From 69eca3102a54b3d2372af5df60654b5ca0b49d31 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 7 Oct 2026 04:06:03 +0000
Subject: [PATCH 1/5] plan 0031: run the logger's remote-transfer PIN handshake
 on connect

The Fledgling firmware (logger plan 0019) now advertises a PIN-locked
transfer service from its main menu, so a download can start without
pressing Transfer on the device. This is the app side: DeviceContext.connect
runs AUTH?/AUTH:<hmac> before handing out the connection, learns the PIN via
PINGET on a locally started transfer, tries the stored PIN silently, and
only prompts for a logger it has never seen. Pre-0019 firmware stays silent
to AUTH? and connects exactly as before after 2 s.

The PIN never leaves the device's browser storage. The Device tab shows the
stored copy (new firmware omits it from SLIST), requires exactly four
digits, and gains the remote_transfer on/off setting. Golden vectors are
shared with the firmware tests and LapWing.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BTPVvtL3ZVDj7UBcAthaQk
---
 CHANGELOG.md                                |  17 ++
 CLAUDE.md                                   |   2 +-
 docs/ble-protocol.md                        |  76 ++++++-
 docs/ble.md                                 |   8 +
 docs/plans/0031-remote-transfer-pin.md      |  81 +++++++
 src/components/LoggerPinDialog.tsx          |  66 ++++++
 src/components/drawer/DeviceSettingsTab.tsx |  15 +-
 src/contexts/DeviceContext.tsx              |  50 +++-
 src/lib/ble/auth.test.ts                    | 178 +++++++++++++++
 src/lib/ble/auth.ts                         | 240 ++++++++++++++++++++
 src/lib/ble/index.ts                        |  10 +
 src/lib/ble/pinStore.ts                     |  59 +++++
 src/lib/deviceSettingsSchema.test.ts        |  13 ++
 src/lib/deviceSettingsSchema.ts             |  27 ++-
 src/locales/de/drawer.json                  |  16 ++
 src/locales/en/drawer.json                  |  16 ++
 src/locales/es/drawer.json                  |  16 ++
 src/locales/fr/drawer.json                  |  16 ++
 src/locales/it/drawer.json                  |  16 ++
 src/locales/ja/drawer.json                  |  16 ++
 src/locales/pt-BR/drawer.json               |  16 ++
 21 files changed, 947 insertions(+), 7 deletions(-)
 create mode 100644 docs/plans/0031-remote-transfer-pin.md
 create mode 100644 src/components/LoggerPinDialog.tsx
 create mode 100644 src/lib/ble/auth.test.ts
 create mode 100644 src/lib/ble/auth.ts
 create mode 100644 src/lib/ble/pinStore.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3bc25225..be82ae33 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > from git history and grouped by theme rather than exhaustive per-commit
 > detail.
 
+## [5.1.0] - unreleased
+
+### Added
+- **Start a logger download from the app while the logger sits on its menu.**
+  With a Fledgling running the new firmware, Connect works without pressing
+  Transfer on the logger first. The logger only opens up once the app proves it
+  knows the logger's 4-digit PIN, which the app learns automatically the next
+  time you start a transfer from the logger itself. A logger it hasn't seen
+  before asks for the PIN once (shown on the logger under Transfer → PIN). Too
+  many wrong PINs lock the logger for a while, and the Insta360 camera always
+  gets the radio first. Older loggers connect exactly as before. (Plan 0031.)
+- **Remote Transfer setting** on the Device tab, to turn this off per logger.
+
+### Changed
+- The Device tab's Bluetooth PIN now has to be exactly four digits (leading
+  zeros are fine), matching what the logger accepts.
+
 ## [5.0.0] - 2026-10-04
 
 ### Added
diff --git a/CLAUDE.md b/CLAUDE.md
index e0c66b42..14a8764d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -143,7 +143,7 @@ src/
 │   ├── insta360/          # ★ Native-only Insta360 camera bridge (plan 0025): ipc (insta360_* over the lazy Tauri loader), nativePlayer (the camera stream as a <video>-shaped VideoSurface for useVideoSync), playerClock + pose (pure, tested)
 │   ├── videoPlaylist.ts   # ★ Pure GoPro chunked-video model: parse/order GH/GX/GP/GOPR chunk names, build a virtual timeline (cumulative offsets) + virtual↔local time mapping + planAudioSegments (export audio stitch). useVideoSync swaps the <video> src per chunk; a single file is a 1-chunk playlist
 │   ├── satelliteImagery.ts # ★ Esri Wayback parsing (online-only satellite imagery-date picker)
-│   ├── ble/               # Web Bluetooth DovesLapTimer protocol + firmware OTA (→ docs/ble.md)
+│   ├── ble/               # Web Bluetooth DovesLapTimer protocol + firmware OTA (→ docs/ble.md); auth.ts = remote-transfer PIN handshake run by DeviceContext.connect (plan 0031, wire spec docs/ble-protocol.md §3.3) + pinStore.ts (per-logger PIN, local only)
 │   ├── db/                # Admin DB layer: ITrackDatabase + supabaseAdapter + getDatabase()
 │   ├── billing*.ts        # Subscription logic + Supabase billing I/O (→ docs/backend.md)
 │   ├── weatherService.ts  # Historical weather (online-only): NWS/IEM METAR → Open-Meteo fallback
diff --git a/docs/ble-protocol.md b/docs/ble-protocol.md
index 991f1e0e..b3573327 100644
--- a/docs/ble-protocol.md
+++ b/docs/ble-protocol.md
@@ -105,6 +105,10 @@ Standard read-only service; the firmware publishes its identity here via Adafrui
    stability).
 6. **Subscribe** to the notify characteristic(s) a given protocol uses
    **before** writing the command that triggers them (see each protocol below).
+7. **Authenticate** with `AUTH?` before anything else (§3.3). A logger started
+   from its own Transfer menu answers `AUTH:OPEN`; one reached from its main menu
+   (remote transfer) refuses everything but the handshake and `BATT` until the
+   PIN is proven; pre-PIN firmware says nothing.
 
 > **No DFU service is requested.** Firmware updates ride the `0x1820` file service
 > (see §10). Chrome's Web Bluetooth blocklist bans the Nordic legacy DFU service,
@@ -130,6 +134,62 @@ Just drop the GATT connection. Safe to call when already disconnected. Some flow
 (settings reset, firmware apply) expect the device to reboot and the link to drop
 on its own — treat that disconnect as expected.
 
+### 3.3 Remote transfer & the PIN handshake (`AUTH`, `PINGET`)
+
+Logger plan 0019 / viewer plan 0031. While the logger sits on its **main menu**
+with the `remote_transfer` setting `on`, it advertises the same `0x1820` service
+in a **locked** mode: only `AUTH?`, `AUTH:<answer>` and `BATT` are accepted;
+anything else answers `AUTH:REQUIRED`. A correct answer turns the logger into the
+transfer page (labelled *Remote Transfer*) and every command except `PINGET`
+opens up. A transfer started on the logger itself (Transfer → Bluetooth) is
+**open**: everything is allowed, including `PINGET`.
+
+```
+client → 0x2A3E : "AUTH?"
+device → 0x2A40 : "AUTH:NONCE:<32 hex>"      (locked: a fresh 16-byte nonce)
+               |  "AUTH:OPEN"                 (local start — nothing to prove)
+               |  "AUTH:OK"                   (already authenticated)
+               |  "AUTH:LOCKED:<seconds>"     (lockout running)
+               |  "AUTH:BUSY"                 (a check is in flight / RNG busy)
+               |  (silence)                   (pre-0019 firmware — treat as open)
+
+client → 0x2A3E : "AUTH:<32 hex answer>"
+device → 0x2A40 : "AUTH:OK"                   (session promoted to a transfer)
+               |  "AUTH:FAIL:<tries left>"    (nonce consumed — ask for a new one)
+               |  "AUTH:LOCKED:<seconds>"
+               |  "AUTH:NO_NONCE"             (answer without a pending nonce)
+```
+
+**answer** = the first 16 bytes, lowercase hex, of
+`HMAC-SHA256(key = PIN as ASCII, msg = "BEAUTH1|" + nonceHex)`, where `nonceHex`
+is the 32 hex characters exactly as received. The device compares
+case-insensitively in constant time. Golden vectors (firmware
+`tests/remote_auth_test.cpp`, `src/lib/ble/auth.test.ts`, LapWing):
+
+| PIN | nonce | answer |
+|---|---|---|
+| `4821` | `00112233445566778899aabbccddeeff` | `4936f5dad4502101eb0f65790cca77b4` |
+| `1000` | `ffffffffffffffffffffffffffffffff` | `3db7fac4dc48559fa85594079b59fce4` |
+
+- **Lockout:** 5 wrong answers lock for 60 s, doubling per lockout up to 15 min.
+  RAM-only — a power cycle clears it.
+- **Squat limit:** a locked session that hasn't authenticated within **20 s** of
+  connecting gets `AUTH:TIMEOUT` and is dropped. Prompting a user for the PIN
+  counts against it.
+- **The camera always wins.** If the Insta360 auto-record needs the radio (engine
+  turning, camera waking or recording), the logger sends `AUTH:CAMERA` and drops a
+  remote session — before or after authentication.
+- **`PINGET`** → `PIN:<4 digits>`, **open sessions only** (`AUTH:REQUIRED`
+  otherwise). This is how a client learns the PIN without anyone typing it: a
+  local start hands it over, and the client stores it for the next remote start.
+- **The PIN is 4 digits, leading zeros allowed.** Shown on the logger under
+  Transfer → PIN (hold Select to reveal; it hides itself again).
+
+> **Security limit.** The link is unencrypted (Just Works), so the handshake is a
+> gate against a casual nearby phone, not against a sniffer: a captured nonce +
+> answer can be brute-forced offline across the 10 000 PINs. Changing the PIN
+> (Transfer → PIN → New PIN on the logger, or `SSET`) is the remedy.
+
 ---
 
 ## 4. Command summary
@@ -142,6 +202,9 @@ channel and terminator differ per command.
 | `LIST` | `0x2A3D` | `…END` (anchored at end) | (timeout) |
 | `GET:<filename>` | `0x2A40` then `0x2A3F` | `SIZE:<n>` → data chunks → `DONE` | `ERROR` |
 | `BATT` | `0x2A40` | `BATT:<pct>,<volt>` | (timeout) |
+| `AUTH?` | `0x2A40` | `AUTH:NONCE:<hex>` / `AUTH:OPEN` / `AUTH:OK` (§3.3) | `AUTH:LOCKED:<s>` / `AUTH:BUSY` / (silence = legacy) |
+| `AUTH:<answer>` | `0x2A40` | `AUTH:OK` (§3.3) | `AUTH:FAIL:<n>` / `AUTH:LOCKED:<s>` / `AUTH:NO_NONCE` |
+| `PINGET` | `0x2A40` | `PIN:<4 digits>` (open sessions only) | `AUTH:REQUIRED` / `SERR:NOT_FOUND` |
 | `SLIST` | `0x2A40` | `SVAL:<k>=<v>` … → `SEND` | — |
 | `SGET:<key>` | `0x2A40` | `SVAL:<key>=<value>` | `SERR:<reason>` |
 | `SSET:<key>=<value>` | `0x2A40` | `SOK:<key>` | `SERR:<reason>` |
@@ -266,6 +329,9 @@ device → 0x2A40 : "SEND"                 (terminator)
 Parse each `SVAL:` line by splitting on the **first** `=`. Build a `key → value`
 map. Resolve on `SEND`. Reset a ~3 s idle timer per message; hard timeout ~10 s.
 
+PIN-gated firmware (§3.3) **omits `bluetooth_pin`** from the list; read it with
+`PINGET` on an open session instead.
+
 ### 8.2 Get one (`SGET:<key>`)
 
 ```
@@ -275,7 +341,8 @@ device → 0x2A40 : "SVAL:<key>=<value>"   (match the requested key)
 device → 0x2A40 : "SERR:<reason>"        e.g. "SERR:NOT_FOUND"
 ```
 
-Timeout ~5 s.
+Timeout ~5 s. `SGET:bluetooth_pin` answers `SERR:PROTECTED` on PIN-gated
+firmware (§3.3).
 
