docs: bring README and docs current for v1.25

Reflect the v1.25 surface without touching the changelog or version
numbers.

- README highlights now cover the new clinical signals (respiratory
  rate, the opt-in PHQ-9 / GAD-7 mental-wellbeing self-checks with calm
  crisis handling, grip strength, pain score, waist / body measurements,
  longevity labs), the signal registry that wires each one across charts,
  correlations, the coach, FHIR, and the API at once, structured records
  (allergies, family history; immunizations noted out of scope), the
  opt-in environmental-context module, inbound document extraction
  (transcribe, never interpret), and the self-description posture (a
  record-keeping and wellness tool, not a medical device).
- ai-providers.md gains a "what the Coach is — and isn't" section: the
  non-diagnostic standard and the calm proactive morning check-in
  behaviour.
- mcp-capabilities.md notes that the new measurement signals reach the
  assistant through the existing metric and labs tools via the registry,
  that the mental-wellbeing instruments / records / documents are
  deliberately not exposed over MCP, and ties the grounding contract to
  the project-wide self-description standard.
- getting-started.md lists the environmental module's Open-Meteo egress
  as an opt-in outbound dependency.

README.md

@@ -28,14 +28,19 @@
 
 HealthLog is a self-hosted health tracking app (PWA + native iOS client) that runs from a single `docker compose up` on a NAS, homelab, or small VPS. It brings weight, blood pressure, pulse, blood glucose, body composition, sleep, mood, menstrual cycle, and medications onto one timeline — synced from the devices you already own — and keeps everything encrypted at rest on hardware you control. No vendor cloud, no subscription, no telemetry.
 
+HealthLog is a personal health record-keeping and wellness tool. It is not a medical device and does not diagnose, treat, cure, or prevent any disease — it helps you log, visualise, and export your own data, and leaves clinical judgement to a clinician.
+
 Try the [live demo](https://demo.healthlog.dev) to see a working install — sign in with `demo` / `demo123demo123`.
 
 ## Highlights
 
-- **Every vital on one timeline.** Weight, blood pressure, pulse, glucose, body composition, sleep, SpO₂, mood, and cycle tracking — charted with trends, moving averages, and clinical reference ranges (ESH 2023, ADA 2024), overridable with the targets your clinician set.
+- **Every vital on one timeline.** Weight, blood pressure, pulse, glucose, body composition, sleep, SpO₂, respiratory rate, mood, and cycle tracking — charted with trends, moving averages, and clinical reference ranges (ESH 2023, ADA 2024), overridable with the targets your clinician set.
+- **Clinical signals, opt-in and additive.** Validated mental-wellbeing self-checks (PHQ-9, GAD-7) that sit beside mood tracking with calm crisis-resource handling, grip strength, a 0–10 pain score, waist and body measurements, and a longevity lab panel — each added through one signal registry, so a new signal wires into charts, correlations, the coach, the FHIR map, and the API at once.
+- **Records and the documents you're handed.** Structured allergies and family history (encrypted), lab values you key in or scan, and inbound documents — discharge letters and reports — read to extract the facts they state (values, codes, dates) for you to review and confirm. HealthLog transcribes what a document says; it never interprets or diagnoses from it. (Immunization records are deliberately out of scope.)
+- **Context that explains the numbers.** An opt-in environmental module folds weather, daylight, and temperature in as influence signals (winter darkness against mood, heat against blood pressure) using a home location you set, so a pattern has somewhere to point.
 - **Your devices, one server.** Withings, WHOOP, Oura and Polar sync over OAuth2, Fitbit connects experimentally over the Fitbit Web API, an Apple Health `export.zip` folds your full history in, and the native iOS app streams HealthKit live. A per-metric source priority decides which reading is canonical when wearables overlap.
 - **Medication tracking that tells the truth.** Flexible schedules (weekly injections, weekday-only, intervals, PRN, cyclic), a configurable intake window per dose, and a traceable dose history where every slot reads taken, late, skipped, or missed — the same ledger the compliance rate is computed from, so the percentage can never disagree with the timeline.
-- **AI insights you own.** Daily briefing, health scores, correlations, and a conversational coach grounded in your own measurements, with proactive check-ins. Bring your own OpenAI or Anthropic key, or point at a local endpoint (Ollama, LM Studio, vLLM) so nothing leaves your network.
+- **AI insights you own.** Daily briefing, health scores, correlations, and a conversational coach grounded in your own measurements, with calm proactive check-ins it suppresses when there's nothing genuine to say. The coach describes your data, never diagnoses. Bring your own OpenAI or Anthropic key, or point at a local endpoint (Ollama, LM Studio, vLLM) so nothing leaves your network.
 - **Clinician-ready output.** A doctor-report PDF generated client-side, a read-only HL7 FHIR R4 API, and scoped, time-limited share links you revoke after the visit.
 - **Private by construction.** AES-256-GCM encryption at rest with zero-downtime key rotation, passkey login, server-side sessions, strict CSP — and no third-party tracking anywhere.
 - **Built to be lived in.** Installable PWA with offline support, medication reminders over APNs, Telegram, ntfy, and Web Push, a sub-second dashboard on years of imported history, English and German end to end.

