/workout_header/floating_nav_bar/
  rest_timer_view: rebuilt on the shared chrome, net ~1k lines lighter.
- flutter_test_config.dart pins AmbientGlow.motionEnabled = false for the
  suite; its drift loop never completes and would hang pumpAndSettle.

1032 tests pass; flutter analyze is clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: address CodeRabbit review findings on PR #76

- AnalyticsManager: memoize the fallback exercise map on the `exercises`
  list identity. It was rebuilt every call, so the `_lastTrainedFor`
  identity check never hit and lastTrainedPerMuscle re-walked all
  sessions on every recommendation.
- AnalyticsManager.getRecommendations: forward readinessBand and
  sessionFatigueFactor to recommendSets, matching what
  WorkoutProvider.getRecommendations already passes.
- WorkoutProvider.recordSessionEffort: recompute the calibration offset
  from every stored answer in date order instead of folding the chip in
  incrementally. The chip is re-answerable, so changing your mind used
  to apply both answers.
- WorkoutProvider.recordSessionEffort: roll the session back if the
  offset write fails, so a partial failure can't leave the persisted
  session ahead of the persisted offset.
- SettingsProvider.init: fall back to kDefaultGeminiModel when the
  stored model is no longer in kGeminiModels — an id from an older build
  matched no dropdown item and tripped its assertion.
- SettingsProvider.setGeminiModel/setGeminiThinkingLevel: persist before
  committing in memory, so a failed write leaves the saved value active.
- Gemini model picker: handle a failed _selectModel instead of dropping
  the Future, and clamp the thinking-level slider's live index so a drag
  that outlives its level list can't exceed the new max.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: confirm AI settings saves with a toast

Pairs with the persist-before-commit change: now that a failed write
leaves the previous value active, the screen says so instead of just
appearing not to respond.

Uses the existing RFSnackBar design-system helper. Success toasts only
on the deliberate actions (Save on the API key, picking a model);
the thinking-level and tool-round sliders commit on every drag-release,
so they stay quiet unless the write fails. Every failure toasts.

Also gives the API key Save button a catch — it previously had a
try/finally with no handler, so a storage failure was an unhandled
error from the button's onPressed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: address CodeRabbit review findings on PR #77

- RFIconButton: InkWell instead of a bare GestureDetector, so the
  back/close control in every header is reachable by keyboard and switch
  access — the requirement RFOptionChip already states in this file.
  Gesture area expanded to Material's 48pt minimum; painted box stays
  38pt.
- RFIconButton: expose standardSize/minTapTarget/standardExtent, and
  key RFScreenHeader's counterweight off standardExtent rather than a
  hardcoded 38.0. Documented that the counterweight only holds while
  every action is a default-size RFIconButton.
- showRFActionSheet: isScrollControlled + SingleChildScrollView. The
  9/16 height cap clipped the last action with no way to scroll to it —
  by 50px at default text scale on a 400x640 viewport, 655px at 2.0x.
  Added a text-scale widget test; verified it fails without the fix.
- _PoolRig: fold the drift fade into the wash gradient's alpha instead
  of an Opacity widget, dropping three near-fullscreen saveLayers per
  frame from a loop that never stops. Equivalent output — the gradient's
  far stop is fully transparent.
- _SendButton: InkWell so the coach's send button joins the focus
  traversal order (Enter from the text field already worked).
- _buildExerciseSummary: named parameters, per CLAUDE.md's 3+ argument
  convention.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: count the badge in the centred-title counterweight

RFScreenHeader renders RFGradientBadge plus an 8pt gap into the leading
run, but leadingWidth was derived from onBack alone. With centreTitle and
a badge set, the counterweight under-counted by 42pt and the title landed
21pt right of centre.

Exposes RFGradientBadge.standardSize (mirroring RFIconButton.standardExtent)
so the header can weigh a default-size badge without constructing one, and
adds rf_shell_test.dart covering the badge, badge+back and no-badge cases.
The two badge cases fail without this change; the no-badge control passes
either way.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Devasy Patel <110348311+Devasy23@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Devasy Patel <110348311+Devasy23@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>