v1.3.0-dev06

Sixth dev pre-release toward v1.3.0.

Added

• Timed sets for planks, holds and carries (#89, requested by @chrisfeagles). An exercise can be tracked by Time instead of Reps: its set row shows a time field where reps would be, with weight still there for weighted holds. Typing a time works like a phone timer (130 is 1:30). Switch with the same chip that sets Per Side or Alternating, or in the Exercise Editor; common timed exercises like plank, wall sit and dead hang start as timed on their own.
  • Hold timer. Tap the timer in the time field, get a three second count-in, hold, tap Stop, and the set is filled in and ticked off. Large enough to read from the floor, cues you at your target, and keeps counting if the phone locks.
  • Stats, programs and imports understand holds. Longest hold PRs with their own celebration, hold time charts, time prescriptions in programs, plank 3x45s in Smart-Add, a duration_sec CSV column, and Strong, Hevy, FitNotes and Garmin imports keep their hold times. Trace, MCP, the REST API and the pr.set webhook all carry durations.

Changed

• Claude Fable 5.1 in Trace's model list, now the most capable Claude option. Fable 5 stays selectable.

Fixed

• Trace said lifts were missing from your log when they weren't (#92, reported and diagnosed by @kgenerozov). The AI model would invent a date range in the wrong year and find nothing. Trace now retries empty ranges with the normal window, is told the real date (not the day the Diary is showing), finds lifts last trained more than 30 days ago, and asks before writing to a date more than 60 days away.
• Deleted workouts still counted in Statistics, personal records, reminders, the weekly summary, program week progress, exercise usage sorting and coach views, plus records over MCP, the REST API and the pr.set webhook. Re-importing a workout you deleted no longer skips it as a duplicate.
• MCP delete_workout could remove an already-deleted workout while the real one stayed, and synced devices never learned about the delete. Logging a set to a deleted workout's date also brought it back; it now starts a fresh session.
• Workout CSV exports had an empty exercise column.
• Android: an exercise's library load type was cleared on every sync.

Security

• Uploaded files are stored and served more strictly. Extensions come from the file's actual type rather than its name, and /uploads responses carry nosniff and a sandboxing content policy. Images, audio and video display as before.

Full detail in the CHANGELOG.