Sensor status: distinguish end-of-life and transient comms errors

Two related fixes to how the Libre 3 patch status drives the sensor pill:

- Sensor end-of-life (patch errorData 5/6, sensorEnded) now shows as
  "Expired" rather than "Sensor failed". Both still require replacement and
  mark the CGM inoperable, but a normal end is no longer labeled a failure.
  Carries the reason through a persisted sensorEndedNormally flag so the
  lifecycle resolves .expired vs .failed.

- A code-7 "transmission error" is a transient comms fault, not a terminal
  replace condition (the sensor keeps producing valid glucose). It no longer
  latches the sensor inoperable or stops Loop; instead it surfaces a soft,
  retractable "Check sensor" notice that clears when the sensor reports
  healthy again. Terminal replace (code 8, terminated) is unchanged.

Author: ps2

LibreLoop/LibreLoopCGMManager/LibreLoopCGMManager.swift

@@ -174,7 +174,8 @@ public final class LibreLoopCGMManager: CGMManager {
             hasLiveMonitor: monitor != nil,
             wearDurationMinutes: state.wearDurationMinutes,
             warmupDurationMinutes: state.warmupDurationMinutes,
-            needsReplacement: state.sensorNeedsReplacement
+            needsReplacement: state.sensorNeedsReplacement,
+            endedNormally: state.sensorEndedNormally
         )
     }
 

LibreLoop/LibreLoopCGMManager/LibreLoopCGMManagerState.swift

@@ -77,6 +77,14 @@ public struct LibreLoopCGMManagerState: RawRepresentable, Equatable {
     /// pairing or when the sensor reports healthy again.
     public var sensorNeedsReplacement: Bool = false
 
+    /// Distinguishes *why* the sensor needs replacement, when
+    /// `sensorNeedsReplacement` is set: `true` for a normal end-of-life
+    /// (the sensor self-reported `sensorEnded`), `false` for an early
+    /// failure (`replaceSensor` / patchState 7). Drives whether the UI shows
+    /// "Sensor Expired" vs "Sensor failed" — both still require replacement
+    /// and mark the CGM inoperable. Persisted alongside `sensorNeedsReplacement`.
+    public var sensorEndedNormally: Bool = false
+
     /// Human-readable sensor model. Derived from `generation` when
     /// available (preferred), falling back to the wear-duration heuristic
     /// for state paired before generation was captured.
@@ -119,6 +127,7 @@ public struct LibreLoopCGMManagerState: RawRepresentable, Equatable {
         self.generation = (rawValue["generation"] as? Int).map { UInt16(clamping: $0) }
         self.expiryAlertsScheduledForActivatedAt = rawValue["expiryAlertsScheduledForActivatedAt"] as? Date
         self.sensorNeedsReplacement = rawValue["sensorNeedsReplacement"] as? Bool ?? false
+        self.sensorEndedNormally = rawValue["sensorEndedNormally"] as? Bool ?? false
     }
 
     public var rawValue: RawValue {
@@ -148,6 +157,9 @@ public struct LibreLoopCGMManagerState: RawRepresentable, Equatable {
         if sensorNeedsReplacement {
             raw["sensorNeedsReplacement"] = true
         }
+        if sensorEndedNormally {
+            raw["sensorEndedNormally"] = true
+        }
         return raw
     }
 }

LibreLoop/Pairing/LibreLoopCGMManager+Pairing.swift

@@ -115,6 +115,7 @@ extension LibreLoopCGMManager {
         newState.firstReadingAt = nil
         // New sensor — clear any prior replace/error state.
         newState.sensorNeedsReplacement = false
+        newState.sensorEndedNormally = false
         setState(newState)
 
         emitSensorStartEvent(for: newState)
@@ -328,18 +329,30 @@ extension LibreLoopCGMManager {
     /// check-sensor and clears are logged and retract any prior alert. Patch
     /// status arrives ~once a minute, so we only act when the state changes.
     private func notifySensorAttentionIfNeeded(_ status: PatchStatus) {
-        let attention = status.sensorAttention
+        // A code-7 "transmission error" (`Libre3SensorError.transmissionError`)
+        // is a transient comms fault, not a terminal replace condition — the
+        // sensor keeps producing valid glucose. LibreCRKit's coarse attention
+        // mapping lumps code 7 in with code 8 (terminated) as `.replaceSensor`;
+        // downgrade it here to a soft, retractable `.checkSensor` notice so it
+        // never marks the sensor inoperable or stops Loop.
+        let attention: Libre3SensorAttention = status.sensorError == .transmissionError
+            ? .checkSensor
+            : status.sensorAttention
         guard attention != lastSensorAttention else { return }
         lastSensorAttention = attention
-        llog("sensor attention: \(attention) (patchState=\(status.patchStateKind), replace=\(status.shouldNotifyReplaceSensor))")
+        llog("sensor attention: \(attention) (rawAttention=\(status.sensorAttention), sensorError=\(status.sensorError), patchState=\(status.patchStateKind), replace=\(status.shouldNotifyReplaceSensor))")
 
