Add phone-based step source via Health Connect

app/src/main/AndroidManifest.xml

@@ -42,7 +42,9 @@
     <!-- Phase 8: Health Connect export (write-only). Exactly the Phase 1–4 data types from
          docs/health-connect-integration.md — Phase 5 types (blood pressure, glucose, respiratory
          rate, VO2max, resting HR, nutrition) - the Phase 5 "beyond iOS" types, added in Phase 5 so the
-         first permission sheet stayed narrow. No READ_* permissions anywhere. -->
+         first permission sheet stayed narrow. READ_STEPS below is the one exception: it supports
+         the optional phone step source, and users on the default "Ring" source never see the
+         Health Connect read prompt and never trigger a read. -->
     <uses-permission android:name="android.permission.health.WRITE_HEART_RATE" />
     <uses-permission android:name="android.permission.health.WRITE_OXYGEN_SATURATION" />
     <uses-permission android:name="android.permission.health.WRITE_HEART_RATE_VARIABILITY" />
@@ -62,6 +64,10 @@
     <uses-permission android:name="android.permission.health.WRITE_VO2_MAX" />
     <uses-permission android:name="android.permission.health.WRITE_RESTING_HEART_RATE" />
     <uses-permission android:name="android.permission.health.WRITE_NUTRITION" />
+    <!-- Phone step source (fork feature): the only Health Connect READ permission the app
+         requests, and only when the user opts into "Phone" as their step source. Default
+         ("Ring") users never trigger a read and never see the prompt. -->
+    <uses-permission android:name="android.permission.health.READ_STEPS" />
 
     <application
         android:name=".PulseLoopApplication"

app/src/main/java/com/pulseloop/AppServices.kt

@@ -35,6 +35,7 @@ class AppServices private constructor(context: Context) {
     val db: PulseLoopDatabase = PulseLoopDatabase.getInstance(context)
     val bleClient = RingBLEClient(context)
     val apiKeyStore = ApiKeyStore(context)
+    val stepSourcePrefs = com.pulseloop.settings.StepSourcePrefs(context)
     val coordinator = RingSyncCoordinator(bleClient, db, apiKeyStore)
     val gpsRecorder = GpsRouteRecorder(context, db)
     val liveWorkout = LiveWorkoutManager(coordinator, db, gpsRecorder, context)
@@ -47,7 +48,7 @@ class AppServices private constructor(context: Context) {
     )
     val batteryAlerts = BatteryAlertMonitor(context)
     val providerStore = CoachProviderSettingsStore(context)
-    val summaryCoordinator = CoachSummaryCoordinator(db, apiKeyStore, providerStore)
+    val summaryCoordinator = CoachSummaryCoordinator(db, apiKeyStore, providerStore, stepSourcePrefs)
 
     // iOS #94: runs the due check-in slot the moment a full sync completes, so a slot the periodic
     // worker skipped for stale data is delivered a few minutes later instead of being lost.

app/src/main/java/com/pulseloop/MainActivity.kt

@@ -12,6 +12,7 @@ import androidx.activity.result.contract.ActivityResultContracts
 import androidx.core.content.ContextCompat
 import com.pulseloop.health.HealthConnectPermissionReconcile
 import com.pulseloop.notifications.CoachNotifications
+import com.pulseloop.settings.StepSourcePrefs
 import com.pulseloop.strava.StravaAuth
 import com.pulseloop.strava.StravaTokenStore
 import com.pulseloop.ui.PulseLoopApp
@@ -25,6 +26,13 @@ import kotlinx.coroutines.launch
  *   - Android 12+: BLUETOOTH_SCAN + BLUETOOTH_CONNECT
  *   - Android < 12: ACCESS_FINE_LOCATION (for BLE scanning)
  *   - Android 13+: POST_NOTIFICATIONS
+ *
+ * Health Connect READ_STEPS is deliberately **not** requested here — it is
+ * requested only from the Step Source row in Settings, on the user's explicit
+ * action. This means users on the default "Ring" step source never see the
+ * prompt, and users who declined are not asked again on every foreground.
+ * ACTIVITY_RECOGNITION is not requested at all: the fork reads steps from
+ * Health Connect, never from the raw hardware step counter.
  */
 class MainActivity : ComponentActivity() {
 
@@ -68,6 +76,7 @@ class MainActivity : ComponentActivity() {
         super.onResume()
         // Re-request on resume in case user granted in Settings
         requestAllPermissions()
+        refreshPhoneSteps()
         if (hasAllBlePermissions() && hasNotificationPermission()) {
             CoachNotifications.schedule(this)
         }
@@ -193,4 +202,52 @@ class MainActivity : ComponentActivity() {
     private fun hasFineLocation() = ContextCompat.checkSelfPermission(
         this, Manifest.permission.ACCESS_FINE_LOCATION
     ) == PackageManager.PERMISSION_GRANTED
+
+    /**
+     * Refresh today's phone step count and backfill the last 30 days from
+     * Health Connect, when the user's step source is set to "Phone".
+     *
+     * If the Health Connect read permission is missing, this quietly returns
+     * without prompting. The permission is requested from Settings → Step
+     * Source, on the user's explicit action — never from here, so neither app
+     * launch nor return-to-foreground re-triggers a dialog the user may have
+     * already declined.
+     *
+     * On failure, publishes [PulseEvent.PhoneStepSourceUnavailable]. The
+     * persistence layer responds by clearing *today's* `phoneSteps` on the
+     * `activity_daily` row, so the display's read-time pick falls back to
+     * the ring's live count instead of leaving a stale phone value on screen
+     * for the rest of the day. Historical days keep their `phoneSteps`.
+     */
+    private fun refreshPhoneSteps() {
+        val prefs = StepSourcePrefs(this)
+        if (prefs.stepSource != StepSourcePrefs.SOURCE_PHONE) return
+
+        lifecycleScope.launch(Dispatchers.IO) {
+            val manager = PhoneStepManager(this@MainActivity)
+            if (!manager.refresh()) {
+                // The phone reader couldn't produce a value — permission revoked, the
+                // provider uninstalled, or a device with no Health Connect. Signal the
+                // persistence layer so it clears today's phoneSteps and the display falls
+                // back to the ring's live count instead of a stale phone value.
+                com.pulseloop.ring.PulseEventBus.publishBlocking(
+                    com.pulseloop.ring.PulseEvent.PhoneStepSourceUnavailable
+                )
+                return@launch
+            }
+            // A10: the 30-day historical backfill runs at most once per local day. It has to
+            // run today's refresh on every foreground — the phone has been walking since the
+            // last one — but re-reading 30 days of Health Connect on every resume, writing
+            // every row's updatedAt forward, and having the exporter re-select and re-export
+            // the whole tail is wasted work. The toggle in SettingsScreen still calls
+            // refreshHistoricalDays() directly and is not throttled: an explicit user action
+            // should always run.
+            val today = com.pulseloop.util.TimeUtil.startOfTodayLocal()
+            if (prefs.lastBackfillDay != today) {
+                if (manager.refreshHistoricalDays()) {
+                    prefs.lastBackfillDay = today
+                }
+            }
+        }
+    }
 }