Body-PulseX User Manual

Document ID: PO-UM-001 · Revision: 1.7 · Date: 2026-10-18 Change in this revision: added §7.0, a guided physical-scale connection and first-reading verification walkthrough, available in the in-app User Manual with screenshots and a user-confirmed checklist. Optional sharing remains opt-in. Change in 1.6: documented the Python scale bridge as a third reading path (§2.7); added the Bluetooth Status page (§7.5); rewrote §7 panel-by-panel for the Body page's exact on-screen labels; documented weigh-in storage, phone-Health import and the new phone-Health mirror (§7.3); troubleshooting matrix extended with the scale-hijack, greeting-stall and account-sync rows. Change in 1.5: §2.3 rewritten: one-tap connect, network gates, saved watches, token lifecycle. Changes in 1.4: registered in the documentation control sheet (PO-DX-000); terminology now defers to the glossary (PO-GL-001) so that a word means the same thing in the interface and in every document; connection troubleshooting cross-referenced to the operations runbooks (PO-OP-001 §5.2); the reasons behind the two-transport design and the labelled twin are recorded in ADR-0001 and ADR-0006. Changes in 1.3: chapter 19 (Vitality console) and chapter 20 (reporting a problem, and the maintenance view) added; glossary extended. Instrument: Body-PulseX Watch Intelligence Console Target hardware: a Wear OS smartwatch paired to an Android handset. Reference configuration for this build: model SM-L315F on a One UI handset. Companion documents: Glossary (PO-GL-001) · Model Reference (PO-MR-001) · Operations (PO-OP-001) · Code Documentation (PO-CD-001) · Version Audit Log (PO-AL-001)

Safety and intended use

Body-PulseX is a wellness and self-quantification instrument. It is not a medical device. It has no CE marking, no FDA clearance, and has not undergone clinical validation. Nothing it displays is a diagnosis.

Read this before using any number in this app:

• Do not use Body-PulseX to decide whether to seek or delay medical care. If you have chest pain, breathlessness, fainting, or a heart rate that frightens you, contact emergency services.
• Do not use the ECG Lab as a substitute for a clinical 12-lead ECG. A single-lead strip cannot exclude ischaemia, cannot localise infarction, and can miss intermittent arrhythmia entirely.
• Do not treat the SpO₂ readings as oximetry. Wrist optical SpO₂ is unverified against ISO 80601-2-61 and degrades with motion, cold hands, tattoos and poor contact.
• Do take every "urgent" flag to a clinician as an observation to discuss, with the exported PDF report as the artefact.
• Do remember that the app tells you when it is uncertain. A number shown with low confidence is telling you something real: the measurement conditions were poor.

Contraindications for interpretation: implanted pacemaker or ICD (paced rhythm invalidates the RR-interval statistics), atrial fibrillation already under treatment (HRV metrics lose their autonomic meaning), and pregnancy (all population reference bands in this app are non-pregnant adult cohorts).

---

1. What this instrument actually does

Most wearables show you a number. Body-PulseX shows you a number, its provenance, its uncertainty, and the arithmetic that produced it.

Three principles govern every screen:

1. No fabricated data. If the watch stops sending, the app does not interpolate a plausible heart rate. It holds the last value, visibly decays its confidence, and marks the gap.
2. Every number is traceable. Each index can be opened to reveal the formula, the inputs, the reference population, and the days that drove a trend.
3. Uncertainty is first-class. Frames carry a confidence score; statistics are weighted by it; frames below 0.35 confidence are excluded, not quietly averaged in.

The measurement chain

  wrist sensor → transport → frame confidence → fusion → index → trend → evidence
      │             │              │              │        │        │        │
  optical/ECG    BLE or        timeliness ×    HR/HRV/   0–100   Theil–Sen  driving
   electrode      relay        freshness ×      resp     score    + Mann-    days +
                             provenance ×     synthesis           Kendall   jackknife
                               integrity                          + FDR

Every stage is inspectable in the app. This manual walks the chain in order.

---

2. Getting connected

2.1 Understanding your two transports

The Galaxy Watch 7 does not expose its health sensors to a browser. Samsung keeps the health GATT profile private to Samsung Health and the Galaxy Wearable bond. This is a platform decision, not a fault in the app, and no web application can bypass it.

You therefore have two paths:

The app decides for you: on a detected One UI host it defaults to the relay and offers one-tap override to BLE.