 ### 8.3 Set one (`SSET:<key>=<value>`)
 
@@ -286,7 +353,8 @@ device → 0x2A40 : "SOK:<key>"            (success; "SOK: <key>" with a space a
 device → 0x2A40 : "SERR:<reason>"        e.g. "SERR:WRITE_FAIL"
 ```
 
-Timeout ~5 s.
+Timeout ~5 s. `SSET:bluetooth_pin=` takes exactly four digits (`SERR:BAD_VALUE`
+otherwise) and is live for the next handshake.
 
 ### 8.4 Factory reset (`SRESET`)
 
@@ -549,6 +617,8 @@ new `ble/index.ts` re-export the public surface.
 | `types.ts` | `BleConnection`, `FileInfo`, `DownloadProgress`, `BatteryInfo` |
 | `fileTransfer.ts` | `LIST` + `GET:` (§5, §6) |
 | `battery.ts` | `BATT` (§7) |
+| `auth.ts` | `AUTH?` / `AUTH:` / `PINGET` handshake (§3.3) |
+| `pinStore.ts` | Per-logger PIN memory (browser storage, never cloud-synced) |
 | `settings.ts` | `SLIST` / `SGET` / `SSET` / `SRESET` (§8) |
 | `trackSync.ts` | `TLIST` / `TGET` / `TPUT` / `TDEL` (§9) |
 | `firmwareCrc.ts` | CRC-32/IEEE (§10) |
@@ -583,4 +653,6 @@ For a non-Web-Bluetooth central (btleplug/`tauri-plugin-blec`, bleak, etc.):
 8. **Honor the timeouts** in §4–§10; use a per-chunk watchdog (not a total cap) for
    large transfers.
 9. **Expect reboots** on `SRESET` and `FWAPPLY` — treat the disconnect as expected.
+10. **Run the §3.3 handshake first**, against the golden vectors; treat 2 s of
+    silence to `AUTH?` as pre-PIN firmware.
 </content>
diff --git a/docs/ble.md b/docs/ble.md
index 999163a9..5251f7e1 100644
--- a/docs/ble.md
+++ b/docs/ble.md
@@ -26,6 +26,14 @@ Alfano tile mounts the lazy `AlfanoDownload` flow (Bluetooth serial over native
 explanatory dialogs instead (Alfano uses Bluetooth serial / Classic Bluetooth SPP,
 which Web Bluetooth — BLE GATT only — can't reach, so it has no web path at all).
 
+**Remote transfer PIN (plan 0031).** `DeviceContext.connect` runs
+`authenticateLogger()` (`src/lib/ble/auth.ts`) right after `connectToDevice()`,
+so every web surface gets an authenticated (or open, or legacy) link without
+knowing auth exists. It learns the PIN via `PINGET` on a locally started
+transfer, tries the stored one silently on a remote start, and only then opens
+`LoggerPinDialog` (mounted by `DeviceProvider`). A failure disconnects and toasts.
+Wire spec: [`ble-protocol.md`](ble-protocol.md) §3.3.
+
 `DataloggerDownload` talks to the device only through the generic
 `LoggerConnection` interface (`src/lib/loggers/`): `listLogs` / `downloadLog` /
 `disconnect`, with `createFledglingConnection()` adapting a `BleConnection`. MyChron
diff --git a/docs/plans/0031-remote-transfer-pin.md b/docs/plans/0031-remote-transfer-pin.md
new file mode 100644
index 00000000..9663c86c
--- /dev/null
+++ b/docs/plans/0031-remote-transfer-pin.md
@@ -0,0 +1,81 @@
+# Remote transfer — the app side of the logger's PIN handshake
+
+> Status: **implemented, pending a hardware check** (viewer side). Firmware is
+> DovesDataLogger plan 0019 (PR #168, BETA); the native shell's twin lands in
+> LapWing. The wire spec is `docs/ble-protocol.md` §3.3.
+
+## Problem
+
+Downloading from the Fledgling meant pressing Transfer → Bluetooth on the
+logger, then Connect in the app. The logger is often bolted to a kart in a
+trailer. The ask: let the app start a transfer while the logger sits on its main
+menu, without making that an open door for any phone in the pits, and without
+ever taking the radio from the Insta360 auto-record.
+
+## What the firmware does (logger plan 0019, summarised)
+
+- On the main menu, with `remote_transfer` = `on`, the logger advertises the
+  usual `0x1820` service in a **locked** mode. Only `AUTH?`, `AUTH:<answer>` and
+  `BATT` work until the app proves it knows the 4-digit PIN.
+- Proof = first 16 bytes of `HMAC-SHA256(PIN, "BEAUTH1|" + nonceHex)`, hex. The
+  PIN never crosses the air on a remote start.
+- A correct answer turns the logger into the transfer page ("Remote Transfer").
+- 5 wrong answers → 60 s lockout, doubling to 15 min. 20 s to authenticate.
+- The camera always wins: `AUTH:CAMERA` and the link drops.
+- A **local** start is open, and `PINGET` hands over the PIN there.
+- Transfer → PIN on the logger shows it (hold Select) and can roll a new one.
+
+## Decisions (app side)
+
+1. **One place runs the handshake: `DeviceContext.connect`.** Every web BLE
+   surface (Device tab, the Fledgling download flow) connects through it, so
+   `authenticateLogger()` runs right after `connectToDevice()` and nothing
+   downstream knows auth exists. A failure disconnects, toasts the reason (not
+   for a user cancel) and returns null — which the download flow already reads
+   as "close".
+2. **Learn the PIN instead of asking for it.** On `AUTH:OPEN` (local start) the
+   app sends `PINGET` and stores the answer. The first remote start after any
+   local one needs no typing. Only a logger the app has never seen locally
+   prompts.
+3. **Stored PIN first, silently; a rejected one is forgotten.** A PIN changed on
+   the logger would otherwise burn a try on every connect. The prompt then shows
+   the tries left.
+4. **Storage is per device, local, never synced.** `localStorage`, keyed by
+   Web Bluetooth `device.id` (stable per origin while the permission lasts) with
+   the advertised name as a fallback when the browser issues a fresh id. Every
+   access is guarded; a private window just means asking again. Cloud sync was
+   rejected: it would move a device secret into a server for a convenience the
+   `PINGET` learning already provides.
+5. **2 s of silence to `AUTH?` = pre-0019 firmware.** It doesn't know the verb
+   and says nothing; treating that as open keeps every older logger working.
+   It costs 2 s on a legacy connect, once.
+6. **The Device tab still shows the PIN.** New firmware omits it from `SLIST`;
+   the tab injects the stored copy (which the handshake just fetched or proved,
+   so it is current) and re-stores it on a successful `SSET`. The schema now
+   requires exactly four digits (`0042` is a valid PIN) and adds the
+   `remote_transfer` on/off setting.
+7. **Native (LapWing) is separate.** The Tauri shell talks BLE in Rust; it gets
+   its own implementation of the same handshake against the same golden vectors.
+   This plan's code is web-only.
+
+## Files
+
+- `src/lib/ble/auth.ts` — `computeAuthAnswer` (WebCrypto), `parseAuthReply`,
+  `sendAuthCommand`, `authenticateLogger`, `LoggerAuthError`.
+- `src/lib/ble/pinStore.ts` — the per-logger store.
+- `src/components/LoggerPinDialog.tsx` — the prompt, mounted by `DeviceProvider`.
+- `src/contexts/DeviceContext.tsx` — runs the handshake on connect.
+- `src/components/drawer/DeviceSettingsTab.tsx`, `src/lib/deviceSettingsSchema.ts`.
+- Tests: `src/lib/ble/auth.test.ts` (golden vectors, every reply, the flow),
+  `src/lib/deviceSettingsSchema.test.ts`.
+
+## Known limits
+
+- **Unencrypted link.** A sniffer that captures a nonce + answer can brute-force
+  10 000 PINs offline. The gate stops a casual phone, not a determined attacker
+  with a sniffer; changing the PIN is the remedy. Documented in the wire spec.
+- **The 20 s squat limit includes the prompt.** A user who takes longer to read
+  the PIN off the logger gets "stopped waiting" and connects again (the logger
+  now shows nothing new to type, the second try is quick).
+- **Hardware check outstanding:** remote start from the menu, wrong-PIN lockout,
+  `AUTH:CAMERA` with a paired X4, and a legacy logger connecting after 2 s.
diff --git a/src/components/LoggerPinDialog.tsx b/src/components/LoggerPinDialog.tsx
new file mode 100644
index 00000000..34733eed
--- /dev/null
+++ b/src/components/LoggerPinDialog.tsx
@@ -0,0 +1,66 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+  Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle,
+} from "@/components/ui/dialog";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import type { PinPromptContext } from "@/lib/ble";
+
+interface LoggerPinDialogProps {
+  /** The open prompt, or null when none is pending. */
+  request: PinPromptContext | null;
+  /** Called once per prompt: the entered PIN, or null on cancel. */
+  onDone: (pin: string | null) => void;
+}
+
+/**
+ * Asks for a logger's 4-digit PIN during a remote transfer start (plan 0031).
+ * The PIN is only needed the first time — the app remembers it per logger.
+ */
+export function LoggerPinDialog({ request, onDone }: LoggerPinDialogProps) {
+  const { t } = useTranslation("drawer");
+  const [pin, setPin] = useState("");
+
+  // Every prompt starts empty — a wrong PIN shouldn't sit there to be resent.
+  useEffect(() => {
+    if (request) setPin("");
+  }, [request]);
+
+  const valid = /^[0-9]{4}$/.test(pin);
+
+  return (
+    <Dialog open={request !== null} onOpenChange={(open) => { if (!open) onDone(null); }}>
+      <DialogContent className="max-w-sm">
+        <form
+          onSubmit={(e) => {
+            e.preventDefault();
+            if (valid) onDone(pin);
+          }}
+        >
+          <DialogHeader>
+            <DialogTitle>{t("pin.title", { name: request?.deviceName || t("pin.thisLogger") })}</DialogTitle>
+            <DialogDescription>{t("pin.desc")}</DialogDescription>
+          </DialogHeader>
+          <Input
+            className="my-4 text-center text-2xl tracking-[0.5em] font-mono"
+            inputMode="numeric"
+            autoComplete="off"
+            maxLength={4}
+            autoFocus
+            value={pin}
+            aria-label={t("pin.label")}
+            onChange={(e) => setPin(e.target.value.replace(/[^0-9]/g, "").slice(0, 4))}
+          />
+          {request?.triesLeft !== undefined && (
+            <p className="text-sm text-destructive mb-4">{t("pin.wrong", { count: request.triesLeft })}</p>
+          )}
+          <DialogFooter>
+            <Button type="button" variant="ghost" onClick={() => onDone(null)}>{t("pin.cancel")}</Button>
+            <Button type="submit" disabled={!valid}>{t("pin.submit")}</Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/src/components/drawer/DeviceSettingsTab.tsx b/src/components/drawer/DeviceSettingsTab.tsx
index defa431e..6daa7baa 100644
--- a/src/components/drawer/DeviceSettingsTab.tsx
+++ b/src/components/drawer/DeviceSettingsTab.tsx
@@ -12,7 +12,7 @@ import {
 } from "@/components/ui/select";
 import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
 import { toast } from "sonner";
-import { type BleConnection } from "@/lib/bleDatalogger";
+import { type BleConnection, loadLoggerPin, saveLoggerPin } from "@/lib/bleDatalogger";
 import type { DeviceDetails } from "@/lib/loggers";
 import {
   DEVICE_SETTINGS_SCHEMA,
@@ -117,6 +117,14 @@ export function DeviceSettingsTab({ details, bleConnection, onResetComplete }: D
     setFetchError(null);
     try {
       const settings = await details.listSettings();
+      // PIN-gated firmware (logger plan 0019) leaves the PIN out of SLIST so a
+      // remote peer can't read the secret that gates it. The handshake that
+      // let us in either fetched it (local start) or proved it (remote), so
+      // the stored copy is the device's current PIN.
+      if (!("bluetooth_pin" in settings) && bleConnection) {
+        const pin = loadLoggerPin(bleConnection.device.id, bleConnection.device.name ?? "");
+        if (pin) settings.bluetooth_pin = pin;
+      }
       // Build rows: schema-defined keys first (in order), then unknown keys
       const knownKeys = DEVICE_SETTINGS_SCHEMA.map((s) => s.key);
       const orderedKeys = [
@@ -137,7 +145,7 @@ export function DeviceSettingsTab({ details, bleConnection, onResetComplete }: D
     } finally {
       setLoading(false);
     }
-  }, [details, t]);
+  }, [details, bleConnection, t]);
 
   useEffect(() => {
     fetchSettings();
@@ -193,6 +201,9 @@ export function DeviceSettingsTab({ details, bleConnection, onResetComplete }: D
 
     try {
       await details.setSetting(row.key, row.value);
+      if (row.key === "bluetooth_pin" && bleConnection) {
+        saveLoggerPin(bleConnection.device.id, bleConnection.device.name ?? "", row.value);
+      }
       setRows((prev) =>
         prev.map((r) =>
           r.key === key ? { ...r, originalValue: r.value, saving: false } : r
diff --git a/src/contexts/DeviceContext.tsx b/src/contexts/DeviceContext.tsx
index 8d2dd6e3..38bbc3d6 100644
--- a/src/contexts/DeviceContext.tsx
+++ b/src/contexts/DeviceContext.tsx
@@ -1,10 +1,16 @@
 import { createContext, useCallback, useContext, useEffect, useRef, useState, type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { toast } from "sonner";
 import {
   type BleConnection,
+  type PinPromptContext,
+  authenticateLogger,
   connectToDevice,
   disconnect,
   isBleSupported,
+  LoggerAuthError,
 } from "@/lib/bleDatalogger";
+import { LoggerPinDialog } from "@/components/LoggerPinDialog";
 import type { DeviceDetails, LoggerKind } from "@/lib/loggers";
 import { createBleDeviceDetails } from "@/lib/loggers/bleDetails";
 import {
@@ -73,6 +79,10 @@ interface DeviceContextValue {
 const DeviceContext = createContext<DeviceContextValue | null>(null);
 
 export function DeviceProvider({ children }: { children: ReactNode }) {
+  const { t } = useTranslation("drawer");
+  // The pending remote-transfer PIN prompt (plan 0031) and how to answer it.
+  const [pinRequest, setPinRequest] = useState<PinPromptContext | null>(null);
+  const pinResolveRef = useRef<((pin: string | null) => void) | null>(null);
   const [connection, setConnection] = useState<BleConnection | null>(null);
   const [nativeConnected, setNativeConnected] = useState(false);
   const [details, setDetails] = useState<DeviceDetails | null>(null);
@@ -109,12 +119,49 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
     setDeviceName(null);
   }, []);
 
+  const promptPin = useCallback((ctx: PinPromptContext) => {
+    return new Promise<string | null>((resolve) => {
+      pinResolveRef.current = resolve;
+      setPinRequest(ctx);
+    });
+  }, []);
+
+  const finishPinPrompt = useCallback((pin: string | null) => {
+    const resolve = pinResolveRef.current;
+    pinResolveRef.current = null;
+    setPinRequest(null);
+    resolve?.(pin);
+  }, []);
+
+  const authErrorMessage = useCallback((err: LoggerAuthError) => {
+    switch (err.code) {
+      case "locked": return t("pin.errorLocked", { seconds: err.seconds ?? 0 });
+      case "camera": return t("pin.errorCamera");
+      case "timeout": return t("pin.errorTimeout");
+      case "busy": return t("pin.errorBusy");
+      default: return t("pin.errorProtocol");
+    }
+  }, [t]);
+
   const connectFn = useCallback(async (onStatus?: (msg: string) => void): Promise<BleConnection | null> => {
     if (isConnecting) return null;
     if (connectionRef.current) return connectionRef.current;
     setIsConnecting(true);
     try {
       const conn = await connectToDevice(onStatus);
+      // A logger started remotely from its menu answers nothing but the PIN
+      // handshake until it is satisfied; a local start or older firmware
+      // passes straight through.
+      onStatus?.(t("pin.checking"));
+      try {
+        await authenticateLogger(conn, { promptPin });
+      } catch (err) {
+        disconnect(conn);
+        if (err instanceof LoggerAuthError && err.code !== "cancelled") {
+          toast.error(authErrorMessage(err));
+        }
+        throw err;
+      }
       // Listen for unexpected disconnects
       conn.device.addEventListener("gattserverdisconnected", handleDisconnect);
       setConnection(conn);
@@ -130,7 +177,7 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
     } finally {
       setIsConnecting(false);
     }
-  }, [isConnecting, handleDisconnect]);
+  }, [isConnecting, handleDisconnect, promptPin, authErrorMessage, t]);
 
   const scanNative = useCallback(async (): Promise<ScannedDevice[]> => {
     // Lazy import keeps Tauri off the web/eager graph (Golden Rule #1).
@@ -210,6 +257,7 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
       }}
     >
       {children}
+      <LoggerPinDialog request={pinRequest} onDone={finishPinPrompt} />
     </DeviceContext.Provider>
   );
 }
diff --git a/src/lib/ble/auth.test.ts b/src/lib/ble/auth.test.ts
new file mode 100644
index 00000000..18f52717
--- /dev/null
+++ b/src/lib/ble/auth.test.ts
@@ -0,0 +1,178 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import {
+  authenticateLogger,
+  computeAuthAnswer,
+  isValidPin,
+  LEGACY_TIMEOUT_MS,
+  LoggerAuthError,
+  parseAuthReply,
+} from "./auth";
+import { loadLoggerPin, saveLoggerPin } from "./pinStore";
+import { createMockConnection, flushMicrotasks, lastWritten, writeCount } from "./__test__/mockBle";
+
+const NONCE = "00112233445566778899aabbccddeeff";
+
+function memoryStorage() {
+  const data = new Map<string, string>();
+  return {
+    getItem: (k: string) => data.get(k) ?? null,
+    setItem: (k: string, v: string) => void data.set(k, v),
+    removeItem: (k: string) => void data.delete(k),
+    clear: () => data.clear(),
+  };
+}
+
+function loggerConnection() {
+  const conn = createMockConnection();
+  (conn as { device: unknown }).device = { id: "dev-1", name: "BirdsEye-42", gatt: { connected: true } };
+  return conn;
+}
+
+/** Let async work (WebCrypto included) settle until a new command is written. */
+async function waitForWrite(char: Parameters<typeof writeCount>[0], count: number) {
+  for (let i = 0; i < 50 && writeCount(char) < count; i++) {
+    await flushMicrotasks();
+    await new Promise((r) => setTimeout(r, 0));
+  }
+  expect(writeCount(char)).toBe(count);
+}
+
+beforeEach(() => vi.stubGlobal("localStorage", memoryStorage()));
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.useRealTimers();
+});
+
+describe("computeAuthAnswer", () => {
+  // Golden vectors shared with the firmware's tests/remote_auth_test.cpp and
+  // LapWing's doveslogger auth tests — all three must agree byte for byte.
+  it("matches the firmware golden vector", async () => {
+    await expect(computeAuthAnswer("4821", NONCE)).resolves.toBe("4936f5dad4502101eb0f65790cca77b4");
+  });
+
+  it("matches the second golden vector", async () => {
+    await expect(computeAuthAnswer("1000", "f".repeat(32))).resolves.toBe("3db7fac4dc48559fa85594079b59fce4");
+  });
+});
+
+describe("isValidPin", () => {
+  it("accepts exactly four digits", () => {
+    expect(isValidPin("0042")).toBe(true);
+    expect(isValidPin("123")).toBe(false);
+    expect(isValidPin("12345")).toBe(false);
+    expect(isValidPin("12a4")).toBe(false);
+  });
+});
+
+describe("parseAuthReply", () => {
+  it("parses every firmware reply", () => {
+    expect(parseAuthReply(`AUTH:NONCE:${NONCE}`)).toEqual({ kind: "nonce", nonce: NONCE });
+    expect(parseAuthReply("AUTH:FAIL:3")).toEqual({ kind: "fail", triesLeft: 3 });
+    expect(parseAuthReply("AUTH:LOCKED:60")).toEqual({ kind: "locked", seconds: 60 });
+    expect(parseAuthReply("AUTH:OPEN")).toEqual({ kind: "open" });
+    expect(parseAuthReply("AUTH:OK\r")).toEqual({ kind: "ok" });
+    expect(parseAuthReply("AUTH:CAMERA")).toEqual({ kind: "camera" });
+    expect(parseAuthReply("AUTH:TIMEOUT")).toEqual({ kind: "timeout" });
+    expect(parseAuthReply("PIN:0042")).toEqual({ kind: "pin", pin: "0042" });
+  });
+
+  it("ignores unrelated or malformed lines", () => {
+    expect(parseAuthReply("BATT:50,3.7")).toBeNull();
+    expect(parseAuthReply("AUTH:NONCE:xyz")).toBeNull();
+    expect(parseAuthReply("PIN:12")).toBeNull();
+    expect(parseAuthReply("AUTH:FAIL:")).toBeNull();
+  });
+});
+
+describe("authenticateLogger", () => {
+  it("treats silence as pre-PIN firmware", async () => {
+    vi.useFakeTimers();
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await flushMicrotasks();
+    expect(lastWritten(conn.characteristics.fileRequest)).toBe("AUTH?");
+    await vi.advanceTimersByTimeAsync(LEGACY_TIMEOUT_MS);
+    await expect(result).resolves.toBe("legacy");
+  });
+
+  it("learns the PIN from an open (locally started) session", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn.characteristics.fileRequest, 1);
+    conn.characteristics.fileStatus.simulate("AUTH:OPEN\n");
+    await waitForWrite(conn.characteristics.fileRequest, 2);
+    expect(lastWritten(conn.characteristics.fileRequest)).toBe("PINGET");
+    conn.characteristics.fileStatus.simulate("PIN:4821\n");
+    await expect(result).resolves.toBe("open");
+    expect(loadLoggerPin("dev-1", "BirdsEye-42")).toBe("4821");
+  });
+
+  it("answers silently with a stored PIN", async () => {
+    saveLoggerPin("dev-1", "BirdsEye-42", "4821");
+    const conn = loggerConnection();
+    const promptPin = vi.fn();
+    const result = authenticateLogger(conn, { promptPin });
+    await waitForWrite(conn.characteristics.fileRequest, 1);
+    conn.characteristics.fileStatus.simulate(`AUTH:NONCE:${NONCE}\n`);
+    await waitForWrite(conn.characteristics.fileRequest, 2);
+    expect(lastWritten(conn.characteristics.fileRequest)).toBe("AUTH:4936f5dad4502101eb0f65790cca77b4");
+    conn.characteristics.fileStatus.simulate("AUTH:OK\n");
+    await expect(result).resolves.toBe("authed");
+    expect(promptPin).not.toHaveBeenCalled();
+  });
+
+  it("falls back to the name when the browser hands out a new id", async () => {
+    saveLoggerPin("old-id", "BirdsEye-42", "4821");
+    expect(loadLoggerPin("dev-1", "BirdsEye-42")).toBe("4821");
+  });
+
+  it("forgets a rejected PIN and asks the user", async () => {
+    saveLoggerPin("dev-1", "BirdsEye-42", "9999");
+    const conn = loggerConnection();
+    const promptPin = vi.fn().mockResolvedValue("4821");
+    const result = authenticateLogger(conn, { promptPin });
+    await waitForWrite(conn.characteristics.fileRequest, 1);
+    conn.characteristics.fileStatus.simulate(`AUTH:NONCE:${NONCE}\n`);
+    await waitForWrite(conn.characteristics.fileRequest, 2);
+    conn.characteristics.fileStatus.simulate("AUTH:FAIL:4\n");
+    await waitForWrite(conn.characteristics.fileRequest, 3);
+    expect(lastWritten(conn.characteristics.fileRequest)).toBe("AUTH?");
+    expect(loadLoggerPin("dev-1", "BirdsEye-42")).toBeNull();
+    conn.characteristics.fileStatus.simulate(`AUTH:NONCE:${NONCE}\n`);
+    await waitForWrite(conn.characteristics.fileRequest, 4);
+    expect(promptPin).toHaveBeenCalledWith({ deviceName: "BirdsEye-42", triesLeft: 4 });
+    expect(lastWritten(conn.characteristics.fileRequest)).toBe("AUTH:4936f5dad4502101eb0f65790cca77b4");
+    conn.characteristics.fileStatus.simulate("AUTH:OK\n");
+    await expect(result).resolves.toBe("authed");
+    expect(loadLoggerPin("dev-1", "BirdsEye-42")).toBe("4821");
+  });
+
+  it("gives up when the user cancels the prompt", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn().mockResolvedValue(null) });
+    await waitForWrite(conn.characteristics.fileRequest, 1);
+    conn.characteristics.fileStatus.simulate(`AUTH:NONCE:${NONCE}\n`);
+    await expect(result).rejects.toMatchObject({ code: "cancelled" });
+  });
+
+  it("reports a lockout with its remaining seconds", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn.characteristics.fileRequest, 1);
+    conn.characteristics.fileStatus.simulate("AUTH:LOCKED:120\n");
+    const err = await result.catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(LoggerAuthError);
+    expect(err).toMatchObject({ code: "locked", seconds: 120 });
+  });
+
+  it("reports the camera taking the radio", async () => {
+    saveLoggerPin("dev-1", "BirdsEye-42", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn.characteristics.fileRequest, 1);
+    conn.characteristics.fileStatus.simulate(`AUTH:NONCE:${NONCE}\n`);
+    await waitForWrite(conn.characteristics.fileRequest, 2);
+    conn.characteristics.fileStatus.simulate("AUTH:CAMERA\n");
+    await expect(result).rejects.toMatchObject({ code: "camera" });
+  });
+});
diff --git a/src/lib/ble/auth.ts b/src/lib/ble/auth.ts
new file mode 100644
index 00000000..1171c071
--- /dev/null
+++ b/src/lib/ble/auth.ts
@@ -0,0 +1,240 @@
+/// <reference types="web-bluetooth" />
+
+import type { BleConnection } from "./types";
+import { bleLog } from "./internal";
+import { forgetLoggerPin, loadLoggerPin, saveLoggerPin } from "./pinStore";
+
+/**
+ * Remote-transfer PIN handshake (plan 0031; firmware side is the logger's
+ * plan 0019).
+ *
+ * A logger sitting on its main menu advertises a LOCKED transfer service: it
+ * answers only `AUTH?`, `AUTH:<answer>` and `BATT` until the app proves it
+ * knows the logger's 4-digit PIN. The proof is an HMAC over a fresh nonce, so
+ * the PIN itself never crosses the air on a remote start:
+ *
+ *   app → `AUTH?`                     logger → `AUTH:NONCE:<32 hex>`
+ *   app → `AUTH:<32 hex answer>`      logger → `AUTH:OK` | `AUTH:FAIL:<tries>`
+ *                                                | `AUTH:LOCKED:<seconds>`
+ *
+ * answer = first 16 bytes of HMAC-SHA256(key = PIN ascii,
+ *                                         msg = "BEAUTH1|" + nonceHex), hex.
+ *
+ * A transfer started ON the logger (Transfer → Bluetooth) is OPEN: `AUTH?`
+ * answers `AUTH:OPEN`, and `PINGET` hands out the PIN — which is how the app
+ * learns it without anyone typing it. Firmware older than 0019 doesn't know
+ * `AUTH?` and says nothing, so silence within `LEGACY_TIMEOUT_MS` means
+ * "nothing to prove".
+ */
+
+/** How long to wait for an `AUTH?` reply before treating the logger as pre-PIN firmware. */
+export const LEGACY_TIMEOUT_MS = 2000;
+/** Reply wait for every other step (the answer check reads the card). */
+const REPLY_TIMEOUT_MS = 5000;
+/** Domain-separation prefix, byte-identical to the firmware's `remote_auth`. */
+const AUTH_DOMAIN = "BEAUTH1|";
+/** The answer is the HMAC truncated to this many bytes (32 hex chars). */
+const ANSWER_BYTES = 16;
+
+/** A 4-digit PIN, exactly as the firmware's `remote_auth::isValidPin`. */
+export function isValidPin(pin: string): boolean {
+  return /^[0-9]{4}$/.test(pin);
+}
+
+/** The handshake answer for `pin` against the logger's `nonceHex`. */
+export async function computeAuthAnswer(pin: string, nonceHex: string): Promise<string> {
+  const enc = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(pin),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, enc.encode(AUTH_DOMAIN + nonceHex)));
+  return Array.from(mac.subarray(0, ANSWER_BYTES), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+/** One parsed `AUTH:` / `PIN:` status line. */
+export type AuthReply =
+  | { kind: "open" }
+  | { kind: "ok" }
+  | { kind: "nonce"; nonce: string }
+  | { kind: "fail"; triesLeft: number }
+  | { kind: "locked"; seconds: number }
+  | { kind: "noNonce" }
+  | { kind: "busy" }
+  | { kind: "required" }
+  | { kind: "camera" }
+  | { kind: "timeout" }
+  | { kind: "pin"; pin: string };
+
+/** Parse a status line, or null when it isn't part of the handshake. */
+export function parseAuthReply(line: string): AuthReply | null {
+  const l = line.trim();
+  if (l.startsWith("PIN:")) {
+    const pin = l.substring(4);
+    return isValidPin(pin) ? { kind: "pin", pin } : null;
+  }
+  if (!l.startsWith("AUTH:")) return null;
+  const body = l.substring(5);
+  switch (body) {
+    case "OPEN": return { kind: "open" };
+    case "OK": return { kind: "ok" };
+    case "NO_NONCE": return { kind: "noNonce" };
+    case "BUSY": return { kind: "busy" };
+    case "REQUIRED": return { kind: "required" };
+    case "CAMERA": return { kind: "camera" };
+    case "TIMEOUT": return { kind: "timeout" };
+  }
+  if (body.startsWith("NONCE:")) {
+    const nonce = body.substring(6);
+    return /^[0-9a-fA-F]{32}$/.test(nonce) ? { kind: "nonce", nonce } : null;
+  }
+  if (body.startsWith("FAIL:")) {
+    const n = parseInt(body.substring(5), 10);
+    return Number.isNaN(n) ? null : { kind: "fail", triesLeft: n };
+  }
+  if (body.startsWith("LOCKED:")) {
+    const n = parseInt(body.substring(7), 10);
+    return Number.isNaN(n) ? null : { kind: "locked", seconds: n };
+  }
+  return null;
+}
+
+/**
+ * Write `command` and resolve with the first handshake reply, or null after
+ * `timeoutMs` of silence.
+ */
+export async function sendAuthCommand(
+  connection: BleConnection,
+  command: string,
+  timeoutMs = REPLY_TIMEOUT_MS,
+): Promise<AuthReply | null> {
+  const status = connection.characteristics.fileStatus;
+  return new Promise<AuthReply | null>((resolve, reject) => {
+    let timer: ReturnType<typeof setTimeout> | null = null;
+    const handle = (event: Event) => {
+      const target = event.target as BluetoothRemoteGATTCharacteristic;
+      const raw = new TextDecoder().decode(target.value!);
+      for (const line of raw.split("\n")) {
+        const reply = parseAuthReply(line);
+        if (reply) {
+          finish();
+          resolve(reply);
+          return;
+        }
+      }
+    };
+    const finish = () => {
+      if (timer) clearTimeout(timer);
+      status.removeEventListener("characteristicvaluechanged", handle);
+    };
+    (async () => {
+      await status.startNotifications();
+      status.addEventListener("characteristicvaluechanged", handle);
+      bleLog("AUTH →", command.startsWith("AUTH:") ? "AUTH:<answer>" : command);
+      await connection.characteristics.fileRequest.writeValue(new TextEncoder().encode(command));
+      timer = setTimeout(() => {
+        finish();
+        resolve(null);
+      }, timeoutMs);
+    })().catch((err: unknown) => {
+      finish();
+      reject(err);
+    });
+  });
+}
+
+/** Why the PIN is being asked for. */
+export interface PinPromptContext {
+  /** The logger's advertised name, for the prompt's title. */
+  deviceName: string;
+  /** Set when the previous answer was wrong: how many tries remain before a lockout. */
+  triesLeft?: number;
+}
+
+/** Thrown when the handshake ends without access. `code` drives the UI copy. */
+export class LoggerAuthError extends Error {
+  constructor(
+    readonly code: "cancelled" | "locked" | "camera" | "timeout" | "busy" | "protocol",
+    readonly seconds?: number,
+  ) {
+    super(`logger-auth:${code}`);
+    this.name = "LoggerAuthError";
+  }
+}
+
+export interface AuthenticateOptions {
+  /** Ask the user for the PIN; resolve null to give up. */
+  promptPin: (ctx: PinPromptContext) => Promise<string | null>;
+}
+
+/** How the connection was cleared for use. */
+export type AuthOutcome = "open" | "authed" | "legacy";
+
+/**
+ * Run the handshake on a fresh connection. Resolves once the logger accepts
+ * commands; rejects with `LoggerAuthError` otherwise (the caller disconnects).
+ *
+ * The stored PIN is tried first and silently; a wrong one is forgotten and the
+ * user is asked. On an open (locally started) session the PIN is fetched and
+ * stored, so the next remote start needs no typing.
+ */
+export async function authenticateLogger(
+  connection: BleConnection,
+  { promptPin }: AuthenticateOptions,
+): Promise<AuthOutcome> {
+  const device = connection.device;
+  const deviceName = device.name ?? "";
+  const first = await sendAuthCommand(connection, "AUTH?", LEGACY_TIMEOUT_MS);
+  if (first === null) return "legacy";
+  if (first.kind === "open") {
+    const pin = await sendAuthCommand(connection, "PINGET");
+    if (pin?.kind === "pin") saveLoggerPin(device.id, deviceName, pin.pin);
+    return "open";
+  }
+  if (first.kind === "ok") return "authed";
+
+  let reply: AuthReply | null = first;
+  let pin = loadLoggerPin(device.id, deviceName);
+  let triesLeft: number | undefined;
+  for (;;) {
+    if (reply === null) throw new LoggerAuthError("timeout");
+    switch (reply.kind) {
+      case "locked": throw new LoggerAuthError("locked", reply.seconds);
+      case "camera": throw new LoggerAuthError("camera");
+      case "timeout": throw new LoggerAuthError("timeout");
+      case "busy": throw new LoggerAuthError("busy");
+      case "ok": return "authed";
+      case "nonce": break;
+      default: throw new LoggerAuthError("protocol");
+    }
+
+    if (pin === null) {
+      const entered = await promptPin({ deviceName, triesLeft });
+      if (entered === null) throw new LoggerAuthError("cancelled");
+      if (!isValidPin(entered)) continue;
+      pin = entered;
+    }
+
+    const verdict = await sendAuthCommand(connection, `AUTH:${await computeAuthAnswer(pin, reply.nonce)}`);
+    if (verdict?.kind === "ok") {
+      saveLoggerPin(device.id, deviceName, pin);
+      return "authed";
+    }
+    if (verdict?.kind !== "fail" && verdict?.kind !== "noNonce") {
+      reply = verdict;
+      continue;
+    }
+    if (verdict.kind === "fail") {
+      // A stored PIN that no longer works (changed on the logger) is dropped
+      // so it can't keep burning tries.
+      forgetLoggerPin(device.id, deviceName);
+      triesLeft = verdict.triesLeft;
+      pin = null;
+    }
+    // The logger consumes the nonce on every check: ask for a fresh one.
+    reply = await sendAuthCommand(connection, "AUTH?");
+  }
+}
diff --git a/src/lib/ble/index.ts b/src/lib/ble/index.ts
index 5d78a415..eb4698b9 100644
--- a/src/lib/ble/index.ts
+++ b/src/lib/ble/index.ts
@@ -45,3 +45,13 @@ export type {
   UploadOptions,
   ApplyOptions,
 } from "./firmwareUpload";
+
+// Remote-transfer PIN handshake (docs/plans/0031-remote-transfer-pin.md)
+export {
+  authenticateLogger,
+  computeAuthAnswer,
+  isValidPin,
+  LoggerAuthError,
+} from "./auth";
+export type { AuthOutcome, PinPromptContext } from "./auth";
+export { loadLoggerPin, saveLoggerPin } from "./pinStore";
diff --git a/src/lib/ble/pinStore.ts b/src/lib/ble/pinStore.ts
new file mode 100644
index 00000000..43489e2b
--- /dev/null
+++ b/src/lib/ble/pinStore.ts
@@ -0,0 +1,59 @@
+/**
+ * Per-logger PIN memory for remote transfer (plan 0031).
+ *
+ * Device-local on purpose: it is never cloud-synced, and losing it costs one
+ * look at the logger's Transfer → PIN page. Keyed by the Web Bluetooth
+ * `device.id` (stable per origin while the browser keeps the permission) with
+ * the advertised name as a fallback for when the browser hands out a fresh id.
+ *
+ * Every storage access is guarded: a private window or blocked site data just
+ * means the user is asked again.
+ */
+
+const STORAGE_KEY = "dove-logger-pins";
+
+type PinMap = Record<string, string>;
+
+const idKey = (id: string) => `id:${id}`;
+const nameKey = (name: string) => `name:${name}`;
+
+function read(): PinMap {
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY);
+    const parsed: unknown = raw ? JSON.parse(raw) : {};
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as PinMap) : {};
+  } catch {
+    return {};
+  }
+}
+
+function write(map: PinMap): void {
+  try {
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(map));
+  } catch {
+    // Storage unavailable — the PIN is simply asked for next time.
+  }
+}
+
+/** The stored PIN for this logger, or null. */
+export function loadLoggerPin(deviceId: string, deviceName: string): string | null {
+  const map = read();
+  const pin = map[idKey(deviceId)] ?? (deviceName ? map[nameKey(deviceName)] : undefined);
+  return typeof pin === "string" && /^[0-9]{4}$/.test(pin) ? pin : null;
+}
+
+/** Remember the PIN for this logger. */
+export function saveLoggerPin(deviceId: string, deviceName: string, pin: string): void {
+  const map = read();
+  map[idKey(deviceId)] = pin;
+  if (deviceName) map[nameKey(deviceName)] = pin;
+  write(map);
+}
+
+/** Forget this logger's PIN (it was rejected). */
+export function forgetLoggerPin(deviceId: string, deviceName: string): void {
+  const map = read();
+  delete map[idKey(deviceId)];
+  if (deviceName) delete map[nameKey(deviceName)];
+  write(map);
+}
diff --git a/src/lib/deviceSettingsSchema.test.ts b/src/lib/deviceSettingsSchema.test.ts
index 42faec2a..06d9b1f9 100644
--- a/src/lib/deviceSettingsSchema.test.ts
+++ b/src/lib/deviceSettingsSchema.test.ts
@@ -162,6 +162,19 @@ describe("validateSettingValue — number fields", () => {
     );
   });
 
+  // The logger takes exactly four digits (plan 0031): "123" would come back
+  // SERR:BAD_VALUE, and "0042" is a valid PIN even though it reads as 42.
