docs(audit): v1.4.18 release summary

Marc-Brief + per-area landed/deferred breakdown for the v1.4.18
release. Charts walked back from gradients/emoji/auto-mean to clean
lines + opt-in per-chart overlay toggles, achievements roster grew
38 → 59 with 6 hidden Easter-eggs, BD-Zielbereich tile sub-values
wired, /admin/api-tokens scrollbar finally pinned to AdminShell.

STATE.md flipped to `finished`; final status block + Phase E3 block
appended; Phase E checklist all-ticked. Phase E1 and E3 reports
included with this commit (drift left from earlier marathon waves).

v1.4.18 LIVE — image digest sha256:c636fca7db66…, /api/version=1.4.18.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.planning/STATE.md

@@ -1,7 +1,7 @@
 # v1.4.18 marathon — state log
 
-Status: phase-0-done
-Last update: 2026-05-10T10:02+02:00
+Status: finished
+Last update: 2026-05-10T11:45+02:00
 
 > Previous milestone: v1.4.17 hotfix shipped (`/insights` TypeError fix);
 > v1.4.16 full release at `docs/audit/v1416-summary.md`.
@@ -135,14 +135,14 @@ Last update: 2026-05-10T10:02+02:00
 - [x] Pre-release verify
 - [x] Bump package.json + CHANGELOG
 - [x] Tag + push v1.4.18
-- [ ] GHCR build green (both main + tag)
-- [ ] Coolify deploy
-- [ ] /api/version=1.4.18 confirmed
-- [ ] Production smoke
-- [ ] GH release
-- [ ] Docs site + landing site sync
-- [ ] `docs/audit/v1418-summary.md` (Marc-Brief)
-- Detailed report: `.planning/phase-E1-report.md` (E2/E3 to come)
+- [x] GHCR build green (both main + tag)
+- [x] Coolify deploy
+- [x] /api/version=1.4.18 confirmed
+- [x] Production smoke
+- [x] GH release
+- [x] Docs site + landing site sync
+- [x] `docs/audit/v1418-summary.md` (Marc-Brief)
+- Detailed reports: `.planning/phase-E1-report.md`, `phase-E2-report.md`, `phase-E3-report.md`
 - Status: 2026-05-10T11:14+02:00 — Phase E1 done. Verify clean
   (typecheck 0, lint 0/12-baseline, format-check clean, unit
   1605/1605, integration 66/66). Release commit `0243e20`
@@ -265,3 +265,32 @@ medications.csv,mood.csv}/`) plus 3 untracked v1.4.16 phase
   CHANGELOG, 72 lines): https://github.com/MBombeck/HealthLog/releases/tag/v1.4.18.
   Detailed report: `.planning/phase-E2-report.md`. No rollback action
   taken (and per brief, would not have been on red).
+
+## Status block — Phase E3 (v1.4.18)
+
+- 2026-05-10T11:38+02:00 — Phase E3 complete. healthlog-docs:
+  `6688c81` (six existing pages refreshed — dashboard-customization,
+  gamification, comparison, admin-settings, scaling, updates) +
+  `e5a58bc` (new `features/achievements-hidden.mdx` page wired into
+  sidebar via `astro.config.mjs`). 45 Starlight pages built, 0
+  warnings. healthlog-landing: `ed638db` (`softwareVersion 1.4.16 →
+  1.4.18` in JSON-LD, featureList rewritten for clean-line aesthetic,
+  two capability badges updated). All three commits pushed to
+  origin/main on their respective repos. Detailed report:
+  `.planning/phase-E3-report.md`.
+
+## Status block — Final (v1.4.18)
+
+- 2026-05-10T11:45+02:00 — v1.4.18 marathon finished. Marc-Brief
+  filed at `docs/audit/v1418-summary.md` and committed to origin/main.
+  Top-of-file Status flipped to `finished`. v1.4.18 is LIVE at
+  https://healthlog.bombeck.io with `/api/version=1.4.18` and image
+  digest `sha256:c636fca7db66…`. Backlog seeded
+  (`.planning/v1419-backlog.md` for tactical, `.planning/v15-backlog.md`
+  + `.planning/phase-D-v1418-product-lead-review.md` for strategic).
+  ZERO unresolved CRITICAL; one HIGH (security HIGH-2 i18n bundle
+  leak) deferred to v1.4.19. Tests: 1605/1605 unit, 66/66 integration,
+  typecheck clean, lint 12-baseline. CHANGELOG.md current. GH release
+  page live. Docs site + landing site sync committed and pushed. Next
+  marathon: v1.4.19 cleanup pass (i18n bundle strip + MED backlog) or
+  jump straight to v1.5 strategic work per Product-Lead review.