2.2 Onboarding, step by step

Open the app. The onboarding flow runs once and covers four gates:

1. Environment check. The app determines whether it is running in a top-level browser tab (required — Web Bluetooth is blocked inside iframes and most in-app browsers), whether a Bluetooth adapter is present, and whether the page is served over a secure origin.
2. Transport choice. Relay or BLE, with the recommendation pre-selected for your hardware.
3. Pairing. Either the relay wizard (§2.3) or the browser's device chooser (§2.4).
4. Baseline scan. A short quiet capture that seeds your personal thresholds (§5).

Your answers are stored to your profile and appear afterwards in Setup history on the Console, with the permission state, signal quality and link type recorded for each attempt.

2.3 Native relay setup (/relay)

Install once.

1. Install the two modules from the native-relay/ Android Studio project: wear on the Watch 7, phone on the S25 Ultra.
2. On the watch, grant Body sensors and Physical activity. The collector never invents a missing sensor — if your watch does not expose skin temperature, that channel stays empty rather than being modelled.
3. On the phone, start the relay service. It runs as a foreground service with a persistent notification; Android terminates background sockets, so this notification is load-bearing — do not dismiss the service.
4. The phone shows a LAN address and a token. The relay is closed by default: without the token, connections are refused.

Connect — the normal path is one tap.

Press Find & connect. The app scans your Wi-Fi for the relay, links to it, and only asks for a token if the relay actually demands one. It confirms success only after a real sensor frame has arrived, not merely because a socket opened.

If you already have the line from the phone on your clipboard, Paste link is faster: paste the whole ws://192.168.x.x:8787/pulse?token=… string and the app splits the address from the token for you. Manual entry lives behind Enter manually for the rare case where you know the address and the scan cannot see it.

Before it scans, it checks four things and tells you plainly if one of them makes scanning pointless:

If nothing answers, the panel offers retry, deep scan (probes all common home network ranges) and manual entry with port hints. The scan also retries itself, up to three times, whenever you come back online or switch networks.

Saved watches. Every verified link is saved automatically with its own address and its own token. Switching between watches — a second wearable, a relay at a different location — is one tap in the Saved watches panel, with no token re-entry and no re-discovery. You can rename or remove any entry; removing it also deletes its stored token.

Remembered network. The app also remembers which relay last streamed and a fingerprint of the network it worked on — the radio type and the relay's address range. When you return to that Wi-Fi it reconnects straight to that relay instead of sweeping the network, usually in well under a second. The line showing the remembered relay carries a Forget network action; the fingerprint contains no network name, no MAC address and nothing that identifies the network to anyone else.

Both devices must be on the same Wi-Fi network, and client isolation ("AP isolation" on guest networks) must be off.

Token lifecycle. The stored token shows its age. It is refreshed every time the relay accepts it and expires after 90 days of disuse, so an abandoned copy on a borrowed device stops working on its own. If the phone rotates the token, the app detects the refusal, marks the stored copy as rotated and offers Reset relay token, which wipes it and re-pairs — no reinstall. Rotate deliberately if you have ever shown the relay screen to someone else.

2.4 Web Bluetooth pairing

1. Open the app in standalone Chrome or Edge — not inside another app's browser, not in an embedded preview frame. The app detects both cases and offers a one-tap "open in a full tab" action, plus an Android intent that launches Chrome directly.
2. Turn the Bluetooth radio on at the OS level. Your phone-to-watch pairing is unaffected; the browser needs its own access. No web page on any platform can toggle the radio for you — that is a deliberate browser security boundary.
3. Use Auto-continue when on: arm it, go to quick settings, switch Bluetooth on, and return. The app detects the radio within about a second (immediately on return if the tab was hidden), re-probes the environment, and resumes the connection without another tap.
4. Press Pair. The browser shows its own device chooser; the app cannot pre-select for you (another deliberate security boundary).

2.5 The connection banner

The banner is always truthful about state:

The app remembers your last successful device and transport and re-initiates automatically when the radio returns.

2.6 Watch service availability

The service matrix distinguishes three things that look identical on other apps:

• Available — the channel is enumerated and delivering frames.
• Enumerated, silent — the service exists but has sent nothing for 20 s.
• Restricted — the device is a stock Galaxy Watch, and the channel is reserved by Samsung Health. The relay is the supported route.

