Expired sensor: label it Expired (not failed) and surface Pair New Sensor

Two fixes for the end-of-life experience on a Libre 3 that reaches its rated wear:

1) Expired-vs-failed. A sensor that ends normally first reports sensorEnded
   ("Expired"), then on final shutdown emits the terminated code (Abbott
   errorData 8 -> replaceSensor). The old logic mapped that to "Sensor failed".
   - Lifecycle: a replace/terminated report from a sensor already at/past its
     rated wear duration is a normal end-of-life -> .expired, not .failed. A
     replaceSensor *before* rated wear is still a genuine .failed.
   - Pairing: make endedNormally sticky — once a sensor reported sensorEnded, a
     later terminated/replaceSensor can't downgrade Expired to failed (resets on
     the next pairing).

2) UI: when the sensor is expired/failed, show a prominent "Pair New Sensor"
   button above Last Reading instead of only at the bottom of the settings list.

Adds LibreLoopSensorLifecycleTests covering the expired/terminated transitions.

Confirmed against a field log: sensor at lifeCount 21791 min (15.1 days),
sensorEnded (16:18) then replaceSensor/terminated (20:08) -> was 'Sensor failed'.

Author: ps2

LibreLoop/Pairing/LibreLoopCGMManager+Pairing.swift

@@ -351,7 +351,12 @@ extension LibreLoopCGMManager {
         let needsReplacement = (attention == .replaceSensor || attention == .sensorEnded)
         // A normal end-of-life (`sensorEnded`) surfaces as "Expired"; an early
         // failure (`replaceSensor`) as "Sensor failed". Both need replacement.
-        let endedNormally = needsReplacement && attention == .sensorEnded
+        // Sticky: once a sensor has reported a clean end-of-life, a later
+        // `terminated`/`replaceSensor` shutdown must not downgrade "Expired" to
+        // "failed" — a sensor that ended normally can't retroactively become a
+        // failure. (Abbott emits errorData 8 → `replaceSensor` after a clean
+        // end-of-wear.) The flag resets on the next pairing.
+        let endedNormally = needsReplacement && (attention == .sensorEnded || state.sensorEndedNormally)
         if state.sensorNeedsReplacement != needsReplacement || state.sensorEndedNormally != endedNormally {
             var updated = state
             updated.sensorNeedsReplacement = needsReplacement

LibreLoop/Sensor/LibreLoopSensorLifecycle.swift

@@ -49,18 +49,30 @@ public enum LibreLoopSensorLifecycle: Equatable {
         now: Date = Date()
     ) -> LibreLoopSensorLifecycle {
         guard sensorPaired else { return .noSensor }
-        // A sensor-reported replace/ended state is authoritative — it overrides
-        // every timing-based phase (it won't resume on its own). Distinguish a
-        // normal end-of-life (self-reported `sensorEnded`) from an early failure
-        // so the UI shows "Expired" vs "Sensor failed"; both require replacement.
-        if needsReplacement { return endedNormally ? .expired : .failed }
-        guard let activatedAt else { return .initializing }
-        let age = now.timeIntervalSince(activatedAt)
 
         let sensorWearDuration: TimeInterval = wearDurationMinutes
             .map { TimeInterval($0) * 60 }
             ?? activeDuration
 
+        // A sensor-reported replace/ended state is authoritative — it overrides
+        // every timing-based phase (it won't resume on its own). Distinguish a
+        // normal end-of-life from an early failure so the UI shows "Expired" vs
+        // "Sensor failed"; both require replacement.
+        if needsReplacement {
+            if endedNormally { return .expired }
+            // A replace/terminated report from a sensor that has already reached
+            // its rated wear duration is a normal end-of-life ("Expired"), not a
+            // failure: some sensors emit the terminated-shutdown code (errorData
+            // 8 → `replaceSensor`) after a clean end-of-wear. Only a
+            // `replaceSensor` *before* rated wear is a genuine "Sensor failed".
+            if let activatedAt, now.timeIntervalSince(activatedAt) >= sensorWearDuration {
+                return .expired
+            }
+            return .failed
+        }
+        guard let activatedAt else { return .initializing }
+        let age = now.timeIntervalSince(activatedAt)
+
         let sensorWarmupDuration: TimeInterval = warmupDurationMinutes
             .map { TimeInterval($0) * 60 }
             ?? warmupDuration