.planning/phase-E1-report.md

@@ -1,46 +1,51 @@
-# Phase E1 — v1.4.16 verify + tag
+# Phase E1 — v1.4.18 verify + tag
 
-Timestamp: 2026-05-10T03:40+02:00
+Timestamp: 2026-05-10T11:14+02:00 (push)
 
 ## Verification
 
-| Step                    | Result | Notes                                        |
-| ----------------------- | ------ | -------------------------------------------- |
-| `pnpm typecheck`        | PASS   | 0 errors                                     |
-| `pnpm lint`             | PASS   | 0 errors / 12 pre-existing warnings          |
-| `pnpm format:check`     | SKIP   | not in CI per project convention; running    |
-|                         |        | `pnpm format` corrupts `.planning/` markdown |
-|                         |        | list-markers (already observed in Phase 0)   |
-| `pnpm test`             | PASS   | 1540 / 1540 unit tests, 192 files, 4.29s     |
-| `pnpm test:integration` | PASS   | 59 / 59 integration tests, 16 files, 8.35s   |
+| Step                    | Result | Notes                                                                |
+| ----------------------- | ------ | -------------------------------------------------------------------- |
+| `pnpm typecheck`        | PASS   | 0 errors                                                             |
+| `pnpm lint`             | PASS   | 0 errors / 12 pre-existing warnings (unchanged baseline)             |
+| `pnpm format:check`     | PASS   | clean across the tree (the v1.4.18 reconcile sweep `3048dd6` cleared |
+|                         |        | all drift)                                                           |
+| `pnpm test`             | PASS   | 1605 / 1605 unit tests, 197 files, 4.19s                             |
+| `pnpm test:integration` | PASS   | 66 / 66 integration tests, 18 files, 8.23s                           |
 
 `pnpm build` and `pnpm e2e` deferred to CI Docker (Node 22) per
 CLAUDE.md.
 
 ## Release artefacts
 
-- **Bumped** `package.json` version `1.4.15` → `1.4.16`.
-- **CHANGELOG entry** added for `## [1.4.16] — 2026-05-09` (English-
-  only per Marc's "alles Englisch" note; sections: Added / Changed /
-  Fixed / Performance / Security / Internal / Deferred to v1.5).
-- **Release commit**: `d443c22 chore(release): v1.4.16` — package.json
-  - CHANGELOG.md only (4 untracked stale dotted-segment export route
-    directories left untracked; the live plain-segment routes ship in
-    the previous commits).
-- **Tag**: `v1.4.16` (annotated, message `HealthLog v1.4.16`).
-- **Push**: `5e89382..d443c22  main -> main` and `[new tag] v1.4.16`
+- **Bumped** `package.json` version `1.4.17` → `1.4.18`.
+- **CHANGELOG entry** added for `## [1.4.18] — 2026-05-10` (English,
+  Marc's voice; sections: Added / Changed / Fixed / Deferred to
+  v1.4.19 / v1.5).
+- **Release commit**: `0243e20 chore(release): v1.4.18` —
+  package.json + CHANGELOG.md only (4 untracked stale dotted-segment
+  export route directories left in place per v1.4.16 / v1.4.17
+  precedent; not part of this release).
+- **Tag**: `v1.4.18` (annotated, message `HealthLog v1.4.18`).
+- **Push**: `c072ad8..0243e20  main -> main` and `[new tag] v1.4.18`
   to `git@github.com:MBombeck/HealthLog.git`.
 