A red cross next to Heart Rate on a stock watch is the app being honest, not broken.

2.7 A third path for the scale: the Python bridge

The Feelfit CS20G smart scale can be read three separate ways, and all three feed the same Body page history because they all publish into the same on-screen store:

The bridge is a small program in the python-bridge/ folder — see python-bridge/README.md for the full walkthrough. In outline:

1. Install once: pip install -r requirements.txt inside the folder's virtual environment.
2. Run python main.py. It prints an address such as ws://192.168.1.42:8787/pulse?token=….
3. Paste that address into Devices → WiFi relay in this app.
4. Close the FeelFit app completely, step on the scale barefoot, and stand still.

What success looks like: the Live capture panel on the Body page (§7.4) moves through Introducing → Ready → Reading, and the settled weigh-in appears in Weigh-in history. To the rest of the app, the bridge is indistinguishable from the phone relay — the Scale card, the Frame map and the weigh-in history all work unchanged, because every path writes into the same scaleLink store.

The bridge needs no phone and no Android tooling. Only one program may hold the scale's Bluetooth link at a time, so do not run the phone relay's scale reader and the Python bridge against the same scale at the same time, and always close the FeelFit app first.

---

3. Troubleshooting matrix

---

4. Reading the Intelligence Console (/)

4.1 The live vitals block

Every vital carries three pieces of metadata you should learn to read:

• Source — measured (the sensor sent this), derived (computed from RR intervals), or held (last known value, decaying).
• Quality — 0–1, combining source authority, artifact rate and rejection history.
• Confidence — the frame's temporal confidence: how recent, how complete, how clean.

Heart rate specifically is protected by three guards: a plausibility window of 25–240 bpm, a slew limit of 30 bpm/s (faster than any real chronotropic response, so a bigger jump is a decode fault), and a median over the last three accepted values. When the source is RR-derived, it is the median of the last eight intervals — one ectopic beat cannot move the display.

4.2 The five flagship vitals engines

Each card can be expanded into an explain panel that decomposes the score into its terms, showing which input moved it and by how much.

4.3 Consistency checks

The consistency panel runs nine cross-validations on every window — HR against RR-derived rate, beat integrity, contact state, cadence harmonics, the HRV–HR coupling ceiling, the cardiorespiratory ratio, the age-predicted envelope, provenance, and perfusion. The tolerance band is max(5 bpm, 10 % of reference), taken from ANSI/CTA-2065.

When two signals disagree, the app says so instead of picking a winner. A "halved beats" or "doubled beats" verdict means the optical sensor is counting wrong, and the displayed rate should not be trusted until contact improves.

4.4 Signal quality

Five channels — lock, perfusion, motion, contact, respiration — each graded from in-range fraction and jitter, then combined. Degradation requires three consecutive ticks below 60 and recovery requires 75, with a 90-second cooldown. That hysteresis exists to stop alarm chatter; it also means the quality bar lags reality by a few seconds by design.

---

5. Calibration: making the numbers yours

Population averages are a poor description of any individual. Body-PulseX therefore learns you, in two distinct exercises that people often confuse.

5.1 Baseline calibration (who you are)

What it does. Learns your resting HR, HRV, SpO₂, respiration, skin temperature and beat scatter, and converts them into the thresholds every engine uses.

Protocol. Five sessions, ideally on different days and at similar times. For each: sit still and quiet for the capture, no caffeine within two hours, no exercise within one hour, strap one notch tighter than usual, one finger-width above the wrist bone.

How it learns. Sessions are weighted by recency (0.78 per session back) and by their own quality score, then blended with a population prior using an empirical-Bayes shrinkage update. Early on you are mostly prior; by session five you are mostly you. This is why a single strange session cannot wreck your thresholds.

Derived thresholds. Resting HR = your mean; HRV floor = mean − 1.2 SD; HRV target = mean; SpO₂ floor = mean − 2 SD (capped at 97 %); fever delta = 1.6 SD (minimum 0.30 °C); scatter limit = mean + 2 SD.

Recalibration. The app prompts when your data drifts (a drift score ≥60, or any channel ≥2.5 SD from baseline), when the baseline is older than 14 days, or when you have fewer than five sessions. You can snooze for two days.

5.2 Metrology calibration (how accurate the instrument is)

This is the Calibration Lab (/calibration), and it is a different question: not what is normal for me, but how far is this sensor from a reference.