         // Persist the replace/ended state so the lifecycle, status highlight,
         // CGM page, and isInoperable all reflect "Replace sensor" — and survive
         // an app relaunch. Cleared when the sensor reports healthy again.
         let needsReplacement = (attention == .replaceSensor || attention == .sensorEnded)
-        if state.sensorNeedsReplacement != needsReplacement {
+        // A normal end-of-life (`sensorEnded`) surfaces as "Expired"; an early
+        // failure (`replaceSensor`) as "Sensor failed". Both need replacement.
+        let endedNormally = needsReplacement && attention == .sensorEnded
+        if state.sensorNeedsReplacement != needsReplacement || state.sensorEndedNormally != endedNormally {
             var updated = state
             updated.sensorNeedsReplacement = needsReplacement
+            updated.sensorEndedNormally = endedNormally
             setState(updated)
             // Push a CGM status update so Loop's HUD re-reads cgmStatusHighlight /
             // isInoperable immediately (there's no new glucose to trigger it).
@@ -349,16 +362,25 @@ extension LibreLoopCGMManager {
         let identifier = Alert.Identifier(managerIdentifier: pluginIdentifier,
                                           alertIdentifier: Self.sensorAttentionAlertID)
         let delegate = cgmManagerDelegate
-        let content: (title: String, body: String)?
+        let content: (title: String, body: String, level: Alert.InterruptionLevel)?
         switch attention {
         case .replaceSensor:
             content = (LocalizedString("Replace sensor", comment: "Sensor failure alert title"),
-                       LocalizedString("Your FreeStyle Libre 3 sensor has stopped working and needs to be replaced to resume CGM readings.", comment: "Sensor failure alert body"))
+                       LocalizedString("Your FreeStyle Libre 3 sensor has stopped working and needs to be replaced to resume CGM readings.", comment: "Sensor failure alert body"),
+                       .timeSensitive)
         case .sensorEnded:
             content = (LocalizedString("Sensor ended", comment: "Sensor ended alert title"),
-                       LocalizedString("Your FreeStyle Libre 3 sensor session has ended. Replace it to resume CGM readings.", comment: "Sensor ended alert body"))
+                       LocalizedString("Your FreeStyle Libre 3 sensor session has ended. Replace it to resume CGM readings.", comment: "Sensor ended alert body"),
+                       .timeSensitive)
+        case .checkSensor where status.sensorError == .transmissionError:
+            // Transient comms fault (code 7). Soft, retractable notice that does
+            // not interrupt or stop Loop; readings resume on their own. Retracted
+            // as soon as the sensor reports a healthy status again.
+            content = (LocalizedString("Check sensor", comment: "Sensor check alert title"),
+                       LocalizedString("Loop is having trouble communicating with your FreeStyle Libre 3 sensor. CGM readings may pause briefly and should resume automatically. No action is needed unless this keeps happening.", comment: "Sensor check alert body (transient transmission error)"),
+                       .active)
         case .checkSensor, .none, .unknown:
-            // Transient or cleared — don't alert; retract any standing one.
+            // Other transient/cleared states — don't alert; retract any standing one.
             content = nil
         }
 
@@ -371,7 +393,7 @@ extension LibreLoopCGMManager {
             foregroundContent: .init(title: content.title, body: content.body, acknowledgeActionButtonLabel: LocalizedString("OK", comment: "Alert acknowledge button")),
             backgroundContent: .init(title: content.title, body: content.body, acknowledgeActionButtonLabel: LocalizedString("OK", comment: "Alert acknowledge button")),
             trigger: .immediate,
-            interruptionLevel: .timeSensitive
+            interruptionLevel: content.level
         )
         Task { await delegate?.issueAlert(alert) }
     }

LibreLoop/Sensor/LibreLoopSensorLifecycle.swift

@@ -16,11 +16,15 @@ public enum LibreLoopSensorLifecycle: Equatable {
     case pairingWarmup(pairedAt: Date)
     /// remaining: time left until expiry; total: sensor's full rated wear duration
     case active(remaining: TimeInterval, total: TimeInterval)
+    /// End of life: either the wear clock reached the sensor's rated duration,
+    /// or the sensor self-reported `sensorEnded`. Needs replacement, but is a
+    /// normal outcome (shown as "Expired", not a failure).
     case expired
     case signalLost(since: Date)
-    /// Sensor self-reported a replace/error state (patchState 7, or
-    /// terminated/ended). Authoritative and overrides timing-based phases —
-    /// the sensor will not produce glucose again and must be replaced.
+    /// Sensor self-reported an early replace/error state (patchState 7 /
+    /// `replaceSensor`) before reaching end of life. Authoritative and overrides
+    /// timing-based phases — the sensor will not produce glucose again and must
+    /// be replaced. A normal end-of-life reports `.expired`, not `.failed`.
     case failed
 
     /// Libre 3 spec default wear duration (14 days). Used when the sensor
@@ -41,12 +45,15 @@ public enum LibreLoopSensorLifecycle: Equatable {
         wearDurationMinutes: Int? = nil,
         warmupDurationMinutes: Int? = nil,
         needsReplacement: Bool = false,
+        endedNormally: Bool = false,
         now: Date = Date()
     ) -> LibreLoopSensorLifecycle {
         guard sensorPaired else { return .noSensor }
-        // Sensor-reported failure is authoritative — it overrides every
-        // timing-based phase (a "failed" sensor won't resume on its own).
-        if needsReplacement { return .failed }
+        // A sensor-reported replace/ended state is authoritative — it overrides
+        // every timing-based phase (it won't resume on its own). Distinguish a
+        // normal end-of-life (self-reported `sensorEnded`) from an early failure
+        // so the UI shows "Expired" vs "Sensor failed"; both require replacement.
+        if needsReplacement { return endedNormally ? .expired : .failed }
         guard let activatedAt else { return .initializing }
         let age = now.timeIntervalSince(activatedAt)