+  it("requires exactly four digits for bluetooth_pin, leading zeros allowed", () => {
+    expect(validateSettingValue("bluetooth_pin", "0042")).toBeNull();
+    expect(validateSettingValue("bluetooth_pin", "123")).toBe("Must be exactly 4 digits");
+  });
+
+  it("offers on/off for remote_transfer", () => {
+    expect(validateSettingValue("remote_transfer", "on")).toBeNull();
+    expect(validateSettingValue("remote_transfer", "off")).toBeNull();
+    expect(validateSettingValue("remote_transfer", "yes")).toMatch(/^Must be one of/);
+  });
+
   // Number("") is 0, so an empty box used to validate as a real zero — fine
   // for lap_detection_distance (min 1 caught it) but NOT for the fields whose
   // range includes 0: an empty bluetooth_pin or led_brightness sailed through
diff --git a/src/lib/deviceSettingsSchema.ts b/src/lib/deviceSettingsSchema.ts
index 88873971..15daac1d 100644
--- a/src/lib/deviceSettingsSchema.ts
+++ b/src/lib/deviceSettingsSchema.ts
@@ -108,6 +108,12 @@ export interface DeviceSettingDef {
    * "disabled" sentinel, which sits below any sane threshold.
    */
   allowZero?: boolean;
+  /**
+   * `number` only: the value must be written with exactly this many digits,
+   * leading zeros allowed. The PIN is a 4-character code, not a quantity —
+   * "123" is not a PIN the logger will take (it answers `SERR:BAD_VALUE`).
+   */
+  exactDigits?: number;
   /**
    * Required for `enum`, ignored otherwise. The device stores a bare string, so
    * a free-text field lets a typo through that the firmware then silently
@@ -150,9 +156,25 @@ export const DEVICE_SETTINGS_SCHEMA: DeviceSettingDef[] = [
     label: 'Bluetooth PIN',
     type: 'number',
     maxLength: 4,
+    exactDigits: 4,
     min: 0,
     max: 9999,
-    description: 'Pairing PIN code (4 digits)',
+    description:
+      'Unlocks a transfer started from the app while the logger sits on its menu. Also shown on the logger under Transfer → PIN',
+  },
+  {
+    // Logger plan 0019 / viewer plan 0031: the menu advertises a PIN-locked
+    // transfer service so the app can start a download without anyone
+    // pressing Transfer on the device.
+    key: 'remote_transfer',
+    label: 'Remote Transfer',
+    type: 'enum',
+    options: [
+      { value: 'on', label: 'On (start transfers from the app, PIN-locked)' },
+      { value: 'off', label: 'Off (only from the logger\'s Transfer menu)' },
+    ],
+    description:
+      'Lets the app start a Bluetooth transfer while the logger sits on its main menu. The camera always takes the radio first',
   },
   {
     key: 'driver_name',
@@ -460,6 +482,9 @@ export function validateSettingValue(key: string, value: string): string | null
     if (def.maxLength !== undefined && value.length > def.maxLength) {
       return `Maximum ${def.maxLength} digits`;
     }
+    if (def.exactDigits !== undefined && !new RegExp(`^[0-9]{${def.exactDigits}}$`).test(value)) {
+      return `Must be exactly ${def.exactDigits} digits`;
+    }
   }
 
   if (def.type === 'string') {
diff --git a/src/locales/de/drawer.json b/src/locales/de/drawer.json
index 780035e6..6770bd42 100644
--- a/src/locales/de/drawer.json
+++ b/src/locales/de/drawer.json
@@ -520,5 +520,21 @@
     "deleteConfirmBtn": "Löschen",
     "deleteHasSetups": "Dieser Typ hat gespeicherte Setups – lösche diese zuerst.",
     "deleteDefault": "Der integrierte Standardtyp kann nicht gelöscht werden."
+  },
+  "pin": {
+    "title": "PIN für {{name}}",
+    "thisLogger": "diesen Logger",
+    "desc": "Gib die PIN dieses Loggers ein. Du findest sie am Logger unter Transfer → PIN. Die App merkt sie sich danach.",
+    "label": "Logger-PIN",
+    "wrong_one": "Falsche PIN. Noch {{count}} Versuch, bevor der Logger eine Weile sperrt.",
+    "wrong_other": "Falsche PIN. Noch {{count}} Versuche, bevor der Logger eine Weile sperrt.",
+    "cancel": "Abbrechen",
+    "submit": "Entsperren",
+    "checking": "PIN des Loggers wird geprüft…",
+    "errorLocked": "Zu viele falsche PINs. Der Logger ist für {{seconds}} s gesperrt.",
+    "errorCamera": "Die Kamera braucht gerade das Funkmodul des Loggers. Versuche es erneut, wenn sie fertig ist.",
+    "errorTimeout": "Der Logger hat nicht länger auf die PIN gewartet. Verbinde dich erneut.",
+    "errorBusy": "Der Logger ist beschäftigt. Verbinde dich gleich erneut.",
+    "errorProtocol": "Der Logger hat die Verbindung nicht angenommen. Verbinde dich erneut."
   }
 }
diff --git a/src/locales/en/drawer.json b/src/locales/en/drawer.json
index 82f3d826..2887e171 100644
--- a/src/locales/en/drawer.json
+++ b/src/locales/en/drawer.json
@@ -519,5 +519,21 @@
     "deleteConfirmBtn": "Delete",
     "deleteHasSetups": "This type has saved setups — delete those first.",
     "deleteDefault": "The built-in default type can't be deleted."
+  },
+  "pin": {
+    "title": "PIN for {{name}}",
+    "thisLogger": "this logger",
+    "desc": "Enter this logger's PIN. You can see it on the logger under Transfer → PIN. The app remembers it after this.",
+    "label": "Logger PIN",
+    "wrong_one": "Wrong PIN. {{count}} try left before the logger locks for a while.",
+    "wrong_other": "Wrong PIN. {{count}} tries left before the logger locks for a while.",
+    "cancel": "Cancel",
+    "submit": "Unlock",
+    "checking": "Checking the logger's PIN…",
+    "errorLocked": "Too many wrong PINs. The logger is locked for {{seconds}} s.",
+    "errorCamera": "The camera needs the logger's radio right now. Try again once it's done.",
+    "errorTimeout": "The logger stopped waiting for the PIN. Connect again.",
+    "errorBusy": "The logger is busy. Connect again in a moment.",
+    "errorProtocol": "The logger didn't accept the connection. Connect again."
   }
 }
diff --git a/src/locales/es/drawer.json b/src/locales/es/drawer.json
index 749fe199..03f91222 100644
--- a/src/locales/es/drawer.json
+++ b/src/locales/es/drawer.json
@@ -520,5 +520,21 @@
     "deleteConfirmBtn": "Eliminar",
     "deleteHasSetups": "Este tipo tiene configuraciones guardadas: elimínalas primero.",
     "deleteDefault": "El tipo predeterminado integrado no se puede eliminar."
+  },
+  "pin": {
+    "title": "PIN de {{name}}",
+    "thisLogger": "este registrador",
+    "desc": "Introduce el PIN de este registrador. Puedes verlo en el registrador en Transfer → PIN. La app lo recordará después.",
+    "label": "PIN del registrador",
+    "wrong_one": "PIN incorrecto. Queda {{count}} intento antes de que el registrador se bloquee un rato.",
+    "wrong_other": "PIN incorrecto. Quedan {{count}} intentos antes de que el registrador se bloquee un rato.",
+    "cancel": "Cancelar",
+    "submit": "Desbloquear",
+    "checking": "Comprobando el PIN del registrador…",
+    "errorLocked": "Demasiados PIN incorrectos. El registrador está bloqueado durante {{seconds}} s.",
+    "errorCamera": "La cámara necesita ahora la radio del registrador. Inténtalo de nuevo cuando termine.",
+    "errorTimeout": "El registrador dejó de esperar el PIN. Vuelve a conectar.",
+    "errorBusy": "El registrador está ocupado. Vuelve a conectar en un momento.",
+    "errorProtocol": "El registrador no aceptó la conexión. Vuelve a conectar."
   }
 }
diff --git a/src/locales/fr/drawer.json b/src/locales/fr/drawer.json
index 52e5d43d..64422def 100644
--- a/src/locales/fr/drawer.json
+++ b/src/locales/fr/drawer.json
@@ -520,5 +520,21 @@
     "deleteConfirmBtn": "Supprimer",
     "deleteHasSetups": "Ce type a des configurations enregistrées — supprimez-les d'abord.",
     "deleteDefault": "Le type par défaut intégré ne peut pas être supprimé."
+  },
+  "pin": {
+    "title": "PIN de {{name}}",
+    "thisLogger": "cet enregistreur",
+    "desc": "Saisissez le PIN de cet enregistreur. Il est affiché sur l'enregistreur dans Transfer → PIN. L'app le retiendra ensuite.",
+    "label": "PIN de l'enregistreur",
+    "wrong_one": "PIN incorrect. Il reste {{count}} essai avant que l'enregistreur ne se verrouille un moment.",
+    "wrong_other": "PIN incorrect. Il reste {{count}} essais avant que l'enregistreur ne se verrouille un moment.",
+    "cancel": "Annuler",
+    "submit": "Déverrouiller",
+    "checking": "Vérification du PIN de l'enregistreur…",
+    "errorLocked": "Trop de PIN incorrects. L'enregistreur est verrouillé pendant {{seconds}} s.",
+    "errorCamera": "La caméra a besoin de la radio de l'enregistreur pour le moment. Réessayez quand elle aura fini.",
+    "errorTimeout": "L'enregistreur a cessé d'attendre le PIN. Reconnectez-vous.",
+    "errorBusy": "L'enregistreur est occupé. Reconnectez-vous dans un instant.",
+    "errorProtocol": "L'enregistreur n'a pas accepté la connexion. Reconnectez-vous."
   }
 }
diff --git a/src/locales/it/drawer.json b/src/locales/it/drawer.json
index b4510d3d..35326c08 100644
--- a/src/locales/it/drawer.json
+++ b/src/locales/it/drawer.json
@@ -520,5 +520,21 @@
     "deleteConfirmBtn": "Elimina",
     "deleteHasSetups": "Questo tipo ha configurazioni salvate: eliminale prima.",
     "deleteDefault": "Il tipo predefinito integrato non può essere eliminato."
+  },
+  "pin": {
+    "title": "PIN di {{name}}",
+    "thisLogger": "questo logger",
+    "desc": "Inserisci il PIN di questo logger. Lo trovi sul logger in Transfer → PIN. L'app lo ricorderà in seguito.",
+    "label": "PIN del logger",
+    "wrong_one": "PIN errato. Resta {{count}} tentativo prima che il logger si blocchi per un po'.",
+    "wrong_other": "PIN errato. Restano {{count}} tentativi prima che il logger si blocchi per un po'.",
+    "cancel": "Annulla",
+    "submit": "Sblocca",
+    "checking": "Verifica del PIN del logger…",
+    "errorLocked": "Troppi PIN errati. Il logger è bloccato per {{seconds}} s.",
+    "errorCamera": "La videocamera sta usando la radio del logger. Riprova quando ha finito.",
+    "errorTimeout": "Il logger ha smesso di attendere il PIN. Riconnettiti.",
+    "errorBusy": "Il logger è occupato. Riconnettiti tra un momento.",
+    "errorProtocol": "Il logger non ha accettato la connessione. Riconnettiti."
   }
 }
diff --git a/src/locales/ja/drawer.json b/src/locales/ja/drawer.json
index 3f53440f..299ba8d5 100644
--- a/src/locales/ja/drawer.json
+++ b/src/locales/ja/drawer.json
@@ -520,5 +520,21 @@
     "deleteConfirmBtn": "削除",
     "deleteHasSetups": "このタイプには保存されたセットアップがあります。先に削除してください。",
     "deleteDefault": "組み込みの既定タイプは削除できません。"
+  },
+  "pin": {
+    "title": "{{name}} の PIN",
+    "thisLogger": "このロガー",
+    "desc": "このロガーの PIN を入力してください。ロガーの Transfer → PIN で確認できます。次回からはアプリが記憶します。",
+    "label": "ロガーの PIN",
+    "wrong_one": "PIN が違います。あと {{count}} 回間違えるとロガーがしばらくロックされます。",
+    "wrong_other": "PIN が違います。あと {{count}} 回間違えるとロガーがしばらくロックされます。",
+    "cancel": "キャンセル",
+    "submit": "ロック解除",
+    "checking": "ロガーの PIN を確認しています…",
+    "errorLocked": "PIN の入力ミスが多すぎます。ロガーは {{seconds}} 秒間ロックされています。",
+    "errorCamera": "現在カメラがロガーの無線を使用しています。終わってから再度お試しください。",
+    "errorTimeout": "ロガーが PIN の待機を終了しました。再接続してください。",
+    "errorBusy": "ロガーはビジー状態です。少ししてから再接続してください。",
+    "errorProtocol": "ロガーが接続を受け付けませんでした。再接続してください。"
   }
 }
diff --git a/src/locales/pt-BR/drawer.json b/src/locales/pt-BR/drawer.json
index 33ea8138..0b0774f0 100644
--- a/src/locales/pt-BR/drawer.json
+++ b/src/locales/pt-BR/drawer.json
@@ -520,5 +520,21 @@
     "deleteConfirmBtn": "Excluir",
     "deleteHasSetups": "Este tipo tem configurações salvas — exclua-as primeiro.",
     "deleteDefault": "O tipo padrão integrado não pode ser excluído."
+  },
+  "pin": {
+    "title": "PIN de {{name}}",
+    "thisLogger": "este registrador",
+    "desc": "Digite o PIN deste registrador. Ele aparece no registrador em Transfer → PIN. O app vai lembrar depois disso.",
+    "label": "PIN do registrador",
+    "wrong_one": "PIN incorreto. Resta {{count}} tentativa antes de o registrador bloquear por um tempo.",
+    "wrong_other": "PIN incorreto. Restam {{count}} tentativas antes de o registrador bloquear por um tempo.",
+    "cancel": "Cancelar",
+    "submit": "Desbloquear",
+    "checking": "Verificando o PIN do registrador…",
+    "errorLocked": "PINs incorretos demais. O registrador está bloqueado por {{seconds}} s.",
+    "errorCamera": "A câmera está usando o rádio do registrador agora. Tente de novo quando ela terminar.",
+    "errorTimeout": "O registrador parou de esperar o PIN. Conecte novamente.",
+    "errorBusy": "O registrador está ocupado. Conecte novamente em instantes.",
+    "errorProtocol": "O registrador não aceitou a conexão. Conecte novamente."
   }
 }

From 67b101be88117b6c7a957865fc0c1ea307dc9dcb Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 8 Oct 2026 02:33:46 +0000
Subject: [PATCH 2/5] plan 0031: key stored logger PINs by device id only;
 forget on reset

The advertised-name fallback could match two loggers: default names come
from a 1-in-1000 space, so logger B's PIN could be tried silently on
logger A and burn one of A's five tries. The store is now keyed by the
Web Bluetooth device id alone; old name-keyed entries are never read and
are pruned on the next write.

A Device-tab settings reset can roll a new PIN on the logger, so the
stored copy is forgotten there instead of being spent on the next
connect.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BTPVvtL3ZVDj7UBcAthaQk
---
 src/components/drawer/DeviceSettingsTab.tsx |  9 ++--
 src/lib/ble/auth.test.ts                    | 17 +++---
 src/lib/ble/auth.ts                         |  8 +--
 src/lib/ble/index.ts                        |  2 +-
 src/lib/ble/pinStore.test.ts                | 57 +++++++++++++++++++++
 src/lib/ble/pinStore.ts                     | 30 ++++++-----
 6 files changed, 91 insertions(+), 32 deletions(-)
 create mode 100644 src/lib/ble/pinStore.test.ts

diff --git a/src/components/drawer/DeviceSettingsTab.tsx b/src/components/drawer/DeviceSettingsTab.tsx
index 6daa7baa..c620f07c 100644
--- a/src/components/drawer/DeviceSettingsTab.tsx
+++ b/src/components/drawer/DeviceSettingsTab.tsx
@@ -12,7 +12,7 @@ import {
 } from "@/components/ui/select";
 import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
 import { toast } from "sonner";
-import { type BleConnection, loadLoggerPin, saveLoggerPin } from "@/lib/bleDatalogger";
+import { type BleConnection, forgetLoggerPin, loadLoggerPin, saveLoggerPin } from "@/lib/bleDatalogger";
 import type { DeviceDetails } from "@/lib/loggers";
 import {
   DEVICE_SETTINGS_SCHEMA,
@@ -122,7 +122,7 @@ export function DeviceSettingsTab({ details, bleConnection, onResetComplete }: D
       // let us in either fetched it (local start) or proved it (remote), so
       // the stored copy is the device's current PIN.
       if (!("bluetooth_pin" in settings) && bleConnection) {
-        const pin = loadLoggerPin(bleConnection.device.id, bleConnection.device.name ?? "");
+        const pin = loadLoggerPin(bleConnection.device.id);
         if (pin) settings.bluetooth_pin = pin;
       }
       // Build rows: schema-defined keys first (in order), then unknown keys
@@ -202,7 +202,7 @@ export function DeviceSettingsTab({ details, bleConnection, onResetComplete }: D
     try {
       await details.setSetting(row.key, row.value);
       if (row.key === "bluetooth_pin" && bleConnection) {
-        saveLoggerPin(bleConnection.device.id, bleConnection.device.name ?? "", row.value);
+        saveLoggerPin(bleConnection.device.id, row.value);
       }
       setRows((prev) =>
         prev.map((r) =>
@@ -226,6 +226,9 @@ export function DeviceSettingsTab({ details, bleConnection, onResetComplete }: D
     setResetting(true);
     try {
       await details.resetSettings();
+      // A settings reset can roll a new PIN on the logger; a stale stored one
+      // would silently burn one of the logger's tries on the next connect.
+      if (bleConnection) forgetLoggerPin(bleConnection.device.id);
       toast.success(t("device.toastReset"));
       onResetComplete?.();
     } catch (err) {
diff --git a/src/lib/ble/auth.test.ts b/src/lib/ble/auth.test.ts
index 18f52717..4460f771 100644
--- a/src/lib/ble/auth.test.ts
+++ b/src/lib/ble/auth.test.ts
@@ -104,11 +104,11 @@ describe("authenticateLogger", () => {
     expect(lastWritten(conn.characteristics.fileRequest)).toBe("PINGET");
     conn.characteristics.fileStatus.simulate("PIN:4821\n");
     await expect(result).resolves.toBe("open");
-    expect(loadLoggerPin("dev-1", "BirdsEye-42")).toBe("4821");
+    expect(loadLoggerPin("dev-1")).toBe("4821");
   });
 
   it("answers silently with a stored PIN", async () => {
-    saveLoggerPin("dev-1", "BirdsEye-42", "4821");
+    saveLoggerPin("dev-1", "4821");
     const conn = loggerConnection();
     const promptPin = vi.fn();
     const result = authenticateLogger(conn, { promptPin });
@@ -121,13 +121,8 @@ describe("authenticateLogger", () => {
     expect(promptPin).not.toHaveBeenCalled();
   });
 
-  it("falls back to the name when the browser hands out a new id", async () => {
-    saveLoggerPin("old-id", "BirdsEye-42", "4821");
-    expect(loadLoggerPin("dev-1", "BirdsEye-42")).toBe("4821");
-  });
-
   it("forgets a rejected PIN and asks the user", async () => {
-    saveLoggerPin("dev-1", "BirdsEye-42", "9999");
+    saveLoggerPin("dev-1", "9999");
     const conn = loggerConnection();
     const promptPin = vi.fn().mockResolvedValue("4821");
     const result = authenticateLogger(conn, { promptPin });
@@ -137,14 +132,14 @@ describe("authenticateLogger", () => {
     conn.characteristics.fileStatus.simulate("AUTH:FAIL:4\n");
     await waitForWrite(conn.characteristics.fileRequest, 3);
     expect(lastWritten(conn.characteristics.fileRequest)).toBe("AUTH?");
-    expect(loadLoggerPin("dev-1", "BirdsEye-42")).toBeNull();
+    expect(loadLoggerPin("dev-1")).toBeNull();
     conn.characteristics.fileStatus.simulate(`AUTH:NONCE:${NONCE}\n`);
     await waitForWrite(conn.characteristics.fileRequest, 4);
     expect(promptPin).toHaveBeenCalledWith({ deviceName: "BirdsEye-42", triesLeft: 4 });
     expect(lastWritten(conn.characteristics.fileRequest)).toBe("AUTH:4936f5dad4502101eb0f65790cca77b4");
     conn.characteristics.fileStatus.simulate("AUTH:OK\n");
     await expect(result).resolves.toBe("authed");
-    expect(loadLoggerPin("dev-1", "BirdsEye-42")).toBe("4821");
+    expect(loadLoggerPin("dev-1")).toBe("4821");
   });
 
   it("gives up when the user cancels the prompt", async () => {
@@ -166,7 +161,7 @@ describe("authenticateLogger", () => {
   });
 
   it("reports the camera taking the radio", async () => {
-    saveLoggerPin("dev-1", "BirdsEye-42", "4821");
+    saveLoggerPin("dev-1", "4821");
     const conn = loggerConnection();
     const result = authenticateLogger(conn, { promptPin: vi.fn() });
     await waitForWrite(conn.characteristics.fileRequest, 1);
diff --git a/src/lib/ble/auth.ts b/src/lib/ble/auth.ts
index 1171c071..476336f9 100644
--- a/src/lib/ble/auth.ts
+++ b/src/lib/ble/auth.ts
@@ -191,13 +191,13 @@ export async function authenticateLogger(
   if (first === null) return "legacy";
   if (first.kind === "open") {
     const pin = await sendAuthCommand(connection, "PINGET");
-    if (pin?.kind === "pin") saveLoggerPin(device.id, deviceName, pin.pin);
+    if (pin?.kind === "pin") saveLoggerPin(device.id, pin.pin);
     return "open";
   }
   if (first.kind === "ok") return "authed";
 
   let reply: AuthReply | null = first;
-  let pin = loadLoggerPin(device.id, deviceName);
+  let pin = loadLoggerPin(device.id);
   let triesLeft: number | undefined;
   for (;;) {
     if (reply === null) throw new LoggerAuthError("timeout");
@@ -220,7 +220,7 @@ export async function authenticateLogger(
 
     const verdict = await sendAuthCommand(connection, `AUTH:${await computeAuthAnswer(pin, reply.nonce)}`);
     if (verdict?.kind === "ok") {
-      saveLoggerPin(device.id, deviceName, pin);
+      saveLoggerPin(device.id, pin);
       return "authed";
     }
     if (verdict?.kind !== "fail" && verdict?.kind !== "noNonce") {
@@ -230,7 +230,7 @@ export async function authenticateLogger(
     if (verdict.kind === "fail") {
       // A stored PIN that no longer works (changed on the logger) is dropped
       // so it can't keep burning tries.
-      forgetLoggerPin(device.id, deviceName);
+      forgetLoggerPin(device.id);
       triesLeft = verdict.triesLeft;
       pin = null;
     }
diff --git a/src/lib/ble/index.ts b/src/lib/ble/index.ts
index eb4698b9..49f5f663 100644
--- a/src/lib/ble/index.ts
+++ b/src/lib/ble/index.ts
@@ -54,4 +54,4 @@ export {
   LoggerAuthError,
 } from "./auth";
 export type { AuthOutcome, PinPromptContext } from "./auth";
-export { loadLoggerPin, saveLoggerPin } from "./pinStore";
+export { forgetLoggerPin, loadLoggerPin, saveLoggerPin } from "./pinStore";
diff --git a/src/lib/ble/pinStore.test.ts b/src/lib/ble/pinStore.test.ts
new file mode 100644
index 00000000..fbb0f0b6
--- /dev/null
+++ b/src/lib/ble/pinStore.test.ts
@@ -0,0 +1,57 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { forgetLoggerPin, loadLoggerPin, saveLoggerPin } from "./pinStore";
+
+function memoryStorage(initial: Record<string, string> = {}) {
+  const data = new Map<string, string>(Object.entries(initial));
+  return {
+    data,
+    getItem: (k: string) => data.get(k) ?? null,
+    setItem: (k: string, v: string) => void data.set(k, v),
+    removeItem: (k: string) => void data.delete(k),
+    clear: () => data.clear(),
+  };
+}
+
+afterEach(() => vi.unstubAllGlobals());
+
+describe("pinStore", () => {
+  it("saves, loads and forgets a PIN per device id", () => {
+    vi.stubGlobal("localStorage", memoryStorage());
+    saveLoggerPin("dev-1", "0042");
+    saveLoggerPin("dev-2", "4821");
+    expect(loadLoggerPin("dev-1")).toBe("0042");
+    forgetLoggerPin("dev-1");
+    expect(loadLoggerPin("dev-1")).toBeNull();
+    expect(loadLoggerPin("dev-2")).toBe("4821");
+  });
+
+  it("never falls back to another logger's PIN", () => {
+    // An entry from the first cut of the store, keyed by advertised name.
+    const storage = memoryStorage({ "dove-logger-pins": JSON.stringify({ "name:BirdsEye-42": "4821" }) });
+    vi.stubGlobal("localStorage", storage);
+    expect(loadLoggerPin("dev-1")).toBeNull();
+    saveLoggerPin("dev-1", "1234");
+    // Rewriting the map drops the dead name-keyed entries.
+    expect(JSON.parse(storage.data.get("dove-logger-pins")!)).toEqual({ "id:dev-1": "1234" });
+  });
+
+  it("ignores malformed storage", () => {
+    vi.stubGlobal("localStorage", memoryStorage({ "dove-logger-pins": "{not json" }));
+    expect(loadLoggerPin("dev-1")).toBeNull();
+    vi.stubGlobal("localStorage", memoryStorage({ "dove-logger-pins": "[1,2]" }));
+    expect(loadLoggerPin("dev-1")).toBeNull();
+    vi.stubGlobal("localStorage", memoryStorage({ "dove-logger-pins": JSON.stringify({ "id:dev-1": "12" }) }));
+    expect(loadLoggerPin("dev-1")).toBeNull();
+  });
+
+  it("survives storage that throws", () => {
+    const throwing = {
+      getItem: () => { throw new Error("SecurityError"); },
+      setItem: () => { throw new Error("QuotaExceededError"); },
+    };
+    vi.stubGlobal("localStorage", throwing);
+    expect(() => saveLoggerPin("dev-1", "4821")).not.toThrow();
+    expect(loadLoggerPin("dev-1")).toBeNull();
+    expect(() => forgetLoggerPin("dev-1")).not.toThrow();
+  });
+});
diff --git a/src/lib/ble/pinStore.ts b/src/lib/ble/pinStore.ts
index 43489e2b..7bf11f74 100644
--- a/src/lib/ble/pinStore.ts
+++ b/src/lib/ble/pinStore.ts
@@ -3,11 +3,14 @@
  *
  * Device-local on purpose: it is never cloud-synced, and losing it costs one
  * look at the logger's Transfer → PIN page. Keyed by the Web Bluetooth
- * `device.id` (stable per origin while the browser keeps the permission) with
- * the advertised name as a fallback for when the browser hands out a fresh id.
+ * `device.id` only (stable per origin while the browser keeps the permission).
+ * There is deliberately no fallback to the advertised name: default names come
+ * from a small space, so a name match could try logger B's PIN on logger A and
+ * burn one of A's tries. A browser that hands out a fresh id just means asking
+ * once more (or learning it again from a local start).
  *
- * Every storage access is guarded: a private window or blocked site data just
- * means the user is asked again.
+ * Every storage access is guarded: a private window, blocked site data or a
+ * malformed entry just means the user is asked again.
  */
 
 const STORAGE_KEY = "dove-logger-pins";
@@ -15,7 +18,6 @@ const STORAGE_KEY = "dove-logger-pins";
 type PinMap = Record<string, string>;
 
 const idKey = (id: string) => `id:${id}`;
-const nameKey = (name: string) => `name:${name}`;
 
 function read(): PinMap {
   try {
@@ -28,6 +30,11 @@ function read(): PinMap {
 }
 
 function write(map: PinMap): void {
+  // Entries keyed by advertised name came from the first cut of this store;
+  // they are never read, so drop them whenever the map is rewritten.
+  for (const key of Object.keys(map)) {
+    if (!key.startsWith("id:")) delete map[key];
+  }
   try {
     localStorage.setItem(STORAGE_KEY, JSON.stringify(map));
   } catch {
@@ -36,24 +43,21 @@ function write(map: PinMap): void {
 }
 
 /** The stored PIN for this logger, or null. */
-export function loadLoggerPin(deviceId: string, deviceName: string): string | null {
-  const map = read();
-  const pin = map[idKey(deviceId)] ?? (deviceName ? map[nameKey(deviceName)] : undefined);
+export function loadLoggerPin(deviceId: string): string | null {
+  const pin = read()[idKey(deviceId)];
   return typeof pin === "string" && /^[0-9]{4}$/.test(pin) ? pin : null;
 }
 
 /** Remember the PIN for this logger. */
-export function saveLoggerPin(deviceId: string, deviceName: string, pin: string): void {
+export function saveLoggerPin(deviceId: string, pin: string): void {
   const map = read();
   map[idKey(deviceId)] = pin;
-  if (deviceName) map[nameKey(deviceName)] = pin;
   write(map);
 }
 
-/** Forget this logger's PIN (it was rejected). */
-export function forgetLoggerPin(deviceId: string, deviceName: string): void {
+/** Forget this logger's PIN (rejected, or the logger's settings were reset). */
+export function forgetLoggerPin(deviceId: string): void {
   const map = read();
   delete map[idKey(deviceId)];
-  if (deviceName) delete map[nameKey(deviceName)];
   write(map);
 }

From 137168ad9ba10e8edbdafc3d20ace048cd10a3ff Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 8 Oct 2026 02:34:18 +0000
Subject: [PATCH 3/5] plan 0031: announce a wrong PIN to screen readers

The tries-left message now has role="alert", and the PIN input asks for
one-time-code autocomplete instead of turning autocomplete off.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BTPVvtL3ZVDj7UBcAthaQk
---
 src/components/LoggerPinDialog.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/components/LoggerPinDialog.tsx b/src/components/LoggerPinDialog.tsx
index 34733eed..680a6f6a 100644
--- a/src/components/LoggerPinDialog.tsx
+++ b/src/components/LoggerPinDialog.tsx
@@ -45,7 +45,7 @@ export function LoggerPinDialog({ request, onDone }: LoggerPinDialogProps) {
           <Input
             className="my-4 text-center text-2xl tracking-[0.5em] font-mono"
             inputMode="numeric"
-            autoComplete="off"
+            autoComplete="one-time-code"
             maxLength={4}
             autoFocus
             value={pin}
@@ -53,7 +53,7 @@ export function LoggerPinDialog({ request, onDone }: LoggerPinDialogProps) {
             onChange={(e) => setPin(e.target.value.replace(/[^0-9]/g, "").slice(0, 4))}
           />
           {request?.triesLeft !== undefined && (
-            <p className="text-sm text-destructive mb-4">{t("pin.wrong", { count: request.triesLeft })}</p>
+            <p role="alert" className="text-sm text-destructive mb-4">{t("pin.wrong", { count: request.triesLeft })}</p>
           )}
           <DialogFooter>
             <Button type="button" variant="ghost" onClick={() => onDone(null)}>{t("pin.cancel")}</Button>

From dc871f74672aae7419c36c1d8f9509cf0ccf9af9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 8 Oct 2026 02:34:32 +0000
Subject: [PATCH 4/5] plan 0031: survive reading the PIN, and stop misreading
 the logger
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reading the PIN on the logger (Transfer → PIN) leaves its main menu, and
the logger drops a locked link the moment it does; a slow typist hits the
20 s squat limit instead. The dialog stayed open on a dead link, the
submit failed with a DOMException that never toasted, and the typed PIN
was lost (review H1).

The handshake now owns the link until it hands it over: one queue of
status lines per connection, emptied before every write, with each step
accepting only the replies it expects. The GATT drop and the logger's
session-ending notices (AUTH:TIMEOUT/CAMERA/ENGINE/IDLE) are watched the
whole time, the prompt included. A drop or squat timeout leaves the
prompt open; on submit the same BluetoothDevice is reconnected without
the picker and the handshake reruns with the typed PIN, which is stored
on success. Camera, engine and idle notices close the prompt with a
toast. The dialog copy now says to return the logger to its main menu.

Also from the review:
- M1: GATT/write/WebCrypto failures become a translated toast.
- M2: 2 s of silence to AUTH? is confirmed with a settings-read probe; a
  late nonce or AUTH:REQUIRED is no longer mistaken for legacy firmware.
- L1: a stored PIN is forgotten on LOCKED as well as FAIL.
- L2: NO_NONCE refetches at most 3 times; BUSY is retried once (the
  firmware also sends it when it can't read its PIN).
- L4: unmounting DeviceProvider mid-prompt settles the prompt, so the
  half-open link is disconnected.
- L5: the status line only mentions the PIN once a nonce arrives; docs
  say the legacy cost is paid on every connect.
- L6: tests for reply timeout, typed PIN ending LOCKED, NO_NONCE, BUSY,
  write failure, drops and notices mid-prompt, reconnect, late nonce.
- N2: auth.ts and LoggerPinDialog load on the first connect, off the
  landing payload; CLAUDE.md now says what the eager graph really holds.
- N3: ble-protocol.md §3.3 documents the unprompted notices, including
  the new AUTH:ENGINE and AUTH:IDLE, which also toast after connecting.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BTPVvtL3ZVDj7UBcAthaQk
---
 CHANGELOG.md                           |   6 +-
 CLAUDE.md                              |   8 +-
 docs/ble-protocol.md                   |  41 +-
 docs/ble.md                            |  24 +-
 docs/plans/0031-remote-transfer-pin.md |  85 ++++-
 src/components/LoggerPinDialog.tsx     |   2 +-
 src/contexts/DeviceContext.tsx         | 102 ++++-
 src/lib/ble/auth.test.ts               | 415 +++++++++++++++++---
 src/lib/ble/auth.ts                    | 505 ++++++++++++++++++++-----
 src/lib/ble/connection.ts              |  19 +
 src/lib/ble/index.ts                   |  14 +-
 src/locales/de/drawer.json             |  10 +-
 src/locales/en/drawer.json             |  10 +-
 src/locales/es/drawer.json             |  10 +-
 src/locales/fr/drawer.json             |  10 +-
 src/locales/it/drawer.json             |  10 +-
 src/locales/ja/drawer.json             |  10 +-
 src/locales/pt-BR/drawer.json          |  10 +-
 18 files changed, 1076 insertions(+), 215 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index be82ae33..641c5cb9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,7 +21,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   time you start a transfer from the logger itself. A logger it hasn't seen
   before asks for the PIN once (shown on the logger under Transfer → PIN). Too
   many wrong PINs lock the logger for a while, and the Insta360 camera always
-  gets the radio first. Older loggers connect exactly as before. (Plan 0031.)
+  gets the radio first. Reading the PIN on the logger takes it off its main
+  menu: the app waits, and once you're back on the menu and enter the PIN it
+  reconnects on its own. If the logger ends the session itself (camera, engine
+  started, or 10 minutes idle) the app tells you why. Older loggers connect as
+  before, about 2 seconds slower while the app checks. (Plan 0031.)
 - **Remote Transfer setting** on the Device tab, to turn this off per logger.
 
 ### Changed
diff --git a/CLAUDE.md b/CLAUDE.md
index 14a8764d..ec586d93 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -143,7 +143,7 @@ src/
 │   ├── insta360/          # ★ Native-only Insta360 camera bridge (plan 0025): ipc (insta360_* over the lazy Tauri loader), nativePlayer (the camera stream as a <video>-shaped VideoSurface for useVideoSync), playerClock + pose (pure, tested)
 │   ├── videoPlaylist.ts   # ★ Pure GoPro chunked-video model: parse/order GH/GX/GP/GOPR chunk names, build a virtual timeline (cumulative offsets) + virtual↔local time mapping + planAudioSegments (export audio stitch). useVideoSync swaps the <video> src per chunk; a single file is a 1-chunk playlist
 │   ├── satelliteImagery.ts # ★ Esri Wayback parsing (online-only satellite imagery-date picker)
-│   ├── ble/               # Web Bluetooth DovesLapTimer protocol + firmware OTA (→ docs/ble.md); auth.ts = remote-transfer PIN handshake run by DeviceContext.connect (plan 0031, wire spec docs/ble-protocol.md §3.3) + pinStore.ts (per-logger PIN, local only)
+│   ├── ble/               # Web Bluetooth DovesLapTimer protocol + firmware OTA (→ docs/ble.md); auth.ts = remote-transfer PIN handshake, dynamic-imported by DeviceContext.connect (plan 0031, wire spec docs/ble-protocol.md §3.3) + pinStore.ts (per-logger PIN, local only)
 │   ├── db/                # Admin DB layer: ITrackDatabase + supabaseAdapter + getDatabase()
 │   ├── billing*.ts        # Subscription logic + Supabase billing I/O (→ docs/backend.md)
 │   ├── weatherService.ts  # Historical weather (online-only): NWS/IEM METAR → Open-Meteo fallback
@@ -489,8 +489,10 @@ re-merges it into the main chunk — watch for this.
 **Lazy (off the initial path):** routes (`Login`, `Admin`, `Register`, `Privacy`);
 view tabs (`RaceLineTab`, `GraphViewTab`, `CoachTab`, `ToolsTab`, `SetupsTab`); `FileManagerDrawer`;
 `DataloggerDownload` — the Fledgling BLE flow, mounted on demand by the eager
-`LoggerDownload` picker host so `lib/ble/*` stays off the landing payload while the
-menu still opens instantly; `CourseSectorEditor` (carries
+`LoggerDownload` picker host so the BLE protocol modules stay off the landing
+payload while the menu still opens instantly (the eager `DeviceContext` carries only
+`lib/ble/connection.ts`; it dynamic-imports the PIN handshake `lib/ble/auth` and lazy-loads
+`LoggerPinDialog` on first connect); `CourseSectorEditor` (carries
 `@dnd-kit/*`). Lazy components must render inside `<Suspense>`; use
 `lazy(() => import('…').then((m) => ({ default: m.Named })))` for named exports.
 
diff --git a/docs/ble-protocol.md b/docs/ble-protocol.md
index b3573327..e7cddf94 100644
--- a/docs/ble-protocol.md
+++ b/docs/ble-protocol.md
@@ -151,15 +151,38 @@ device → 0x2A40 : "AUTH:NONCE:<32 hex>"      (locked: a fresh 16-byte nonce)
                |  "AUTH:OK"                   (already authenticated)
                |  "AUTH:LOCKED:<seconds>"     (lockout running)
                |  "AUTH:BUSY"                 (a check is in flight / RNG busy)
-               |  (silence)                   (pre-0019 firmware — treat as open)
+               |  (silence)                   (pre-0019 firmware — confirm, below)
 
 client → 0x2A3E : "AUTH:<32 hex answer>"
 device → 0x2A40 : "AUTH:OK"                   (session promoted to a transfer)
                |  "AUTH:FAIL:<tries left>"    (nonce consumed — ask for a new one)
                |  "AUTH:LOCKED:<seconds>"
                |  "AUTH:NO_NONCE"             (answer without a pending nonce)
+               |  "AUTH:BUSY"                 (PIN unreadable right now — nonce kept,
+                                               no try counted; resend the answer)
 ```
 