Protocol per module. Take simultaneous paired readings — the app's value and a reference value — across a span of the measurement range. Spanning matters: ten pairs all at 60 bpm tell you about offset but nothing about slope. The HR module wants at least 25 bpm of span.

The mathematics. Pairs are fitted with Deming regression, not ordinary least squares, because the reference device also has error; OLS in that situation systematically flattens the slope (regression dilution) and would understate your instrument's true gain error. The variance ratio λ is set per module (HR 2, HRV 3, SpO₂ 1).

Agreement is then reported Bland–Altman style: bias (mean difference), SD of differences, A_rms (√mean of squared differences, the ISO 80601-2-61 statistic), MAE, MAPE, and the repeatability coefficient 1.96·SD_diff.

Verdicts. In tolerance (A_rms within the module tolerance and bias within its limit); correctable (out of tolerance raw, but within it after applying the fitted correction — the app will offer to apply it); out of tolerance (the sensor disagrees in a way a linear correction cannot fix; suspect fit, contact or hardware).

Recommended interval: 60 days per module, or after any change of strap, watch position, or firmware.

5.3 Heart-rate validation mode (a 60-second reference check)

The quickest honest check of your instrument: count your own pulse.

1. Open HR validation mode and sit still for 30–60 seconds.
2. Palpate the radial or carotid pulse and tap once per beat, or enter a total count.
3. The app compares its own stream against your count.

It reports bias, MAPE, the fraction within tolerance, Lin's concordance correlation coefficient, the repeatability coefficient, and drift per 30 days. It also reports the resolution of your own method — counting for 30 s has a floor of 2 bpm — so you can see the reference's error, not just the device's.

Session gates: at least 30 s elapsed, ≥5 device readings, ≥10 counted beats, device SD ≤8 bpm, mean quality ≥0.5. A session failing these is discarded rather than recorded as evidence. Pass criteria: |bias| within the module limit, MAPE ≤10 %, ≥90 % of pairs within tolerance, CCC ≥0.9.

---

6. ECG Lab (/ecg)

6.1 Recording a usable strip

Sit, forearm supported, elbow resting. Hold the opposite finger firmly on the crown for the full recording — light contact is the single biggest cause of unreadable strips. Do not talk, do not clench, keep the arm still. Thirty seconds minimum; the rhythm classifier requires ≥30 s before it will call anything.

6.2 What the app does with it

1. Conditioning — baseline wander removed by a 0.5 Hz high-pass; mains interference measured at both 50 and 60 Hz and notched at whichever dominates; 5–15 Hz band-pass for beat detection.
2. Beat detection — the Pan–Tompkins algorithm (1985): derivative, squaring, 150 ms integration, adaptive dual thresholds, 200 ms refractory period, T-wave discrimination and searchback for missed beats.
3. Quality scoring — five PhysioNet/CinC 2011 indices (kurtosis, baseline power, flatline fraction, high-frequency fraction, saturation) combined into diagnostic / readable / poor.
4. Delineation — an ensemble median beat is built (complexes after an irregular RR are excluded), then QRS onset/offset by steepest-slope walk-back and T-end by the tangent method.
5. Intervals — PR, QRS, QT, and QTc by four formulas. The headline uses Fridericia below 60 or above 100 bpm and Bazett in between, because Bazett over-corrects at tachycardia and under-corrects at bradycardia — a detail most consumer apps ignore.

6.3 Interpreting the output

AF screening combines RR irregularity (RMSSD/meanRR), sample entropy, pNN50 and P-wave absence, scaled down by strip quality and halved when the irregularity looks ectopic rather than fibrillatory. A positive result is a screening result: it means "record another strip and show a clinician", nothing more.

6.4 Pulse deficit — the check no single sensor can do

The ECG measures the electrical beat; the optical sensor measures the mechanical pulse that reaches the wrist. Comparing them detects beats that fire electrically but eject too little blood to be felt — the classic sign in AF and frequent ectopy.

Deficit = HR_ECG − HR_PPG. Above 5 % is minor; above 10 % is reported as a genuine deficit. This requires both sensors simultaneously and is one of the few things this app can do that a chest strap or a finger oximeter alone cannot.

