Add GrowthTrack automatic session sync and onboarding

AGENTS.md

@@ -29,7 +29,10 @@ a run stops as safety-critical (see SAFETY.md).
 1. Never weaken, skip or delete a check to make a change pass. Fix the code or explain.
 2. Never bypass the stop/vent confirmation, the ceiling clamp, or the START gate.
 3. Saved-data changes must keep old files loading; add a `Migrate` case.
-4. No network code in release builds; no data leaves the phone unless the user opts in.
+4. GrowthTrack is the optional release network integration: public-client PKCE, secure tokens,
+   browser approval of an account connection enables automatic transfer of every new real
+   finished session. Disconnected and unmarked earlier history never upload; pending work
+   stays bound to its original grant. No per-session opt-in is required. Diagnostic log upload remains debug-only.
 5. UI: Java-built views (no XML layouts), 48 dp minimum touch targets, colours and sizes
    from `Look`, dialogs through `Ui.dialog()` + `Ui.dress()`.
 6. New logic that can be pure goes in `core/` with a JUnit test.

ARCHITECTURE.md

@@ -9,8 +9,11 @@ so that most of the logic can be understood, changed and tested without a phone.
 app/     Android shell — screens, the foreground run service, Bluetooth (PumpLink),
          notifications, widget, file providers. Depends on core.
          app/src/debug is in debug builds only: the diagnostic console (MainActivity,
-         its own Bluetooth connection and raw frames) and the INTERNET permission its
-         log upload needs. The release APK carries neither.
+         its own Bluetooth connection and raw frames) and cleartext diagnostic log upload.
+         The release APK carries no diagnostic console. Optional
+         GrowthTrack has INTERNET/ACCESS_NETWORK_STATE in main. Browser approval enables
+         automatic same-account session sync, with a separate Activity/task, encrypted
+         no-backup state and persisted network-constrained retry jobs.
 core/    Plain Java — no Android imports, enforced by ArchitectureTest.
          Training plan, session engine, data model and persistence, share codes,
          progress/analytics, and the ZD21 pump protocol (Proto) with its simulator;
@@ -25,6 +28,7 @@ is being removed — see the roadmap).
 
 | You want to… | Look in |
 |---|---|
+| Change the optional GrowthTrack connection | `core/./GrowthTrack*.java`, `app/./GrowthTrack*.java`; [developer handoff](docs/growthtrack-developer-handoff.md) |
 | Change a screen | `app/src/main/java/org/openpump/*Screen.java`, `SessionActivity.java` |
 | Change the training plan | `core/…/Plan.java`, `RxBuild.java`, `Mint.java`, `Deload.java` |
 | Change how a run is recorded or saved | `core/…/AsRun.java`, `RunEdit.java`, `Session.java` |

README.md

@@ -12,7 +12,7 @@
 <p align="center">
   <a href="LICENSE"><img alt="Licence: AGPL-3.0" src="https://img.shields.io/badge/licence-AGPL--3.0-C8FF3D?style=flat-square&labelColor=0b0e13"></a>
   <img alt="Android 7.0 or newer" src="https://img.shields.io/badge/android-7.0%2B-F0A63C?style=flat-square&labelColor=0b0e13">
-  <img alt="No account, no server, no analytics" src="https://img.shields.io/badge/data-stays%20on%20your%20phone-9ba5b2?style=flat-square&labelColor=0b0e13">
+  <img alt="Optional GrowthTrack connection, automatic session sync" src="https://img.shields.io/badge/GrowthTrack-optional-9ba5b2?style=flat-square&labelColor=0b0e13">
   <a href="https://github.com/OpenByte-source/OpenPump-App/releases/latest"><img alt="Latest release: 0.10.0" src="https://img.shields.io/badge/release-0.10.0-5d6776?style=flat-square&labelColor=0b0e13"></a>
 </p>
 
@@ -36,7 +36,9 @@ The goal is bigger than any one feature: the best app there is to pump, track yo
 
 - **Works with** the Epic Hydro PE Pump over Bluetooth. It's the one pump checked on real hardware so far. Others can be added by the people who own them.
 - **No pump?** Practice mode runs everything against a simulated pump, and marks those runs as simulated.
-- **Your data** stays on your phone. No account, no server, no analytics.
+- **Your data** stays on your phone until you export/share it or connect your own GrowthTrack account. Connection enables automatic sync of new real finished sessions; disconnected and preconnection history does not send. Measurements, photos and notes are excluded from this optional connection.
+
+  This feature branch adds the GrowthTrack connection and read-only routine previews. Android build/device validation is still required before release; see the [developer handoff](docs/growthtrack-developer-handoff.md) and [verification record](docs/growthtrack-verification.md).
 - **You need** Android 7.0 or newer.
 - **It's free** and open source, under AGPL-3.0.
 