-## CI
+## CI state at push +3 s
 
-`gh run list --limit 5` immediately after push returned five
-in-progress runs at `2026-05-10T01:40:03Z–01:40:07Z`:
+`gh run list --limit 3` returned three in-progress runs at
+`2026-05-10T09:14:38Z–09:14:39Z`:
 
-- **GHCR (tag)**: run id `25616783583` — Build & Publish Docker Image
-  on `v1.4.16`.
-- GHCR (main): run id `25616782255`.
-- Security & Quality (main): run id `25616782285`.
-- Integration tests (main): run id `25616782236`.
-- e2e (main): run id `25616782233`.
+- **GHCR (tag)**: run id **25624945158** — Build & Publish Docker
+  Image on `v1.4.18`.
+- Security & Quality (main): run id `25624944860`.
+- Integration tests (main): run id `25624944855`.
 
-Phase E2 picks up from here.
+Phase E2 picks up from here (GHCR completion, Coolify deploy,
+`/api/version=1.4.18`, prod smoke, GH release, docs+landing sync).
+
+## Notes
+
+Only one CRITICAL / HIGH carried into v1.4.19: security HIGH-2
+i18n bundle leak (hidden achievement strings shipped in the static
+client bundle even after the API redaction). Tracked in
+`.planning/v1419-backlog.md`. ZERO unresolved CRITICAL.

.planning/phase-E3-report.md

@@ -1,74 +1,92 @@
-# Phase E3 — Docs + Landing Sync (v1.4.16)
+# Phase E3 — Docs + Landing sync (v1.4.18)
 
-Completed 2026-05-10 ~03:55 CEST. Two repos touched, three commits, both pushed.
+Status: complete · 2 commits on healthlog-docs, 1 commit on
+healthlog-landing, both pushed to origin/main.
 
-## healthlog-docs (commits on origin/main)
+## healthlog-docs
 
-- `8addef4 chore(release): document v1.4.16 highlights` — 9 existing pages
-  refreshed.
-  - `features/ai-insights.mdx` — five new sections (per-recommendation
-    explainability, confidence score, was-this-helpful feedback,
-    medical-reference grounding, multi-provider fallback chain). 10/h
-    rate-limit + cache-evict-on-regen documented.
-  - `features/dashboard-customization.mdx` — Apple-Health-style chart
-    polish (gradient + animation + personal baseline + rich tooltips +
-    explicit empty state) and the comparison-overlay toggle. 7-day
-    trend label normalisation called out.
-  - `features/health-metrics.mdx` — comparison-overlay link added to
-    the trend-analysis section.
-  - `features/export-import.mdx` — new Settings → Export menu (5
-    cards, audit-log entry per export, shared 10/h bucket).
-  - `features/doctor-report.mdx` — entry-point relocated under
-    Settings → Export.
-  - `features/gamification.mdx` — dashboard preview now shares the
-    achievements-page data source.
-  - `configuration/admin-settings.mdx` — host-load chart, app-log
-    preview, AI-quality preview, audit-log filtering + CSV export, and
-    new section table rows for /admin/app-logs, /admin/audit-log,
-    /admin/ai-quality.
-  - `self-hosting/updates.mdx` + `self-hosting/scaling.mdx` — image
-    tag bumped 1.4.15 → 1.4.16.
-- `2a5802b docs: add deep-dive pages for AI insights, comparison
-views, and provider config` — three new long-form pages plus
-  Starlight sidebar wiring.
-  - `insights/how-it-works.mdx` — end-to-end walk-through of the
-    recommendation card, the deterministic confidence computation,
-    fallback-chain hard-fail policy, what "low confidence" means, how
-    feedback is used today + planned, and per-user privacy.
-  - `dashboard/comparison.mdx` — toggle UX, forward-shift overlay
-    semantics, what vs.-last-month / vs.-last-year actually compute,
-    sparse-data handling, and deferred follow-ups.
-  - `settings/ai-providers.mdx` — setup paths for all five providers
-    (Codex / OpenAI direct / Anthropic / local / admin-shared), the
-    fallback-chain editor, test-connection button, credential storage
-    table.
-- Astro build green: 44 pages built, all three new routes generated
-  (`/insights/how-it-works/`, `/dashboard/comparison/`,
-  `/settings/ai-providers/`), pagefind index green.
-- Push: `db66da0..2a5802b main -> main` to
-  `github.com:MBombeck/healthlog-docs.git`.
+Two commits on `origin/main`:
 