---

7. Body: Mass-Flux Twin (/body)

Connect a Feelfit-class BLE scale (SIG Weight Scale 0x181D / Body Composition 0x181B, plus the vendor frame format). Weigh yourself under standard conditions: morning, post-void, pre-meal, bare feet, dry skin. Bio-impedance assumes euhydration — a post-exercise or post-meal reading violates the model's assumptions and will move your body fat by percentage points for reasons that have nothing to do with fat.

7.1 Composition

With impedance, fat-free mass comes from the Kyle (2001) equation on the resistance index h²/Z, and total body water from Kushner & Schoeller (1986). Without impedance, the app falls back to Deurenberg (1991) anthropometry and the Wang (1999) hydration constant of 0.732. Results are bounded physiologically (FFM between 35 % and 97 % of mass; TBW between 67 % and 79 % of FFM) so an impedance glitch cannot produce an impossible body.

FFMI and FMI are reported against the Schutz (2002) bands, and resting metabolic rate uses Katch–McArdle when lean mass is measured and Mifflin–St Jeor when it is estimated.

7.2 The five Mass-Flux indices

The novelty here: wrist physiology is re-expressed per unit of metabolically active tissue rather than per person. A 60 bpm heart rate means something different in a 45 kg-lean body than in a 70 kg-lean one.

Composite bands: resilient ≥70, compensating ≥45, strained below. Historical values are recomputed causally — a day's score never uses information from later days, so your history does not silently rewrite itself.

7.3 Every panel on the page, in order

The Body page renders the same set of panels regardless of which of the three reading paths (§2.7) fed the last weigh-in — this is deliberate: ISO 9241-110:2020's conformity-with-user- expectations principle says the same information should look the same wherever it appears.

7.4 Weigh-in storage, sync and the phone Health app

Every weigh-in — however it was captured — is written to this history in the same order:

1. Local first. The reading always lands in this browser's or app's local storage immediately, whether or not you are signed in and whether or not you have a network connection. A line under the Feelfit scale link panel states this plainly: "Saved on this device · sign in to sync" when signed out, "Syncing weigh-ins with your account…" while a sync is in flight, and "Weigh-ins synced with your account" once it lands.
2. Private account sync, when signed in and explicitly enabled. Enable Web console sync in Permissions to upload your local weigh-ins to your own account and merges anything already stored there, so the same history appears on your phone, the web app and the desktop app. A collision on the same reading keeps the locally-captured copy, because it may carry richer radio diagnostics (the raw packet, for example) that a synced copy does not.
3. Importing from the phone Health app (toggle: Also import weigh-ins from the phone Health app, controlled separately in Permissions). The Android relay reads back weigh-ins that other apps — including the FeelFit app itself — wrote to the phone's Health store, and folds them into this same history and your account. Turn it off if you deliberately want to keep a comparison between FeelFit's own numbers and this app's numbers separate; the Compare with your scale app panel (§7.3) still works either way, reading the phone's Health store directly.
4. Sending this app's weigh-ins to the phone Health app (toggle: Also send weigh-ins to the phone Health app, controlled separately in Permissions). This is the reverse direction: each new weigh-in captured here is written out to the phone's Health store as well, so any other Health-app-reading tool on the phone sees it too. The write happens on the phone — this computer only asks the phone relay to do it over the same LAN link that carries vitals — so the phone relay must be linked for it to work; the line under the toggle says so explicitly ("Start the relay on your phone and keep it linked so readings can be sent" versus "Phone relay connected — each new weigh-in is written there too"). When it is off, weigh-ins stay in this app and your account only.
   • What is sent: mass, and body resistance (impedance) when the scale measured it.
   • What is withheld: fat, muscle, water and bone are never sent, because the scale never measured them — this app calculates them from mass and impedance (§7.1), and sending a calculated figure into another app's store as if it were measured would misrepresent its provenance. This mirrors the design rule the Python bridge documents for its own output: "the bridge deliberately sends only what the hardware actually measured."

7.5 Bluetooth Status (/bluetooth)

A dedicated diagnostics page — separate from the Body page because the question "is the radio even working" is worth answering on its own, without composition maths in the way. It reads the same underlying stores as the Body page and the dashboard's Scale card, so nothing here can disagree with what those pages show; it only adds detail. This separation follows Nielsen's "visibility of system status" heuristic: a stalled link should be diagnosable without hunting through an unrelated results screen.