+**Session-ending notices.** The logger may send one of these **unprompted, at any
+time** — mid-handshake, while the user is typing the PIN, or on an authenticated
+session — and then drops the link:
+
+| Notice | Meaning |
+|---|---|
+| `AUTH:TIMEOUT` | 20 s squat limit: not authenticated in time (locked sessions only) |
+| `AUTH:CAMERA` | the Insta360 auto-record needs the radio |
+| `AUTH:ENGINE` | a remote session ended because the engine started (the logger goes back to logging) |
+| `AUTH:IDLE` | a remote session ended after 10 min with no transfer commands |
+
+A client must not read any of them as the reply to the command it just sent,
+and should tell the user why the link went away.
+
+**Legacy detection.** Pre-0019 firmware ignores `AUTH?`, but silence can also be
+a slow reply. After **2 s** of silence send a settings read (`SGET:bluetooth_name`)
+and keep listening: pre-PIN firmware answers it (`SVAL:` / `SERR:` / `SBUSY`), a
+locked logger answers `AUTH:REQUIRED` (send `AUTH?` again), and a late reply to
+the first `AUTH?` still counts. No answer at all within ~3 s more → treat as
+pre-PIN firmware. Every legacy connect pays this ~2 s, every time.
+
 **answer** = the first 16 bytes, lowercase hex, of
 `HMAC-SHA256(key = PIN as ASCII, msg = "BEAUTH1|" + nonceHex)`, where `nonceHex`
 is the 32 hex characters exactly as received. The device compares
@@ -179,6 +202,10 @@ case-insensitively in constant time. Golden vectors (firmware
 - **The camera always wins.** If the Insta360 auto-record needs the radio (engine
   turning, camera waking or recording), the logger sends `AUTH:CAMERA` and drops a
   remote session — before or after authentication.
+- **Leaving the main menu drops a locked session** without a notice. Reading the
+  PIN (Transfer → PIN) does exactly that, so a client that prompts for the PIN
+  should reconnect after the user returns the logger to its menu and rerun the
+  handshake with the typed PIN (the web client does).
 - **`PINGET`** → `PIN:<4 digits>`, **open sessions only** (`AUTH:REQUIRED`
   otherwise). This is how a client learns the PIN without anyone typing it: a
   local start hands it over, and the client stores it for the next remote start.
@@ -203,8 +230,9 @@ channel and terminator differ per command.
 | `GET:<filename>` | `0x2A40` then `0x2A3F` | `SIZE:<n>` → data chunks → `DONE` | `ERROR` |
 | `BATT` | `0x2A40` | `BATT:<pct>,<volt>` | (timeout) |
 | `AUTH?` | `0x2A40` | `AUTH:NONCE:<hex>` / `AUTH:OPEN` / `AUTH:OK` (§3.3) | `AUTH:LOCKED:<s>` / `AUTH:BUSY` / (silence = legacy) |
-| `AUTH:<answer>` | `0x2A40` | `AUTH:OK` (§3.3) | `AUTH:FAIL:<n>` / `AUTH:LOCKED:<s>` / `AUTH:NO_NONCE` |
-| `PINGET` | `0x2A40` | `PIN:<4 digits>` (open sessions only) | `AUTH:REQUIRED` / `SERR:NOT_FOUND` |
+| `AUTH:<answer>` | `0x2A40` | `AUTH:OK` (§3.3) | `AUTH:FAIL:<n>` / `AUTH:LOCKED:<s>` / `AUTH:NO_NONCE` / `AUTH:BUSY` |
+| `PINGET` | `0x2A40` | `PIN:<4 digits>` (open sessions only) | `AUTH:REQUIRED` / `SERR:NOT_FOUND` / `SBUSY` |
+| (unprompted) | `0x2A40` | — | `AUTH:TIMEOUT` / `AUTH:CAMERA` / `AUTH:ENGINE` / `AUTH:IDLE`, then the link drops (§3.3) |
 | `SLIST` | `0x2A40` | `SVAL:<k>=<v>` … → `SEND` | — |
 | `SGET:<key>` | `0x2A40` | `SVAL:<key>=<value>` | `SERR:<reason>` |
 | `SSET:<key>=<value>` | `0x2A40` | `SOK:<key>` | `SERR:<reason>` |
@@ -653,6 +681,9 @@ For a non-Web-Bluetooth central (btleplug/`tauri-plugin-blec`, bleak, etc.):
 8. **Honor the timeouts** in §4–§10; use a per-chunk watchdog (not a total cap) for
    large transfers.
 9. **Expect reboots** on `SRESET` and `FWAPPLY` — treat the disconnect as expected.
-10. **Run the §3.3 handshake first**, against the golden vectors; treat 2 s of
-    silence to `AUTH?` as pre-PIN firmware.
+10. **Run the §3.3 handshake first**, against the golden vectors. Confirm 2 s of
+    silence to `AUTH?` with the settings-read probe before treating the logger as
+    pre-PIN firmware, accept only the replies each step expects (drop anything
+    queued before the command), and handle the unprompted session-ending notices
+    anywhere.
 </content>
diff --git a/docs/ble.md b/docs/ble.md
index 5251f7e1..4290d5ec 100644
--- a/docs/ble.md
+++ b/docs/ble.md
@@ -16,7 +16,10 @@ state lives in `DeviceContext.tsx` (wraps the app tree in `Index.tsx`). Source:
 The user reaches the BLE flow through `LoggerDownload` → `LoggerPicker` (an eager,
 lightweight image chooser of supported loggers). Picking the PerchWerks Fledgling
 tile mounts `DataloggerDownload` — the lazy Web Bluetooth flow — on demand, so
-`lib/ble/*` stays out of the initial bundle while the menu still opens instantly.
+the protocol modules (file transfer, settings, tracks, firmware) stay out of the
+initial bundle while the menu still opens instantly. The eager `DeviceContext`
+carries only `lib/ble/connection.ts` (picker + GATT open); the PIN handshake
+(`auth.ts`, `pinStore.ts`) and `LoggerPinDialog` load on the first connect.
 On the native (Tauri) shell the webview has no Web Bluetooth, so the Fledgling tile
 instead mounts the lazy `DovesloggerDownload` flow (BLE over native IPC: scan →
 pick device → connect → list → download), the MyChron tile mounts the lazy
@@ -26,12 +29,19 @@ Alfano tile mounts the lazy `AlfanoDownload` flow (Bluetooth serial over native
 explanatory dialogs instead (Alfano uses Bluetooth serial / Classic Bluetooth SPP,
 which Web Bluetooth — BLE GATT only — can't reach, so it has no web path at all).
 