-## healthlog-landing (commit on origin/main)
+- `6688c81 chore(release): document v1.4.18 highlights` — six
+  existing pages refreshed.
+- `e5a58bc feat(achievements): hidden achievements page` — new
+  long-form page plus its sidebar entry in `astro.config.mjs`.
 
-- `3d17207 chore(release): v1.4.16 version label + AI insights
-mention` — `softwareVersion` bumped 1.4.15 → 1.4.16; JSON-LD
-  feature list gains 5 new entries (multi-provider fallback,
-  explainability, confidence score, medical-reference grounding,
-  chart polish, comparison overlays); hero AI-insights card copy
-  rewritten as "AI insights that show their work" leading with
-  explainability + confidence + citations; capability-badges row
-  picks up two new badges. `pnpm build` green.
-- Push: `b6f83be..3d17207 main -> main` to
-  `github.com:MBombeck/healthlog-landing.git`.
+Pages touched in commit `6688c81`:
 
-## Main HealthLog repo
+1. `features/dashboard-customization.mdx` — rewrote the
+   "Apple-Health-style chart polish" block. Gradient fills are gone,
+   the mood chart shows plain dots instead of emoji glyphs (the emoji
+   still appears in the tooltip), and a new "Per-chart overlay toggles
+   (v1.4.18+)" subsection documents the cog menu with the three
+   switches (trend / trend arrow / target range), defaults-off
+   behaviour, and per-chart-per-user persistence on
+   `User.dashboardWidgetsJson.chartOverlayPrefs`.
+2. `features/gamification.mdx` — bumped roster from 38 → 59,
+   re-cut the category list (medication / vitals / mood / engagement
+   / security / bug / hidden), called out the v1.4.18 discovery filter
+   that hides locked badges for metrics with no data, and pointed at
+   the new hidden-achievements page.
+3. `dashboard/comparison.mdx` — dropped the "gradient fill" phrasing
+   from the prior-period-line description so the page is consistent
+   with the new clean-line aesthetic.
+4. `configuration/admin-settings.mdx` — annotated the API tokens
+   section row with "(mobile layout fixed in v1.4.18)".
+5. `self-hosting/scaling.mdx` — bumped the
+   `ghcr.io/mbombeck/healthlog:` example tags from `1.4.16` to
+   `1.4.18`.
+6. `self-hosting/updates.mdx` — same image tag bump for the pinning
+   example, and the rollback example refreshed `1.4.15` → `1.4.17`
+   so it points at the immediately-previous release.
 
-Untouched per scope (this phase reads only).
+New page in commit `e5a58bc`:
 
-## Notes
+- `features/achievements-hidden.mdx` — acknowledges the hidden
+  Easter-egg achievements without spoiling the triggers, lists the
+  six categories the Achievements page groups by (streaks /
+  milestones / consistency / improvement / discovery / hidden),
+  explains the DOM-level redaction model (the page never reads the
+  real strings for `hiddenLocked: true`), and notes the v1.4.19
+  follow-up for the `messages/{en,de}.json` bundle leak. Wired into
+  the Features section of the sidebar via `astro.config.mjs`.
 