The page has four panels:

If the scale panel shows a device name with a phase stuck on "Introducing itself" for more than a few seconds, see the greeting-stall row in the troubleshooting matrix (§3): the fix is nearly always to stay on the platform and let the automatic retry ladder run, or to force-close the FeelFit app first.

8. Chrono-Phenotype Calendar (/calendar)

8.1 The daily fingerprint

Each day is reduced to a 20-locus signature across five clusters — cardiac, autonomic, oxygen, metabolic, recovery. Each locus is z-scored against your median and MAD (blended with population values until you have eight days), then rendered as a letter from an eight-symbol alphabet. The result is a compact glyph you can compare across days at a glance.

Cluster scores weight the loci by polarity (some are good high, some good low, some are neutral where deviation in either direction is the signal). The composite weights clusters: autonomic 1.3, oxygen 1.2, cardiac 1.0, recovery 1.0, metabolic 0.8.

Verdicts: thriving ≥64, steady ≥48, strained ≥34, depleted below — with an override to anomalous when today's signature is genuinely unlike your recent self (similarity <0.25).

8.2 Pattern detection

Seven detectors, each a smooth logistic on a composite of z-scores rather than a hard threshold, so confidence rises gradually instead of flipping:

8.3 Timestamps and circadian context

Every logged measurement carries a timestamp and a circadian phase label derived from local time, so a 06:00 HRV reading is never silently compared against a 22:00 one. Coverage is reported as the longest contiguous run of covered hours in the day — 18 scattered hours and 18 contiguous hours are not the same evidence.

---

9. Body Insights (/insights)

9.1 Trends done properly

Trends use Theil–Sen slopes (median of pairwise slopes, ~29 % breakdown point) rather than least squares, so one anomalous day cannot manufacture a trend. Significance is the non-parametric Mann–Kendall test with tie correction — it assumes no distributional shape, which matters because almost nothing in physiology is Gaussian.

Evidence labels map directly to p-values: strong <0.01, moderate <0.05, weak <0.2, none otherwise or with fewer than five days.

Multiplicity control. With 20 loci tested repeatedly, uncorrected testing would produce a "significant" result roughly daily by chance alone. Alerts therefore apply Benjamini–Hochberg FDR control at α = 0.05 across all simultaneously tested loci. This is why the app reports fewer, better trends than apps that test each metric in isolation.

Change points are detected with the Pettitt test — useful for "when did this actually change?" rather than "is it drifting?".

9.2 Peer norms

Percentiles come from named cohorts, not invented curves: NHANES for resting HR, the FRIEND registry for VO₂max, Nunan's meta-analysis for HRV, the Sleep Heart Health Study for overnight SpO₂ nadir, Tudor-Locke for steps, Schutz for FFMI. Each band shows its source in the app. A percentile is a comparison, not a target — a 30th-percentile resting HR in an endurance athlete is unremarkable.

9.3 Coupling map

Cross-correlation between metrics at lags of −3 to +3 days, retained only at |r| ≥0.5 with at least eight paired days. It answers questions like "does my sleep debt lead my HRV by a day?" The app deliberately calls these couplings, never causes.

---

10. Evidence dossiers, sharing and export

10.1 The dossier

Any KPI or locus can be opened into a dossier containing:

• Fusion inputs — every sensor and derived value that fed the number.
• Trend statistics — Theil–Sen slope, Mann–Kendall τ and p, change point if any.
• Confidence ledger — coverage × quality × support, with the grade (high / moderate / low / insufficient) and the reason.
• Driving days — a leave-one-out jackknife showing exactly which days move the slope, and a concentration figure. If one day carries most of the trend, the app says the trend is fragile rather than significant.

10.2 Sharing safely

Share links are redacted, time-limited and view-capped. The recipient sees one dossier — the statistics and the conclusion — never your measurement history, and never your identity. Technically: a 32-byte random token is generated, only its SHA-256 hash is stored, the page is excluded from search indexing, and you can revoke any link instantly. Treat the link itself as the credential; anyone holding it can view it until it expires, is exhausted, or is revoked.

10.3 PDF export

Two exports exist: a session report (current vitals, engine scores, connection metadata, quality) and a dossier report (trend statistics, confidence ledger, driving days). Both are branded, self-contained and suitable to hand to a clinician. Both state on the page that the instrument is not a medical device.