-**Remote transfer PIN (plan 0031).** `DeviceContext.connect` runs
-`authenticateLogger()` (`src/lib/ble/auth.ts`) right after `connectToDevice()`,
-so every web surface gets an authenticated (or open, or legacy) link without
-knowing auth exists. It learns the PIN via `PINGET` on a locally started
-transfer, tries the stored one silently on a remote start, and only then opens
-`LoggerPinDialog` (mounted by `DeviceProvider`). A failure disconnects and toasts.
+**Remote transfer PIN (plan 0031).** `DeviceContext.connect` dynamic-imports
+`authenticateLogger()` (`src/lib/ble/auth.ts`) and runs it right after
+`connectToDevice()`, so every web surface gets an authenticated (or open, or
+legacy) link without knowing auth exists. It learns the PIN via `PINGET` on a
+locally started transfer, tries the stored one silently on a remote start, and
+only then opens `LoggerPinDialog` (lazy, mounted by `DeviceProvider`). Reading
+the PIN on the logger leaves its main menu, which drops the link: the dialog
+stays open, and on submit the handshake reconnects the same `BluetoothDevice`
+(`reconnectDevice`, no picker) and reruns with the typed PIN. A camera notice
+closes the dialog. Any failure disconnects and toasts a translated reason. After
+connecting, `watchLinkEndNotices` toasts the logger's own session-ending notices
+(`AUTH:CAMERA` / `ENGINE` / `IDLE`) before the disconnect tears the UI down. A
+Device-tab settings reset forgets the stored PIN (the reset may roll a new one).
 Wire spec: [`ble-protocol.md`](ble-protocol.md) §3.3.
 
 `DataloggerDownload` talks to the device only through the generic
diff --git a/docs/plans/0031-remote-transfer-pin.md b/docs/plans/0031-remote-transfer-pin.md
index 9663c86c..a3d498a1 100644
--- a/docs/plans/0031-remote-transfer-pin.md
+++ b/docs/plans/0031-remote-transfer-pin.md
@@ -21,7 +21,9 @@ ever taking the radio from the Insta360 auto-record.
   PIN never crosses the air on a remote start.
 - A correct answer turns the logger into the transfer page ("Remote Transfer").
 - 5 wrong answers → 60 s lockout, doubling to 15 min. 20 s to authenticate.
-- The camera always wins: `AUTH:CAMERA` and the link drops.
+- The camera always wins: `AUTH:CAMERA` and the link drops. A remote session
+  also ends with `AUTH:ENGINE` when the engine starts and `AUTH:IDLE` after
+  10 min without transfer commands. Leaving the main menu drops a locked link.
 - A **local** start is open, and `PINGET` hands over the PIN there.
 - Transfer → PIN on the logger shows it (hold Select) and can roll a new one.
 
@@ -38,17 +40,26 @@ ever taking the radio from the Insta360 auto-record.
    local one needs no typing. Only a logger the app has never seen locally
    prompts.
 3. **Stored PIN first, silently; a rejected one is forgotten.** A PIN changed on
-   the logger would otherwise burn a try on every connect. The prompt then shows
-   the tries left.
+   the logger would otherwise burn a try on every connect. "Rejected" is any
+   verdict but OK — `FAIL`, and `LOCKED` (what the 5th miss returns). The prompt
+   then shows the tries left. A Device-tab settings reset forgets it too, since
+   the reset can roll a new PIN.
 4. **Storage is per device, local, never synced.** `localStorage`, keyed by
-   Web Bluetooth `device.id` (stable per origin while the permission lasts) with
-   the advertised name as a fallback when the browser issues a fresh id. Every
-   access is guarded; a private window just means asking again. Cloud sync was
-   rejected: it would move a device secret into a server for a convenience the
-   `PINGET` learning already provides.
-5. **2 s of silence to `AUTH?` = pre-0019 firmware.** It doesn't know the verb
-   and says nothing; treating that as open keeps every older logger working.
-   It costs 2 s on a legacy connect, once.
+   Web Bluetooth `device.id` only (stable per origin while the permission
+   lasts). The first cut fell back to the advertised name when the browser
+   issued a fresh id; review dropped it — default names come from a 1-in-1000
+   space, so logger B's PIN could be tried on logger A and burn one of A's
+   tries. Old name-keyed entries are never read and are pruned on the next
+   write. Every access is guarded; a private window just means asking again.
+   Cloud sync was rejected: it would move a device secret into a server for a
+   convenience the `PINGET` learning already provides.
+5. **2 s of silence to `AUTH?`, confirmed by a probe = pre-0019 firmware.** It
+   doesn't know the verb and says nothing. Silence alone was too trusting (a
+   slow reply read as legacy, and every later command then got
+   `AUTH:REQUIRED`), so the app follows up with `SGET:bluetooth_name` and keeps
+   listening: old firmware answers it, a locked logger answers `AUTH:REQUIRED`,
+   and a late nonce still counts. The ~2 s is paid on every legacy connect, not
+   once.
 6. **The Device tab still shows the PIN.** New firmware omits it from `SLIST`;
    the tab injects the stored copy (which the handshake just fetched or proved,
    so it is current) and re-stores it on a successful `SSET`. The schema now
@@ -58,24 +69,60 @@ ever taking the radio from the Insta360 auto-record.
    its own implementation of the same handshake against the same golden vectors.
    This plan's code is web-only.
 
+8. **The handshake owns the link until it hands it over.** One queue of status
+   lines per connection; each step accepts only the replies it expects, and the
+   queue is emptied before every write, so a stale or interleaved line is never
+   an answer. The GATT drop and the logger's session-ending notices
+   (`AUTH:TIMEOUT|CAMERA|ENGINE|IDLE`) are watched throughout, the PIN prompt
+   included. `AUTH:BUSY` is retried once (the firmware also sends it when it
+   can't read its PIN, without consuming the nonce); `AUTH:NO_NONCE` fetches a
+   fresh nonce at most 3 times. Any other failure (GATT, write, WebCrypto) is a
+   translated toast, never just a console line.
+9. **Reading the PIN costs the link; the app reconnects.** Transfer → PIN on the
+   logger leaves the main menu, which drops a locked link, and a slow typist
+   hits the 20 s squat limit. Either way the prompt stays open (its copy says to
+   return the logger to the main menu first); on submit the handshake reopens
+   the same `BluetoothDevice` without the picker (`reconnectDevice`) and reruns
+   with the typed PIN, storing it on success. Capped at 2 reconnects. A camera,
+   engine or idle notice closes the prompt with a toast instead — reconnecting
+   can't help there.
+10. **Notices after the handshake are surfaced too.** `watchLinkEndNotices`
+   toasts `AUTH:CAMERA` / `ENGINE` / `IDLE` on a connected logger, before the
+   disconnect tears the Device tab or download dialog down.
+11. **Off the landing payload.** `DeviceContext` dynamic-imports `lib/ble/auth`
+   and lazy-loads `LoggerPinDialog` on the first connect. Unmounting
+   `DeviceProvider` mid-prompt settles the prompt so the half-open link is
+   disconnected rather than leaked.
+
 ## Files
 
 - `src/lib/ble/auth.ts` — `computeAuthAnswer` (WebCrypto), `parseAuthReply`,
-  `sendAuthCommand`, `authenticateLogger`, `LoggerAuthError`.
+  `parseLinkEndNotice`, the line-queue `AuthChannel`, `authenticateLogger`,
+  `watchLinkEndNotices`, `LoggerAuthError`.
 - `src/lib/ble/pinStore.ts` — the per-logger store.
-- `src/components/LoggerPinDialog.tsx` — the prompt, mounted by `DeviceProvider`.
+- `src/lib/ble/connection.ts` — `reconnectDevice` (same device, no picker).
+- `src/components/LoggerPinDialog.tsx` — the prompt, lazy-mounted by `DeviceProvider`.
 - `src/contexts/DeviceContext.tsx` — runs the handshake on connect.
 - `src/components/drawer/DeviceSettingsTab.tsx`, `src/lib/deviceSettingsSchema.ts`.
-- Tests: `src/lib/ble/auth.test.ts` (golden vectors, every reply, the flow),
-  `src/lib/deviceSettingsSchema.test.ts`.
+- Tests: `src/lib/ble/auth.test.ts` (golden vectors, every reply, legacy probe,
+  busy/no-nonce/timeout, notices and drops mid-prompt, reconnect),
+  `src/lib/ble/pinStore.test.ts`, `src/lib/deviceSettingsSchema.test.ts`.
 
 ## Known limits
 
 - **Unencrypted link.** A sniffer that captures a nonce + answer can brute-force
   10 000 PINs offline. The gate stops a casual phone, not a determined attacker
   with a sniffer; changing the PIN is the remedy. Documented in the wire spec.
-- **The 20 s squat limit includes the prompt.** A user who takes longer to read
-  the PIN off the logger gets "stopped waiting" and connects again (the logger
-  now shows nothing new to type, the second try is quick).
+- **The reconnect needs the logger back on its main menu.** If the user submits
+  while the logger is still on the PIN page, `gatt.connect()` fails and the app
+  says to return it to the menu and connect again.
 - **Hardware check outstanding:** remote start from the menu, wrong-PIN lockout,
-  `AUTH:CAMERA` with a paired X4, and a legacy logger connecting after 2 s.
+  `AUTH:CAMERA` with a paired X4, a legacy logger connecting after the probe,
+  and the read-the-PIN-then-reconnect path (Chrome's `gatt.connect()` on a
+  device that re-advertises).
+
+## Review follow-up (PR #454)
+
+H1 (prompt on a dead link, typed PIN lost), M1 (non-auth errors only logged),
+M2 (slow reply read as legacy), M3 (stale PIN after a settings reset), L1–L6 and
+the nits are addressed by decisions 3–5 and 8–11 above.
diff --git a/src/components/LoggerPinDialog.tsx b/src/components/LoggerPinDialog.tsx
index 680a6f6a..94860782 100644
--- a/src/components/LoggerPinDialog.tsx
+++ b/src/components/LoggerPinDialog.tsx
@@ -5,7 +5,7 @@ import {
 } from "@/components/ui/dialog";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
-import type { PinPromptContext } from "@/lib/ble";
+import type { PinPromptContext } from "@/lib/ble/auth";
 
 interface LoggerPinDialogProps {
   /** The open prompt, or null when none is pending. */
diff --git a/src/contexts/DeviceContext.tsx b/src/contexts/DeviceContext.tsx
index 38bbc3d6..4066b121 100644
--- a/src/contexts/DeviceContext.tsx
+++ b/src/contexts/DeviceContext.tsx
@@ -1,16 +1,16 @@
-import { createContext, useCallback, useContext, useEffect, useRef, useState, type ReactNode } from "react";
+import {
+  createContext, lazy, Suspense, useCallback, useContext, useEffect, useRef, useState, type ReactNode,
+} from "react";
 import { useTranslation } from "react-i18next";
 import { toast } from "sonner";
 import {
   type BleConnection,
-  type PinPromptContext,
-  authenticateLogger,
   connectToDevice,
   disconnect,
   isBleSupported,
-  LoggerAuthError,
+  reconnectDevice,
 } from "@/lib/bleDatalogger";
-import { LoggerPinDialog } from "@/components/LoggerPinDialog";
+import type { AuthPhase, LinkEndNotice, LoggerAuthError, PinPromptContext } from "@/lib/ble/auth";
 import type { DeviceDetails, LoggerKind } from "@/lib/loggers";
 import { createBleDeviceDetails } from "@/lib/loggers/bleDetails";
 import {
@@ -20,6 +20,12 @@ import {
 } from "@/lib/loggers/native/owner";
 import type { ScannedDevice } from "@/lib/loggers/doveslogger/ipc";
 
+// The remote-transfer PIN handshake (plan 0031) and its prompt load on the
+// first connect, keeping them off the landing payload.
+const LoggerPinDialog = lazy(() =>
+  import("@/components/LoggerPinDialog").then((m) => ({ default: m.LoggerPinDialog })),
+);
+
 /** DeviceContext's label in the native connection-ownership token. */
 const OWNER = "device-tab";
 
@@ -94,6 +100,8 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
   const connectionRef = useRef<BleConnection | null>(null);
   const nativeConnectedRef = useRef(false);
   const flashingRef = useRef(false);
+  // Unsubscribes the session-ending-notice watch on the live connection.
+  const stopNoticeWatchRef = useRef<(() => void) | null>(null);
 
   // Keep refs in sync for cleanup
   useEffect(() => {
@@ -109,6 +117,8 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
   }, []);
 
   const handleDisconnect = useCallback(() => {
+    stopNoticeWatchRef.current?.();
+    stopNoticeWatchRef.current = null;
     // During a firmware flash the device reboots into its bootloader; that BLE
     // drop is expected, so keep the UI mounted instead of tearing it down.
     if (flashingRef.current) return;
@@ -119,8 +129,16 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
     setDeviceName(null);
   }, []);
 
-  const promptPin = useCallback((ctx: PinPromptContext) => {
+  const promptPin = useCallback((ctx: PinPromptContext, signal: AbortSignal) => {
     return new Promise<string | null>((resolve) => {
+      // The logger ended the session for good while the prompt was open:
+      // close it (the handshake toasts why).
+      signal.addEventListener("abort", () => {
+        if (pinResolveRef.current !== resolve) return;
+        pinResolveRef.current = null;
+        setPinRequest(null);
+        resolve(null);
+      });
       pinResolveRef.current = resolve;
       setPinRequest(ctx);
     });
@@ -138,30 +156,68 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
       case "locked": return t("pin.errorLocked", { seconds: err.seconds ?? 0 });
       case "camera": return t("pin.errorCamera");
       case "timeout": return t("pin.errorTimeout");
+      case "engine": return t("pin.errorEngine");
+      case "idle": return t("pin.errorIdle");
       case "busy": return t("pin.errorBusy");
+      case "noReply": return t("pin.errorNoReply");
+      case "disconnected": return t("pin.errorDisconnected");
       default: return t("pin.errorProtocol");
     }
   }, [t]);
 
+  const linkEndMessage = useCallback((notice: LinkEndNotice) => {
+    switch (notice) {
+      case "camera": return t("pin.errorCamera");
+      case "engine": return t("pin.errorEngine");
+      case "idle": return t("pin.errorIdle");
+      default: return t("pin.errorTimeout");
+    }
+  }, [t]);
+
   const connectFn = useCallback(async (onStatus?: (msg: string) => void): Promise<BleConnection | null> => {
     if (isConnecting) return null;
     if (connectionRef.current) return connectionRef.current;
     setIsConnecting(true);
+    let conn: BleConnection;
+    try {
+      conn = await connectToDevice(onStatus);
+    } catch (err) {
+      // User cancelled the picker or connection failed
+      console.warn("BLE connect failed/cancelled:", err);
+      setIsConnecting(false);
+      return null;
+    }
     try {
-      const conn = await connectToDevice(onStatus);
       // A logger started remotely from its menu answers nothing but the PIN
       // handshake until it is satisfied; a local start or older firmware
       // passes straight through.
-      onStatus?.(t("pin.checking"));
+      const auth = await import("@/lib/ble/auth");
+      const device = conn.device;
+      let result;
       try {
-        await authenticateLogger(conn, { promptPin });
+        result = await auth.authenticateLogger(conn, {
+          promptPin,
+          reconnect: () => reconnectDevice(device),
+          onPhase: (phase: AuthPhase) => {
+            if (phase === "pin") onStatus?.(t("pin.checking"));
+            else if (phase === "reconnecting") onStatus?.(t("pin.reconnecting"));
+            else onStatus?.(t("pin.handshake"));
+          },
+        });
       } catch (err) {
         disconnect(conn);
-        if (err instanceof LoggerAuthError && err.code !== "cancelled") {
-          toast.error(authErrorMessage(err));
-        }
-        throw err;
+        // authenticateLogger only ever rejects with LoggerAuthError.
+        const authErr = err as LoggerAuthError;
+        if (authErr.code !== "cancelled") toast.error(authErrorMessage(authErr));
+        return null;
       }
+      conn = result.connection;
+      // The logger can end the session on its own (camera, engine start,
+      // idle): say why before the disconnect tears the UI down.
+      stopNoticeWatchRef.current?.();
+      stopNoticeWatchRef.current = auth.watchLinkEndNotices(conn, (notice) => {
+        toast.error(linkEndMessage(notice));
+      });
       // Listen for unexpected disconnects
       conn.device.addEventListener("gattserverdisconnected", handleDisconnect);
       setConnection(conn);
@@ -170,14 +226,15 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
       setLoggerKind("fledgling");
       setDeviceName(conn.device.name ?? "Unknown Device");
       return conn;
-    } catch (err) {
-      // User cancelled the picker or connection failed
-      console.warn("BLE connect failed/cancelled:", err);
+    } catch {
+      // Loading the handshake module failed (offline chunk miss).
+      disconnect(conn);
+      toast.error(t("pin.errorProtocol"));
       return null;
     } finally {
       setIsConnecting(false);
     }
-  }, [isConnecting, handleDisconnect, promptPin, authErrorMessage, t]);
+  }, [isConnecting, handleDisconnect, promptPin, authErrorMessage, linkEndMessage, t]);
 
   const scanNative = useCallback(async (): Promise<ScannedDevice[]> => {
     // Lazy import keeps Tauri off the web/eager graph (Golden Rule #1).
@@ -228,6 +285,11 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
   // Cleanup on unmount
   useEffect(() => {
     return () => {
+      // Settle a PIN prompt still open so the handshake fails and disconnects
+      // its half-open link instead of waiting forever.
+      const resolvePin = pinResolveRef.current;
+      pinResolveRef.current = null;
+      resolvePin?.(null);
       if (connectionRef.current) {
         disconnect(connectionRef.current);
       }
@@ -257,7 +319,11 @@ export function DeviceProvider({ children }: { children: ReactNode }) {
       }}
     >
       {children}
-      <LoggerPinDialog request={pinRequest} onDone={finishPinPrompt} />
+      {pinRequest && (
+        <Suspense fallback={null}>
+          <LoggerPinDialog request={pinRequest} onDone={finishPinPrompt} />
+        </Suspense>
+      )}
     </DeviceContext.Provider>
   );
 }
diff --git a/src/lib/ble/auth.test.ts b/src/lib/ble/auth.test.ts
index 4460f771..a2d02ab7 100644
--- a/src/lib/ble/auth.test.ts
+++ b/src/lib/ble/auth.test.ts
@@ -1,16 +1,28 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import {
   authenticateLogger,
+  BUSY_RETRY_DELAY_MS,
   computeAuthAnswer,
   isValidPin,
+  LEGACY_PROBE_TIMEOUT_MS,
   LEGACY_TIMEOUT_MS,
   LoggerAuthError,
   parseAuthReply,
+  parseLinkEndNotice,
+  REPLY_TIMEOUT_MS,
+  watchLinkEndNotices,
+  type PinPromptContext,
 } from "./auth";
 import { loadLoggerPin, saveLoggerPin } from "./pinStore";
-import { createMockConnection, flushMicrotasks, lastWritten, writeCount } from "./__test__/mockBle";
+import { createMockConnection, lastWritten, writeCount } from "./__test__/mockBle";
+import type { BleConnection } from "./types";
 
 const NONCE = "00112233445566778899aabbccddeeff";
+/** computeAuthAnswer("4821", NONCE) — the firmware golden vector. */
+const ANSWER_4821 = "AUTH:4936f5dad4502101eb0f65790cca77b4";
+
+// Captured before any test fakes timers: waiting on WebCrypto needs real time.
+const realSetTimeout = globalThis.setTimeout;
 
 function memoryStorage() {
   const data = new Map<string, string>();
@@ -22,22 +34,60 @@ function memoryStorage() {
   };
 }
 
-function loggerConnection() {
+type MockLogger = ReturnType<typeof createMockConnection> & {
+  device: EventTarget & { id: string; name: string; gatt: { connected: boolean } };
+};
+
+function loggerConnection(): MockLogger {
   const conn = createMockConnection();
-  (conn as { device: unknown }).device = { id: "dev-1", name: "BirdsEye-42", gatt: { connected: true } };
-  return conn;
+  const device = Object.assign(new EventTarget(), { id: "dev-1", name: "BirdsEye-42", gatt: { connected: true } });
+  (conn as { device: unknown }).device = device;
+  return conn as MockLogger;
+}
+
+/** The logger drops the GATT link. */
+function drop(conn: MockLogger) {
+  conn.device.gatt.connected = false;
+  conn.device.dispatchEvent(new Event("gattserverdisconnected"));
 }
 
-/** Let async work (WebCrypto included) settle until a new command is written. */
-async function waitForWrite(char: Parameters<typeof writeCount>[0], count: number) {
-  for (let i = 0; i < 50 && writeCount(char) < count; i++) {
-    await flushMicrotasks();
-    await new Promise((r) => setTimeout(r, 0));
+const req = (conn: MockLogger) => conn.characteristics.fileRequest;
+const reply = (conn: MockLogger, line: string) => conn.characteristics.fileStatus.simulate(`${line}\n`);
+
+/** Let async work (WebCrypto included) settle until `count` commands were written. */
+async function waitForWrite(conn: MockLogger, count: number) {
+  for (let i = 0; i < 200 && writeCount(req(conn)) < count; i++) {
+    await new Promise((r) => realSetTimeout(r, 1));
   }
-  expect(writeCount(char)).toBe(count);
+  expect(writeCount(req(conn))).toBe(count);
+}
+
+/** A PIN prompt the test answers by hand. */
+function manualPrompt() {
+  const calls: { ctx: PinPromptContext; signal: AbortSignal; answer: (pin: string | null) => void }[] = [];
+  const promptPin = vi.fn((ctx: PinPromptContext, signal: AbortSignal) =>
+    new Promise<string | null>((resolve) => calls.push({ ctx, signal, answer: resolve })));
+  return { promptPin, calls };
 }
 