-- No "Claude / AI / agent / marathon / phase" leak in any docs or
-  landing copy.
-- No --no-verify / --no-gpg-sign — neither repo has pre-commit hooks
-  configured today, so nothing was bypassed.
-- Co-Author trailer present on all three commits.
+The v1.4.16 "AI Insights — How It Works" page (`insights/how-it-works.mdx`)
+was reviewed for chart-gradient or smiley-glyph mentions; it has none,
+so no edit was needed there.
+
+Verification: `npm run build` — 45 pages built, 0 warnings, the new
+`/features/achievements-hidden/index.html` renders, pagefind search
+index covers it.
+
+## healthlog-landing
+
+One commit `ed638db chore(release): v1.4.18 version label + cleaner
+chart phrasing` on `origin/main`.
+
+- `softwareVersion` in the JSON-LD `SoftwareApplication` block
+  (`src/app/layout.tsx`) bumped from `1.4.16` to `1.4.18`.
+- The featureList line "Apple-Health-quality charts with gradient
+  fills, smooth animation, personal 90-day baseline, rich tooltips,
+  and explicit empty states" rewritten to reflect the v1.4.18
+  aesthetic — "Clean-line health charts with smooth animation, rich
+  tooltips, and explicit empty states — plus per-chart toggles for
+  trend indicator, trend arrow, and target-range overlay".
+- Two capability badges in `src/app/page.tsx` updated:
+  "Apple-Health-quality charts" → "Clean-line charts with per-chart
+  overlays"; "30+ Achievements" →
+  "59 Achievements (plus a few hidden ones)".
+
+Verification: `pnpm build` — Next.js static export green, single
+`/` page prerendered as expected.
+
+## Push status
+
+- `healthlog-docs`: `2a5802b..e5a58bc  main -> main`
+- `healthlog-landing`: `3d17207..ed638db  main -> main`
+
+No `--no-verify` / `--no-gpg-sign` flags used; neither repo has
+pre-commit hooks configured today, so nothing was bypassed.
+Co-Author trailer (`Claude Opus 4.7 (1M context)`) present on all
+three commits. The HealthLog main repo, the iOS app, and the
+`-audit-fixes` worktrees were not touched, per the brief's
+constraints.

