diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3bc25225..641c5cb9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > from git history and grouped by theme rather than exhaustive per-commit
 > detail.
 
+## [5.1.0] - unreleased
+
+### Added
+- **Start a logger download from the app while the logger sits on its menu.**
+  With a Fledgling running the new firmware, Connect works without pressing
+  Transfer on the logger first. The logger only opens up once the app proves it
+  knows the logger's 4-digit PIN, which the app learns automatically the next
+  time you start a transfer from the logger itself. A logger it hasn't seen
+  before asks for the PIN once (shown on the logger under Transfer → PIN). Too
+  many wrong PINs lock the logger for a while, and the Insta360 camera always
+  gets the radio first. Reading the PIN on the logger takes it off its main
+  menu: the app waits, and once you're back on the menu and enter the PIN it
+  reconnects on its own. If the logger ends the session itself (camera, engine
+  started, or 10 minutes idle) the app tells you why. Older loggers connect as
+  before, about 2 seconds slower while the app checks. (Plan 0031.)
+- **Remote Transfer setting** on the Device tab, to turn this off per logger.
+
+### Changed
+- The Device tab's Bluetooth PIN now has to be exactly four digits (leading
+  zeros are fine), matching what the logger accepts.
+
 ## [5.0.0] - 2026-10-04
 
 ### Added
diff --git a/CLAUDE.md b/CLAUDE.md
index e0c66b42..ec586d93 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -143,7 +143,7 @@ src/
 │   ├── insta360/          # ★ Native-only Insta360 camera bridge (plan 0025): ipc (insta360_* over the lazy Tauri loader), nativePlayer (the camera stream as a <video>-shaped VideoSurface for useVideoSync), playerClock + pose (pure, tested)
 │   ├── videoPlaylist.ts   # ★ Pure GoPro chunked-video model: parse/order GH/GX/GP/GOPR chunk names, build a virtual timeline (cumulative offsets) + virtual↔local time mapping + planAudioSegments (export audio stitch). useVideoSync swaps the <video> src per chunk; a single file is a 1-chunk playlist
 │   ├── satelliteImagery.ts # ★ Esri Wayback parsing (online-only satellite imagery-date picker)
-│   ├── ble/               # Web Bluetooth DovesLapTimer protocol + firmware OTA (→ docs/ble.md)
+│   ├── ble/               # Web Bluetooth DovesLapTimer protocol + firmware OTA (→ docs/ble.md); auth.ts = remote-transfer PIN handshake, dynamic-imported by DeviceContext.connect (plan 0031, wire spec docs/ble-protocol.md §3.3) + pinStore.ts (per-logger PIN, local only)
 │   ├── db/                # Admin DB layer: ITrackDatabase + supabaseAdapter + getDatabase()
 │   ├── billing*.ts        # Subscription logic + Supabase billing I/O (→ docs/backend.md)
 │   ├── weatherService.ts  # Historical weather (online-only): NWS/IEM METAR → Open-Meteo fallback
@@ -489,8 +489,10 @@ re-merges it into the main chunk — watch for this.
 **Lazy (off the initial path):** routes (`Login`, `Admin`, `Register`, `Privacy`);
 view tabs (`RaceLineTab`, `GraphViewTab`, `CoachTab`, `ToolsTab`, `SetupsTab`); `FileManagerDrawer`;
 `DataloggerDownload` — the Fledgling BLE flow, mounted on demand by the eager
-`LoggerDownload` picker host so `lib/ble/*` stays off the landing payload while the
-menu still opens instantly; `CourseSectorEditor` (carries
+`LoggerDownload` picker host so the BLE protocol modules stay off the landing
+payload while the menu still opens instantly (the eager `DeviceContext` carries only
+`lib/ble/connection.ts`; it dynamic-imports the PIN handshake `lib/ble/auth` and lazy-loads
+`LoggerPinDialog` on first connect); `CourseSectorEditor` (carries
 `@dnd-kit/*`). Lazy components must render inside `<Suspense>`; use
 `lazy(() => import('…').then((m) => ({ default: m.Named })))` for named exports.
 
diff --git a/docs/ble-protocol.md b/docs/ble-protocol.md
index 991f1e0e..845ad1e9 100644
--- a/docs/ble-protocol.md
+++ b/docs/ble-protocol.md
@@ -105,6 +105,10 @@ Standard read-only service; the firmware publishes its identity here via Adafrui
    stability).
 6. **Subscribe** to the notify characteristic(s) a given protocol uses
    **before** writing the command that triggers them (see each protocol below).
+7. **Authenticate** with `AUTH?` before anything else (§3.3). A logger started
+   from its own Transfer menu answers `AUTH:OPEN`; one reached from its main menu
+   (remote transfer) refuses everything but the handshake and `BATT` until the
+   PIN is proven; pre-PIN firmware says nothing.
 
 > **No DFU service is requested.** Firmware updates ride the `0x1820` file service
 > (see §10). Chrome's Web Bluetooth blocklist bans the Nordic legacy DFU service,
@@ -130,6 +134,94 @@ Just drop the GATT connection. Safe to call when already disconnected. Some flow
 (settings reset, firmware apply) expect the device to reboot and the link to drop
 on its own — treat that disconnect as expected.
 
+### 3.3 Remote transfer & the PIN handshake (`AUTH`, `PINGET`)
+
+Logger plan 0019 / viewer plan 0031. While the logger sits on its **main menu**
+with the `remote_transfer` setting `on`, it advertises the same `0x1820` service
+in a **locked** mode: only `AUTH?`, `AUTH:<answer>` and `BATT` are accepted;
+anything else answers `AUTH:REQUIRED`. A correct answer turns the logger into the
+transfer page (labelled *Remote Transfer*) and every command except `PINGET`
+opens up. A transfer started on the logger itself (Transfer → Bluetooth) is
+**open**: everything is allowed, including `PINGET`.
+
+```
+client → 0x2A3E : "AUTH?"
+device → 0x2A40 : "AUTH:NONCE:<32 hex>"      (locked: a fresh 16-byte nonce)
+               |  "AUTH:OPEN"                 (local start — nothing to prove)
+               |  "AUTH:OK"                   (already authenticated)
+               |  "AUTH:LOCKED:<seconds>"     (lockout running)
+               |  "AUTH:BUSY"                 (a check is in flight / RNG busy)
+               |  (silence)                   (pre-0019 firmware — confirm, below)
+
+client → 0x2A3E : "AUTH:<32 hex answer>"
+device → 0x2A40 : "AUTH:OK"                   (session promoted to a transfer)
+               |  "AUTH:FAIL:<tries left>"    (nonce consumed — ask for a new one)
+               |  "AUTH:LOCKED:<seconds>"
+               |  "AUTH:NO_NONCE"             (answer without a pending nonce)
+               |  "AUTH:BUSY"                 (PIN unreadable right now — nonce kept,
+                                               no try counted; resend the answer)
+```
+
+**Session-ending notices.** The logger may send one of these **unprompted, at any
+time** — mid-handshake, while the user is typing the PIN, or on an authenticated
+session — and then drops the link:
+
+| Notice | Meaning |
+|---|---|
+| `AUTH:TIMEOUT` | 20 s squat limit: not authenticated in time (locked sessions only) |
+| `AUTH:CAMERA` | the Insta360 auto-record needs the radio (camera waking, recording, or its bench page) |
+| `AUTH:ENGINE` | a remote session ended because the engine started (the logger goes back to logging) — sent for an engine start even with a paired camera |
+| `AUTH:IDLE` | a remote session ended after 10 min with no transfer commands |
+
+A client must not read any of them as the reply to the command it just sent,
+and should tell the user why the link went away.
+
+**Legacy detection.** Pre-0019 firmware ignores `AUTH?`, but silence can also be
+a slow reply. After **2 s** of silence send a settings read (`SGET:bluetooth_name`)
+and keep listening: pre-PIN firmware answers it (`SVAL:` / `SERR:` / `SBUSY`), a
+locked logger answers `AUTH:REQUIRED` (send `AUTH?` again), and a late reply to
+the first `AUTH?` still counts. No answer at all within ~3 s more → treat as
+pre-PIN firmware. Every legacy connect pays this ~2 s, every time.
+
+**answer** = the first 16 bytes, lowercase hex, of
+`HMAC-SHA256(key = PIN as ASCII, msg = "BEAUTH1|" + nonceHex)`, where `nonceHex`
+is the 32 hex characters exactly as received. The device compares
+case-insensitively in constant time. Golden vectors (firmware
+`tests/remote_auth_test.cpp`, `src/lib/ble/auth.test.ts`, LapWing):
+
+| PIN | nonce | answer |
+|---|---|---|
+| `4821` | `00112233445566778899aabbccddeeff` | `4936f5dad4502101eb0f65790cca77b4` |
+| `1000` | `ffffffffffffffffffffffffffffffff` | `3db7fac4dc48559fa85594079b59fce4` |
+
+- **Lockout:** 5 wrong answers lock for 60 s, doubling per lockout up to 15 min.
+  RAM-only — a power cycle clears it.
+- **Squat limit:** a locked session that hasn't authenticated within **20 s** of
+  connecting gets `AUTH:TIMEOUT` and is dropped. Prompting a user for the PIN
+  counts against it.
+- **The camera always wins.** If the Insta360 auto-record needs the radio (camera
+  waking or recording), the logger sends `AUTH:CAMERA` and drops a remote session —
+  before or after authentication. An engine start ends a remote session with
+  `AUTH:ENGINE` instead, camera paired or not.
+- **Leaving the main menu drops a locked session** without a notice. Reading the
+  PIN (Transfer → PIN) does exactly that, so a client that prompts for the PIN
+  should reconnect after the user returns the logger to its menu and rerun the
+  handshake with the typed PIN (the web client does).
+- **`PINGET`** → `PIN:<4 digits>`, **open sessions only** (`AUTH:REQUIRED`
+  otherwise). `SERR:NOT_FOUND` means the logger has no valid PIN stored right
+  now: treat it as "nothing learned", not as an error.
+- **`AUTH:BUSY` to an answer** also means the logger couldn't read its own PIN
+  (SD busy, settings unreadable): the nonce is kept and no try is counted, so
+  resending the same answer once is safe. This is how a client learns the PIN without anyone typing it: a
+  local start hands it over, and the client stores it for the next remote start.
+- **The PIN is 4 digits, leading zeros allowed.** Shown on the logger under
+  Transfer → PIN (hold Select to reveal; it hides itself again).
+
+> **Security limit.** The link is unencrypted (Just Works), so the handshake is a
+> gate against a casual nearby phone, not against a sniffer: a captured nonce +
+> answer can be brute-forced offline across the 10 000 PINs. Changing the PIN
+> (Transfer → PIN → New PIN on the logger, or `SSET`) is the remedy.
+
 ---
 
 ## 4. Command summary
@@ -142,6 +234,10 @@ channel and terminator differ per command.
 | `LIST` | `0x2A3D` | `…END` (anchored at end) | (timeout) |
 | `GET:<filename>` | `0x2A40` then `0x2A3F` | `SIZE:<n>` → data chunks → `DONE` | `ERROR` |
 | `BATT` | `0x2A40` | `BATT:<pct>,<volt>` | (timeout) |
+| `AUTH?` | `0x2A40` | `AUTH:NONCE:<hex>` / `AUTH:OPEN` / `AUTH:OK` (§3.3) | `AUTH:LOCKED:<s>` / `AUTH:BUSY` / (silence = legacy) |
+| `AUTH:<answer>` | `0x2A40` | `AUTH:OK` (§3.3) | `AUTH:FAIL:<n>` / `AUTH:LOCKED:<s>` / `AUTH:NO_NONCE` / `AUTH:BUSY` |
+| `PINGET` | `0x2A40` | `PIN:<4 digits>` (open sessions only) | `AUTH:REQUIRED` / `SERR:NOT_FOUND` / `SBUSY` |
+| (unprompted) | `0x2A40` | — | `AUTH:TIMEOUT` / `AUTH:CAMERA` / `AUTH:ENGINE` / `AUTH:IDLE`, then the link drops (§3.3) |
 | `SLIST` | `0x2A40` | `SVAL:<k>=<v>` … → `SEND` | — |
 | `SGET:<key>` | `0x2A40` | `SVAL:<key>=<value>` | `SERR:<reason>` |
 | `SSET:<key>=<value>` | `0x2A40` | `SOK:<key>` | `SERR:<reason>` |
@@ -266,6 +362,9 @@ device → 0x2A40 : "SEND"                 (terminator)
 Parse each `SVAL:` line by splitting on the **first** `=`. Build a `key → value`
 map. Resolve on `SEND`. Reset a ~3 s idle timer per message; hard timeout ~10 s.
 
+PIN-gated firmware (§3.3) **omits `bluetooth_pin`** from the list; read it with
+`PINGET` on an open session instead.
+
 ### 8.2 Get one (`SGET:<key>`)
 
 ```
@@ -275,7 +374,8 @@ device → 0x2A40 : "SVAL:<key>=<value>"   (match the requested key)
 device → 0x2A40 : "SERR:<reason>"        e.g. "SERR:NOT_FOUND"
 ```
 
-Timeout ~5 s.
+Timeout ~5 s. `SGET:bluetooth_pin` answers `SERR:PROTECTED` on PIN-gated
+firmware (§3.3).
 
 ### 8.3 Set one (`SSET:<key>=<value>`)
 
@@ -286,7 +386,8 @@ device → 0x2A40 : "SOK:<key>"            (success; "SOK: <key>" with a space a
 device → 0x2A40 : "SERR:<reason>"        e.g. "SERR:WRITE_FAIL"
 ```
 
-Timeout ~5 s.
+Timeout ~5 s. `SSET:bluetooth_pin=` takes exactly four digits (`SERR:BAD_VALUE`
+otherwise) and is live for the next handshake.
