v1.7.3 — protection buys maintenance, never a surplus

A quality patch about trust in both directions: the coach earns the right to act on its own by holding itself to a harder standard of evidence.

Under lead mode the coach now gives you a heads-up with a one-tap undo instead of asking permission for goal-date and structural changes it can safely own (clinical findings, locked exercises, and anything irreversible still ask). In exchange, its evidence discipline got a full round of tightening:

• Protection buys maintenance, never a surplus. A protective calorie raise during a cut is capped at maintenance measured from your own complete logged days — a formula estimate can hold your target, but never lift it. This closes a ratchet where a chronically-open protective escape could raise the target check-in after check-in, past anything the record supported.
• An unlogged day is not a small one. Logged intake counts as evidence only when the day reads complete (a morning-to-evening span with real calories, or a whole day declared at once). A partial or missing day is absent, never "low" — so thin logging can't read as under-eating, and "you're behind on fuel" nudges are withheld when the log can't support them. The coach also recognizes your logging mode — full, occasional, or quiet — and adjusts what it treats as evidence.
• A pending change is judged against the day it applies. A queued nutrition change is re-derived at its boundary; if the evidence in force that morning no longer supports the number, it's trimmed or set aside with a receipt instead of applied on faith.
• Your own number outranks the queue. Set your calorie target directly (POST /api/nutrition/target, MCP set_nutrition_target) and any queued machine adjustment is set aside with a receipt saying exactly that.
• The cut is grounded in the log. The cut target derives from a safe pace band (0.5–0.75% of bodyweight per week) and a bounded deficit against measured maintenance — when the numbers say the date, the date moves; the calories stop inflating to defend an optimistic deadline.
• The brake needs a second opinion. A single watch-state dimension no longer holds back a training day by itself, and an HRV dip registers on a meaningful band of your baseline rather than a bare sign flip. Safety vetoes are untouched.
• Smaller honesty fixes: a goal date adapts only on material, cooled-down evidence instead of being renegotiated weekly; a change parked by the change budget stays parked; draft proposals with future evidence dates no longer jam adoption (repair migration included); the week-ahead read is served from a background-warmed cache; and the coach quietly asks for a stale weigh-in or waist measurement — a few times, one card at a time, then lets go.

Upgrading: schema migration 92 runs automatically on boot. Back up first, as always. No public/ changes — installed PWAs need no update.

Full details in CHANGELOG.md.

Full Changelog: v1.7.2...v1.7.3