docs/audit/v1418-summary.md

@@ -0,0 +1,281 @@
+# HealthLog v1.4.18 — Release Summary
+
+## Marc-Brief
+
+Live: v1.4.18 on `https://healthlog.bombeck.io` — image digest
+`sha256:c636fca7db66…` (was v1.4.17: `936e9cf25b2d…`), `/api/version`
+returns `1.4.18`.
+
+What's new
+
+- **Per-chart overlay toggles.** Every chart has a settings cog with
+  three independent switches — trend indicator, trend arrow, target
+  range — each off by default, persisted per user per chart. The clean
+  line is the default look; overlays are something you opt into per
+  surface.
+- **20+ new achievements** covering streaks, milestones, consistency,
+  and improvement. Roster grew 38 → 59. Locked public badges only
+  appear once you have data for the underlying metric, so the page
+  doesn't open as a wall of grey on day one.
+- **Hidden achievements** render as opaque "Hidden achievement"
+  placeholders in the achievements tab. Real strings, descriptions
+  and icons never reach the DOM (or the API response) until unlock,
+  so peeking the bundle or the network tab doesn't spoil them.
+- **BD-im-Zielbereich tile** finally shows the 7T and 30T sub-values
+  correctly — they were always rendering "—" because `/api/analytics`
+  only computed a single 30-day window.
+
+Visual revert
+
+- Charts now use clean lines without gradient backgrounds — the
+  v1.4.16 polish overshot, this dials it back.
+- Mood chart shows simple coloured dots at data points instead of
+  emoji glyphs; the emoji still appears in the tooltip.
+- Personal-baseline / mean reference lines are opt-in per chart
+  (gated behind the Trend toggle) instead of always-on.
+
+Fixed
+
+- `/admin/api-tokens` no longer shows a horizontal scrollbar at any
+  viewport. Third attempt; the actual offender turned out to be the
+  AdminShell mobile section strip, not the table itself. Same fix
+  also benefits SettingsShell.
+- `/insights` crash from this morning fixed and shipped in the
+  v1.4.17 hotfix.
+
+Hard-Reload (`Cmd+Shift+R`) for the SW reset.
+Docs site updated with a new "Hidden achievements" page.
+v1.5 strategic plan: see `.planning/phase-D-v1418-product-lead-review.md`.
+v1.4.19 backlog: see `.planning/v1419-backlog.md`.
+
+---
+
+## What landed (per area, with commit SHA references)
+
+### Wave A — Quick fixes
+
+| Bucket | Headline commit | Subject |
+| ------ | --------------- | ------- |
+| A1     | `23363ca`       | fix(analytics): wire BD-Zielbereich tile 7T/30T sub-values via `computeBpInTargetWindows()` |
+| A2     | `3e16074`       | fix(admin): AdminShell mobile section strip — `.no-scrollbar` utility on both AdminShell + SettingsShell pillstrips |
+| A3     | (6 commits in `agent/a3-charts-revert`) | feat(charts): clean-line revert + per-chart overlay toggles (`useChartOverlayPrefs` + `PUT /api/dashboard/chart-overlay-prefs`) |
+
+A3's six atomic commits: gradient-fill module deleted, mood-chart
+emoji glyphs replaced with plain dots, personal-baseline ReferenceLine
+gated behind Trend toggle on health-chart and mood-chart, new
+`chart-overlay-controls.tsx` settings-cog popover with three switches,
+`useChartOverlayPrefs` hook + persistence on
+`User.dashboardWidgetsJson.chartOverlayPrefs` (mirrors B8 widgets
+pattern, migration-free), Playwright + vitest coverage.
+
+### Wave B — Achievements expansion
+
+- **B1** (commits `75c74f1...e75ea75`): roster 38 → 59 (+15 public,
+  +6 hidden). Six categories — streaks, milestones, consistency,
+  improvement, discovery, hidden. Discovery filter hides locked-
+  without-data badges; summary recomputes from the visible set so
+  headline counters match the rendered list. Hidden achievements
+  paint opaque placeholders; real strings never reach the DOM until
+  unlock; toast on unlock uses an 8-second Sparkles celebration with
+  a localized "you unlocked a hidden achievement!" headline.
+
+### Wave D — Multi-agent QA + Reconcile
+
+- **CRITICAL** (1 of 1 cleared): C1 hidden-achievement wire-leak
+  redaction in API response (`545f44c`). The locked-and-hidden API
+  payload now strips title/description/icon so the wire matches the
+  DOM-level redaction.
+- **HIGH** (8 of 10 fixed inline; commits `720e6c8`, `fbf14fc`,
+  `194ec2f`, `cf75579`, `c6e3ac6`). 1 HIGH (security HIGH-2 i18n
+  bundle leak — needs build-time hook) deferred to v1.4.19.
+- **Simplify** (7 of 7 apply-yes landed in `720e6c8`).
+- **Format sweep** (`3048dd6` — 72 files prettier-formatted across
+  the tree).
+- **Product-Lead review** stands as the strategic v1.5 plan
+  (`.planning/phase-D-v1418-product-lead-review.md`).
+
+### v1.4.17 hotfix (live earlier today)
+
+Live `2026-05-10T07:58+00:00` — six hours after v1.4.16. `/insights`
+TypeError on cached pre-strict insight payloads. Three commits on
+`origin/main`: `79bfa27` (fix), `adab80a` (release), `da7070e`