 
 ### 8.4 Factory reset (`SRESET`)
 
@@ -298,6 +399,9 @@ device → 0x2A40 : "SOK:RESET"            (then the device reboots)
 After `SOK:RESET` the device reboots — the client should **disconnect immediately**
 and expect the link to drop. Timeout ~10 s. Errors as `SERR:<reason>`.
 
+On PIN-gated firmware (§3.3) the reset **keeps a valid `bluetooth_pin`** (an
+invalid one is regenerated), so a client's stored PIN stays good across it.
+
 ### 8.5 Known settings (schema)
 
 | Key | Type | Range / max | Meaning |
@@ -549,6 +653,8 @@ new `ble/index.ts` re-export the public surface.
 | `types.ts` | `BleConnection`, `FileInfo`, `DownloadProgress`, `BatteryInfo` |
 | `fileTransfer.ts` | `LIST` + `GET:` (§5, §6) |
 | `battery.ts` | `BATT` (§7) |
+| `auth.ts` | `AUTH?` / `AUTH:` / `PINGET` handshake (§3.3) |
+| `pinStore.ts` | Per-logger PIN memory (browser storage, never cloud-synced) |
 | `settings.ts` | `SLIST` / `SGET` / `SSET` / `SRESET` (§8) |
 | `trackSync.ts` | `TLIST` / `TGET` / `TPUT` / `TDEL` (§9) |
 | `firmwareCrc.ts` | CRC-32/IEEE (§10) |
@@ -583,4 +689,9 @@ For a non-Web-Bluetooth central (btleplug/`tauri-plugin-blec`, bleak, etc.):
 8. **Honor the timeouts** in §4–§10; use a per-chunk watchdog (not a total cap) for
    large transfers.
 9. **Expect reboots** on `SRESET` and `FWAPPLY` — treat the disconnect as expected.
+10. **Run the §3.3 handshake first**, against the golden vectors. Confirm 2 s of
+    silence to `AUTH?` with the settings-read probe before treating the logger as
+    pre-PIN firmware, accept only the replies each step expects (drop anything
+    queued before the command), and handle the unprompted session-ending notices
+    anywhere.
 </content>
diff --git a/docs/ble.md b/docs/ble.md
index 999163a9..7c5679f0 100644
--- a/docs/ble.md
+++ b/docs/ble.md
@@ -16,7 +16,10 @@ state lives in `DeviceContext.tsx` (wraps the app tree in `Index.tsx`). Source:
 The user reaches the BLE flow through `LoggerDownload` → `LoggerPicker` (an eager,
 lightweight image chooser of supported loggers). Picking the PerchWerks Fledgling
 tile mounts `DataloggerDownload` — the lazy Web Bluetooth flow — on demand, so
-`lib/ble/*` stays out of the initial bundle while the menu still opens instantly.
+the protocol modules (file transfer, settings, tracks, firmware) stay out of the
+initial bundle while the menu still opens instantly. The eager `DeviceContext`
+carries only `lib/ble/connection.ts` (picker + GATT open); the PIN handshake
+(`auth.ts`, `pinStore.ts`) and `LoggerPinDialog` load on the first connect.
 On the native (Tauri) shell the webview has no Web Bluetooth, so the Fledgling tile
 instead mounts the lazy `DovesloggerDownload` flow (BLE over native IPC: scan →
 pick device → connect → list → download), the MyChron tile mounts the lazy
@@ -26,6 +29,21 @@ Alfano tile mounts the lazy `AlfanoDownload` flow (Bluetooth serial over native
 explanatory dialogs instead (Alfano uses Bluetooth serial / Classic Bluetooth SPP,
 which Web Bluetooth — BLE GATT only — can't reach, so it has no web path at all).
 
+**Remote transfer PIN (plan 0031).** `DeviceContext.connect` dynamic-imports
+`authenticateLogger()` (`src/lib/ble/auth.ts`) and runs it right after
+`connectToDevice()`, so every web surface gets an authenticated (or open, or
+legacy) link without knowing auth exists. It learns the PIN via `PINGET` on a
+locally started transfer, tries the stored one silently on a remote start, and
+only then opens `LoggerPinDialog` (lazy, mounted by `DeviceProvider`). Reading
+the PIN on the logger leaves its main menu, which drops the link: the dialog
+stays open, and on submit the handshake reconnects the same `BluetoothDevice`
+(`reconnectDevice`, no picker) and reruns with the typed PIN. A camera notice
+closes the dialog. Any failure disconnects and toasts a translated reason. After
+connecting, `watchLinkEndNotices` toasts the logger's own session-ending notices
+(`AUTH:CAMERA` / `ENGINE` / `IDLE`) before the disconnect tears the UI down.
+A Device-tab settings reset keeps the stored PIN (`SRESET` preserves it).
+Wire spec: [`ble-protocol.md`](ble-protocol.md) §3.3.
+
 `DataloggerDownload` talks to the device only through the generic
 `LoggerConnection` interface (`src/lib/loggers/`): `listLogs` / `downloadLog` /
 `disconnect`, with `createFledglingConnection()` adapting a `BleConnection`. MyChron
diff --git a/docs/plans/0031-remote-transfer-pin.md b/docs/plans/0031-remote-transfer-pin.md
new file mode 100644
index 00000000..9a4ef230
--- /dev/null
+++ b/docs/plans/0031-remote-transfer-pin.md
@@ -0,0 +1,130 @@
+# Remote transfer — the app side of the logger's PIN handshake
+
+> Status: **implemented, pending a hardware check** (viewer side). Firmware is
+> DovesDataLogger plan 0019 (PR #168, BETA); the native shell's twin lands in
+> LapWing. The wire spec is `docs/ble-protocol.md` §3.3.
+
+## Problem
+
+Downloading from the Fledgling meant pressing Transfer → Bluetooth on the
+logger, then Connect in the app. The logger is often bolted to a kart in a
+trailer. The ask: let the app start a transfer while the logger sits on its main
+menu, without making that an open door for any phone in the pits, and without
+ever taking the radio from the Insta360 auto-record.
+
+## What the firmware does (logger plan 0019, summarised)
+
+- On the main menu, with `remote_transfer` = `on`, the logger advertises the
+  usual `0x1820` service in a **locked** mode. Only `AUTH?`, `AUTH:<answer>` and
+  `BATT` work until the app proves it knows the 4-digit PIN.
+- Proof = first 16 bytes of `HMAC-SHA256(PIN, "BEAUTH1|" + nonceHex)`, hex. The
+  PIN never crosses the air on a remote start.
+- A correct answer turns the logger into the transfer page ("Remote Transfer").
+- 5 wrong answers → 60 s lockout, doubling to 15 min. 20 s to authenticate.
+- The camera always wins: `AUTH:CAMERA` and the link drops. A remote session
+  also ends with `AUTH:ENGINE` when the engine starts and `AUTH:IDLE` after
+  10 min without transfer commands. Leaving the main menu drops a locked link.
+- A **local** start is open, and `PINGET` hands over the PIN there.
+- Transfer → PIN on the logger shows it (hold Select) and can roll a new one.
+
+## Decisions (app side)
+
+1. **One place runs the handshake: `DeviceContext.connect`.** Every web BLE
+   surface (Device tab, the Fledgling download flow) connects through it, so
+   `authenticateLogger()` runs right after `connectToDevice()` and nothing
+   downstream knows auth exists. A failure disconnects, toasts the reason (not
+   for a user cancel) and returns null — which the download flow already reads
+   as "close".
+2. **Learn the PIN instead of asking for it.** On `AUTH:OPEN` (local start) the
+   app sends `PINGET` and stores the answer. The first remote start after any
+   local one needs no typing. Only a logger the app has never seen locally
+   prompts.
+3. **Stored PIN first, silently; a rejected one is forgotten.** A PIN changed on
+   the logger would otherwise burn a try on every connect. "Rejected" is any
+   verdict but OK — `FAIL`, and `LOCKED` (what the 5th miss returns). The prompt
+   then shows the tries left. A Device-tab settings reset keeps it: the
+   firmware's `SRESET` preserves a valid `bluetooth_pin` (it used to roll a new
+   one, which review M3 flagged; the logger side fixed it there).
+4. **Storage is per device, local, never synced.** `localStorage`, keyed by
+   Web Bluetooth `device.id` only (stable per origin while the permission
+   lasts). The first cut fell back to the advertised name when the browser
+   issued a fresh id; review dropped it — default names come from a 1-in-1000
+   space, so logger B's PIN could be tried on logger A and burn one of A's
+   tries. Old name-keyed entries are never read and are pruned on the next
+   write. Every access is guarded; a private window just means asking again.
+   Cloud sync was rejected: it would move a device secret into a server for a
+   convenience the `PINGET` learning already provides.
+5. **2 s of silence to `AUTH?`, confirmed by a probe = pre-0019 firmware.** It
+   doesn't know the verb and says nothing. Silence alone was too trusting (a
+   slow reply read as legacy, and every later command then got
+   `AUTH:REQUIRED`), so the app follows up with `SGET:bluetooth_name` and keeps
+   listening: old firmware answers it, a locked logger answers `AUTH:REQUIRED`,
+   and a late nonce still counts. The ~2 s is paid on every legacy connect, not
+   once.
+6. **The Device tab still shows the PIN.** New firmware omits it from `SLIST`;
+   the tab injects the stored copy (which the handshake just fetched or proved,
+   so it is current) and re-stores it on a successful `SSET`. The schema now
+   requires exactly four digits (`0042` is a valid PIN) and adds the
+   `remote_transfer` on/off setting.
+7. **Native (LapWing) is separate.** The Tauri shell talks BLE in Rust; it gets
+   its own implementation of the same handshake against the same golden vectors.
+   This plan's code is web-only.
+
+8. **The handshake owns the link until it hands it over.** One queue of status
+   lines per connection; each step accepts only the replies it expects, and the
+   queue is emptied before every write, so a stale or interleaved line is never
+   an answer. The GATT drop and the logger's session-ending notices
+   (`AUTH:TIMEOUT|CAMERA|ENGINE|IDLE`) are watched throughout, the PIN prompt
+   included. `AUTH:BUSY` is retried once (the firmware also sends it when it
+   can't read its PIN, without consuming the nonce); `AUTH:NO_NONCE` fetches a
+   fresh nonce at most 3 times. Any other failure (GATT, write, WebCrypto) is a
+   translated toast, never just a console line.
+9. **Reading the PIN costs the link; the app reconnects.** Transfer → PIN on the
+   logger leaves the main menu, which drops a locked link, and a slow typist
+   hits the 20 s squat limit. Either way the prompt stays open (its copy says to
+   return the logger to the main menu first); on submit the handshake reopens
+   the same `BluetoothDevice` without the picker (`reconnectDevice`) and reruns
+   with the typed PIN, storing it on success. Capped at 2 reconnects. A camera,
+   engine or idle notice closes the prompt with a toast instead — reconnecting
+   can't help there.
+10. **Notices after the handshake are surfaced too.** `watchLinkEndNotices`
+   toasts `AUTH:CAMERA` / `ENGINE` / `IDLE` on a connected logger, before the
+   disconnect tears the Device tab or download dialog down.
+11. **Off the landing payload.** `DeviceContext` dynamic-imports `lib/ble/auth`
+   and lazy-loads `LoggerPinDialog` on the first connect. Unmounting
+   `DeviceProvider` mid-prompt settles the prompt so the half-open link is
+   disconnected rather than leaked.
+
+## Files
+
+- `src/lib/ble/auth.ts` — `computeAuthAnswer` (WebCrypto), `parseAuthReply`,
+  `parseLinkEndNotice`, the line-queue `AuthChannel`, `authenticateLogger`,
+  `watchLinkEndNotices`, `LoggerAuthError`.
+- `src/lib/ble/pinStore.ts` — the per-logger store.
+- `src/lib/ble/connection.ts` — `reconnectDevice` (same device, no picker).
+- `src/components/LoggerPinDialog.tsx` — the prompt, lazy-mounted by `DeviceProvider`.
+- `src/contexts/DeviceContext.tsx` — runs the handshake on connect.
+- `src/components/drawer/DeviceSettingsTab.tsx`, `src/lib/deviceSettingsSchema.ts`.
+- Tests: `src/lib/ble/auth.test.ts` (golden vectors, every reply, legacy probe,
+  busy/no-nonce/timeout, notices and drops mid-prompt, reconnect),
+  `src/lib/ble/pinStore.test.ts`, `src/lib/deviceSettingsSchema.test.ts`.
+
+## Known limits
+
+- **Unencrypted link.** A sniffer that captures a nonce + answer can brute-force
+  10 000 PINs offline. The gate stops a casual phone, not a determined attacker
+  with a sniffer; changing the PIN is the remedy. Documented in the wire spec.
+- **The reconnect needs the logger back on its main menu.** If the user submits
+  while the logger is still on the PIN page, `gatt.connect()` fails and the app
+  says to return it to the menu and connect again.
+- **Hardware check outstanding:** remote start from the menu, wrong-PIN lockout,
+  `AUTH:CAMERA` with a paired X4, a legacy logger connecting after the probe,
+  `AUTH:ENGINE` on an engine start, and the read-the-PIN-then-reconnect path (Chrome's `gatt.connect()` on a
+  device that re-advertises).