-beforeEach(() => vi.stubGlobal("localStorage", memoryStorage()));
+async function waitForPrompt(calls: unknown[], count: number) {
+  for (let i = 0; i < 200 && calls.length < count; i++) {
+    await new Promise((r) => realSetTimeout(r, 1));
+  }
+  expect(calls.length).toBe(count);
+}
+
+/** Drive a locked logger to the point where it has handed out a nonce. */
+async function startLocked(conn: MockLogger) {
+  await waitForWrite(conn, 1);
+  expect(lastWritten(req(conn))).toBe("AUTH?");
+  reply(conn, `AUTH:NONCE:${NONCE}`);
+}
+
+beforeEach(() => {
+  vi.stubGlobal("localStorage", memoryStorage());
+  vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
+});
 afterEach(() => {
   vi.unstubAllGlobals();
   vi.useRealTimers();
@@ -64,18 +114,28 @@ describe("isValidPin", () => {
   });
 });
 
-describe("parseAuthReply", () => {
+describe("parseAuthReply / parseLinkEndNotice", () => {
   it("parses every firmware reply", () => {
     expect(parseAuthReply(`AUTH:NONCE:${NONCE}`)).toEqual({ kind: "nonce", nonce: NONCE });
     expect(parseAuthReply("AUTH:FAIL:3")).toEqual({ kind: "fail", triesLeft: 3 });
     expect(parseAuthReply("AUTH:LOCKED:60")).toEqual({ kind: "locked", seconds: 60 });
     expect(parseAuthReply("AUTH:OPEN")).toEqual({ kind: "open" });
     expect(parseAuthReply("AUTH:OK\r")).toEqual({ kind: "ok" });
-    expect(parseAuthReply("AUTH:CAMERA")).toEqual({ kind: "camera" });
-    expect(parseAuthReply("AUTH:TIMEOUT")).toEqual({ kind: "timeout" });
+    expect(parseAuthReply("AUTH:NO_NONCE")).toEqual({ kind: "noNonce" });
+    expect(parseAuthReply("AUTH:BUSY")).toEqual({ kind: "busy" });
+    expect(parseAuthReply("AUTH:REQUIRED")).toEqual({ kind: "required" });
     expect(parseAuthReply("PIN:0042")).toEqual({ kind: "pin", pin: "0042" });
   });
 
+  it("parses the session-ending notices separately", () => {
+    expect(parseLinkEndNotice("AUTH:TIMEOUT")).toBe("timeout");
+    expect(parseLinkEndNotice("AUTH:CAMERA\r")).toBe("camera");
+    expect(parseLinkEndNotice("AUTH:ENGINE")).toBe("engine");
+    expect(parseLinkEndNotice("AUTH:IDLE")).toBe("idle");
+    expect(parseLinkEndNotice("AUTH:OK")).toBeNull();
+    expect(parseAuthReply("AUTH:CAMERA")).toBeNull();
+  });
+
   it("ignores unrelated or malformed lines", () => {
     expect(parseAuthReply("BATT:50,3.7")).toBeNull();
     expect(parseAuthReply("AUTH:NONCE:xyz")).toBeNull();
@@ -84,40 +144,131 @@ describe("parseAuthReply", () => {
   });
 });
 
-describe("authenticateLogger", () => {
-  it("treats silence as pre-PIN firmware", async () => {
-    vi.useFakeTimers();
+describe("authenticateLogger — opening", () => {
+  it("confirms pre-PIN firmware with a settings read after the silence", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    await vi.advanceTimersByTimeAsync(LEGACY_TIMEOUT_MS);
+    await waitForWrite(conn, 2);
+    expect(lastWritten(req(conn))).toBe("SGET:bluetooth_name");
+    reply(conn, "SVAL:bluetooth_name=Logger-1");
+    await expect(result).resolves.toMatchObject({ outcome: "legacy", connection: conn });
+  });
+
+  it("treats total silence as pre-PIN firmware", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    await vi.advanceTimersByTimeAsync(LEGACY_TIMEOUT_MS);
+    await waitForWrite(conn, 2);
+    await vi.advanceTimersByTimeAsync(LEGACY_PROBE_TIMEOUT_MS);
+    await expect(result).resolves.toMatchObject({ outcome: "legacy" });
+  });
+
+  it("does not mistake a nonce that arrives after the silence for legacy firmware", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    await vi.advanceTimersByTimeAsync(LEGACY_TIMEOUT_MS);
+    await waitForWrite(conn, 2);
+    reply(conn, `AUTH:NONCE:${NONCE}`);
+    await waitForWrite(conn, 3);
+    expect(lastWritten(req(conn))).toBe(ANSWER_4821);
+    // The probe's AUTH:REQUIRED lands late; it must not be read as the verdict.
+    reply(conn, "AUTH:REQUIRED");
+    reply(conn, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed" });
+  });
+
+  it("asks for a fresh nonce when the probe says a PIN is required", async () => {
+    saveLoggerPin("dev-1", "4821");
     const conn = loggerConnection();
     const result = authenticateLogger(conn, { promptPin: vi.fn() });
-    await flushMicrotasks();
-    expect(lastWritten(conn.characteristics.fileRequest)).toBe("AUTH?");
+    await waitForWrite(conn, 1);
     await vi.advanceTimersByTimeAsync(LEGACY_TIMEOUT_MS);
-    await expect(result).resolves.toBe("legacy");
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:REQUIRED");
+    await waitForWrite(conn, 3);
+    expect(lastWritten(req(conn))).toBe("AUTH?");
+    reply(conn, `AUTH:NONCE:${NONCE}`);
+    await waitForWrite(conn, 4);
+    reply(conn, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed" });
   });
 
   it("learns the PIN from an open (locally started) session", async () => {
     const conn = loggerConnection();
     const result = authenticateLogger(conn, { promptPin: vi.fn() });
-    await waitForWrite(conn.characteristics.fileRequest, 1);
-    conn.characteristics.fileStatus.simulate("AUTH:OPEN\n");
-    await waitForWrite(conn.characteristics.fileRequest, 2);
-    expect(lastWritten(conn.characteristics.fileRequest)).toBe("PINGET");
-    conn.characteristics.fileStatus.simulate("PIN:4821\n");
-    await expect(result).resolves.toBe("open");
+    await waitForWrite(conn, 1);
+    reply(conn, "AUTH:OPEN");
+    await waitForWrite(conn, 2);
+    expect(lastWritten(req(conn))).toBe("PINGET");
+    reply(conn, "PIN:4821");
+    await expect(result).resolves.toMatchObject({ outcome: "open" });
     expect(loadLoggerPin("dev-1")).toBe("4821");
   });
 
+  it("does not wait out PINGET when the logger refuses it", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    reply(conn, "AUTH:OPEN");
+    await waitForWrite(conn, 2);
+    reply(conn, "SERR:NOT_FOUND");
+    await expect(result).resolves.toMatchObject({ outcome: "open" });
+    expect(loadLoggerPin("dev-1")).toBeNull();
+  });
+
+  it("retries once when the logger is busy", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await waitForWrite(conn, 1);
+    reply(conn, "AUTH:BUSY");
+    await vi.advanceTimersByTimeAsync(BUSY_RETRY_DELAY_MS);
+    await waitForWrite(conn, 2);
+    expect(lastWritten(req(conn))).toBe("AUTH?");
+    reply(conn, `AUTH:NONCE:${NONCE}`);
+    await waitForWrite(conn, 3);
+    // Busy on the answer (the logger couldn't read its PIN): resend it once.
+    reply(conn, "AUTH:BUSY");
+    await vi.advanceTimersByTimeAsync(BUSY_RETRY_DELAY_MS);
+    await waitForWrite(conn, 4);
+    expect(lastWritten(req(conn))).toBe(ANSWER_4821);
+    reply(conn, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed" });
+  });
+
+  it("gives up when the logger stays busy", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:BUSY");
+    await vi.advanceTimersByTimeAsync(BUSY_RETRY_DELAY_MS);
+    await waitForWrite(conn, 3);
+    reply(conn, "AUTH:BUSY");
+    await expect(result).rejects.toMatchObject({ code: "busy" });
+    expect(loadLoggerPin("dev-1")).toBe("4821");
+  });
+});
+
+describe("authenticateLogger — PIN", () => {
   it("answers silently with a stored PIN", async () => {
     saveLoggerPin("dev-1", "4821");
     const conn = loggerConnection();
     const promptPin = vi.fn();
     const result = authenticateLogger(conn, { promptPin });
-    await waitForWrite(conn.characteristics.fileRequest, 1);
-    conn.characteristics.fileStatus.simulate(`AUTH:NONCE:${NONCE}\n`);
-    await waitForWrite(conn.characteristics.fileRequest, 2);
-    expect(lastWritten(conn.characteristics.fileRequest)).toBe("AUTH:4936f5dad4502101eb0f65790cca77b4");
-    conn.characteristics.fileStatus.simulate("AUTH:OK\n");
-    await expect(result).resolves.toBe("authed");
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    expect(lastWritten(req(conn))).toBe(ANSWER_4821);
+    // An unrelated notification in between is not a verdict.
+    reply(conn, "BATT:80,3.9");
+    reply(conn, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed" });
     expect(promptPin).not.toHaveBeenCalled();
   });
 
@@ -126,48 +277,208 @@ describe("authenticateLogger", () => {
     const conn = loggerConnection();
     const promptPin = vi.fn().mockResolvedValue("4821");
     const result = authenticateLogger(conn, { promptPin });
-    await waitForWrite(conn.characteristics.fileRequest, 1);
-    conn.characteristics.fileStatus.simulate(`AUTH:NONCE:${NONCE}\n`);
-    await waitForWrite(conn.characteristics.fileRequest, 2);
-    conn.characteristics.fileStatus.simulate("AUTH:FAIL:4\n");
-    await waitForWrite(conn.characteristics.fileRequest, 3);
-    expect(lastWritten(conn.characteristics.fileRequest)).toBe("AUTH?");
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:FAIL:4");
+    await waitForWrite(conn, 3);
+    expect(lastWritten(req(conn))).toBe("AUTH?");
     expect(loadLoggerPin("dev-1")).toBeNull();
-    conn.characteristics.fileStatus.simulate(`AUTH:NONCE:${NONCE}\n`);
-    await waitForWrite(conn.characteristics.fileRequest, 4);
-    expect(promptPin).toHaveBeenCalledWith({ deviceName: "BirdsEye-42", triesLeft: 4 });
-    expect(lastWritten(conn.characteristics.fileRequest)).toBe("AUTH:4936f5dad4502101eb0f65790cca77b4");
-    conn.characteristics.fileStatus.simulate("AUTH:OK\n");
-    await expect(result).resolves.toBe("authed");
+    reply(conn, `AUTH:NONCE:${NONCE}`);
+    await waitForWrite(conn, 4);
+    expect(promptPin).toHaveBeenCalledWith({ deviceName: "BirdsEye-42", triesLeft: 4 }, expect.any(AbortSignal));
+    expect(lastWritten(req(conn))).toBe(ANSWER_4821);
+    reply(conn, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed" });
     expect(loadLoggerPin("dev-1")).toBe("4821");
   });
 
   it("gives up when the user cancels the prompt", async () => {
     const conn = loggerConnection();
     const result = authenticateLogger(conn, { promptPin: vi.fn().mockResolvedValue(null) });
-    await waitForWrite(conn.characteristics.fileRequest, 1);
-    conn.characteristics.fileStatus.simulate(`AUTH:NONCE:${NONCE}\n`);
+    await startLocked(conn);
     await expect(result).rejects.toMatchObject({ code: "cancelled" });
   });
 
   it("reports a lockout with its remaining seconds", async () => {
     const conn = loggerConnection();
     const result = authenticateLogger(conn, { promptPin: vi.fn() });
-    await waitForWrite(conn.characteristics.fileRequest, 1);
-    conn.characteristics.fileStatus.simulate("AUTH:LOCKED:120\n");
+    await waitForWrite(conn, 1);
+    reply(conn, "AUTH:LOCKED:120");
     const err = await result.catch((e: unknown) => e);
     expect(err).toBeInstanceOf(LoggerAuthError);
     expect(err).toMatchObject({ code: "locked", seconds: 120 });
   });
 
+  it("reports a lockout triggered by a typed PIN and stores nothing", async () => {
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn().mockResolvedValue("4821") });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:LOCKED:60");
+    await expect(result).rejects.toMatchObject({ code: "locked", seconds: 60 });
+    expect(loadLoggerPin("dev-1")).toBeNull();
+  });
+
+  it("forgets a stored PIN whose answer ends in a lockout", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:LOCKED:60");
+    await expect(result).rejects.toMatchObject({ code: "locked" });
+    expect(loadLoggerPin("dev-1")).toBeNull();
+  });
+
+  it("fetches a fresh nonce on NO_NONCE, a limited number of times", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await startLocked(conn);
+    let writes = 2;
+    for (let round = 0; round < 4; round++) {
+      await waitForWrite(conn, writes);
+      expect(lastWritten(req(conn))).toBe(ANSWER_4821);
+      reply(conn, "AUTH:NO_NONCE");
+      if (round === 3) break;
+      await waitForWrite(conn, writes + 1);
+      expect(lastWritten(req(conn))).toBe("AUTH?");
+      reply(conn, `AUTH:NONCE:${NONCE}`);
+      writes += 2;
+    }
+    await expect(result).rejects.toMatchObject({ code: "protocol" });
+    // NO_NONCE says nothing about the PIN.
+    expect(loadLoggerPin("dev-1")).toBe("4821");
+  });
+
+  it("reports a logger that stops answering", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const result = authenticateLogger(conn, { promptPin: vi.fn() });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    const settled = result.catch((e: unknown) => e);
+    await vi.advanceTimersByTimeAsync(REPLY_TIMEOUT_MS);
+    await expect(settled).resolves.toMatchObject({ code: "noReply" });
+  });
+
+  it("maps a failed write to a protocol error", async () => {
+    const conn = loggerConnection();
+    req(conn).writeValue = vi.fn().mockRejectedValue(new DOMException("GATT operation failed", "NetworkError"));
+    await expect(authenticateLogger(conn, { promptPin: vi.fn() })).rejects.toMatchObject({ code: "protocol" });
+  });
+});
+
+describe("authenticateLogger — the link ending", () => {
   it("reports the camera taking the radio", async () => {
     saveLoggerPin("dev-1", "4821");
     const conn = loggerConnection();
     const result = authenticateLogger(conn, { promptPin: vi.fn() });
-    await waitForWrite(conn.characteristics.fileRequest, 1);
-    conn.characteristics.fileStatus.simulate(`AUTH:NONCE:${NONCE}\n`);
-    await waitForWrite(conn.characteristics.fileRequest, 2);
-    conn.characteristics.fileStatus.simulate("AUTH:CAMERA\n");
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    reply(conn, "AUTH:CAMERA");
+    await expect(result).rejects.toMatchObject({ code: "camera" });
+  });
+
+  it("closes the prompt when the camera takes the radio mid-prompt", async () => {
+    const conn = loggerConnection();
+    const { promptPin, calls } = manualPrompt();
+    const result = authenticateLogger(conn, { promptPin, reconnect: vi.fn() });
+    await startLocked(conn);
+    await waitForPrompt(calls, 1);
+    reply(conn, "AUTH:CAMERA");
     await expect(result).rejects.toMatchObject({ code: "camera" });
+    expect(calls[0].signal.aborted).toBe(true);
+  });
+
+  it("closes the prompt on a drop when it can't reconnect", async () => {
+    const conn = loggerConnection();
+    const { promptPin, calls } = manualPrompt();
+    const result = authenticateLogger(conn, { promptPin });
+    await startLocked(conn);
+    await waitForPrompt(calls, 1);
+    drop(conn);
+    await expect(result).rejects.toMatchObject({ code: "disconnected" });
+    expect(calls[0].signal.aborted).toBe(true);
+  });
+
+  it("reconnects and reuses the typed PIN after the logger left its menu", async () => {
+    const conn = loggerConnection();
+    const fresh = loggerConnection();
+    const reconnect = vi.fn(async (): Promise<BleConnection> => fresh);
+    const { promptPin, calls } = manualPrompt();
+    const result = authenticateLogger(conn, { promptPin, reconnect });
+    await startLocked(conn);
+    await waitForPrompt(calls, 1);
+    // The user opens Transfer → PIN on the logger: it drops the link. The
+    // prompt stays open.
+    drop(conn);
+    await new Promise((r) => realSetTimeout(r, 5));
+    expect(calls[0].signal.aborted).toBe(false);
+    calls[0].answer("4821");
+    await startLocked(fresh);
+    await waitForWrite(fresh, 2);
+    expect(lastWritten(req(fresh))).toBe(ANSWER_4821);
+    reply(fresh, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed", connection: fresh });
+    expect(reconnect).toHaveBeenCalledTimes(1);
+    expect(promptPin).toHaveBeenCalledTimes(1);
+    expect(loadLoggerPin("dev-1")).toBe("4821");
+  });
+
+  it("reconnects after the squat limit runs out during the prompt", async () => {
+    const conn = loggerConnection();
+    const fresh = loggerConnection();
+    const { promptPin, calls } = manualPrompt();
+    const result = authenticateLogger(conn, { promptPin, reconnect: async () => fresh });
+    await startLocked(conn);
+    await waitForPrompt(calls, 1);
+    reply(conn, "AUTH:TIMEOUT");
+    drop(conn);
+    calls[0].answer("4821");
+    await startLocked(fresh);
+    await waitForWrite(fresh, 2);
+    reply(fresh, "AUTH:OK");
+    await expect(result).resolves.toMatchObject({ outcome: "authed", connection: fresh });
+  });
+
+  it("reports a reconnect that fails", async () => {
+    const conn = loggerConnection();
+    const { promptPin, calls } = manualPrompt();
+    const result = authenticateLogger(conn, {
+      promptPin,
+      reconnect: async () => { throw new DOMException("Connection attempt failed", "NetworkError"); },
+    });
+    await startLocked(conn);
+    await waitForPrompt(calls, 1);
+    drop(conn);
+    calls[0].answer("4821");
+    await expect(result).rejects.toMatchObject({ code: "disconnected" });
+  });
+
+  it("does not reconnect for a drop before any PIN was typed", async () => {
+    saveLoggerPin("dev-1", "4821");
+    const conn = loggerConnection();
+    const reconnect = vi.fn();
+    const result = authenticateLogger(conn, { promptPin: vi.fn(), reconnect });
+    await startLocked(conn);
+    await waitForWrite(conn, 2);
+    drop(conn);
+    await expect(result).rejects.toMatchObject({ code: "disconnected" });
+    expect(reconnect).not.toHaveBeenCalled();
+  });
+});
+
+describe("watchLinkEndNotices", () => {
+  it("reports the notices that end an authenticated session", () => {
+    const conn = loggerConnection();
+    const seen: string[] = [];
+    const stop = watchLinkEndNotices(conn, (n) => seen.push(n));
+    reply(conn, "AUTH:ENGINE");
+    reply(conn, "BATT:50,3.7");
+    reply(conn, "AUTH:IDLE");
+    stop();
+    reply(conn, "AUTH:CAMERA");
+    expect(seen).toEqual(["engine", "idle"]);
   });
 });
diff --git a/src/lib/ble/auth.ts b/src/lib/ble/auth.ts
index 476336f9..4889df79 100644
--- a/src/lib/ble/auth.ts
+++ b/src/lib/ble/auth.ts
@@ -23,14 +23,35 @@ import { forgetLoggerPin, loadLoggerPin, saveLoggerPin } from "./pinStore";
  * A transfer started ON the logger (Transfer → Bluetooth) is OPEN: `AUTH?`
  * answers `AUTH:OPEN`, and `PINGET` hands out the PIN — which is how the app
  * learns it without anyone typing it. Firmware older than 0019 doesn't know
- * `AUTH?` and says nothing, so silence within `LEGACY_TIMEOUT_MS` means
- * "nothing to prove".
+ * `AUTH?` and says nothing; silence for `LEGACY_TIMEOUT_MS` is then confirmed
+ * with a settings read (a locked logger answers it `AUTH:REQUIRED`) so a slow
+ * reply is never mistaken for old firmware.
+ *
+ * The logger can also end the session on its own with a notice before it
+ * drops the link: `AUTH:TIMEOUT` (20 s without authenticating), `AUTH:CAMERA`
+ * (the Insta360 needs the radio), `AUTH:ENGINE` (the engine started) and
+ * `AUTH:IDLE` (10 min with no transfer commands). The handshake watches for
+ * them, and for the GATT link dropping, the whole time — including while the
+ * user is typing the PIN.
  */
 
-/** How long to wait for an `AUTH?` reply before treating the logger as pre-PIN firmware. */
+/** How long to wait for an `AUTH?` reply before probing for pre-PIN firmware. */
 export const LEGACY_TIMEOUT_MS = 2000;
+/** How long the legacy probe (and a late `AUTH?` reply) may take. */
+export const LEGACY_PROBE_TIMEOUT_MS = 3000;
+/**
+ * The legacy probe: every firmware answers a settings read — pre-PIN firmware
+ * with `SVAL`/`SERR`, a locked logger with `AUTH:REQUIRED`.
+ */
+const LEGACY_PROBE = "SGET:bluetooth_name";
 /** Reply wait for every other step (the answer check reads the card). */
-const REPLY_TIMEOUT_MS = 5000;
+export const REPLY_TIMEOUT_MS = 5000;
+/** Pause before the single retry of a command the logger answered `AUTH:BUSY`. */
+export const BUSY_RETRY_DELAY_MS = 500;
+/** `AUTH:NO_NONCE` → fresh nonce rounds allowed before giving up. */
+const MAX_NO_NONCE_RETRIES = 3;
+/** Reconnects allowed per handshake after the link drops around the PIN prompt. */
+const MAX_RECONNECTS = 2;
 /** Domain-separation prefix, byte-identical to the firmware's `remote_auth`. */
 const AUTH_DOMAIN = "BEAUTH1|";
 /** The answer is the HMAC truncated to this many bytes (32 hex chars). */
@@ -55,7 +76,8 @@ export async function computeAuthAnswer(pin: string, nonceHex: string): Promise<
   return Array.from(mac.subarray(0, ANSWER_BYTES), (b) => b.toString(16).padStart(2, "0")).join("");
 }
 
-/** One parsed `AUTH:` / `PIN:` status line. */
+
+/** One parsed `AUTH:` / `PIN:` reply to a handshake command. */
 export type AuthReply =
   | { kind: "open" }
   | { kind: "ok" }
@@ -65,11 +87,9 @@ export type AuthReply =
   | { kind: "noNonce" }
   | { kind: "busy" }
   | { kind: "required" }
-  | { kind: "camera" }
-  | { kind: "timeout" }
   | { kind: "pin"; pin: string };
 
-/** Parse a status line, or null when it isn't part of the handshake. */
+/** Parse a reply line, or null when it isn't one (link-end notices included). */
 export function parseAuthReply(line: string): AuthReply | null {
   const l = line.trim();
   if (l.startsWith("PIN:")) {
@@ -84,8 +104,6 @@ export function parseAuthReply(line: string): AuthReply | null {
     case "NO_NONCE": return { kind: "noNonce" };
     case "BUSY": return { kind: "busy" };
     case "REQUIRED": return { kind: "required" };
-    case "CAMERA": return { kind: "camera" };
-    case "TIMEOUT": return { kind: "timeout" };
   }
   if (body.startsWith("NONCE:")) {
     const nonce = body.substring(6);
@@ -102,48 +120,159 @@ export function parseAuthReply(line: string): AuthReply | null {
   return null;
 }
 