---

11. Alerts

Three sensitivity presets tune every alert at once:

Alert families: arrhythmia signals (scatter and HRV floor breach), hypoxia risk (deficit, dip count, respiratory load), autonomic trend (HRV gap, HR creep, stress). Evidence alerts are separate and statistical: confidence collapse, confidence drop, an FDR-surviving trend shift, a Pettitt level shift, and a fragility advisory when a single day dominates.

Every alert carries an actionable summary: what changed, by how much, over what window, with what confidence.

---

12. Data, privacy and account

• Baselines, buffers and preferences live in your browser's local storage. Profile, setup history and share links live in your account.
• The offline ring buffer holds up to 15 minutes of frames (256–8192 depending on rate) to cover dropouts, and replays them on reconnect with restored frames marked and down-weighted to 0.85 confidence.
• You can export your calibrated baseline as JSON and import it on a new device, so switching phones does not cost you five calibration sessions.
• Error telemetry scrubs console breadcrumbs, query strings and share tokens; no health value leaves the app through error reporting.
• Payments run through Paddle, PayFast or Ozow. Every webhook is signature-verified and idempotency-ledgered before entitlement changes.

---

13. AEGIS Sentinel and THE SANCTUM (/sentinel)

13.1 What the Sentinel does

The Sentinel continuously scores the observations it can see — respiration rate, SpO2, skin temperature, pulse, and anything you enter manually — using the NEWS2 early-warning parameter set, and places you in one of five tiers:

Important. A wrist sensor cannot measure consciousness, and it measures respiration indirectly. If a parameter is missing, the Sentinel says the score is partial rather than assuming that parameter is normal. Never treat a "Sanctuary" verdict as reassurance if you feel unwell.

13.2 The call tree

The call-tree viewer shows, as a diagram, exactly who would be contacted, on which channel, and in what order, for any tier you select — including hypothetical scenarios you have not reached. Use it to check your roster before you need it.

13.3 Emergency roster and dispatch

Add contacts in priority order, each with a phone number, optional email, and the tiers that arm them. Numbers are normalised to international format; destinations are masked on screen. When a tier arms dispatch, the app prepares the message and hands it to your phone's SMS, WhatsApp or email app — you always see and confirm the message before it leaves. Every attempt (sent, opened, cancelled, blocked, failed) is written to a local dispatch log you can review or clear.

13.4 Responder handover PDF

One tap produces a handover sheet: current NEWS2 with the per-parameter breakdown, trend sparklines, your notes and medications, and a QR code a responder can scan to open the redacted dossier. Past handovers are archived on the device so you can re-issue one.

13.5 THE SANCTUM

A resonance and breathing module: adaptive tones generated live (nothing is streamed), with the frequency and envelope responding to your current autonomic state, plus a practice log so you can see whether a technique actually moves your HRV. This is a wellbeing practice, not a treatment, and it is never presented as one.

---

14. Preferences that follow the device

14.1 Per-watch transport override

The transport override (Auto / Force BLE / Force relay) is saved per watch, not globally. Each remembered device gets its own setting; devices you have never pinned inherit a default. The override panel shows which device the setting applies to, flags when a value is inherited, and offers a one-tap Use default to unpin. Swapping watches re-scopes the preference immediately — no reload needed.

14.2 Storage health

Everything local shares one browser storage quota. The app tiers its data: safety-critical items (emergency roster, escalation policy, baseline, consent) are protected, and if the device runs out of room the app sheds regenerable telemetry — ECG strips, the outage buffer, the oldest ledger entries — to make room. If a save is genuinely refused, you get an explicit "out of room" notice; the app never pretends a save worked. Export your baseline JSON and any needed PDFs before clearing browser data.

14.3 Panel failures

Each panel is independently sandboxed. If one engine hits bad data it collapses to a single card naming the panel with a retry button; the rest of the console and your live stream keep running. Repeated failure of the same panel is worth reporting.

14.4 Shutting down

The logout/shutdown button is a coordinated teardown: it stops timers and audio, closes the transport, flushes pending saves, then signs you out. Use it instead of just closing the tab if you want to be certain nothing is left streaming.

---

15. Consent, cookies and legal

On first run you choose what non-essential telemetry is allowed. Until you decide, nothing optional loads — the gate is real, not cosmetic, and you can withdraw consent at any time from the same control, effective in the same session. The /legal page carries the intended-use statement, the not-a-medical-device disclosure, data handling and retention, and support contact details.