+
+## Review follow-up (PR #454)
+
+H1 (prompt on a dead link, typed PIN lost), M1 (non-auth errors only logged),
+M2 (slow reply read as legacy), L1–L6 and the nits are addressed by decisions
+3–5 and 8–11 above. M3 (stale PIN after a settings reset) was fixed in the
+firmware instead: `SRESET` now keeps the PIN, so the app keeps its copy.
diff --git a/src/components/LoggerPinDialog.tsx b/src/components/LoggerPinDialog.tsx
new file mode 100644
index 00000000..94860782
--- /dev/null
+++ b/src/components/LoggerPinDialog.tsx
@@ -0,0 +1,66 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+  Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle,
+} from "@/components/ui/dialog";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import type { PinPromptContext } from "@/lib/ble/auth";
+
+interface LoggerPinDialogProps {
+  /** The open prompt, or null when none is pending. */
+  request: PinPromptContext | null;
+  /** Called once per prompt: the entered PIN, or null on cancel. */
+  onDone: (pin: string | null) => void;
+}
+
+/**
+ * Asks for a logger's 4-digit PIN during a remote transfer start (plan 0031).
+ * The PIN is only needed the first time — the app remembers it per logger.
+ */
+export function LoggerPinDialog({ request, onDone }: LoggerPinDialogProps) {
+  const { t } = useTranslation("drawer");
+  const [pin, setPin] = useState("");
+
+  // Every prompt starts empty — a wrong PIN shouldn't sit there to be resent.
+  useEffect(() => {
+    if (request) setPin("");
+  }, [request]);
+
+  const valid = /^[0-9]{4}$/.test(pin);
+
+  return (
+    <Dialog open={request !== null} onOpenChange={(open) => { if (!open) onDone(null); }}>
+      <DialogContent className="max-w-sm">
+        <form
+          onSubmit={(e) => {
+            e.preventDefault();
+            if (valid) onDone(pin);
+          }}
+        >
+          <DialogHeader>
+            <DialogTitle>{t("pin.title", { name: request?.deviceName || t("pin.thisLogger") })}</DialogTitle>
+            <DialogDescription>{t("pin.desc")}</DialogDescription>
+          </DialogHeader>
+          <Input
+            className="my-4 text-center text-2xl tracking-[0.5em] font-mono"
+            inputMode="numeric"
+            autoComplete="one-time-code"
+            maxLength={4}
+            autoFocus
+            value={pin}
+            aria-label={t("pin.label")}
+            onChange={(e) => setPin(e.target.value.replace(/[^0-9]/g, "").slice(0, 4))}
+          />
+          {request?.triesLeft !== undefined && (
+            <p role="alert" className="text-sm text-destructive mb-4">{t("pin.wrong", { count: request.triesLeft })}</p>
+          )}
+          <DialogFooter>
+            <Button type="button" variant="ghost" onClick={() => onDone(null)}>{t("pin.cancel")}</Button>
+            <Button type="submit" disabled={!valid}>{t("pin.submit")}</Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/src/components/drawer/DeviceSettingsTab.tsx b/src/components/drawer/DeviceSettingsTab.tsx
index defa431e..818c8fed 100644
--- a/src/components/drawer/DeviceSettingsTab.tsx
+++ b/src/components/drawer/DeviceSettingsTab.tsx
@@ -12,7 +12,7 @@ import {
 } from "@/components/ui/select";
 import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
 import { toast } from "sonner";
-import { type BleConnection } from "@/lib/bleDatalogger";
+import { type BleConnection, loadLoggerPin, saveLoggerPin } from "@/lib/bleDatalogger";
 import type { DeviceDetails } from "@/lib/loggers";
 import {
   DEVICE_SETTINGS_SCHEMA,
@@ -117,6 +117,14 @@ export function DeviceSettingsTab({ details, bleConnection, onResetComplete }: D
     setFetchError(null);
     try {
       const settings = await details.listSettings();
+      // PIN-gated firmware (logger plan 0019) leaves the PIN out of SLIST so a
+      // remote peer can't read the secret that gates it. The handshake that
+      // let us in either fetched it (local start) or proved it (remote), so
+      // the stored copy is the device's current PIN.
+      if (!("bluetooth_pin" in settings) && bleConnection) {
+        const pin = loadLoggerPin(bleConnection.device.id);
+        if (pin) settings.bluetooth_pin = pin;
+      }
       // Build rows: schema-defined keys first (in order), then unknown keys
       const knownKeys = DEVICE_SETTINGS_SCHEMA.map((s) => s.key);
       const orderedKeys = [
@@ -137,7 +145,7 @@ export function DeviceSettingsTab({ details, bleConnection, onResetComplete }: D
     } finally {
       setLoading(false);
     }
-  }, [details, t]);
+  }, [details, bleConnection, t]);
 
   useEffect(() => {
     fetchSettings();
@@ -193,6 +201,9 @@ export function DeviceSettingsTab({ details, bleConnection, onResetComplete }: D
 
     try {
       await details.setSetting(row.key, row.value);
+      if (row.key === "bluetooth_pin" && bleConnection) {
+        saveLoggerPin(bleConnection.device.id, row.value);
+      }
       setRows((prev) =>
         prev.map((r) =>
           r.key === key ? { ...r, originalValue: r.value, saving: false } : r
@@ -215,6 +226,7 @@ export function DeviceSettingsTab({ details, bleConnection, onResetComplete }: D
     setResetting(true);
     try {
       await details.resetSettings();
+      // The stored PIN stays: SRESET keeps the logger's bluetooth_pin.
       toast.success(t("device.toastReset"));
       onResetComplete?.();
     } catch (err) {
diff --git a/src/contexts/DeviceContext.tsx b/src/contexts/DeviceContext.tsx
index 8d2dd6e3..4066b121 100644
--- a/src/contexts/DeviceContext.tsx
+++ b/src/contexts/DeviceContext.tsx
@@ -1,10 +1,16 @@
-import { createContext, useCallback, useContext, useEffect, useRef, useState, type ReactNode } from "react";
+import {
+  createContext, lazy, Suspense, useCallback, useContext, useEffect, useRef, useState, type ReactNode,
+} from "react";
+import { useTranslation } from "react-i18next";
+import { toast } from "sonner";
 import {
   type BleConnection,
   connectToDevice,
   disconnect,
   isBleSupported,
+  reconnectDevice,
 } from "@/lib/bleDatalogger";
+import type { AuthPhase, LinkEndNotice, LoggerAuthError, PinPromptContext } from "@/lib/ble/auth";
 import type { DeviceDetails, LoggerKind } from "@/lib/loggers";
 import { createBleDeviceDetails } from "@/lib/loggers/bleDetails";
 import {
@@ -14,6 +20,12 @@ import {
 } from "@/lib/loggers/native/owner";
 import type { ScannedDevice } from "@/lib/loggers/doveslogger/ipc";
 
+// The remote-transfer PIN handshake (plan 0031) and its prompt load on the
+// first connect, keeping them off the landing payload.
+const LoggerPinDialog = lazy(() =>
+  import("@/components/LoggerPinDialog").then((m) => ({ default: m.LoggerPinDialog })),
+);
+
 /** DeviceContext's label in the native connection-ownership token. */
 const OWNER = "device-tab";
 
@@ -73,6 +85,10 @@ interface DeviceContextValue {
 const DeviceContext = createContext<DeviceContextValue | null>(null);
 
 export function DeviceProvider({ children }: { children: ReactNode }) {
+  const { t } = useTranslation("drawer");
+  // The pending remote-transfer PIN prompt (plan 0031) and how to answer it.
+  const [pinRequest, setPinRequest] = useState<PinPromptContext | null>(null);
+  const pinResolveRef = useRef<((pin: string | null) => void) | null>(null);
   const [connection, setConnection] = useState<BleConnection | null>(null);
   const [nativeConnected, setNativeConnected] = useState(false);
   const [details, setDetails] = useState<DeviceDetails | null>(null);
@@ -84,6 +100,8 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
   const connectionRef = useRef<BleConnection | null>(null);
   const nativeConnectedRef = useRef(false);
   const flashingRef = useRef(false);
+  // Unsubscribes the session-ending-notice watch on the live connection.
+  const stopNoticeWatchRef = useRef<(() => void) | null>(null);
 
   // Keep refs in sync for cleanup
   useEffect(() => {
@@ -99,6 +117,8 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
   }, []);
 
   const handleDisconnect = useCallback(() => {
+    stopNoticeWatchRef.current?.();
+    stopNoticeWatchRef.current = null;
     // During a firmware flash the device reboots into its bootloader; that BLE
     // drop is expected, so keep the UI mounted instead of tearing it down.
     if (flashingRef.current) return;
@@ -109,12 +129,95 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
     setDeviceName(null);
   }, []);
 
+  const promptPin = useCallback((ctx: PinPromptContext, signal: AbortSignal) => {
+    return new Promise<string | null>((resolve) => {
+      // The logger ended the session for good while the prompt was open:
+      // close it (the handshake toasts why).
+      signal.addEventListener("abort", () => {
+        if (pinResolveRef.current !== resolve) return;
+        pinResolveRef.current = null;
+        setPinRequest(null);
+        resolve(null);
+      });
+      pinResolveRef.current = resolve;
+      setPinRequest(ctx);
+    });
+  }, []);
+
+  const finishPinPrompt = useCallback((pin: string | null) => {
+    const resolve = pinResolveRef.current;
+    pinResolveRef.current = null;
+    setPinRequest(null);
+    resolve?.(pin);
+  }, []);
+
+  const authErrorMessage = useCallback((err: LoggerAuthError) => {
+    switch (err.code) {
+      case "locked": return t("pin.errorLocked", { seconds: err.seconds ?? 0 });
+      case "camera": return t("pin.errorCamera");
+      case "timeout": return t("pin.errorTimeout");
+      case "engine": return t("pin.errorEngine");
+      case "idle": return t("pin.errorIdle");
+      case "busy": return t("pin.errorBusy");
+      case "noReply": return t("pin.errorNoReply");
+      case "disconnected": return t("pin.errorDisconnected");
+      default: return t("pin.errorProtocol");
+    }
+  }, [t]);
+
+  const linkEndMessage = useCallback((notice: LinkEndNotice) => {
+    switch (notice) {
+      case "camera": return t("pin.errorCamera");
+      case "engine": return t("pin.errorEngine");
+      case "idle": return t("pin.errorIdle");
+      default: return t("pin.errorTimeout");
+    }
+  }, [t]);
+
   const connectFn = useCallback(async (onStatus?: (msg: string) => void): Promise<BleConnection | null> => {
     if (isConnecting) return null;
     if (connectionRef.current) return connectionRef.current;
     setIsConnecting(true);
+    let conn: BleConnection;
     try {
-      const conn = await connectToDevice(onStatus);
+      conn = await connectToDevice(onStatus);
+    } catch (err) {
+      // User cancelled the picker or connection failed
+      console.warn("BLE connect failed/cancelled:", err);
+      setIsConnecting(false);
+      return null;
+    }
+    try {
+      // A logger started remotely from its menu answers nothing but the PIN
+      // handshake until it is satisfied; a local start or older firmware
+      // passes straight through.
+      const auth = await import("@/lib/ble/auth");
+      const device = conn.device;
+      let result;
+      try {
+        result = await auth.authenticateLogger(conn, {
+          promptPin,
+          reconnect: () => reconnectDevice(device),
+          onPhase: (phase: AuthPhase) => {
+            if (phase === "pin") onStatus?.(t("pin.checking"));
+            else if (phase === "reconnecting") onStatus?.(t("pin.reconnecting"));
+            else onStatus?.(t("pin.handshake"));
+          },
+        });
+      } catch (err) {
+        disconnect(conn);
+        // authenticateLogger only ever rejects with LoggerAuthError.
+        const authErr = err as LoggerAuthError;
+        if (authErr.code !== "cancelled") toast.error(authErrorMessage(authErr));
+        return null;
+      }
+      conn = result.connection;
+      // The logger can end the session on its own (camera, engine start,
+      // idle): say why before the disconnect tears the UI down.
+      stopNoticeWatchRef.current?.();
+      stopNoticeWatchRef.current = auth.watchLinkEndNotices(conn, (notice) => {
+        toast.error(linkEndMessage(notice));
+      });
       // Listen for unexpected disconnects
       conn.device.addEventListener("gattserverdisconnected", handleDisconnect);
       setConnection(conn);
@@ -123,14 +226,15 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
       setLoggerKind("fledgling");
       setDeviceName(conn.device.name ?? "Unknown Device");
       return conn;
-    } catch (err) {
-      // User cancelled the picker or connection failed
-      console.warn("BLE connect failed/cancelled:", err);
+    } catch {
+      // Loading the handshake module failed (offline chunk miss).
+      disconnect(conn);
+      toast.error(t("pin.errorProtocol"));
       return null;
     } finally {
       setIsConnecting(false);
     }
-  }, [isConnecting, handleDisconnect]);
+  }, [isConnecting, handleDisconnect, promptPin, authErrorMessage, linkEndMessage, t]);
 
   const scanNative = useCallback(async (): Promise<ScannedDevice[]> => {
     // Lazy import keeps Tauri off the web/eager graph (Golden Rule #1).
@@ -181,6 +285,11 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
   // Cleanup on unmount
   useEffect(() => {
     return () => {
+      // Settle a PIN prompt still open so the handshake fails and disconnects
+      // its half-open link instead of waiting forever.
+      const resolvePin = pinResolveRef.current;
+      pinResolveRef.current = null;
+      resolvePin?.(null);
       if (connectionRef.current) {
         disconnect(connectionRef.current);
       }
@@ -210,6 +319,11 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
       }}
     >
       {children}
+      {pinRequest && (
+        <Suspense fallback={null}>
+          <LoggerPinDialog request={pinRequest} onDone={finishPinPrompt} />
+        </Suspense>
+      )}
     </DeviceContext.Provider>
   );
 }
diff --git a/src/lib/ble/auth.test.ts b/src/lib/ble/auth.test.ts
new file mode 100644
index 00000000..a2d02ab7
--- /dev/null
+++ b/src/lib/ble/auth.test.ts
@@ -0,0 +1,484 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import {
+  authenticateLogger,
+  BUSY_RETRY_DELAY_MS,
+  computeAuthAnswer,
+  isValidPin,
+  LEGACY_PROBE_TIMEOUT_MS,
+  LEGACY_TIMEOUT_MS,
+  LoggerAuthError,
+  parseAuthReply,
+  parseLinkEndNotice,
+  REPLY_TIMEOUT_MS,
+  watchLinkEndNotices,
+  type PinPromptContext,
+} from "./auth";
+import { loadLoggerPin, saveLoggerPin } from "./pinStore";
+import { createMockConnection, lastWritten, writeCount } from "./__test__/mockBle";
+import type { BleConnection } from "./types";
+
+const NONCE = "00112233445566778899aabbccddeeff";
+/** computeAuthAnswer("4821", NONCE) — the firmware golden vector. */
+const ANSWER_4821 = "AUTH:4936f5dad4502101eb0f65790cca77b4";
+
+// Captured before any test fakes timers: waiting on WebCrypto needs real time.