+/** A notice the logger sends, unprompted, right before it ends the session. */
+export type LinkEndNotice = "timeout" | "camera" | "engine" | "idle";
+/** Why the link to the logger ended: a notice, or the GATT link just dropping. */
+export type LinkEnd = LinkEndNotice | "lost";
+
+/** Parse a session-ending notice (`AUTH:TIMEOUT|CAMERA|ENGINE|IDLE`), or null. */
+export function parseLinkEndNotice(line: string): LinkEndNotice | null {
+  switch (line.trim()) {
+    case "AUTH:TIMEOUT": return "timeout";
+    case "AUTH:CAMERA": return "camera";
+    case "AUTH:ENGINE": return "engine";
+    case "AUTH:IDLE": return "idle";
+    default: return null;
+  }
+}
+
+/** Every complete, non-empty line in a status notification. */
+function notificationLines(event: Event): string[] {
+  const value = (event.target as BluetoothRemoteGATTCharacteristic).value;
+  if (!value) return [];
+  return new TextDecoder().decode(value).split("\n").map((l) => l.trim()).filter(Boolean);
+}
+
+/** Internal: the link ended while the handshake was using it. */
+class LinkEndedError extends Error {
+  constructor(readonly end: LinkEnd) {
+    super(`logger-link:${end}`);
+    this.name = "LinkEndedError";
+  }
+}
+
 /**
- * Write `command` and resolve with the first handshake reply, or null after
- * `timeoutMs` of silence.
+ * The handshake's view of one connection: a queue of status lines plus a
+ * watch on the link. Lines are only accepted after the command that asks for
+ * them (`send` empties the queue), and each step names the replies it accepts,
+ * so a stale or interleaved line can never be read as an answer.
  */
-export async function sendAuthCommand(
-  connection: BleConnection,
-  command: string,
-  timeoutMs = REPLY_TIMEOUT_MS,
-): Promise<AuthReply | null> {
-  const status = connection.characteristics.fileStatus;
-  return new Promise<AuthReply | null>((resolve, reject) => {
-    let timer: ReturnType<typeof setTimeout> | null = null;
-    const handle = (event: Event) => {
-      const target = event.target as BluetoothRemoteGATTCharacteristic;
-      const raw = new TextDecoder().decode(target.value!);
-      for (const line of raw.split("\n")) {
-        const reply = parseAuthReply(line);
-        if (reply) {
-          finish();
-          resolve(reply);
-          return;
+class AuthChannel {
+  ended: LinkEnd | null = null;
+  private lines: string[] = [];
+  private wake: (() => void) | null = null;
+  private readonly endListeners = new Set<(end: LinkEnd) => void>();
+
+  constructor(readonly connection: BleConnection) {}
+
+  private readonly onStatus = (event: Event) => {
+    for (const line of notificationLines(event)) {
+      const notice = parseLinkEndNotice(line);
+      if (notice) this.end(notice);
+      else this.lines.push(line);
+    }
+    this.poke();
+  };
+
+  private readonly onDisconnect = () => this.end("lost");
+
+  async open(): Promise<void> {
+    this.connection.device.addEventListener("gattserverdisconnected", this.onDisconnect);
+    const status = this.connection.characteristics.fileStatus;
+    status.addEventListener("characteristicvaluechanged", this.onStatus);
+    await status.startNotifications();
+  }
+
+  close(): void {
+    this.connection.device.removeEventListener("gattserverdisconnected", this.onDisconnect);
+    this.connection.characteristics.fileStatus.removeEventListener("characteristicvaluechanged", this.onStatus);
+    this.endListeners.clear();
+  }
+
+  /** Call `cb` when the link ends; returns the unsubscribe. */
+  onEnd(cb: (end: LinkEnd) => void): () => void {
+    this.endListeners.add(cb);
+    return () => this.endListeners.delete(cb);
+  }
+
+  private end(end: LinkEnd): void {
+    if (this.ended) return;
+    this.ended = end;
+    for (const cb of this.endListeners) cb(end);
+    this.poke();
+  }
+
+  private poke(): void {
+    const wake = this.wake;
+    this.wake = null;
+    wake?.();
+  }
+
+  private throwIfEnded(): void {
+    if (this.ended) throw new LinkEndedError(this.ended);
+  }
+
+  async send(command: string): Promise<void> {
+    this.throwIfEnded();
+    this.lines = [];
+    bleLog("AUTH →", command.startsWith("AUTH:") ? "AUTH:<answer>" : command);
+    await this.connection.characteristics.fileRequest.writeValue(new TextEncoder().encode(command));
+  }
+
+  /** The first queued or incoming line `match` accepts, or null after `timeoutMs`. */
+  async expect<T>(match: (line: string) => T | null, timeoutMs: number): Promise<T | null> {
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      this.poke();
+    }, timeoutMs);
+    try {
+      for (;;) {
+        this.throwIfEnded();
+        while (this.lines.length > 0) {
+          const hit = match(this.lines.shift()!);
+          if (hit !== null) return hit;
         }
+        if (timedOut) return null;
+        await new Promise<void>((resolve) => {
+          this.wake = resolve;
+        });
       }
-    };
-    const finish = () => {
-      if (timer) clearTimeout(timer);
-      status.removeEventListener("characteristicvaluechanged", handle);
-    };
-    (async () => {
-      await status.startNotifications();
-      status.addEventListener("characteristicvaluechanged", handle);
-      bleLog("AUTH →", command.startsWith("AUTH:") ? "AUTH:<answer>" : command);
-      await connection.characteristics.fileRequest.writeValue(new TextEncoder().encode(command));
-      timer = setTimeout(() => {
-        finish();
-        resolve(null);
-      }, timeoutMs);
-    })().catch((err: unknown) => {
-      finish();
-      reject(err);
-    });
-  });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+}
+
+/** A matcher accepting only the listed reply kinds. */
+function only<K extends AuthReply["kind"]>(...kinds: K[]) {
+  return (line: string): Extract<AuthReply, { kind: K }> | null => {
+    const reply = parseAuthReply(line);
+    return reply && (kinds as string[]).includes(reply.kind)
+      ? (reply as Extract<AuthReply, { kind: K }>)
+      : null;
+  };
+}
+
+/** Replies to `AUTH?`. */
+const NONCE_REPLY = only("nonce", "open", "ok", "locked", "busy");
+/** Replies to `AUTH:<answer>`. */
+const VERDICT_REPLY = only("ok", "fail", "locked", "noNonce", "busy");
+
+const delay = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms));
+
+/** Send `command`; on `AUTH:BUSY` wait briefly and send it once more. */
+async function ask<T extends AuthReply>(
+  ch: AuthChannel,
+  command: string,
+  match: (line: string) => T | null,
+): Promise<T | null> {
+  await ch.send(command);
+  const reply = await ch.expect(match, REPLY_TIMEOUT_MS);
+  if (reply?.kind !== "busy") return reply;
+  await delay(BUSY_RETRY_DELAY_MS);
+  await ch.send(command);
+  return ch.expect(match, REPLY_TIMEOUT_MS);
 }
 
 /** Why the PIN is being asked for. */
@@ -154,10 +283,20 @@ export interface PinPromptContext {
   triesLeft?: number;
 }
 
+/** What the handshake is doing, for the connect flow's status line. */
+export type AuthPhase = "handshake" | "pin" | "reconnecting";
+
 /** Thrown when the handshake ends without access. `code` drives the UI copy. */
 export class LoggerAuthError extends Error {
   constructor(
-    readonly code: "cancelled" | "locked" | "camera" | "timeout" | "busy" | "protocol",
+    readonly code:
+      | "cancelled"
+      | "locked"
+      | "busy"
+      | "noReply"
+      | "disconnected"
+      | "protocol"
+      | LinkEndNotice,
     readonly seconds?: number,
   ) {
     super(`logger-auth:${code}`);
@@ -165,76 +304,256 @@ export class LoggerAuthError extends Error {
   }
 }
 
+function linkEndError(end: LinkEnd): LoggerAuthError {
+  return new LoggerAuthError(end === "lost" ? "disconnected" : end);
+}
+
 export interface AuthenticateOptions {
-  /** Ask the user for the PIN; resolve null to give up. */
-  promptPin: (ctx: PinPromptContext) => Promise<string | null>;
+  /**
+   * Ask the user for the PIN; resolve null to give up. `signal` aborts when
+   * the logger ends the session for good while the prompt is open — the
+   * prompt should close (resolving null is fine; the abort wins).
+   */
+  promptPin: (ctx: PinPromptContext, signal: AbortSignal) => Promise<string | null>;
+  /**
+   * Reopen the GATT link to the same logger. When the link drops (or the
+   * logger's 20 s squat limit runs out) around the PIN prompt — reading the
+   * PIN means leaving the logger's main menu — the handshake reconnects and
+   * reruns with the typed PIN. Without it, a dropped link just fails.
+   */
+  reconnect?: () => Promise<BleConnection>;
+  /** Progress for the connect flow's status line. */
+  onPhase?: (phase: AuthPhase) => void;
 }
 
 /** How the connection was cleared for use. */
 export type AuthOutcome = "open" | "authed" | "legacy";
 
+export interface AuthResult {
+  outcome: AuthOutcome;
+  /** The connection to use: a fresh one when the handshake had to reconnect. */
+  connection: BleConnection;
+}
+
+/** Mutable state that survives a reconnect. */
+interface HandshakeState {
+  /** A PIN the user typed that the logger hasn't ruled on yet. */
+  typedPin: string | null;
+}
+
 /**
- * Run the handshake on a fresh connection. Resolves once the logger accepts
- * commands; rejects with `LoggerAuthError` otherwise (the caller disconnects).
- *
- * The stored PIN is tried first and silently; a wrong one is forgotten and the
- * user is asked. On an open (locally started) session the PIN is fetched and
- * stored, so the next remote start needs no typing.
+ * `AUTH?` with the legacy check: silence, then a settings-read probe. A late
+ * reply to `AUTH?` still wins, and `AUTH:REQUIRED` to the probe means the
+ * nonce got lost, so ask again.
  */
-export async function authenticateLogger(
-  connection: BleConnection,
-  { promptPin }: AuthenticateOptions,
+async function openingReply(ch: AuthChannel): Promise<AuthReply | "legacy"> {
+  await ch.send("AUTH?");
+  const first = await ch.expect(NONCE_REPLY, LEGACY_TIMEOUT_MS);
+  if (first?.kind === "busy") {
+    await delay(BUSY_RETRY_DELAY_MS);
+    await ch.send("AUTH?");
+    const retried = await ch.expect(NONCE_REPLY, REPLY_TIMEOUT_MS);
+    if (!retried) throw new LoggerAuthError("noReply");
+    return retried;
+  }
+  if (first) return first;
+
+  await ch.send(LEGACY_PROBE);
+  const probe = await ch.expect<AuthReply | "legacy">((line) => {
+    const reply = NONCE_REPLY(line) ?? only("required")(line);
+    if (reply) return reply;
+    return /^(SVAL:|SERR:|SBUSY)/.test(line) ? "legacy" : null;
+  }, LEGACY_PROBE_TIMEOUT_MS);
+  // Nothing at all to a settings read: behave as the app always did.
+  if (probe === null || probe === "legacy") return "legacy";
+  if (probe.kind !== "required") return probe;
+  const again = await ask(ch, "AUTH?", NONCE_REPLY);
+  if (!again) throw new LoggerAuthError("noReply");
+  return again;
+}
+
+/** On an open session, fetch and store the PIN so a later remote start needs no typing. */
+async function learnPin(ch: AuthChannel, deviceId: string): Promise<void> {
+  await ch.send("PINGET");
+  const reply = await ch.expect<AuthReply | "none">((line) => {
+    const r = only("pin", "required")(line);
+    if (r) return r;
+    return /^(SERR|SBUSY)/.test(line) ? "none" : null;
+  }, REPLY_TIMEOUT_MS);
+  if (reply !== null && reply !== "none" && reply.kind === "pin") saveLoggerPin(deviceId, reply.pin);
+}
+
+/**
+ * Ask the user for a PIN. The prompt is closed (and this throws) if the
+ * logger ends the session in a way a reconnect can't fix; a plain drop or the
+ * squat timeout leaves it open when `canReconnect`, since the user is most
+ * likely off reading the PIN on the logger.
+ */
+async function promptForPin(
+  ch: AuthChannel,
+  promptPin: AuthenticateOptions["promptPin"],
+  ctx: PinPromptContext,
+  canReconnect: boolean,
+): Promise<string> {
+  const recoverable = (end: LinkEnd) => canReconnect && (end === "lost" || end === "timeout");
+  if (ch.ended && !recoverable(ch.ended)) throw new LinkEndedError(ch.ended);
+  const abort = new AbortController();
+  let off: () => void = () => {};
+  const aborted = new Promise<null>((resolve) => {
+    off = ch.onEnd((end) => {
+      if (recoverable(end)) return;
+      abort.abort();
+      resolve(null);
+    });
+  });
+  try {
+    for (;;) {
+      const entered = await Promise.race([promptPin(ctx, abort.signal), aborted]);
+      if (abort.signal.aborted) throw new LinkEndedError(ch.ended!);
+      if (entered === null) throw new LoggerAuthError("cancelled");
+      if (isValidPin(entered)) return entered;
+    }
+  } finally {
+    off();
+  }
+}
+
+async function handshake(
+  ch: AuthChannel,
+  state: HandshakeState,
+  { promptPin, reconnect, onPhase }: AuthenticateOptions,
 ): Promise<AuthOutcome> {
-  const device = connection.device;
+  const device = ch.connection.device;
   const deviceName = device.name ?? "";
-  const first = await sendAuthCommand(connection, "AUTH?", LEGACY_TIMEOUT_MS);
-  if (first === null) return "legacy";
-  if (first.kind === "open") {
-    const pin = await sendAuthCommand(connection, "PINGET");
-    if (pin?.kind === "pin") saveLoggerPin(device.id, pin.pin);
+  await ch.open();
+
+  let reply: AuthReply | null | "legacy" = await openingReply(ch);
+  if (reply === "legacy") return "legacy";
+  if (reply.kind === "open") {
+    await learnPin(ch, device.id);
     return "open";
   }
-  if (first.kind === "ok") return "authed";
 
-  let reply: AuthReply | null = first;
-  let pin = loadLoggerPin(device.id);
+  onPhase?.("pin");
+  let pin = state.typedPin ?? loadLoggerPin(device.id);
   let triesLeft: number | undefined;
+  let noNonceRounds = 0;
   for (;;) {
-    if (reply === null) throw new LoggerAuthError("timeout");
+    if (reply === null) throw new LoggerAuthError("noReply");
     switch (reply.kind) {
+      case "ok": return "authed";
       case "locked": throw new LoggerAuthError("locked", reply.seconds);
-      case "camera": throw new LoggerAuthError("camera");
-      case "timeout": throw new LoggerAuthError("timeout");
       case "busy": throw new LoggerAuthError("busy");
-      case "ok": return "authed";
       case "nonce": break;
       default: throw new LoggerAuthError("protocol");
     }
+    const nonce = reply.nonce;
 
     if (pin === null) {
-      const entered = await promptPin({ deviceName, triesLeft });
-      if (entered === null) throw new LoggerAuthError("cancelled");
-      if (!isValidPin(entered)) continue;
-      pin = entered;
+      pin = await promptForPin(ch, promptPin, { deviceName, triesLeft }, reconnect !== undefined);
+      state.typedPin = pin;
     }
 
-    const verdict = await sendAuthCommand(connection, `AUTH:${await computeAuthAnswer(pin, reply.nonce)}`);
-    if (verdict?.kind === "ok") {
-      saveLoggerPin(device.id, pin);
-      return "authed";
-    }
-    if (verdict?.kind !== "fail" && verdict?.kind !== "noNonce") {
-      reply = verdict;
-      continue;
-    }
-    if (verdict.kind === "fail") {
-      // A stored PIN that no longer works (changed on the logger) is dropped
-      // so it can't keep burning tries.
-      forgetLoggerPin(device.id);
-      triesLeft = verdict.triesLeft;
-      pin = null;
+    const verdict = await ask(ch, `AUTH:${await computeAuthAnswer(pin, nonce)}`, VERDICT_REPLY);
+    if (verdict === null) throw new LoggerAuthError("noReply");
+    switch (verdict.kind) {
+      case "ok":
+        saveLoggerPin(device.id, pin);
+        state.typedPin = null;
+        return "authed";
+      case "fail":
+        // A PIN the logger rejects is dropped (stored or typed), so it can't
+        // keep burning tries on later connects.
+        forgetLoggerPin(device.id);
+        state.typedPin = null;
+        pin = null;
+        triesLeft = verdict.triesLeft;
+        break;
+      case "locked":
+        forgetLoggerPin(device.id);
+        state.typedPin = null;
+        throw new LoggerAuthError("locked", verdict.seconds);
+      case "noNonce":
+        if (++noNonceRounds > MAX_NO_NONCE_RETRIES) throw new LoggerAuthError("protocol");
+        break;
+      case "busy":
+        throw new LoggerAuthError("busy");
     }
     // The logger consumes the nonce on every check: ask for a fresh one.
-    reply = await sendAuthCommand(connection, "AUTH?");
+    reply = await ask(ch, "AUTH?", NONCE_REPLY);
+  }
+}
+
+/**
+ * Run the handshake on a fresh connection. Resolves once the logger accepts
+ * commands, with the connection to use (a new one if it had to reconnect);
+ * rejects with `LoggerAuthError` otherwise (the caller disconnects).
+ *
+ * The stored PIN is tried first and silently; a rejected one is forgotten and
+ * the user is asked. On an open (locally started) session the PIN is fetched
+ * and stored, so the next remote start needs no typing.
+ */
+export async function authenticateLogger(
+  connection: BleConnection,
+  options: AuthenticateOptions,
+): Promise<AuthResult> {
+  const state: HandshakeState = { typedPin: null };
+  let conn = connection;
+  let reconnects = 0;
+  options.onPhase?.("handshake");
+  for (;;) {
+    const ch = new AuthChannel(conn);
+    try {
+      const outcome = await handshake(ch, state, options);
+      return { outcome, connection: conn };
+    } catch (err) {
+      if (err instanceof LoggerAuthError && err.code === "cancelled") throw err;
+      const end: LinkEnd | null =
+        ch.ended ?? (err instanceof LinkEndedError ? err.end : null)
+          ?? (conn.device.gatt?.connected === false ? "lost" : null);
+      const retry =
+        (end === "lost" || end === "timeout")
+        && state.typedPin !== null
+        && options.reconnect !== undefined
+        && reconnects < MAX_RECONNECTS;
+      if (retry) {
+        reconnects++;
+        options.onPhase?.("reconnecting");
+        try {
+          conn = await options.reconnect!();
+        } catch {
+          throw new LoggerAuthError("disconnected");
+        }
+        continue;
+      }
+      if (end) throw linkEndError(end);
+      if (err instanceof LoggerAuthError) throw err;
+      // GATT, write or WebCrypto failures: still a failed connect the user
+      // should hear about.
+      bleLog("AUTH handshake failed:", err);
+      throw new LoggerAuthError("protocol");
+    } finally {
+      ch.close();
+    }
   }
 }
+
+/**
+ * After the handshake: report the session-ending notices the logger can send
+ * on an open link (`AUTH:CAMERA`, `AUTH:ENGINE`, `AUTH:IDLE`, `AUTH:TIMEOUT`)
+ * just before it drops it. Returns the unsubscribe.
+ */
+export function watchLinkEndNotices(
+  connection: BleConnection,
+  onNotice: (notice: LinkEndNotice) => void,
+): () => void {
+  const status = connection.characteristics.fileStatus;
+  const handle = (event: Event) => {
+    for (const line of notificationLines(event)) {
+      const notice = parseLinkEndNotice(line);
+      if (notice) onNotice(notice);
+    }
+  };
+  status.addEventListener("characteristicvaluechanged", handle);
+  return () => status.removeEventListener("characteristicvaluechanged", handle);
+}
diff --git a/src/lib/ble/connection.ts b/src/lib/ble/connection.ts
index 5b47cc69..80b3414d 100644
--- a/src/lib/ble/connection.ts
+++ b/src/lib/ble/connection.ts
@@ -25,6 +25,25 @@ export async function connectToDevice(
     optionalServices: [DIS_SERVICE_UUID],
   });
 
+  return openGattConnection(device, updateStatus);
+}
+
+/**
+ * Reopen the GATT link to a device the user already picked, without the
+ * browser picker. Used when the logger drops the link mid-handshake (it leaves
+ * its main menu while the user reads the PIN — plan 0031).
+ */
+export async function reconnectDevice(
+  device: BluetoothDevice,
+  onStatusChange?: (status: string) => void,
+): Promise<BleConnection> {
+  return openGattConnection(device, onStatusChange || (() => {}));
+}
+
+async function openGattConnection(
+  device: BluetoothDevice,
+  updateStatus: (status: string) => void,
+): Promise<BleConnection> {
   updateStatus("Connecting...");
   const server = await device.gatt!.connect();
 
diff --git a/src/lib/ble/index.ts b/src/lib/ble/index.ts
index 49f5f663..82b1d012 100644
--- a/src/lib/ble/index.ts
+++ b/src/lib/ble/index.ts
@@ -16,7 +16,7 @@ export type {
 } from "./types";
 
 export { formatBytes, formatSpeed, formatTime } from "./format";
-export { isBleSupported, connectToDevice, disconnect } from "./connection";
+export { isBleSupported, connectToDevice, reconnectDevice, disconnect } from "./connection";
 export { requestFileList, downloadFile } from "./fileTransfer";
 export { requestBatteryLevel } from "./battery";
 export {
@@ -47,11 +47,21 @@ export type {
 } from "./firmwareUpload";
 