LibreLoopTests/LibreLoopCGMManagerStateTests.swift

@@ -16,3 +16,51 @@ final class LibreLoopCGMManagerStateTests: XCTestCase {
         XCTAssertEqual(restored.activatedAt, state.activatedAt)
     }
 }
+
+final class LibreLoopSensorLifecycleTests: XCTestCase {
+    private let day: TimeInterval = 24 * 60 * 60
+    private let now = Date(timeIntervalSince1970: 1_700_000_000)
+
+    private func compute(activatedDaysAgo: Double,
+                         needsReplacement: Bool,
+                         endedNormally: Bool,
+                         wearDurationMinutes: Int? = nil) -> LibreLoopSensorLifecycle {
+        LibreLoopSensorLifecycle.compute(
+            sensorPaired: true,
+            activatedAt: now.addingTimeInterval(-activatedDaysAgo * day),
+            latestReadingAt: nil,
+            firstReadingAt: nil,
+            lastPairedAt: nil,
+            hasLiveMonitor: false,
+            wearDurationMinutes: wearDurationMinutes,
+            needsReplacement: needsReplacement,
+            endedNormally: endedNormally,
+            now: now
+        )
+    }
+
+    // A clean end-of-life (`sensorEnded`) always shows Expired.
+    func testEndedNormallyShowsExpired() {
+        XCTAssertEqual(compute(activatedDaysAgo: 15, needsReplacement: true, endedNormally: true), .expired)
+    }
+
+    // The reported bug: a sensor past its rated wear reports the terminated
+    // shutdown code (`replaceSensor`, endedNormally=false) — it must stay
+    // Expired, not flip to "Sensor failed".
+    func testReplaceSensorPastRatedWearShowsExpired() {
+        XCTAssertEqual(compute(activatedDaysAgo: 15, needsReplacement: true, endedNormally: false), .expired)
+    }
+
+    // A genuine early failure (`replaceSensor` well before rated wear) stays Failed.
+    func testReplaceSensorBeforeRatedWearShowsFailed() {
+        XCTAssertEqual(compute(activatedDaysAgo: 3, needsReplacement: true, endedNormally: false), .failed)
+    }
+
+    // Honors a sensor-reported wear duration, not just the 14-day default.
+    func testReplaceSensorPastReportedWearShowsExpired() {
+        XCTAssertEqual(
+            compute(activatedDaysAgo: 11, needsReplacement: true, endedNormally: false, wearDurationMinutes: 10 * 24 * 60),
+            .expired
+        )
+    }
+}

LibreLoopUI/Views/LibreLoopSettingsView.swift

@@ -32,6 +32,7 @@ struct LibreLoopSettingsView: View {
         List {
             sensorImageHeader
             sensorSection
+            replaceSensorPromptSection
             lastReadingSection
             recentReadingsSection
             debugInfoSection
@@ -179,6 +180,29 @@ struct LibreLoopSettingsView: View {
         }
     }
 
+    /// Prominent replace CTA shown at the top (above Last Reading) only when the
+    /// current sensor is done — expired or failed. The same action also lives in
+    /// the management section at the bottom for a deliberate early replace, but
+    /// when the sensor needs replacing the user shouldn't have to hunt for it.
+    @ViewBuilder
+    private var replaceSensorPromptSection: some View {
+        if viewModel.lifecycle == .expired || viewModel.lifecycle == .failed {
+            Section {
+                Button {
+                    confirmingReplace = true
+                } label: {
+                    Text(LocalizedString("Pair New Sensor", comment: "Prominent action to pair a new sensor when the current one needs replacement"))
+                        .fontWeight(.semibold)
+                        .frame(maxWidth: .infinity)
+                }
+                .buttonStyle(.borderedProminent)
+                .controlSize(.large)
+                .listRowInsets(EdgeInsets(top: 8, leading: 16, bottom: 8, trailing: 16))
+                .listRowBackground(Color.clear)
+            }
+        }
+    }
+
     @ViewBuilder
     private var lastReadingSection: some View {
         Section(LocalizedString("Last Reading", comment: "Settings section: last reading")) {