+const realSetTimeout = globalThis.setTimeout;
+
+function memoryStorage() {
+  const data = new Map<string, string>();
+  return {
+    getItem: (k: string) => data.get(k) ?? null,
+    setItem: (k: string, v: string) => void data.set(k, v),
+    removeItem: (k: string) => void data.delete(k),
+    clear: () => data.clear(),
+  };
+}
+
+type MockLogger = ReturnType<typeof createMockConnection> & {
+  device: EventTarget & { id: string; name: string; gatt: { connected: boolean } };
+};
+
+function loggerConnection(): MockLogger {
+  const conn = createMockConnection();
+  const device = Object.assign(new EventTarget(), { id: "dev-1", name: "BirdsEye-42", gatt: { connected: true } });
+  (conn as { device: unknown }).device = device;
+  return conn as MockLogger;
+}
+
+/** The logger drops the GATT link. */
+function drop(conn: MockLogger) {
+  conn.device.gatt.connected = false;
+  conn.device.dispatchEvent(new Event("gattserverdisconnected"));
+}
+
+const req = (conn: MockLogger) => conn.characteristics.fileRequest;
+const reply = (conn: MockLogger, line: string) => conn.characteristics.fileStatus.simulate(`${line}\n`);
+
+/** Let async work (WebCrypto included) settle until `count` commands were written. */
+async function waitForWrite(conn: MockLogger, count: number) {
+  for (let i = 0; i < 200 && writeCount(req(conn)) < count; i++) {
+    await new Promise((r) => realSetTimeout(r, 1));
+  }
+  expect(writeCount(req(conn))).toBe(count);
+}
+
+/** A PIN prompt the test answers by hand. */
+function manualPrompt() {
+  const calls: { ctx: PinPromptContext; signal: AbortSignal; answer: (pin: string | null) => void }[] = [];
+  const promptPin = vi.fn((ctx: PinPromptContext, signal: AbortSignal) =>
+    new Promise<string | null>((resolve) => calls.push({ ctx, signal, answer: resolve })));
+  return { promptPin, calls };
+}
+
+async function waitForPrompt(calls: unknown[], count: number) {
+  for (let i = 0; i < 200 && calls.length < count; i++) {
+    await new Promise((r) => realSetTimeout(r, 1));
+  }
+  expect(calls.length).toBe(count);
+}
+
+/** Drive a locked logger to the point where it has handed out a nonce. */
+async function startLocked(conn: MockLogger) {
+  await waitForWrite(conn, 1);
+  expect(lastWritten(req(conn))).toBe("AUTH?");
+  reply(conn, `AUTH:NONCE:${NONCE}`);
+}
+
+beforeEach(() => {
+  vi.stubGlobal("localStorage", memoryStorage());
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
+});
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.useRealTimers();
+});
+
+describe("computeAuthAnswer", () => {
+  // Golden vectors shared with the firmware's tests/remote_auth_test.cpp and
+  // LapWing's doveslogger auth tests — all three must agree byte for byte.
+  it("matches the firmware golden vector", async () => {
+    await expect(computeAuthAnswer("4821", NONCE)).resolves.toBe("4936f5dad4502101eb0f65790cca77b4");
+  });
+
+  it("matches the second golden vector", async () => {
+    await expect(computeAuthAnswer("1000", "f".repeat(32))).resolves.toBe("3db7fac4dc48559fa85594079b59fce4");
+  });
+});
+
+describe("isValidPin", () => {
+  it("accepts exactly four digits", () => {
+    expect(isValidPin("0042")).toBe(true);
+    expect(isValidPin("123")).toBe(false);
+    expect(isValidPin("12345")).toBe(false);
+    expect(isValidPin("12a4")).toBe(false);
+  });
+});
+
+describe("parseAuthReply / parseLinkEndNotice", () => {
+  it("parses every firmware reply", () => {
+    expect(parseAuthReply(`AUTH:NONCE:${NONCE}`)).toEqual({ kind: "nonce", nonce: NONCE });
+    expect(parseAuthReply("AUTH:FAIL:3")).toEqual({ kind: "fail", triesLeft: 3 });
+    expect(parseAuthReply("AUTH:LOCKED:60")).toEqual({ kind: "locked", seconds: 60 });
+    expect(parseAuthReply("AUTH:OPEN")).toEqual({ kind: "open" });
+    expect(parseAuthReply("AUTH:OK\r")).toEqual({ kind: "ok" });
+    expect(parseAuthReply("AUTH:NO_NONCE")).toEqual({ kind: "noNonce" });
+    expect(parseAuthReply("AUTH:BUSY")).toEqual({ kind: "busy" });
+    expect(parseAuthReply("AUTH:REQUIRED")).toEqual({ kind: "required" });
+    expect(parseAuthReply("PIN:0042")).toEqual({ kind: "pin", pin: "0042" });
+  });
+
+  it("parses the session-ending notices separately", () => {
+    expect(parseLinkEndNotice("AUTH:TIMEOUT")).toBe("timeout");
+    expect(parseLinkEndNotice("AUTH:CAMERA\r")).toBe("camera");
+    expect(parseLinkEndNotice("AUTH:ENGINE")).toBe("engine");
+    expect(parseLinkEndNotice("AUTH:IDLE")).toBe("idle");
+    expect(parseLinkEndNotice("AUTH:OK")).toBeNull();
+    expect(parseAuthReply("AUTH:CAMERA")).toBeNull();
+  });
+
+  it("ignores unrelated or malformed lines", () => {
+    expect(parseAuthReply("BATT:50,3.7")).toBeNull();
+    expect(parseAuthReply("AUTH:NONCE:xyz")).toBeNull();
+    expect(parseAuthReply("PIN:12")).toBeNull();
+    expect(parseAuthReply("AUTH:FAIL:")).toBeNull();
+  });
+});
+
+describe("authenticateLogger — opening", () => {
+  it("confirms pre-PIN firmware with a settings read after the silence", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    await vi.advanceTimersByTimeAsync(LEGACY_TIMEOUT_MS);
+    await waitForWrite(conn, 2);
+    expect(lastWritten(req(conn))).toBe("SGET:bluetooth_name");
+    reply(conn, "SVAL:bluetooth_name=Logger-1");
+    await expect(result).resolves.toMatchObject({ outcome: "legacy", connection: conn });
+  });
+
+  it("treats total silence as pre-PIN firmware", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    await vi.advanceTimersByTimeAsync(LEGACY_TIMEOUT_MS);
+    await waitForWrite(conn, 2);
+    await vi.advanceTimersByTimeAsync(LEGACY_PROBE_TIMEOUT_MS);
+    await expect(result).resolves.toMatchObject({ outcome: "legacy" });
+  });
+
+  it("does not mistake a nonce that arrives after the silence for legacy firmware", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    await vi.advanceTimersByTimeAsync(LEGACY_TIMEOUT_MS);
+    await waitForWrite(conn, 2);
+    reply(conn, `AUTH:NONCE:${NONCE}`);
+    await waitForWrite(conn, 3);
+    expect(lastWritten(req(conn))).toBe(ANSWER_4821);
+    // The probe's AUTH:REQUIRED lands late; it must not be read as the verdict.
+    reply(conn, "AUTH:REQUIRED");
+    reply(conn, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed" });
+  });
+
+  it("asks for a fresh nonce when the probe says a PIN is required", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    await vi.advanceTimersByTimeAsync(LEGACY_TIMEOUT_MS);
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:REQUIRED");
+    await waitForWrite(conn, 3);
+    expect(lastWritten(req(conn))).toBe("AUTH?");
+    reply(conn, `AUTH:NONCE:${NONCE}`);
+    await waitForWrite(conn, 4);
+    reply(conn, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed" });
+  });
+
+  it("learns the PIN from an open (locally started) session", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    reply(conn, "AUTH:OPEN");
+    await waitForWrite(conn, 2);
+    expect(lastWritten(req(conn))).toBe("PINGET");
+    reply(conn, "PIN:4821");
+    await expect(result).resolves.toMatchObject({ outcome: "open" });
+    expect(loadLoggerPin("dev-1")).toBe("4821");
+  });
+
+  it("does not wait out PINGET when the logger refuses it", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    reply(conn, "AUTH:OPEN");
+    await waitForWrite(conn, 2);
+    reply(conn, "SERR:NOT_FOUND");
+    await expect(result).resolves.toMatchObject({ outcome: "open" });
+    expect(loadLoggerPin("dev-1")).toBeNull();
+  });
+
+  it("retries once when the logger is busy", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    reply(conn, "AUTH:BUSY");
+    await vi.advanceTimersByTimeAsync(BUSY_RETRY_DELAY_MS);
+    await waitForWrite(conn, 2);
+    expect(lastWritten(req(conn))).toBe("AUTH?");
+    reply(conn, `AUTH:NONCE:${NONCE}`);
+    await waitForWrite(conn, 3);
+    // Busy on the answer (the logger couldn't read its PIN): resend it once.
+    reply(conn, "AUTH:BUSY");
+    await vi.advanceTimersByTimeAsync(BUSY_RETRY_DELAY_MS);
+    await waitForWrite(conn, 4);
+    expect(lastWritten(req(conn))).toBe(ANSWER_4821);
+    reply(conn, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed" });
+  });
+
+  it("gives up when the logger stays busy", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:BUSY");
+    await vi.advanceTimersByTimeAsync(BUSY_RETRY_DELAY_MS);
+    await waitForWrite(conn, 3);
+    reply(conn, "AUTH:BUSY");
+    await expect(result).rejects.toMatchObject({ code: "busy" });
+    expect(loadLoggerPin("dev-1")).toBe("4821");
+  });
+});
+
+describe("authenticateLogger — PIN", () => {
+  it("answers silently with a stored PIN", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const promptPin = vi.fn();
+    const result = authenticateLogger(conn, { promptPin });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    expect(lastWritten(req(conn))).toBe(ANSWER_4821);
+    // An unrelated notification in between is not a verdict.
+    reply(conn, "BATT:80,3.9");
+    reply(conn, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed" });
+    expect(promptPin).not.toHaveBeenCalled();
+  });
+
+  it("forgets a rejected PIN and asks the user", async () => {
+    saveLoggerPin("dev-1", "9999");
+    const conn = loggerConnection();
+    const promptPin = vi.fn().mockResolvedValue("4821");
+    const result = authenticateLogger(conn, { promptPin });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:FAIL:4");
+    await waitForWrite(conn, 3);
+    expect(lastWritten(req(conn))).toBe("AUTH?");
+    expect(loadLoggerPin("dev-1")).toBeNull();
+    reply(conn, `AUTH:NONCE:${NONCE}`);
+    await waitForWrite(conn, 4);
+    expect(promptPin).toHaveBeenCalledWith({ deviceName: "BirdsEye-42", triesLeft: 4 }, expect.any(AbortSignal));
+    expect(lastWritten(req(conn))).toBe(ANSWER_4821);
+    reply(conn, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed" });
+    expect(loadLoggerPin("dev-1")).toBe("4821");
+  });
+
+  it("gives up when the user cancels the prompt", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn().mockResolvedValue(null) });
+    await startLocked(conn);
+    await expect(result).rejects.toMatchObject({ code: "cancelled" });
+  });
+
+  it("reports a lockout with its remaining seconds", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    reply(conn, "AUTH:LOCKED:120");
+    const err = await result.catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(LoggerAuthError);
+    expect(err).toMatchObject({ code: "locked", seconds: 120 });
+  });
+
+  it("reports a lockout triggered by a typed PIN and stores nothing", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn().mockResolvedValue("4821") });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:LOCKED:60");
+    await expect(result).rejects.toMatchObject({ code: "locked", seconds: 60 });
+    expect(loadLoggerPin("dev-1")).toBeNull();
+  });
+
+  it("forgets a stored PIN whose answer ends in a lockout", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:LOCKED:60");
+    await expect(result).rejects.toMatchObject({ code: "locked" });
+    expect(loadLoggerPin("dev-1")).toBeNull();
+  });
+
+  it("fetches a fresh nonce on NO_NONCE, a limited number of times", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await startLocked(conn);
+    let writes = 2;
+    for (let round = 0; round < 4; round++) {
+      await waitForWrite(conn, writes);
+      expect(lastWritten(req(conn))).toBe(ANSWER_4821);
+      reply(conn, "AUTH:NO_NONCE");
+      if (round === 3) break;
+      await waitForWrite(conn, writes + 1);
+      expect(lastWritten(req(conn))).toBe("AUTH?");
+      reply(conn, `AUTH:NONCE:${NONCE}`);
+      writes += 2;
+    }
+    await expect(result).rejects.toMatchObject({ code: "protocol" });
+    // NO_NONCE says nothing about the PIN.