docs/api/mcp-capabilities.md

@@ -28,7 +28,10 @@ them up front):
 4. **Data and context only.** The server ships facts; it never returns a
    diagnosis, clinical verdict, risk score, or treatment change. The
    assistant narrates the facts and leaves clinical judgement to the
-   user's clinician.
+   user's clinician. This mirrors HealthLog's project-wide self-description
+   standard: the app is a personal health record-keeping and wellness tool,
+   not a medical device, and nothing it surfaces — here or in the UI —
+   diagnoses or treats.
 
 Discover before fetching: call `list_metrics` (or read the
 `healthlog://measurements/inventory` resource) first to see what exists,
@@ -95,6 +98,19 @@ Every read tool is annotated read-only / non-destructive / idempotent /
 closed-world — the read-only guarantee is structural (only read tools are
 registered for a read session), and the annotation merely advertises it.
 
+The v1.25 clinical-signal additions reach the assistant through these same
+tools rather than new tool names: respiratory rate, grip strength, the 0–10
+pain score, and waist / body measurements appear via `list_metrics` →
+`get_metric_series` / `get_metrics`, and the longevity lab markers via
+`get_labs`. A new signal is declared once in the in-app signal registry and
+shows up across the metric tools, correlations, and the FHIR map together,
+so the MCP surface never advertises a signal the record can't return. The
+opt-in mental-wellbeing instruments (PHQ-9, GAD-7), the structured records
+(allergies, family history), and the inbound-document store are deliberately
+**not** exposed over MCP: the instrument answers are kept out of the
+assistant by design, and the document pipeline extracts facts for the user
+to confirm in-app rather than streaming them to a model.
+
 ## Resources
 
 Read-only context the assistant can attach alongside tool results. Like

docs/integrations/ai-providers.md

@@ -198,6 +198,30 @@ The Coach drawer surfaces a "Local" badge when generation resolves
 to the local provider, so users who pinned a local endpoint can see
 at a glance that their context stayed on the host.
 
+## What the Coach is — and isn't
+
+The Coach is an informational assistant that works from your own
+logged data. It is not a doctor, what it says is not medical advice,
+and it does not diagnose, prescribe, or change treatment — those
+boundaries are written into its system prompt as safety contracts, not
+left to chance. It describes patterns observationally ("your resting
+heart rate has been rising over 14 days"), never as a verdict about a
+named condition, and it defers diagnosis, dose, and drug-interaction
+questions to a healthcare professional. This is HealthLog's
+project-wide self-description standard: a personal health
+record-keeping and wellness tool, not a medical device. The same
+non-diagnostic framing governs the daily briefing, the insights, and
+every surface that turns your data into words.
+
+The Coach can also reach out proactively — a calm, once-a-day morning
+check-in when there is something genuine to surface (a recovery trend
+easing off, blood pressure running a touch high). The nudge is warm
+and localized, references the focus by category rather than quoting
+your own words back, and stays silent when there is nothing real to
+say or when you have engaged the Coach recently. It is an invitation,
+never a streak-guilt prompt, and it inherits the same non-diagnostic
+boundaries as the chat.
+
 ## Caching contract
 
 Two caches sit in front of every provider call so generation budgets

docs/self-hosting/getting-started.md

@@ -16,6 +16,10 @@ already installed, longer if a TLS-fronted public hostname is in scope
   hold a 1.5 GB upload in `/tmp` while it parses.
 - **Outbound HTTPS** to `ghcr.io` (image pulls) plus whichever
   integration endpoints you plan to enable (Withings, OpenAI, etc.).
+  The opt-in environmental-context module additionally reaches
+  `api.open-meteo.com` for weather and daylight; it stays off until you
+  enable it and set a home location, and every outbound call goes
+  through the SSRF-guarded egress wrapper.
 - **Optional but recommended:** a reverse proxy that terminates TLS
   and forwards to `http://localhost:3000` (Caddy, Traefik, Nginx
   Proxy Manager, Coolify, or bare Nginx — see `reverse-proxy.md`).