---

16. Maintenance schedule

---

19. Vitality console (/vitality)

Four cards, each answering a different question about training and recovery. All four are built from your own history — your measured resting heart rate, your calibrated baseline, your logged days — and every card tells you which of its inputs were measured and which were assumed.

Three things worth knowing:

• Effort while under-recovered is worth less. PAI-X discounts a day whose HRV sits below your own baseline. That is intentional: those minutes cost you more and buy you less.
• Taking the watch off does not create recovery. Unobserved hours are credited at resting rate only, never at the overnight rate.
• Thin evidence is stated, not hidden. Each card needs a minimum number of logged days and will say "not enough evidence yet" instead of showing a confident guess. Complete the calibration sessions in chapter 5 to move them onto your own numbers.

These are wellness models, not clinical ones, and they assume you are not on a rate-controlling medication such as a beta-blocker — such medication flattens heart-rate reserve and invalidates every number on this page.

---

20. Reporting a problem

Send a bug report. From any screen, open the report dialog and describe what happened. The app attaches the technical context needed to reproduce it: the page you were on, the transport in use, your device, recent connection log lines, your consent settings and the build version. It does not attach your vitals, your contacts or any share link.

If the report cannot be sent — no network, or the service is briefly rate-limited — it is not lost. It is parked on this device and retried automatically over the next few hours, including after you close and reopen the app. You can also copy or download the report and send it yourself.

The maintenance view. Support may ask you to open a hidden diagnostics page (/debug/sentry, or press Ctrl/Cmd + Alt + S). It is not part of the product and is safe to look at: it shows whether this build's version matches the one crash reports are recorded against, whether the reporting service is reachable, and what any queued reports are waiting for. Nothing on it transmits health data.

---

17. Glossary

A_rms — root-mean-square difference against a reference; the accuracy statistic used by ISO 80601-2-61. Bland–Altman — a method-comparison analysis reporting bias and limits of agreement rather than correlation. Breakdown point — the fraction of contaminated data an estimator tolerates before it becomes arbitrary. Theil–Sen: ~29 %. Least squares: 0 %. CCC (Lin's concordance) — agreement measure penalising both scatter and systematic offset; correlation alone cannot detect a constant bias. Deming regression — line fitting where both variables carry error; required for method comparison. FDR (Benjamini–Hochberg) — controls the expected proportion of false discoveries among many simultaneous tests. Frame confidence — timeliness × freshness × provenance × integrity, in [0.05, 1]; below 0.35 the frame is excluded. LTTB — Largest-Triangle-Three-Buckets: chart downsampling that keeps peaks and troughs visible instead of averaging them away. NEWS2 — National Early Warning Score 2, the aggregate physiological early-warning score the Sentinel uses as its methodological source. Storage tier — critical / standard / bulk classification that decides which local data is shed first when the device runs out of room. Transport scope — the identity of the watch a transport override applies to; overrides are saved per watch. Kish effective sample size — how many equally weighted samples your weighted sample is really worth. Lomb–Scargle — spectral estimation for irregularly sampled series; correct for RR intervals, unlike an FFT on interpolated data. Malik filter — rejects an RR interval differing by more than 20 % from its predecessor. Mann–Kendall — non-parametric test for monotone trend. ODI-3% — oxygen desaturation index: 3 %-or-greater desaturation events per hour. Pettitt test — non-parametric change-point detection. pNN50 — percentage of successive NN intervals differing by more than 50 ms. Poincaré SD1/SD2 — short- and long-term variability from the RR scatter plot. RMSSD — root mean square of successive NN differences; the standard short-term vagal index. Shrinkage (empirical Bayes) — pulling a small-sample personal estimate toward a population prior in proportion to how little data supports it. Theil–Sen — robust slope estimator, the median of all pairwise slopes. TRIMP — training impulse; exercise load weighted exponentially by heart-rate reserve.

---

Added in revision 1.3

---

18. Support and escalation

For a clinical question, export the relevant dossier or session PDF and take it to a clinician; the report contains the measurement conditions, the confidence ledger and the standards each number is based on, which is what makes it discussable.

For an instrument question — a channel reported restricted, a link that will not hold, a calibration that will not converge — start with §3, then the Relay checklist, then the Calibration Lab's own diagnostics. Each of those screens reports live probe results rather than remembered flags, so what they show is the current truth about your setup.