+    expect(loadLoggerPin("dev-1")).toBe("4821");
+  });
+
+  it("reports a logger that stops answering", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    const settled = result.catch((e: unknown) => e);
+    await vi.advanceTimersByTimeAsync(REPLY_TIMEOUT_MS);
+    await expect(settled).resolves.toMatchObject({ code: "noReply" });
+  });
+
+  it("maps a failed write to a protocol error", async () => {
+    const conn = loggerConnection();
+    req(conn).writeValue = vi.fn().mockRejectedValue(new DOMException("GATT operation failed", "NetworkError"));
+    await expect(authenticateLogger(conn, { promptPin: vi.fn() })).rejects.toMatchObject({ code: "protocol" });
+  });
+});
+
+describe("authenticateLogger — the link ending", () => {
+  it("reports the camera taking the radio", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:CAMERA");
+    await expect(result).rejects.toMatchObject({ code: "camera" });
+  });
+
+  it("closes the prompt when the camera takes the radio mid-prompt", async () => {
+    const conn = loggerConnection();
+    const { promptPin, calls } = manualPrompt();
+    const result = authenticateLogger(conn, { promptPin, reconnect: vi.fn() });
+    await startLocked(conn);
+    await waitForPrompt(calls, 1);
+    reply(conn, "AUTH:CAMERA");
+    await expect(result).rejects.toMatchObject({ code: "camera" });
+    expect(calls[0].signal.aborted).toBe(true);
+  });
+
+  it("closes the prompt on a drop when it can't reconnect", async () => {
+    const conn = loggerConnection();
+    const { promptPin, calls } = manualPrompt();
+    const result = authenticateLogger(conn, { promptPin });
+    await startLocked(conn);
+    await waitForPrompt(calls, 1);
+    drop(conn);
+    await expect(result).rejects.toMatchObject({ code: "disconnected" });
+    expect(calls[0].signal.aborted).toBe(true);
+  });
+
+  it("reconnects and reuses the typed PIN after the logger left its menu", async () => {
+    const conn = loggerConnection();
+    const fresh = loggerConnection();
+    const reconnect = vi.fn(async (): Promise<BleConnection> => fresh);
+    const { promptPin, calls } = manualPrompt();
+    const result = authenticateLogger(conn, { promptPin, reconnect });
+    await startLocked(conn);
+    await waitForPrompt(calls, 1);
+    // The user opens Transfer → PIN on the logger: it drops the link. The
+    // prompt stays open.
+    drop(conn);
+    await new Promise((r) => realSetTimeout(r, 5));
+    expect(calls[0].signal.aborted).toBe(false);
+    calls[0].answer("4821");
+    await startLocked(fresh);
+    await waitForWrite(fresh, 2);
+    expect(lastWritten(req(fresh))).toBe(ANSWER_4821);
+    reply(fresh, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed", connection: fresh });
+    expect(reconnect).toHaveBeenCalledTimes(1);
+    expect(promptPin).toHaveBeenCalledTimes(1);
+    expect(loadLoggerPin("dev-1")).toBe("4821");
+  });
+
+  it("reconnects after the squat limit runs out during the prompt", async () => {
+    const conn = loggerConnection();
+    const fresh = loggerConnection();
+    const { promptPin, calls } = manualPrompt();
+    const result = authenticateLogger(conn, { promptPin, reconnect: async () => fresh });
+    await startLocked(conn);
+    await waitForPrompt(calls, 1);
+    reply(conn, "AUTH:TIMEOUT");
+    drop(conn);
+    calls[0].answer("4821");
+    await startLocked(fresh);
+    await waitForWrite(fresh, 2);
+    reply(fresh, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed", connection: fresh });
+  });
+
+  it("reports a reconnect that fails", async () => {
+    const conn = loggerConnection();
+    const { promptPin, calls } = manualPrompt();
+    const result = authenticateLogger(conn, {
+      promptPin,
+      reconnect: async () => { throw new DOMException("Connection attempt failed", "NetworkError"); },
+    });
+    await startLocked(conn);
+    await waitForPrompt(calls, 1);
+    drop(conn);
+    calls[0].answer("4821");
+    await expect(result).rejects.toMatchObject({ code: "disconnected" });
+  });
+
+  it("does not reconnect for a drop before any PIN was typed", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const reconnect = vi.fn();
+    const result = authenticateLogger(conn, { promptPin: vi.fn(), reconnect });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    drop(conn);
+    await expect(result).rejects.toMatchObject({ code: "disconnected" });
+    expect(reconnect).not.toHaveBeenCalled();
+  });
+});
+
+describe("watchLinkEndNotices", () => {
+  it("reports the notices that end an authenticated session", () => {
+    const conn = loggerConnection();
+    const seen: string[] = [];
+    const stop = watchLinkEndNotices(conn, (n) => seen.push(n));
+    reply(conn, "AUTH:ENGINE");
+    reply(conn, "BATT:50,3.7");
+    reply(conn, "AUTH:IDLE");
+    stop();
+    reply(conn, "AUTH:CAMERA");
+    expect(seen).toEqual(["engine", "idle"]);
+  });
+});
diff --git a/src/lib/ble/auth.ts b/src/lib/ble/auth.ts
new file mode 100644
index 00000000..4889df79
--- /dev/null
+++ b/src/lib/ble/auth.ts
@@ -0,0 +1,559 @@
+/// <reference types="web-bluetooth" />
+
+import type { BleConnection } from "./types";
+import { bleLog } from "./internal";
+import { forgetLoggerPin, loadLoggerPin, saveLoggerPin } from "./pinStore";
+
+/**
+ * Remote-transfer PIN handshake (plan 0031; firmware side is the logger's
+ * plan 0019).
+ *
+ * A logger sitting on its main menu advertises a LOCKED transfer service: it
+ * answers only `AUTH?`, `AUTH:<answer>` and `BATT` until the app proves it
+ * knows the logger's 4-digit PIN. The proof is an HMAC over a fresh nonce, so
+ * the PIN itself never crosses the air on a remote start:
+ *
+ *   app → `AUTH?`                     logger → `AUTH:NONCE:<32 hex>`
+ *   app → `AUTH:<32 hex answer>`      logger → `AUTH:OK` | `AUTH:FAIL:<tries>`
+ *                                                | `AUTH:LOCKED:<seconds>`
+ *
+ * answer = first 16 bytes of HMAC-SHA256(key = PIN ascii,
+ *                                         msg = "BEAUTH1|" + nonceHex), hex.
+ *
+ * A transfer started ON the logger (Transfer → Bluetooth) is OPEN: `AUTH?`
+ * answers `AUTH:OPEN`, and `PINGET` hands out the PIN — which is how the app
+ * learns it without anyone typing it. Firmware older than 0019 doesn't know
+ * `AUTH?` and says nothing; silence for `LEGACY_TIMEOUT_MS` is then confirmed
+ * with a settings read (a locked logger answers it `AUTH:REQUIRED`) so a slow
+ * reply is never mistaken for old firmware.
+ *
+ * The logger can also end the session on its own with a notice before it
+ * drops the link: `AUTH:TIMEOUT` (20 s without authenticating), `AUTH:CAMERA`
+ * (the Insta360 needs the radio), `AUTH:ENGINE` (the engine started) and
+ * `AUTH:IDLE` (10 min with no transfer commands). The handshake watches for
+ * them, and for the GATT link dropping, the whole time — including while the
+ * user is typing the PIN.
+ */
+
+/** How long to wait for an `AUTH?` reply before probing for pre-PIN firmware. */
+export const LEGACY_TIMEOUT_MS = 2000;
+/** How long the legacy probe (and a late `AUTH?` reply) may take. */
+export const LEGACY_PROBE_TIMEOUT_MS = 3000;
+/**
+ * The legacy probe: every firmware answers a settings read — pre-PIN firmware
+ * with `SVAL`/`SERR`, a locked logger with `AUTH:REQUIRED`.
+ */
+const LEGACY_PROBE = "SGET:bluetooth_name";
+/** Reply wait for every other step (the answer check reads the card). */
+export const REPLY_TIMEOUT_MS = 5000;
+/** Pause before the single retry of a command the logger answered `AUTH:BUSY`. */
+export const BUSY_RETRY_DELAY_MS = 500;
+/** `AUTH:NO_NONCE` → fresh nonce rounds allowed before giving up. */
+const MAX_NO_NONCE_RETRIES = 3;
+/** Reconnects allowed per handshake after the link drops around the PIN prompt. */
+const MAX_RECONNECTS = 2;
+/** Domain-separation prefix, byte-identical to the firmware's `remote_auth`. */
+const AUTH_DOMAIN = "BEAUTH1|";
+/** The answer is the HMAC truncated to this many bytes (32 hex chars). */
+const ANSWER_BYTES = 16;
+
+/** A 4-digit PIN, exactly as the firmware's `remote_auth::isValidPin`. */
+export function isValidPin(pin: string): boolean {
+  return /^[0-9]{4}$/.test(pin);
+}
+
+/** The handshake answer for `pin` against the logger's `nonceHex`. */
+export async function computeAuthAnswer(pin: string, nonceHex: string): Promise<string> {
+  const enc = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(pin),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, enc.encode(AUTH_DOMAIN + nonceHex)));
+  return Array.from(mac.subarray(0, ANSWER_BYTES), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+
+/** One parsed `AUTH:` / `PIN:` reply to a handshake command. */
+export type AuthReply =
+  | { kind: "open" }
+  | { kind: "ok" }
+  | { kind: "nonce"; nonce: string }
+  | { kind: "fail"; triesLeft: number }
+  | { kind: "locked"; seconds: number }
+  | { kind: "noNonce" }
+  | { kind: "busy" }
+  | { kind: "required" }
+  | { kind: "pin"; pin: string };
+
+/** Parse a reply line, or null when it isn't one (link-end notices included). */
+export function parseAuthReply(line: string): AuthReply | null {
+  const l = line.trim();
+  if (l.startsWith("PIN:")) {
+    const pin = l.substring(4);
+    return isValidPin(pin) ? { kind: "pin", pin } : null;
+  }
+  if (!l.startsWith("AUTH:")) return null;
+  const body = l.substring(5);
+  switch (body) {
+    case "OPEN": return { kind: "open" };
+    case "OK": return { kind: "ok" };
+    case "NO_NONCE": return { kind: "noNonce" };
+    case "BUSY": return { kind: "busy" };
+    case "REQUIRED": return { kind: "required" };
+  }
+  if (body.startsWith("NONCE:")) {
+    const nonce = body.substring(6);
+    return /^[0-9a-fA-F]{32}$/.test(nonce) ? { kind: "nonce", nonce } : null;
+  }
+  if (body.startsWith("FAIL:")) {
+    const n = parseInt(body.substring(5), 10);
+    return Number.isNaN(n) ? null : { kind: "fail", triesLeft: n };
+  }
+  if (body.startsWith("LOCKED:")) {
+    const n = parseInt(body.substring(7), 10);
+    return Number.isNaN(n) ? null : { kind: "locked", seconds: n };
+  }
+  return null;
+}
+
+/** A notice the logger sends, unprompted, right before it ends the session. */
+export type LinkEndNotice = "timeout" | "camera" | "engine" | "idle";
+/** Why the link to the logger ended: a notice, or the GATT link just dropping. */
+export type LinkEnd = LinkEndNotice | "lost";
+
+/** Parse a session-ending notice (`AUTH:TIMEOUT|CAMERA|ENGINE|IDLE`), or null. */
+export function parseLinkEndNotice(line: string): LinkEndNotice | null {
+  switch (line.trim()) {
+    case "AUTH:TIMEOUT": return "timeout";
+    case "AUTH:CAMERA": return "camera";
+    case "AUTH:ENGINE": return "engine";
+    case "AUTH:IDLE": return "idle";
+    default: return null;
+  }
+}
+
+/** Every complete, non-empty line in a status notification. */
+function notificationLines(event: Event): string[] {
+  const value = (event.target as BluetoothRemoteGATTCharacteristic).value;
+  if (!value) return [];
+  return new TextDecoder().decode(value).split("\n").map((l) => l.trim()).filter(Boolean);
+}
+
+/** Internal: the link ended while the handshake was using it. */
+class LinkEndedError extends Error {
+  constructor(readonly end: LinkEnd) {
+    super(`logger-link:${end}`);
+    this.name = "LinkEndedError";
+  }
+}
+
+/**
+ * The handshake's view of one connection: a queue of status lines plus a
+ * watch on the link. Lines are only accepted after the command that asks for
+ * them (`send` empties the queue), and each step names the replies it accepts,
+ * so a stale or interleaved line can never be read as an answer.