SAFETY.md

@@ -53,7 +53,11 @@ own risk — the full terms, including the warranty and liability disclaimer, ar
    or leaving a screen never orphans a pump under pressure.
 6. **Practice mode is never mistaken for a pump.** Simulated runs are labelled everywhere
    and filed as simulated.
-7. **Nothing is sent on the user's behalf.** No network traffic in release builds.
+7. **Connection is optional and authorizes automatic sync.** GrowthTrack linking uses
+   the system browser; every new real finished session transfers to that grant. Disconnected
+   and preconnection history never sends. No measurements, photos or notes are uploaded.
+   Account-bound encrypted pending work retries automatically. Data transfer owns no pump connection and
+   cannot start hardware. The diagnostic log console remains debug-only.
 
 These are enforced by code review, by `WiringCheck` (static checks over the source), by
 the self-test, and — as pump drivers arrive — by a conformance kit every driver must pass.

app/src/debug/AndroidManifest.xml

@@ -7,8 +7,9 @@
      builds developers make themselves. SessionActivity reaches it by class name, and only
      when BuildConfig.DEBUG says it is here.
 
-     INTERNET and cleartext traffic are the console's log upload to a developer's own
-     computer. Release builds never hold the INTERNET permission. -->
+     Cleartext traffic is for the console's log upload to a developer's own computer.
+     INTERNET is also declared in main for optional GrowthTrack account connection and automatic session sync.
+     Release builds forbid cleartext and carry no diagnostic console. -->
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
     <uses-permission android:name="android.permission.INTERNET" />
 

app/src/main/AndroidManifest.xml

@@ -1,6 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
 
+    <!-- Optional GrowthTrack connection authorizes automatic same-account session sync. -->
+    <uses-permission android:name="android.permission.INTERNET" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+
     <!-- Legacy (<= API 30) -->
     <uses-permission android:name="android.permission.BLUETOOTH"
         android:maxSdkVersion="30" />
@@ -161,7 +165,8 @@
         android:icon="@mipmap/ic_launcher"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:theme="@android:style/Theme.DeviceDefault.NoActionBar"
-        android:allowBackup="false">
+        android:allowBackup="false"
+        android:usesCleartextTraffic="false">
         <!-- A rotation DESTROYS an Activity by default, and a destroyed Activity is an
              exit from a live run: the pump session ends, and (fix round 1) has to be
              filed as an abort from onDestroy because nothing else can. Two layers stop
@@ -227,6 +232,9 @@
              the one that is running. A duplicate that gets past this finishes itself before it
              touches anything (SessionActivity#anotherScreenIsLive, WiringCheck invariant 108;
              OneScreenManifestTest pins this attribute). -->
+        <service android:name=".GrowthTrackSyncService"
+            android:permission="android.permission.BIND_JOB_SERVICE" android:exported="true" />
+
         <activity
             android:name=".SessionActivity"
             android:exported="true"
@@ -493,5 +501,19 @@
             android:authorities="org.openpump.export"
             android:exported="false"
             android:grantUriPermissions="true" />
+        <!-- Data transfer has its own task and never creates a second pump owner. -->
+        <activity android:name=".GrowthTrackActivity" android:exported="false"
+            android:launchMode="singleTask" android:taskAffinity="org.openpump.growthtrack"
+            android:excludeFromRecents="true" />
+        <activity android:name=".GrowthTrackCallbackActivity" android:exported="true"
+            android:taskAffinity="org.openpump.growthtrack.callback"
+            android:excludeFromRecents="true" android:noHistory="true">
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="gt-openpump" android:host="oauth" android:path="/callback" />
+            </intent-filter>
+        </activity>
     </application>
 </manifest>