 // Remote-transfer PIN handshake (docs/plans/0031-remote-transfer-pin.md)
+// DeviceContext loads ./auth with a dynamic import so it stays off the eager
+// graph; these re-exports are for code that is already lazy.
 export {
   authenticateLogger,
   computeAuthAnswer,
   isValidPin,
   LoggerAuthError,
+  watchLinkEndNotices,
+} from "./auth";
+export type {
+  AuthOutcome,
+  AuthPhase,
+  AuthResult,
+  LinkEnd,
+  LinkEndNotice,
+  PinPromptContext,
 } from "./auth";
-export type { AuthOutcome, PinPromptContext } from "./auth";
 export { forgetLoggerPin, loadLoggerPin, saveLoggerPin } from "./pinStore";
diff --git a/src/locales/de/drawer.json b/src/locales/de/drawer.json
index 6770bd42..022290f8 100644
--- a/src/locales/de/drawer.json
+++ b/src/locales/de/drawer.json
@@ -524,17 +524,23 @@
   "pin": {
     "title": "PIN für {{name}}",
     "thisLogger": "diesen Logger",
-    "desc": "Gib die PIN dieses Loggers ein. Du findest sie am Logger unter Transfer → PIN. Die App merkt sie sich danach.",
+    "desc": "Gib die PIN dieses Loggers ein. Öffne dazu am Logger Transfer → PIN und bring den Logger danach zurück in sein Hauptmenü, bevor du sie hier eingibst. Die App merkt sie sich danach.",
     "label": "Logger-PIN",
     "wrong_one": "Falsche PIN. Noch {{count}} Versuch, bevor der Logger eine Weile sperrt.",
     "wrong_other": "Falsche PIN. Noch {{count}} Versuche, bevor der Logger eine Weile sperrt.",
     "cancel": "Abbrechen",
     "submit": "Entsperren",
+    "handshake": "Verbindung mit dem Logger wird hergestellt…",
     "checking": "PIN des Loggers wird geprüft…",
+    "reconnecting": "Erneute Verbindung mit dem Logger…",
     "errorLocked": "Zu viele falsche PINs. Der Logger ist für {{seconds}} s gesperrt.",
     "errorCamera": "Die Kamera braucht gerade das Funkmodul des Loggers. Versuche es erneut, wenn sie fertig ist.",
-    "errorTimeout": "Der Logger hat nicht länger auf die PIN gewartet. Verbinde dich erneut.",
+    "errorTimeout": "Der Logger hat nicht länger auf die PIN gewartet. Bring ihn zurück ins Hauptmenü und verbinde dich erneut.",
+    "errorEngine": "Der Motor wurde gestartet, daher hat der Logger die Fernübertragung beendet, um sich auf die Aufzeichnung vorzubereiten.",
+    "errorIdle": "Der Logger hat die Fernübertragung nach 10 Minuten ohne Aktivität beendet. Verbinde dich erneut, um fortzufahren.",
     "errorBusy": "Der Logger ist beschäftigt. Verbinde dich gleich erneut.",
+    "errorNoReply": "Der Logger antwortet nicht mehr. Verbinde dich erneut.",
+    "errorDisconnected": "Der Logger hat die Verbindung getrennt. Stelle sicher, dass er im Hauptmenü ist, und verbinde dich erneut.",
     "errorProtocol": "Der Logger hat die Verbindung nicht angenommen. Verbinde dich erneut."
   }
 }
diff --git a/src/locales/en/drawer.json b/src/locales/en/drawer.json
index 2887e171..7d129fe3 100644
--- a/src/locales/en/drawer.json
+++ b/src/locales/en/drawer.json
@@ -523,17 +523,23 @@
   "pin": {
     "title": "PIN for {{name}}",
     "thisLogger": "this logger",
-    "desc": "Enter this logger's PIN. You can see it on the logger under Transfer → PIN. The app remembers it after this.",
+    "desc": "Enter this logger's PIN. To see it, open Transfer → PIN on the logger, then return the logger to its main menu before entering it here. The app remembers it after this.",
     "label": "Logger PIN",
     "wrong_one": "Wrong PIN. {{count}} try left before the logger locks for a while.",
     "wrong_other": "Wrong PIN. {{count}} tries left before the logger locks for a while.",
     "cancel": "Cancel",
     "submit": "Unlock",
+    "handshake": "Talking to the logger…",
     "checking": "Checking the logger's PIN…",
+    "reconnecting": "Reconnecting to the logger…",
     "errorLocked": "Too many wrong PINs. The logger is locked for {{seconds}} s.",
     "errorCamera": "The camera needs the logger's radio right now. Try again once it's done.",
-    "errorTimeout": "The logger stopped waiting for the PIN. Connect again.",
+    "errorTimeout": "The logger stopped waiting for the PIN. Return it to its main menu and connect again.",
+    "errorEngine": "The engine started, so the logger ended the remote transfer to get ready to log.",
+    "errorIdle": "The logger ended the remote transfer after 10 minutes without activity. Connect again to continue.",
     "errorBusy": "The logger is busy. Connect again in a moment.",
+    "errorNoReply": "The logger stopped answering. Connect again.",
+    "errorDisconnected": "The logger dropped the connection. Make sure it's on its main menu, then connect again.",
     "errorProtocol": "The logger didn't accept the connection. Connect again."
   }
 }
diff --git a/src/locales/es/drawer.json b/src/locales/es/drawer.json
index 03f91222..3adaab33 100644
--- a/src/locales/es/drawer.json
+++ b/src/locales/es/drawer.json
@@ -524,17 +524,23 @@
   "pin": {
     "title": "PIN de {{name}}",
     "thisLogger": "este registrador",
-    "desc": "Introduce el PIN de este registrador. Puedes verlo en el registrador en Transfer → PIN. La app lo recordará después.",
+    "desc": "Introduce el PIN de este registrador. Para verlo, abre Transfer → PIN en el registrador y vuelve a su menú principal antes de introducirlo aquí. La app lo recordará después.",
     "label": "PIN del registrador",
     "wrong_one": "PIN incorrecto. Queda {{count}} intento antes de que el registrador se bloquee un rato.",
     "wrong_other": "PIN incorrecto. Quedan {{count}} intentos antes de que el registrador se bloquee un rato.",
     "cancel": "Cancelar",
     "submit": "Desbloquear",
+    "handshake": "Comunicando con el registrador…",
     "checking": "Comprobando el PIN del registrador…",
+    "reconnecting": "Reconectando con el registrador…",
     "errorLocked": "Demasiados PIN incorrectos. El registrador está bloqueado durante {{seconds}} s.",
     "errorCamera": "La cámara necesita ahora la radio del registrador. Inténtalo de nuevo cuando termine.",
-    "errorTimeout": "El registrador dejó de esperar el PIN. Vuelve a conectar.",
+    "errorTimeout": "El registrador dejó de esperar el PIN. Vuelve a su menú principal y conecta de nuevo.",
+    "errorEngine": "El motor arrancó, así que el registrador terminó la transferencia remota para prepararse a registrar.",
+    "errorIdle": "El registrador terminó la transferencia remota tras 10 minutos sin actividad. Vuelve a conectar para continuar.",
     "errorBusy": "El registrador está ocupado. Vuelve a conectar en un momento.",
+    "errorNoReply": "El registrador dejó de responder. Vuelve a conectar.",
+    "errorDisconnected": "El registrador cortó la conexión. Asegúrate de que esté en su menú principal y vuelve a conectar.",
     "errorProtocol": "El registrador no aceptó la conexión. Vuelve a conectar."
   }
 }
diff --git a/src/locales/fr/drawer.json b/src/locales/fr/drawer.json
index 64422def..cfe1358f 100644
--- a/src/locales/fr/drawer.json
+++ b/src/locales/fr/drawer.json
@@ -524,17 +524,23 @@
   "pin": {
     "title": "PIN de {{name}}",
     "thisLogger": "cet enregistreur",
-    "desc": "Saisissez le PIN de cet enregistreur. Il est affiché sur l'enregistreur dans Transfer → PIN. L'app le retiendra ensuite.",
+    "desc": "Saisissez le PIN de cet enregistreur. Pour le voir, ouvrez Transfer → PIN sur l'enregistreur, puis ramenez-le à son menu principal avant de le saisir ici. L'app le retiendra ensuite.",
     "label": "PIN de l'enregistreur",
     "wrong_one": "PIN incorrect. Il reste {{count}} essai avant que l'enregistreur ne se verrouille un moment.",
     "wrong_other": "PIN incorrect. Il reste {{count}} essais avant que l'enregistreur ne se verrouille un moment.",
     "cancel": "Annuler",
     "submit": "Déverrouiller",
+    "handshake": "Communication avec l'enregistreur…",
     "checking": "Vérification du PIN de l'enregistreur…",
+    "reconnecting": "Reconnexion à l'enregistreur…",
     "errorLocked": "Trop de PIN incorrects. L'enregistreur est verrouillé pendant {{seconds}} s.",
     "errorCamera": "La caméra a besoin de la radio de l'enregistreur pour le moment. Réessayez quand elle aura fini.",
-    "errorTimeout": "L'enregistreur a cessé d'attendre le PIN. Reconnectez-vous.",
+    "errorTimeout": "L'enregistreur a cessé d'attendre le PIN. Ramenez-le à son menu principal et reconnectez-vous.",
+    "errorEngine": "Le moteur a démarré : l'enregistreur a mis fin au transfert à distance pour se préparer à enregistrer.",
+    "errorIdle": "L'enregistreur a mis fin au transfert à distance après 10 minutes sans activité. Reconnectez-vous pour continuer.",
     "errorBusy": "L'enregistreur est occupé. Reconnectez-vous dans un instant.",
+    "errorNoReply": "L'enregistreur ne répond plus. Reconnectez-vous.",
+    "errorDisconnected": "L'enregistreur a coupé la connexion. Vérifiez qu'il est sur son menu principal, puis reconnectez-vous.",
     "errorProtocol": "L'enregistreur n'a pas accepté la connexion. Reconnectez-vous."
   }
 }
diff --git a/src/locales/it/drawer.json b/src/locales/it/drawer.json
index 35326c08..2880de30 100644
--- a/src/locales/it/drawer.json
+++ b/src/locales/it/drawer.json
@@ -524,17 +524,23 @@
   "pin": {
     "title": "PIN di {{name}}",
     "thisLogger": "questo logger",
-    "desc": "Inserisci il PIN di questo logger. Lo trovi sul logger in Transfer → PIN. L'app lo ricorderà in seguito.",
+    "desc": "Inserisci il PIN di questo logger. Per vederlo, apri Transfer → PIN sul logger, poi riporta il logger al menu principale prima di inserirlo qui. L'app lo ricorderà in seguito.",
     "label": "PIN del logger",
     "wrong_one": "PIN errato. Resta {{count}} tentativo prima che il logger si blocchi per un po'.",
     "wrong_other": "PIN errato. Restano {{count}} tentativi prima che il logger si blocchi per un po'.",
     "cancel": "Annulla",
     "submit": "Sblocca",
+    "handshake": "Comunicazione con il logger…",
     "checking": "Verifica del PIN del logger…",
+    "reconnecting": "Riconnessione al logger…",
     "errorLocked": "Troppi PIN errati. Il logger è bloccato per {{seconds}} s.",
     "errorCamera": "La videocamera sta usando la radio del logger. Riprova quando ha finito.",
-    "errorTimeout": "Il logger ha smesso di attendere il PIN. Riconnettiti.",
+    "errorTimeout": "Il logger ha smesso di attendere il PIN. Riportalo al menu principale e riconnettiti.",
+    "errorEngine": "Il motore si è avviato, quindi il logger ha chiuso il trasferimento remoto per prepararsi a registrare.",
+    "errorIdle": "Il logger ha chiuso il trasferimento remoto dopo 10 minuti di inattività. Riconnettiti per continuare.",
     "errorBusy": "Il logger è occupato. Riconnettiti tra un momento.",
+    "errorNoReply": "Il logger non risponde più. Riconnettiti.",
+    "errorDisconnected": "Il logger ha interrotto la connessione. Assicurati che sia nel menu principale, poi riconnettiti.",
     "errorProtocol": "Il logger non ha accettato la connessione. Riconnettiti."
   }
 }
diff --git a/src/locales/ja/drawer.json b/src/locales/ja/drawer.json
index 299ba8d5..8666a1ec 100644
--- a/src/locales/ja/drawer.json
+++ b/src/locales/ja/drawer.json
@@ -524,17 +524,23 @@
   "pin": {
     "title": "{{name}} の PIN",
     "thisLogger": "このロガー",
-    "desc": "このロガーの PIN を入力してください。ロガーの Transfer → PIN で確認できます。次回からはアプリが記憶します。",
+    "desc": "このロガーの PIN を入力してください。ロガーの Transfer → PIN で確認し、ここに入力する前にロガーをメインメニューに戻してください。次回からはアプリが記憶します。",
     "label": "ロガーの PIN",
     "wrong_one": "PIN が違います。あと {{count}} 回間違えるとロガーがしばらくロックされます。",
     "wrong_other": "PIN が違います。あと {{count}} 回間違えるとロガーがしばらくロックされます。",
     "cancel": "キャンセル",
     "submit": "ロック解除",
+    "handshake": "ロガーと通信しています…",
     "checking": "ロガーの PIN を確認しています…",
+    "reconnecting": "ロガーに再接続しています…",
     "errorLocked": "PIN の入力ミスが多すぎます。ロガーは {{seconds}} 秒間ロックされています。",
     "errorCamera": "現在カメラがロガーの無線を使用しています。終わってから再度お試しください。",
-    "errorTimeout": "ロガーが PIN の待機を終了しました。再接続してください。",
+    "errorTimeout": "ロガーが PIN の待機を終了しました。ロガーをメインメニューに戻して再接続してください。",
+    "errorEngine": "エンジンが始動したため、ロガーは記録の準備のためにリモート転送を終了しました。",
+    "errorIdle": "10 分間操作がなかったため、ロガーはリモート転送を終了しました。続けるには再接続してください。",
     "errorBusy": "ロガーはビジー状態です。少ししてから再接続してください。",
+    "errorNoReply": "ロガーが応答しなくなりました。再接続してください。",
+    "errorDisconnected": "ロガーとの接続が切れました。ロガーがメインメニューにあることを確認して、再接続してください。",
     "errorProtocol": "ロガーが接続を受け付けませんでした。再接続してください。"
   }
 }
diff --git a/src/locales/pt-BR/drawer.json b/src/locales/pt-BR/drawer.json
index 0b0774f0..b16920c6 100644
--- a/src/locales/pt-BR/drawer.json
+++ b/src/locales/pt-BR/drawer.json
@@ -524,17 +524,23 @@
   "pin": {
     "title": "PIN de {{name}}",
     "thisLogger": "este registrador",
-    "desc": "Digite o PIN deste registrador. Ele aparece no registrador em Transfer → PIN. O app vai lembrar depois disso.",
+    "desc": "Digite o PIN deste registrador. Para vê-lo, abra Transfer → PIN no registrador e depois volte ao menu principal dele antes de digitá-lo aqui. O app vai lembrar depois disso.",
     "label": "PIN do registrador",
     "wrong_one": "PIN incorreto. Resta {{count}} tentativa antes de o registrador bloquear por um tempo.",
     "wrong_other": "PIN incorreto. Restam {{count}} tentativas antes de o registrador bloquear por um tempo.",
     "cancel": "Cancelar",
     "submit": "Desbloquear",
+    "handshake": "Conversando com o registrador…",
     "checking": "Verificando o PIN do registrador…",
+    "reconnecting": "Reconectando ao registrador…",
     "errorLocked": "PINs incorretos demais. O registrador está bloqueado por {{seconds}} s.",
     "errorCamera": "A câmera está usando o rádio do registrador agora. Tente de novo quando ela terminar.",
-    "errorTimeout": "O registrador parou de esperar o PIN. Conecte novamente.",
+    "errorTimeout": "O registrador parou de esperar o PIN. Volte ao menu principal dele e conecte novamente.",
+    "errorEngine": "O motor ligou, então o registrador encerrou a transferência remota para se preparar para registrar.",
+    "errorIdle": "O registrador encerrou a transferência remota após 10 minutos sem atividade. Conecte novamente para continuar.",
     "errorBusy": "O registrador está ocupado. Conecte novamente em instantes.",
+    "errorNoReply": "O registrador parou de responder. Conecte novamente.",
+    "errorDisconnected": "O registrador caiu a conexão. Verifique se ele está no menu principal e conecte novamente.",
     "errorProtocol": "O registrador não aceitou a conexão. Conecte novamente."
   }
 }

From e1fa2ef5a3b366124ea9772b92b450c923d8c89c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 8 Oct 2026 02:37:20 +0000
Subject: [PATCH 5/5] plan 0031: keep the stored PIN across a settings reset

The logger's SRESET now preserves a valid bluetooth_pin (logger review
M3/nit), so forgetting the app's copy after a reset would only cost a
prompt on the next remote start. Reverted, and ble-protocol.md now says
SRESET keeps the PIN, PINGET may answer SERR:NOT_FOUND (nothing learned),
AUTH:BUSY to an answer means the PIN was unreadable (nonce kept, no try
counted), and an engine start ends a remote session with AUTH:ENGINE even
with a paired camera.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BTPVvtL3ZVDj7UBcAthaQk
---
 docs/ble-protocol.md                        | 20 ++++++++++++++------
 docs/ble.md                                 |  4 ++--
 docs/plans/0031-remote-transfer-pin.md      | 12 +++++++-----
 src/components/drawer/DeviceSettingsTab.tsx |  6 ++----
 src/lib/ble/pinStore.ts                     |  2 +-
 5 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/docs/ble-protocol.md b/docs/ble-protocol.md
index e7cddf94..845ad1e9 100644
--- a/docs/ble-protocol.md
+++ b/docs/ble-protocol.md
@@ -169,8 +169,8 @@ session — and then drops the link:
 | Notice | Meaning |
 |---|---|
 | `AUTH:TIMEOUT` | 20 s squat limit: not authenticated in time (locked sessions only) |
-| `AUTH:CAMERA` | the Insta360 auto-record needs the radio |
-| `AUTH:ENGINE` | a remote session ended because the engine started (the logger goes back to logging) |
+| `AUTH:CAMERA` | the Insta360 auto-record needs the radio (camera waking, recording, or its bench page) |
+| `AUTH:ENGINE` | a remote session ended because the engine started (the logger goes back to logging) — sent for an engine start even with a paired camera |
 | `AUTH:IDLE` | a remote session ended after 10 min with no transfer commands |
 
 A client must not read any of them as the reply to the command it just sent,
@@ -199,15 +199,20 @@ case-insensitively in constant time. Golden vectors (firmware
 - **Squat limit:** a locked session that hasn't authenticated within **20 s** of
   connecting gets `AUTH:TIMEOUT` and is dropped. Prompting a user for the PIN
   counts against it.
-- **The camera always wins.** If the Insta360 auto-record needs the radio (engine
-  turning, camera waking or recording), the logger sends `AUTH:CAMERA` and drops a
-  remote session — before or after authentication.
+- **The camera always wins.** If the Insta360 auto-record needs the radio (camera
+  waking or recording), the logger sends `AUTH:CAMERA` and drops a remote session —
+  before or after authentication. An engine start ends a remote session with
+  `AUTH:ENGINE` instead, camera paired or not.
 - **Leaving the main menu drops a locked session** without a notice. Reading the
   PIN (Transfer → PIN) does exactly that, so a client that prompts for the PIN
   should reconnect after the user returns the logger to its menu and rerun the
   handshake with the typed PIN (the web client does).
 - **`PINGET`** → `PIN:<4 digits>`, **open sessions only** (`AUTH:REQUIRED`
-  otherwise). This is how a client learns the PIN without anyone typing it: a
+  otherwise). `SERR:NOT_FOUND` means the logger has no valid PIN stored right
+  now: treat it as "nothing learned", not as an error.
+- **`AUTH:BUSY` to an answer** also means the logger couldn't read its own PIN
+  (SD busy, settings unreadable): the nonce is kept and no try is counted, so
+  resending the same answer once is safe. This is how a client learns the PIN without anyone typing it: a
   local start hands it over, and the client stores it for the next remote start.
 - **The PIN is 4 digits, leading zeros allowed.** Shown on the logger under
   Transfer → PIN (hold Select to reveal; it hides itself again).
@@ -394,6 +399,9 @@ device → 0x2A40 : "SOK:RESET"            (then the device reboots)
 After `SOK:RESET` the device reboots — the client should **disconnect immediately**
 and expect the link to drop. Timeout ~10 s. Errors as `SERR:<reason>`.
 
+On PIN-gated firmware (§3.3) the reset **keeps a valid `bluetooth_pin`** (an
+invalid one is regenerated), so a client's stored PIN stays good across it.
+
 ### 8.5 Known settings (schema)
 
 | Key | Type | Range / max | Meaning |
diff --git a/docs/ble.md b/docs/ble.md
index 4290d5ec..7c5679f0 100644
--- a/docs/ble.md
+++ b/docs/ble.md
@@ -40,8 +40,8 @@ stays open, and on submit the handshake reconnects the same `BluetoothDevice`
 (`reconnectDevice`, no picker) and reruns with the typed PIN. A camera notice
 closes the dialog. Any failure disconnects and toasts a translated reason. After
 connecting, `watchLinkEndNotices` toasts the logger's own session-ending notices
-(`AUTH:CAMERA` / `ENGINE` / `IDLE`) before the disconnect tears the UI down. A
-Device-tab settings reset forgets the stored PIN (the reset may roll a new one).
+(`AUTH:CAMERA` / `ENGINE` / `IDLE`) before the disconnect tears the UI down.
+A Device-tab settings reset keeps the stored PIN (`SRESET` preserves it).
 Wire spec: [`ble-protocol.md`](ble-protocol.md) §3.3.
 
 `DataloggerDownload` talks to the device only through the generic
diff --git a/docs/plans/0031-remote-transfer-pin.md b/docs/plans/0031-remote-transfer-pin.md
index a3d498a1..9a4ef230 100644
--- a/docs/plans/0031-remote-transfer-pin.md
+++ b/docs/plans/0031-remote-transfer-pin.md
@@ -42,8 +42,9 @@ ever taking the radio from the Insta360 auto-record.
 3. **Stored PIN first, silently; a rejected one is forgotten.** A PIN changed on
    the logger would otherwise burn a try on every connect. "Rejected" is any
    verdict but OK — `FAIL`, and `LOCKED` (what the 5th miss returns). The prompt
-   then shows the tries left. A Device-tab settings reset forgets it too, since
-   the reset can roll a new PIN.
+   then shows the tries left. A Device-tab settings reset keeps it: the
+   firmware's `SRESET` preserves a valid `bluetooth_pin` (it used to roll a new
+   one, which review M3 flagged; the logger side fixed it there).
 4. **Storage is per device, local, never synced.** `localStorage`, keyed by
    Web Bluetooth `device.id` only (stable per origin while the permission
    lasts). The first cut fell back to the advertised name when the browser
@@ -118,11 +119,12 @@ ever taking the radio from the Insta360 auto-record.
   says to return it to the menu and connect again.
 - **Hardware check outstanding:** remote start from the menu, wrong-PIN lockout,
   `AUTH:CAMERA` with a paired X4, a legacy logger connecting after the probe,
-  and the read-the-PIN-then-reconnect path (Chrome's `gatt.connect()` on a
+  `AUTH:ENGINE` on an engine start, and the read-the-PIN-then-reconnect path (Chrome's `gatt.connect()` on a
   device that re-advertises).
 
 ## Review follow-up (PR #454)
 
 H1 (prompt on a dead link, typed PIN lost), M1 (non-auth errors only logged),
-M2 (slow reply read as legacy), M3 (stale PIN after a settings reset), L1–L6 and
-the nits are addressed by decisions 3–5 and 8–11 above.
+M2 (slow reply read as legacy), L1–L6 and the nits are addressed by decisions
+3–5 and 8–11 above. M3 (stale PIN after a settings reset) was fixed in the
+firmware instead: `SRESET` now keeps the PIN, so the app keeps its copy.
diff --git a/src/components/drawer/DeviceSettingsTab.tsx b/src/components/drawer/DeviceSettingsTab.tsx
index c620f07c..818c8fed 100644
--- a/src/components/drawer/DeviceSettingsTab.tsx
+++ b/src/components/drawer/DeviceSettingsTab.tsx
@@ -12,7 +12,7 @@ import {
 } from "@/components/ui/select";
 import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
 import { toast } from "sonner";
-import { type BleConnection, forgetLoggerPin, loadLoggerPin, saveLoggerPin } from "@/lib/bleDatalogger";
+import { type BleConnection, loadLoggerPin, saveLoggerPin } from "@/lib/bleDatalogger";
 import type { DeviceDetails } from "@/lib/loggers";
 import {
   DEVICE_SETTINGS_SCHEMA,
@@ -226,9 +226,7 @@ export function DeviceSettingsTab({ details, bleConnection, onResetComplete }: D
     setResetting(true);
     try {
       await details.resetSettings();
-      // A settings reset can roll a new PIN on the logger; a stale stored one
-      // would silently burn one of the logger's tries on the next connect.
-      if (bleConnection) forgetLoggerPin(bleConnection.device.id);
+      // The stored PIN stays: SRESET keeps the logger's bluetooth_pin.
       toast.success(t("device.toastReset"));
       onResetComplete?.();
     } catch (err) {
diff --git a/src/lib/ble/pinStore.ts b/src/lib/ble/pinStore.ts
index 7bf11f74..f92c0315 100644
--- a/src/lib/ble/pinStore.ts
+++ b/src/lib/ble/pinStore.ts
@@ -55,7 +55,7 @@ export function saveLoggerPin(deviceId: string, pin: string): void {
   write(map);
 }
 
-/** Forget this logger's PIN (rejected, or the logger's settings were reset). */
+/** Forget this logger's PIN (the logger rejected it). */
 export function forgetLoggerPin(deviceId: string): void {
   const map = read();
   delete map[idKey(deviceId)];