+ */
+class AuthChannel {
+  ended: LinkEnd | null = null;
+  private lines: string[] = [];
+  private wake: (() => void) | null = null;
+  private readonly endListeners = new Set<(end: LinkEnd) => void>();
+
+  constructor(readonly connection: BleConnection) {}
+
+  private readonly onStatus = (event: Event) => {
+    for (const line of notificationLines(event)) {
+      const notice = parseLinkEndNotice(line);
+      if (notice) this.end(notice);
+      else this.lines.push(line);
+    }
+    this.poke();
+  };
+
+  private readonly onDisconnect = () => this.end("lost");
+
+  async open(): Promise<void> {
+    this.connection.device.addEventListener("gattserverdisconnected", this.onDisconnect);
+    const status = this.connection.characteristics.fileStatus;
+    status.addEventListener("characteristicvaluechanged", this.onStatus);
+    await status.startNotifications();
+  }
+
+  close(): void {
+    this.connection.device.removeEventListener("gattserverdisconnected", this.onDisconnect);
+    this.connection.characteristics.fileStatus.removeEventListener("characteristicvaluechanged", this.onStatus);
+    this.endListeners.clear();
+  }
+
+  /** Call `cb` when the link ends; returns the unsubscribe. */
+  onEnd(cb: (end: LinkEnd) => void): () => void {
+    this.endListeners.add(cb);
+    return () => this.endListeners.delete(cb);
+  }
+
+  private end(end: LinkEnd): void {
+    if (this.ended) return;
+    this.ended = end;
+    for (const cb of this.endListeners) cb(end);
+    this.poke();
+  }
+
+  private poke(): void {
+    const wake = this.wake;
+    this.wake = null;
+    wake?.();
+  }
+
+  private throwIfEnded(): void {
+    if (this.ended) throw new LinkEndedError(this.ended);
+  }
+
+  async send(command: string): Promise<void> {
+    this.throwIfEnded();
+    this.lines = [];
+    bleLog("AUTH →", command.startsWith("AUTH:") ? "AUTH:<answer>" : command);
+    await this.connection.characteristics.fileRequest.writeValue(new TextEncoder().encode(command));
+  }
+
+  /** The first queued or incoming line `match` accepts, or null after `timeoutMs`. */
+  async expect<T>(match: (line: string) => T | null, timeoutMs: number): Promise<T | null> {
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      this.poke();
+    }, timeoutMs);
+    try {
+      for (;;) {
+        this.throwIfEnded();
+        while (this.lines.length > 0) {
+          const hit = match(this.lines.shift()!);
+          if (hit !== null) return hit;
+        }
+        if (timedOut) return null;
+        await new Promise<void>((resolve) => {
+          this.wake = resolve;
+        });
+      }
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+}
+
+/** A matcher accepting only the listed reply kinds. */
+function only<K extends AuthReply["kind"]>(...kinds: K[]) {
+  return (line: string): Extract<AuthReply, { kind: K }> | null => {
+    const reply = parseAuthReply(line);
+    return reply && (kinds as string[]).includes(reply.kind)
+      ? (reply as Extract<AuthReply, { kind: K }>)
+      : null;
+  };
+}
+
+/** Replies to `AUTH?`. */
+const NONCE_REPLY = only("nonce", "open", "ok", "locked", "busy");
+/** Replies to `AUTH:<answer>`. */
+const VERDICT_REPLY = only("ok", "fail", "locked", "noNonce", "busy");
+
+const delay = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
+
+/** Send `command`; on `AUTH:BUSY` wait briefly and send it once more. */
+async function ask<T extends AuthReply>(
+  ch: AuthChannel,
+  command: string,
+  match: (line: string) => T | null,
+): Promise<T | null> {
+  await ch.send(command);
+  const reply = await ch.expect(match, REPLY_TIMEOUT_MS);
+  if (reply?.kind !== "busy") return reply;
+  await delay(BUSY_RETRY_DELAY_MS);
+  await ch.send(command);
+  return ch.expect(match, REPLY_TIMEOUT_MS);
+}
+
+/** Why the PIN is being asked for. */
+export interface PinPromptContext {
+  /** The logger's advertised name, for the prompt's title. */
+  deviceName: string;
+  /** Set when the previous answer was wrong: how many tries remain before a lockout. */
+  triesLeft?: number;
+}
+
+/** What the handshake is doing, for the connect flow's status line. */
+export type AuthPhase = "handshake" | "pin" | "reconnecting";
+
+/** Thrown when the handshake ends without access. `code` drives the UI copy. */
+export class LoggerAuthError extends Error {
+  constructor(
+    readonly code:
+      | "cancelled"
+      | "locked"
+      | "busy"
+      | "noReply"
+      | "disconnected"
+      | "protocol"
+      | LinkEndNotice,
+    readonly seconds?: number,
+  ) {
+    super(`logger-auth:${code}`);
+    this.name = "LoggerAuthError";
+  }
+}
+
+function linkEndError(end: LinkEnd): LoggerAuthError {
+  return new LoggerAuthError(end === "lost" ? "disconnected" : end);
+}
+
+export interface AuthenticateOptions {
+  /**
+   * Ask the user for the PIN; resolve null to give up. `signal` aborts when
+   * the logger ends the session for good while the prompt is open — the
+   * prompt should close (resolving null is fine; the abort wins).
+   */
+  promptPin: (ctx: PinPromptContext, signal: AbortSignal) => Promise<string | null>;
+  /**
+   * Reopen the GATT link to the same logger. When the link drops (or the
+   * logger's 20 s squat limit runs out) around the PIN prompt — reading the
+   * PIN means leaving the logger's main menu — the handshake reconnects and
+   * reruns with the typed PIN. Without it, a dropped link just fails.
+   */
+  reconnect?: () => Promise<BleConnection>;
+  /** Progress for the connect flow's status line. */
+  onPhase?: (phase: AuthPhase) => void;
+}
+
+/** How the connection was cleared for use. */
+export type AuthOutcome = "open" | "authed" | "legacy";
+
+export interface AuthResult {
+  outcome: AuthOutcome;
+  /** The connection to use: a fresh one when the handshake had to reconnect. */
+  connection: BleConnection;
+}
+
+/** Mutable state that survives a reconnect. */
+interface HandshakeState {
+  /** A PIN the user typed that the logger hasn't ruled on yet. */
+  typedPin: string | null;
+}
+
+/**
+ * `AUTH?` with the legacy check: silence, then a settings-read probe. A late
+ * reply to `AUTH?` still wins, and `AUTH:REQUIRED` to the probe means the
+ * nonce got lost, so ask again.
+ */
+async function openingReply(ch: AuthChannel): Promise<AuthReply | "legacy"> {
+  await ch.send("AUTH?");
+  const first = await ch.expect(NONCE_REPLY, LEGACY_TIMEOUT_MS);
+  if (first?.kind === "busy") {
+    await delay(BUSY_RETRY_DELAY_MS);
+    await ch.send("AUTH?");
+    const retried = await ch.expect(NONCE_REPLY, REPLY_TIMEOUT_MS);
+    if (!retried) throw new LoggerAuthError("noReply");
+    return retried;
+  }
+  if (first) return first;
+
+  await ch.send(LEGACY_PROBE);
+  const probe = await ch.expect<AuthReply | "legacy">((line) => {
+    const reply = NONCE_REPLY(line) ?? only("required")(line);
+    if (reply) return reply;
+    return /^(SVAL:|SERR:|SBUSY)/.test(line) ? "legacy" : null;
+  }, LEGACY_PROBE_TIMEOUT_MS);
+  // Nothing at all to a settings read: behave as the app always did.
+  if (probe === null || probe === "legacy") return "legacy";
+  if (probe.kind !== "required") return probe;
+  const again = await ask(ch, "AUTH?", NONCE_REPLY);
+  if (!again) throw new LoggerAuthError("noReply");
+  return again;
+}
+
+/** On an open session, fetch and store the PIN so a later remote start needs no typing. */
+async function learnPin(ch: AuthChannel, deviceId: string): Promise<void> {
+  await ch.send("PINGET");
+  const reply = await ch.expect<AuthReply | "none">((line) => {
+    const r = only("pin", "required")(line);
+    if (r) return r;
+    return /^(SERR|SBUSY)/.test(line) ? "none" : null;
+  }, REPLY_TIMEOUT_MS);
+  if (reply !== null && reply !== "none" && reply.kind === "pin") saveLoggerPin(deviceId, reply.pin);
+}
+
+/**
+ * Ask the user for a PIN. The prompt is closed (and this throws) if the
+ * logger ends the session in a way a reconnect can't fix; a plain drop or the
+ * squat timeout leaves it open when `canReconnect`, since the user is most
+ * likely off reading the PIN on the logger.
+ */
+async function promptForPin(
+  ch: AuthChannel,
+  promptPin: AuthenticateOptions["promptPin"],
+  ctx: PinPromptContext,
+  canReconnect: boolean,
+): Promise<string> {
+  const recoverable = (end: LinkEnd) => canReconnect && (end === "lost" || end === "timeout");
+  if (ch.ended && !recoverable(ch.ended)) throw new LinkEndedError(ch.ended);
+  const abort = new AbortController();
+  let off: () => void = () => {};
+  const aborted = new Promise<null>((resolve) => {
+    off = ch.onEnd((end) => {
+      if (recoverable(end)) return;
+      abort.abort();
+      resolve(null);
+    });
+  });
+  try {
+    for (;;) {
+      const entered = await Promise.race([promptPin(ctx, abort.signal), aborted]);
+      if (abort.signal.aborted) throw new LinkEndedError(ch.ended!);
+      if (entered === null) throw new LoggerAuthError("cancelled");
+      if (isValidPin(entered)) return entered;
+    }
+  } finally {
+    off();
+  }
+}
+
+async function handshake(
+  ch: AuthChannel,
+  state: HandshakeState,
+  { promptPin, reconnect, onPhase }: AuthenticateOptions,
+): Promise<AuthOutcome> {
+  const device = ch.connection.device;
+  const deviceName = device.name ?? "";
+  await ch.open();
+
+  let reply: AuthReply | null | "legacy" = await openingReply(ch);
+  if (reply === "legacy") return "legacy";
+  if (reply.kind === "open") {
+    await learnPin(ch, device.id);
+    return "open";
+  }
+
+  onPhase?.("pin");
+  let pin = state.typedPin ?? loadLoggerPin(device.id);
+  let triesLeft: number | undefined;
+  let noNonceRounds = 0;
+  for (;;) {
+    if (reply === null) throw new LoggerAuthError("noReply");
+    switch (reply.kind) {
+      case "ok": return "authed";
+      case "locked": throw new LoggerAuthError("locked", reply.seconds);
+      case "busy": throw new LoggerAuthError("busy");
+      case "nonce": break;
+      default: throw new LoggerAuthError("protocol");
+    }
+    const nonce = reply.nonce;
+
+    if (pin === null) {
+      pin = await promptForPin(ch, promptPin, { deviceName, triesLeft }, reconnect !== undefined);
+      state.typedPin = pin;
+    }
+
+    const verdict = await ask(ch, `AUTH:${await computeAuthAnswer(pin, nonce)}`, VERDICT_REPLY);
+    if (verdict === null) throw new LoggerAuthError("noReply");
+    switch (verdict.kind) {
+      case "ok":
+        saveLoggerPin(device.id, pin);
+        state.typedPin = null;
+        return "authed";
+      case "fail":
+        // A PIN the logger rejects is dropped (stored or typed), so it can't
+        // keep burning tries on later connects.
+        forgetLoggerPin(device.id);
+        state.typedPin = null;
+        pin = null;
+        triesLeft = verdict.triesLeft;
+        break;
+      case "locked":
+        forgetLoggerPin(device.id);
+        state.typedPin = null;
+        throw new LoggerAuthError("locked", verdict.seconds);
+      case "noNonce":
+        if (++noNonceRounds > MAX_NO_NONCE_RETRIES) throw new LoggerAuthError("protocol");
+        break;
+      case "busy":
+        throw new LoggerAuthError("busy");
+    }
+    // The logger consumes the nonce on every check: ask for a fresh one.
+    reply = await ask(ch, "AUTH?", NONCE_REPLY);
+  }
+}
+
+/**
+ * Run the handshake on a fresh connection. Resolves once the logger accepts
+ * commands, with the connection to use (a new one if it had to reconnect);
+ * rejects with `LoggerAuthError` otherwise (the caller disconnects).
+ *
+ * The stored PIN is tried first and silently; a rejected one is forgotten and
+ * the user is asked. On an open (locally started) session the PIN is fetched
+ * and stored, so the next remote start needs no typing.
+ */
+export async function authenticateLogger(
+  connection: BleConnection,
+  options: AuthenticateOptions,
+): Promise<AuthResult> {
+  const state: HandshakeState = { typedPin: null };
+  let conn = connection;
+  let reconnects = 0;
+  options.onPhase?.("handshake");
+  for (;;) {
+    const ch = new AuthChannel(conn);
+    try {
+      const outcome = await handshake(ch, state, options);
+      return { outcome, connection: conn };
+    } catch (err) {
+      if (err instanceof LoggerAuthError && err.code === "cancelled") throw err;
+      const end: LinkEnd | null =
+        ch.ended ?? (err instanceof LinkEndedError ? err.end : null)
+          ?? (conn.device.gatt?.connected === false ? "lost" : null);
+      const retry =
+        (end === "lost" || end === "timeout")
+        && state.typedPin !== null
+        && options.reconnect !== undefined
+        && reconnects < MAX_RECONNECTS;
+      if (retry) {
+        reconnects++;
+        options.onPhase?.("reconnecting");
+        try {
+          conn = await options.reconnect!();
+        } catch {
+          throw new LoggerAuthError("disconnected");
+        }
+        continue;
+      }
+      if (end) throw linkEndError(end);
+      if (err instanceof LoggerAuthError) throw err;
+      // GATT, write or WebCrypto failures: still a failed connect the user
+      // should hear about.
+      bleLog("AUTH handshake failed:", err);
+      throw new LoggerAuthError("protocol");
+    } finally {
+      ch.close();
+    }
+  }
+}
+
+/**
+ * After the handshake: report the session-ending notices the logger can send
+ * on an open link (`AUTH:CAMERA`, `AUTH:ENGINE`, `AUTH:IDLE`, `AUTH:TIMEOUT`)
+ * just before it drops it. Returns the unsubscribe.
+ */
+export function watchLinkEndNotices(
+  connection: BleConnection,
+  onNotice: (notice: LinkEndNotice) => void,
+): () => void {
+  const status = connection.characteristics.fileStatus;
+  const handle = (event: Event) => {
+    for (const line of notificationLines(event)) {
+      const notice = parseLinkEndNotice(line);
+      if (notice) onNotice(notice);
+    }
+  };
+  status.addEventListener("characteristicvaluechanged", handle);
+  return () => status.removeEventListener("characteristicvaluechanged", handle);
+}
diff --git a/src/lib/ble/connection.ts b/src/lib/ble/connection.ts
index 5b47cc69..80b3414d 100644
--- a/src/lib/ble/connection.ts
+++ b/src/lib/ble/connection.ts
@@ -25,6 +25,25 @@ export async function connectToDevice(
     optionalServices: [DIS_SERVICE_UUID],
   });
 
+  return openGattConnection(device, updateStatus);
+}
+
+/**
+ * Reopen the GATT link to a device the user already picked, without the
+ * browser picker. Used when the logger drops the link mid-handshake (it leaves
+ * its main menu while the user reads the PIN — plan 0031).
