docs(train): how the Loop's firmware updates go (ADR 0030, D40)

D10's details: Train checks once a day and when asked; the instance
relays Polar's firmware service for its people, the files a day in
memory, unless its operator sets LOOP_FIRMWARE_RELAY=off; after an
update the band is set up again at once with the figures it had.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0030-halkyon-train.md

@@ -1,9 +1,10 @@
 # ADR 0030: Halkyon Train, what it does and where its data comes from
 
-- **Status:** decided 27–28 Oct 2026, by the developer (D1–D39 below). The shell (D12)
+- **Status:** decided 27–28 Oct 2026, by the developer (D1–D40 below). The shell (D12)
   is built; recording (D13–D28) is built on Android, iOS waiting for a Mac; Health
   Connect (D29–D31) is built; the Loop's setup and keeping (7a, D34–D36) and its
-  daily data (7b, D37, D38) and its sessions (7c, D39) are built.
+  daily data (7b, D37, D38) and its sessions (7c, D39) are built; its firmware (D10,
+  D40) is being built.
 - **Numbering:** 0025 is held by the federation draft (stashed), 0026–0029 by the .NET
   rewrite on the local branch `rewrite-dotnet`, abandoned on 27 Oct; Train takes the next
   free number so that neither is ever read as this one.
@@ -729,6 +730,23 @@ Strava. What was found, 27 Oct:
   track* stays for Health Connect's. Not yet tried with a Loop: Polar's other sport
   IDs, and whether the band keeps samples of a detected session, are for a real band.
 
+- **D40 How D10's firmware updates go** (recommended, the developer's; 28 Oct): Polar's
+  SDK asks Polar's firmware service (`https://firmware-management.polar.com`, `POST
+  /api/v1/firmware-update/check` with a client name, the band's UUID made from its ID,
+  its firmware version and hardware code; read in the SDK's classes, 8.3.0) and gets a
+  version and a file's address. Train asks once a day, on the day's first connection,
+  and when the person taps *Check for updates* (over only when asked); an update found
+  shows on the Loop screen with its version and what Polar learns, and never starts by
+  itself. Through the instance, Train's server asks Polar for the person and fetches
+  the file, keeping the latest per hardware and version in memory for a day (over a
+  folder on disk, which the deploy would need a volume for); it offers this by default,
+  for the people signed in, and its operator turns it off with
+  `LOOP_FIRMWARE_RELAY=off` (over off by default, and over always on), the app then
+  offering the direct way alone. Before an update Train reads and keeps what is on the
+  band; after it, Train sets the band up again at once with the figures it had and sets
+  its clock (over asking first), the band getting a new user identifier as with every
+  setup (D35).
+
 ## Consequences
 
 - Train's sensors are one pattern: open profiles read by the app itself, on the phone;