+ */
+export async function reconnectDevice(
+  device: BluetoothDevice,
+  onStatusChange?: (status: string) => void,
+): Promise<BleConnection> {
+  return openGattConnection(device, onStatusChange || (() => {}));
+}
+
+async function openGattConnection(
+  device: BluetoothDevice,
+  updateStatus: (status: string) => void,
+): Promise<BleConnection> {
   updateStatus("Connecting...");
   const server = await device.gatt!.connect();
 
diff --git a/src/lib/ble/index.ts b/src/lib/ble/index.ts
index 5d78a415..82b1d012 100644
--- a/src/lib/ble/index.ts
+++ b/src/lib/ble/index.ts
@@ -16,7 +16,7 @@ export type {
 } from "./types";
 
 export { formatBytes, formatSpeed, formatTime } from "./format";
-export { isBleSupported, connectToDevice, disconnect } from "./connection";
+export { isBleSupported, connectToDevice, reconnectDevice, disconnect } from "./connection";
 export { requestFileList, downloadFile } from "./fileTransfer";
 export { requestBatteryLevel } from "./battery";
 export {
@@ -45,3 +45,23 @@ export type {
   UploadOptions,
   ApplyOptions,
 } from "./firmwareUpload";
+
+// Remote-transfer PIN handshake (docs/plans/0031-remote-transfer-pin.md)
+// DeviceContext loads ./auth with a dynamic import so it stays off the eager
+// graph; these re-exports are for code that is already lazy.
+export {
+  authenticateLogger,
+  computeAuthAnswer,
+  isValidPin,
+  LoggerAuthError,
+  watchLinkEndNotices,
+} from "./auth";
+export type {
+  AuthOutcome,
+  AuthPhase,
+  AuthResult,
+  LinkEnd,
+  LinkEndNotice,
+  PinPromptContext,
+} from "./auth";
+export { forgetLoggerPin, loadLoggerPin, saveLoggerPin } from "./pinStore";
diff --git a/src/lib/ble/pinStore.test.ts b/src/lib/ble/pinStore.test.ts
new file mode 100644
index 00000000..fbb0f0b6
--- /dev/null
+++ b/src/lib/ble/pinStore.test.ts
@@ -0,0 +1,57 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { forgetLoggerPin, loadLoggerPin, saveLoggerPin } from "./pinStore";
+
+function memoryStorage(initial: Record<string, string> = {}) {
+  const data = new Map<string, string>(Object.entries(initial));
+  return {
+    data,
+    getItem: (k: string) => data.get(k) ?? null,
+    setItem: (k: string, v: string) => void data.set(k, v),
+    removeItem: (k: string) => void data.delete(k),
+    clear: () => data.clear(),
+  };
+}
+
+afterEach(() => vi.unstubAllGlobals());
+
+describe("pinStore", () => {
+  it("saves, loads and forgets a PIN per device id", () => {
+    vi.stubGlobal("localStorage", memoryStorage());
+    saveLoggerPin("dev-1", "0042");
+    saveLoggerPin("dev-2", "4821");
+    expect(loadLoggerPin("dev-1")).toBe("0042");
+    forgetLoggerPin("dev-1");
+    expect(loadLoggerPin("dev-1")).toBeNull();
+    expect(loadLoggerPin("dev-2")).toBe("4821");
+  });
+
+  it("never falls back to another logger's PIN", () => {
+    // An entry from the first cut of the store, keyed by advertised name.
+    const storage = memoryStorage({ "dove-logger-pins": JSON.stringify({ "name:BirdsEye-42": "4821" }) });
+    vi.stubGlobal("localStorage", storage);
+    expect(loadLoggerPin("dev-1")).toBeNull();
+    saveLoggerPin("dev-1", "1234");
+    // Rewriting the map drops the dead name-keyed entries.
+    expect(JSON.parse(storage.data.get("dove-logger-pins")!)).toEqual({ "id:dev-1": "1234" });
+  });
+
+  it("ignores malformed storage", () => {
+    vi.stubGlobal("localStorage", memoryStorage({ "dove-logger-pins": "{not json" }));
+    expect(loadLoggerPin("dev-1")).toBeNull();
+    vi.stubGlobal("localStorage", memoryStorage({ "dove-logger-pins": "[1,2]" }));
+    expect(loadLoggerPin("dev-1")).toBeNull();
+    vi.stubGlobal("localStorage", memoryStorage({ "dove-logger-pins": JSON.stringify({ "id:dev-1": "12" }) }));
+    expect(loadLoggerPin("dev-1")).toBeNull();
+  });
+
+  it("survives storage that throws", () => {
+    const throwing = {
+      getItem: () => { throw new Error("SecurityError"); },
+      setItem: () => { throw new Error("QuotaExceededError"); },
+    };
+    vi.stubGlobal("localStorage", throwing);
+    expect(() => saveLoggerPin("dev-1", "4821")).not.toThrow();
+    expect(loadLoggerPin("dev-1")).toBeNull();
+    expect(() => forgetLoggerPin("dev-1")).not.toThrow();
+  });
+});
diff --git a/src/lib/ble/pinStore.ts b/src/lib/ble/pinStore.ts
new file mode 100644
index 00000000..f92c0315
--- /dev/null
+++ b/src/lib/ble/pinStore.ts
@@ -0,0 +1,63 @@
+/**
+ * Per-logger PIN memory for remote transfer (plan 0031).
+ *
+ * Device-local on purpose: it is never cloud-synced, and losing it costs one
+ * look at the logger's Transfer → PIN page. Keyed by the Web Bluetooth
+ * `device.id` only (stable per origin while the browser keeps the permission).
+ * There is deliberately no fallback to the advertised name: default names come
+ * from a small space, so a name match could try logger B's PIN on logger A and
+ * burn one of A's tries. A browser that hands out a fresh id just means asking
+ * once more (or learning it again from a local start).
+ *
+ * Every storage access is guarded: a private window, blocked site data or a
+ * malformed entry just means the user is asked again.
+ */
+
+const STORAGE_KEY = "dove-logger-pins";
+
+type PinMap = Record<string, string>;
+
+const idKey = (id: string) => `id:${id}`;
+
+function read(): PinMap {
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY);
+    const parsed: unknown = raw ? JSON.parse(raw) : {};
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as PinMap) : {};
+  } catch {
+    return {};
+  }
+}
+
+function write(map: PinMap): void {
+  // Entries keyed by advertised name came from the first cut of this store;
+  // they are never read, so drop them whenever the map is rewritten.
+  for (const key of Object.keys(map)) {
+    if (!key.startsWith("id:")) delete map[key];
+  }
+  try {
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(map));
+  } catch {
+    // Storage unavailable — the PIN is simply asked for next time.
+  }
+}
+
+/** The stored PIN for this logger, or null. */
+export function loadLoggerPin(deviceId: string): string | null {
+  const pin = read()[idKey(deviceId)];
+  return typeof pin === "string" && /^[0-9]{4}$/.test(pin) ? pin : null;
+}
+
+/** Remember the PIN for this logger. */
+export function saveLoggerPin(deviceId: string, pin: string): void {
+  const map = read();
+  map[idKey(deviceId)] = pin;
+  write(map);
+}
+
+/** Forget this logger's PIN (the logger rejected it). */
+export function forgetLoggerPin(deviceId: string): void {
+  const map = read();
+  delete map[idKey(deviceId)];
+  write(map);
+}
diff --git a/src/lib/deviceSettingsSchema.test.ts b/src/lib/deviceSettingsSchema.test.ts
index 42faec2a..06d9b1f9 100644
--- a/src/lib/deviceSettingsSchema.test.ts
+++ b/src/lib/deviceSettingsSchema.test.ts
@@ -162,6 +162,19 @@ describe("validateSettingValue — number fields", () => {
     );
   });
 
+  // The logger takes exactly four digits (plan 0031): "123" would come back
+  // SERR:BAD_VALUE, and "0042" is a valid PIN even though it reads as 42.
+  it("requires exactly four digits for bluetooth_pin, leading zeros allowed", () => {
+    expect(validateSettingValue("bluetooth_pin", "0042")).toBeNull();
+    expect(validateSettingValue("bluetooth_pin", "123")).toBe("Must be exactly 4 digits");
+  });
+
+  it("offers on/off for remote_transfer", () => {
+    expect(validateSettingValue("remote_transfer", "on")).toBeNull();
+    expect(validateSettingValue("remote_transfer", "off")).toBeNull();
+    expect(validateSettingValue("remote_transfer", "yes")).toMatch(/^Must be one of/);
+  });
+
   // Number("") is 0, so an empty box used to validate as a real zero — fine
   // for lap_detection_distance (min 1 caught it) but NOT for the fields whose
   // range includes 0: an empty bluetooth_pin or led_brightness sailed through
diff --git a/src/lib/deviceSettingsSchema.ts b/src/lib/deviceSettingsSchema.ts
index 88873971..15daac1d 100644
--- a/src/lib/deviceSettingsSchema.ts
+++ b/src/lib/deviceSettingsSchema.ts
@@ -108,6 +108,12 @@ export interface DeviceSettingDef {
    * "disabled" sentinel, which sits below any sane threshold.
    */
   allowZero?: boolean;
+  /**
+   * `number` only: the value must be written with exactly this many digits,
+   * leading zeros allowed. The PIN is a 4-character code, not a quantity —
+   * "123" is not a PIN the logger will take (it answers `SERR:BAD_VALUE`).
+   */
+  exactDigits?: number;
   /**
    * Required for `enum`, ignored otherwise. The device stores a bare string, so
    * a free-text field lets a typo through that the firmware then silently
@@ -150,9 +156,25 @@ export const DEVICE_SETTINGS_SCHEMA: DeviceSettingDef[] = [
     label: 'Bluetooth PIN',
     type: 'number',
     maxLength: 4,
+    exactDigits: 4,
     min: 0,
     max: 9999,
-    description: 'Pairing PIN code (4 digits)',
+    description:
+      'Unlocks a transfer started from the app while the logger sits on its menu. Also shown on the logger under Transfer → PIN',
+  },
+  {
+    // Logger plan 0019 / viewer plan 0031: the menu advertises a PIN-locked
+    // transfer service so the app can start a download without anyone
+    // pressing Transfer on the device.
+    key: 'remote_transfer',
+    label: 'Remote Transfer',
+    type: 'enum',
+    options: [
+      { value: 'on', label: 'On (start transfers from the app, PIN-locked)' },
+      { value: 'off', label: 'Off (only from the logger\'s Transfer menu)' },
+    ],
+    description:
+      'Lets the app start a Bluetooth transfer while the logger sits on its main menu. The camera always takes the radio first',
   },
   {
     key: 'driver_name',
@@ -460,6 +482,9 @@ export function validateSettingValue(key: string, value: string): string | null
     if (def.maxLength !== undefined && value.length > def.maxLength) {
       return `Maximum ${def.maxLength} digits`;
     }
+    if (def.exactDigits !== undefined && !new RegExp(`^[0-9]{${def.exactDigits}}$`).test(value)) {
+      return `Must be exactly ${def.exactDigits} digits`;
+    }
   }
 
   if (def.type === 'string') {
diff --git a/src/locales/de/drawer.json b/src/locales/de/drawer.json
index 780035e6..022290f8 100644
--- a/src/locales/de/drawer.json
+++ b/src/locales/de/drawer.json
@@ -520,5 +520,27 @@
     "deleteConfirmBtn": "Löschen",
     "deleteHasSetups": "Dieser Typ hat gespeicherte Setups – lösche diese zuerst.",
     "deleteDefault": "Der integrierte Standardtyp kann nicht gelöscht werden."
+  },
+  "pin": {
+    "title": "PIN für {{name}}",
+    "thisLogger": "diesen Logger",
+    "desc": "Gib die PIN dieses Loggers ein. Öffne dazu am Logger Transfer → PIN und bring den Logger danach zurück in sein Hauptmenü, bevor du sie hier eingibst. Die App merkt sie sich danach.",
+    "label": "Logger-PIN",
+    "wrong_one": "Falsche PIN. Noch {{count}} Versuch, bevor der Logger eine Weile sperrt.",
+    "wrong_other": "Falsche PIN. Noch {{count}} Versuche, bevor der Logger eine Weile sperrt.",
+    "cancel": "Abbrechen",
+    "submit": "Entsperren",
+    "handshake": "Verbindung mit dem Logger wird hergestellt…",
+    "checking": "PIN des Loggers wird geprüft…",
+    "reconnecting": "Erneute Verbindung mit dem Logger…",
+    "errorLocked": "Zu viele falsche PINs. Der Logger ist für {{seconds}} s gesperrt.",
+    "errorCamera": "Die Kamera braucht gerade das Funkmodul des Loggers. Versuche es erneut, wenn sie fertig ist.",
+    "errorTimeout": "Der Logger hat nicht länger auf die PIN gewartet. Bring ihn zurück ins Hauptmenü und verbinde dich erneut.",
+    "errorEngine": "Der Motor wurde gestartet, daher hat der Logger die Fernübertragung beendet, um sich auf die Aufzeichnung vorzubereiten.",
+    "errorIdle": "Der Logger hat die Fernübertragung nach 10 Minuten ohne Aktivität beendet. Verbinde dich erneut, um fortzufahren.",
+    "errorBusy": "Der Logger ist beschäftigt. Verbinde dich gleich erneut.",
+    "errorNoReply": "Der Logger antwortet nicht mehr. Verbinde dich erneut.",
+    "errorDisconnected": "Der Logger hat die Verbindung getrennt. Stelle sicher, dass er im Hauptmenü ist, und verbinde dich erneut.",
+    "errorProtocol": "Der Logger hat die Verbindung nicht angenommen. Verbinde dich erneut."
   }
 }
diff --git a/src/locales/en/drawer.json b/src/locales/en/drawer.json
index 82f3d826..7d129fe3 100644
--- a/src/locales/en/drawer.json
+++ b/src/locales/en/drawer.json
@@ -519,5 +519,27 @@
     "deleteConfirmBtn": "Delete",
     "deleteHasSetups": "This type has saved setups — delete those first.",
     "deleteDefault": "The built-in default type can't be deleted."
+  },
+  "pin": {
+    "title": "PIN for {{name}}",
+    "thisLogger": "this logger",
+    "desc": "Enter this logger's PIN. To see it, open Transfer → PIN on the logger, then return the logger to its main menu before entering it here. The app remembers it after this.",
+    "label": "Logger PIN",
+    "wrong_one": "Wrong PIN. {{count}} try left before the logger locks for a while.",
+    "wrong_other": "Wrong PIN. {{count}} tries left before the logger locks for a while.",
+    "cancel": "Cancel",
+    "submit": "Unlock",
+    "handshake": "Talking to the logger…",
+    "checking": "Checking the logger's PIN…",
+    "reconnecting": "Reconnecting to the logger…",
+    "errorLocked": "Too many wrong PINs. The logger is locked for {{seconds}} s.",
+    "errorCamera": "The camera needs the logger's radio right now. Try again once it's done.",
+    "errorTimeout": "The logger stopped waiting for the PIN. Return it to its main menu and connect again.",
+    "errorEngine": "The engine started, so the logger ended the remote transfer to get ready to log.",
+    "errorIdle": "The logger ended the remote transfer after 10 minutes without activity. Connect again to continue.",
+    "errorBusy": "The logger is busy. Connect again in a moment.",
+    "errorNoReply": "The logger stopped answering. Connect again.",
+    "errorDisconnected": "The logger dropped the connection. Make sure it's on its main menu, then connect again.",
+    "errorProtocol": "The logger didn't accept the connection. Connect again."
   }
 }
diff --git a/src/locales/es/drawer.json b/src/locales/es/drawer.json
index 749fe199..3adaab33 100644
--- a/src/locales/es/drawer.json
+++ b/src/locales/es/drawer.json
@@ -520,5 +520,27 @@
     "deleteConfirmBtn": "Eliminar",
     "deleteHasSetups": "Este tipo tiene configuraciones guardadas: elimínalas primero.",
     "deleteDefault": "El tipo predeterminado integrado no se puede eliminar."
+  },
+  "pin": {
+    "title": "PIN de {{name}}",
+    "thisLogger": "este registrador",
+    "desc": "Introduce el PIN de este registrador. Para verlo, abre Transfer → PIN en el registrador y vuelve a su menú principal antes de introducirlo aquí. La app lo recordará después.",
+    "label": "PIN del registrador",
+    "wrong_one": "PIN incorrecto. Queda {{count}} intento antes de que el registrador se bloquee un rato.",
+    "wrong_other": "PIN incorrecto. Quedan {{count}} intentos antes de que el registrador se bloquee un rato.",
+    "cancel": "Cancelar",
+    "submit": "Desbloquear",
+    "handshake": "Comunicando con el registrador…",
+    "checking": "Comprobando el PIN del registrador…",
+    "reconnecting": "Reconectando con el registrador…",
+    "errorLocked": "Demasiados PIN incorrectos. El registrador está bloqueado durante {{seconds}} s.",
+    "errorCamera": "La cámara necesita ahora la radio del registrador. Inténtalo de nuevo cuando termine.",
+    "errorTimeout": "El registrador dejó de esperar el PIN. Vuelve a su menú principal y conecta de nuevo.",
+    "errorEngine": "El motor arrancó, así que el registrador terminó la transferencia remota para prepararse a registrar.",
+    "errorIdle": "El registrador terminó la transferencia remota tras 10 minutos sin actividad. Vuelve a conectar para continuar.",
+    "errorBusy": "El registrador está ocupado. Vuelve a conectar en un momento.",
+    "errorNoReply": "El registrador dejó de responder. Vuelve a conectar.",
+    "errorDisconnected": "El registrador cortó la conexión. Asegúrate de que esté en su menú principal y vuelve a conectar.",
+    "errorProtocol": "El registrador no aceptó la conexión. Vuelve a conectar."
   }
 }
diff --git a/src/locales/fr/drawer.json b/src/locales/fr/drawer.json
index 52e5d43d..cfe1358f 100644
--- a/src/locales/fr/drawer.json
+++ b/src/locales/fr/drawer.json
@@ -520,5 +520,27 @@
     "deleteConfirmBtn": "Supprimer",
     "deleteHasSetups": "Ce type a des configurations enregistrées — supprimez-les d'abord.",
     "deleteDefault": "Le type par défaut intégré ne peut pas être supprimé."
+  },
+  "pin": {
+    "title": "PIN de {{name}}",
+    "thisLogger": "cet enregistreur",
+    "desc": "Saisissez le PIN de cet enregistreur. Pour le voir, ouvrez Transfer → PIN sur l'enregistreur, puis ramenez-le à son menu principal avant de le saisir ici. L'app le retiendra ensuite.",
+    "label": "PIN de l'enregistreur",
+    "wrong_one": "PIN incorrect. Il reste {{count}} essai avant que l'enregistreur ne se verrouille un moment.",
+    "wrong_other": "PIN incorrect. Il reste {{count}} essais avant que l'enregistreur ne se verrouille un moment.",
+    "cancel": "Annuler",
+    "submit": "Déverrouiller",
+    "handshake": "Communication avec l'enregistreur…",
+    "checking": "Vérification du PIN de l'enregistreur…",
+    "reconnecting": "Reconnexion à l'enregistreur…",
+    "errorLocked": "Trop de PIN incorrects. L'enregistreur est verrouillé pendant {{seconds}} s.",
+    "errorCamera": "La caméra a besoin de la radio de l'enregistreur pour le moment. Réessayez quand elle aura fini.",
+    "errorTimeout": "L'enregistreur a cessé d'attendre le PIN. Ramenez-le à son menu principal et reconnectez-vous.",
+    "errorEngine": "Le moteur a démarré : l'enregistreur a mis fin au transfert à distance pour se préparer à enregistrer.",
+    "errorIdle": "L'enregistreur a mis fin au transfert à distance après 10 minutes sans activité. Reconnectez-vous pour continuer.",
+    "errorBusy": "L'enregistreur est occupé. Reconnectez-vous dans un instant.",
+    "errorNoReply": "L'enregistreur ne répond plus. Reconnectez-vous.",
+    "errorDisconnected": "L'enregistreur a coupé la connexion. Vérifiez qu'il est sur son menu principal, puis reconnectez-vous.",
+    "errorProtocol": "L'enregistreur n'a pas accepté la connexion. Reconnectez-vous."
   }
 }
diff --git a/src/locales/it/drawer.json b/src/locales/it/drawer.json
index b4510d3d..2880de30 100644
--- a/src/locales/it/drawer.json
+++ b/src/locales/it/drawer.json
@@ -520,5 +520,27 @@
     "deleteConfirmBtn": "Elimina",
     "deleteHasSetups": "Questo tipo ha configurazioni salvate: eliminale prima.",
     "deleteDefault": "Il tipo predefinito integrato non può essere eliminato."
+  },
+  "pin": {
+    "title": "PIN di {{name}}",
+    "thisLogger": "questo logger",
+    "desc": "Inserisci il PIN di questo logger. Per vederlo, apri Transfer → PIN sul logger, poi riporta il logger al menu principale prima di inserirlo qui. L'app lo ricorderà in seguito.",
+    "label": "PIN del logger",
+    "wrong_one": "PIN errato. Resta {{count}} tentativo prima che il logger si blocchi per un po'.",
+    "wrong_other": "PIN errato. Restano {{count}} tentativi prima che il logger si blocchi per un po'.",
+    "cancel": "Annulla",
+    "submit": "Sblocca",
+    "handshake": "Comunicazione con il logger…",
+    "checking": "Verifica del PIN del logger…",
+    "reconnecting": "Riconnessione al logger…",
+    "errorLocked": "Troppi PIN errati. Il logger è bloccato per {{seconds}} s.",
+    "errorCamera": "La videocamera sta usando la radio del logger. Riprova quando ha finito.",
+    "errorTimeout": "Il logger ha smesso di attendere il PIN. Riportalo al menu principale e riconnettiti.",
+    "errorEngine": "Il motore si è avviato, quindi il logger ha chiuso il trasferimento remoto per prepararsi a registrare.",
+    "errorIdle": "Il logger ha chiuso il trasferimento remoto dopo 10 minuti di inattività. Riconnettiti per continuare.",
+    "errorBusy": "Il logger è occupato. Riconnettiti tra un momento.",
+    "errorNoReply": "Il logger non risponde più. Riconnettiti.",
+    "errorDisconnected": "Il logger ha interrotto la connessione. Assicurati che sia nel menu principale, poi riconnettiti.",
+    "errorProtocol": "Il logger non ha accettato la connessione. Riconnettiti."
   }
 }
diff --git a/src/locales/ja/drawer.json b/src/locales/ja/drawer.json
index 3f53440f..8666a1ec 100644
--- a/src/locales/ja/drawer.json
+++ b/src/locales/ja/drawer.json
@@ -520,5 +520,27 @@
     "deleteConfirmBtn": "削除",
     "deleteHasSetups": "このタイプには保存されたセットアップがあります。先に削除してください。",
     "deleteDefault": "組み込みの既定タイプは削除できません。"
+  },
+  "pin": {
+    "title": "{{name}} の PIN",
+    "thisLogger": "このロガー",
+    "desc": "このロガーの PIN を入力してください。ロガーの Transfer → PIN で確認し、ここに入力する前にロガーをメインメニューに戻してください。次回からはアプリが記憶します。",
+    "label": "ロガーの PIN",
+    "wrong_one": "PIN が違います。あと {{count}} 回間違えるとロガーがしばらくロックされます。",
+    "wrong_other": "PIN が違います。あと {{count}} 回間違えるとロガーがしばらくロックされます。",
+    "cancel": "キャンセル",
+    "submit": "ロック解除",
+    "handshake": "ロガーと通信しています…",
+    "checking": "ロガーの PIN を確認しています…",
+    "reconnecting": "ロガーに再接続しています…",
+    "errorLocked": "PIN の入力ミスが多すぎます。ロガーは {{seconds}} 秒間ロックされています。",
+    "errorCamera": "現在カメラがロガーの無線を使用しています。終わってから再度お試しください。",
+    "errorTimeout": "ロガーが PIN の待機を終了しました。ロガーをメインメニューに戻して再接続してください。",
+    "errorEngine": "エンジンが始動したため、ロガーは記録の準備のためにリモート転送を終了しました。",
+    "errorIdle": "10 分間操作がなかったため、ロガーはリモート転送を終了しました。続けるには再接続してください。",
+    "errorBusy": "ロガーはビジー状態です。少ししてから再接続してください。",
+    "errorNoReply": "ロガーが応答しなくなりました。再接続してください。",
+    "errorDisconnected": "ロガーとの接続が切れました。ロガーがメインメニューにあることを確認して、再接続してください。",
+    "errorProtocol": "ロガーが接続を受け付けませんでした。再接続してください。"
   }
 }
diff --git a/src/locales/pt-BR/drawer.json b/src/locales/pt-BR/drawer.json
index 33ea8138..b16920c6 100644
--- a/src/locales/pt-BR/drawer.json
+++ b/src/locales/pt-BR/drawer.json
@@ -520,5 +520,27 @@
     "deleteConfirmBtn": "Excluir",
     "deleteHasSetups": "Este tipo tem configurações salvas — exclua-as primeiro.",
     "deleteDefault": "O tipo padrão integrado não pode ser excluído."
+  },
+  "pin": {
+    "title": "PIN de {{name}}",
+    "thisLogger": "este registrador",
+    "desc": "Digite o PIN deste registrador. Para vê-lo, abra Transfer → PIN no registrador e depois volte ao menu principal dele antes de digitá-lo aqui. O app vai lembrar depois disso.",
+    "label": "PIN do registrador",
+    "wrong_one": "PIN incorreto. Resta {{count}} tentativa antes de o registrador bloquear por um tempo.",
+    "wrong_other": "PIN incorreto. Restam {{count}} tentativas antes de o registrador bloquear por um tempo.",
+    "cancel": "Cancelar",
+    "submit": "Desbloquear",
+    "handshake": "Conversando com o registrador…",
+    "checking": "Verificando o PIN do registrador…",
+    "reconnecting": "Reconectando ao registrador…",
+    "errorLocked": "PINs incorretos demais. O registrador está bloqueado por {{seconds}} s.",
+    "errorCamera": "A câmera está usando o rádio do registrador agora. Tente de novo quando ela terminar.",
+    "errorTimeout": "O registrador parou de esperar o PIN. Volte ao menu principal dele e conecte novamente.",
+    "errorEngine": "O motor ligou, então o registrador encerrou a transferência remota para se preparar para registrar.",
+    "errorIdle": "O registrador encerrou a transferência remota após 10 minutos sem atividade. Conecte novamente para continuar.",
+    "errorBusy": "O registrador está ocupado. Conecte novamente em instantes.",
+    "errorNoReply": "O registrador parou de responder. Conecte novamente.",
+    "errorDisconnected": "O registrador caiu a conexão. Verifique se ele está no menu principal e conecte novamente.",
+    "errorProtocol": "O registrador não aceitou a conexão. Conecte novamente."
   }
 }