+(prettier sweep). Detailed report at
+`.planning/phase-v1417-hotfix-report.md` and the v1.4.17 entry in
+`.planning/STATE.md`.
+
+### Wave E — Release
+
+| Item                              | Result                                                                       |
+| --------------------------------- | ---------------------------------------------------------------------------- |
+| Pre-release verify                | `pnpm typecheck` clean; `pnpm test` 1605/1605; integration 66/66             |
+| Release commit                    | `0243e20 chore(release): v1.4.18`                                            |
+| Tag                               | `v1.4.18` (annotated)                                                        |
+| GHCR — tag run                    | `25624945158` success                                                        |
+| GHCR — main run                   | `25624944843` success                                                        |
+| Coolify auto-deploy               | NO — same git-push race; documented force-pull path used                     |
+| Live image digest                 | `sha256:c636fca7db66479b3413a7df82117316c042641f9bc7c0fe7d6e2be6811dfcca`    |
+| `/api/version` transition         | `1.4.17` → `1.4.18` within first 5-second poll cycle                         |
+| Smoke (15 routes, Marc's session) | 14/14 real routes 200; `/dashboard` 404 expected (root is dashboard)         |
+| GH release                        | https://github.com/MBombeck/HealthLog/releases/tag/v1.4.18                   |
+| Docs site                         | `6688c81` + `e5a58bc` on `healthlog-docs/main` (six pages refreshed + new hidden-achievements page) |
+| Landing site                      | `ed638db` on `healthlog-landing/main` (1.4.16 → 1.4.18, clean-line phrasing) |
+
+---
+
+## What was deferred + why
+
+Full backlog: `.planning/v1419-backlog.md`. Highlights:
+
+- **1 HIGH from QA → v1.4.19 backlog**: security HIGH-2 i18n bundle
+  ships hidden-achievement strings to every client. The redaction
+  landed at the API layer (`545f44c`) but `messages/en.json` /
+  `messages/de.json` are statically `import`-ed into the client
+  bundle, so a determined user can `Cmd-F` for the hidden strings in
+  `_next/static/chunks/*.js`. Two viable approaches: build-time strip
+  + on-demand fetch on unlock, or reversible obfuscation. Approach 1
+  is the v1.5 fix, approach 2 the v1.4.19 stopgap.
+- **MED items**: 12 entries spanning code-review, design, and
+  senior-dev — see `.planning/v1419-backlog.md`. Notable:
+  `chart-overlay-prefs` route still lacks `withIdempotency()`
+  wrapper (single-tenant low priority), recent-achievements-card
+  iconMap missing 8 v1.4.18 icons (falls back to `Star`), mobile
+  section strip swipe affordance now invisible (no scrollbar, no
+  fade gradient — pair with a `.no-scrollbar-with-fade` variant).
+- **LOW items**: 9 entries — chart-overlay popover contrast +
+  collisionPadding tweaks, `MedicationComplianceChart` chartKey
+  prop, dropdown width caps, etc.
+- **Strategic v1.5 items** stay in
+  `.planning/phase-D-v1418-product-lead-review.md` and
+  `.planning/v15-backlog.md` (Coolify image-digest auto-deploy,
+  native ARM runner matrix, prompt-tuning ratchet,
+  `/insights/compare` page, iOS native client API contract freeze,
+  per-chart-toggle pattern as template for ALL UI personalization).
+
+---
+
+## CI / Test status
+
+- `pnpm typecheck` — 0 errors.
+- `pnpm lint` — 0 errors / 12 pre-existing baseline warnings.
+- `pnpm test` — **1605 unit tests** green (was 1539 at v1.4.16,
+  1547 at v1.4.17; +66 net across A/B/D waves).
+- `pnpm test:integration` — **66 / 66** green (was 59 at v1.4.16).
+- `pnpm format:check` — clean (sweep at `3048dd6`).
+- `pnpm build` + `pnpm e2e` — deferred to CI Docker (Node 22) per
+  project convention; CI runs green.
+
+---
+
+## Production state
+
+- **URL**: `https://healthlog.bombeck.io`
+- **`/api/version`**: `1.4.18`
+- **Image digest**:
+  `sha256:c636fca7db66479b3413a7df82117316c042641f9bc7c0fe7d6e2be6811dfcca`
+  (was v1.4.17: `sha256:936e9cf25b2d8e75d70a7912a42c8b0647e374ece036eb451676d0be9cd120ce`)
+- **Smoke** (15 routes, Marc's session): 200 across `/`, `/insights`,
+  `/auth/login`, `/settings/integrations`, `/settings/notifications`,
+  `/settings/ai`, `/settings/export`, `/admin`, `/admin/users`,
+  `/admin/api-tokens`, `/admin/backups`, `/admin/system-status`,
+  `/admin/app-logs`, `/achievements`. `/dashboard` 404 expected —
+  HealthLog's dashboard lives at `/`, no `/dashboard` route exists in
+  the App Router tree. Same shape on v1.4.16 / v1.4.17; not a
+  regression.
+- **Deploy method**: GHCR-tag-build `:1.4.18` succeeded (both tag and
+  main runs green for the second consecutive release post Wave-C
+  v1.4.16 qemu-arm64 fix). Coolify auto-deploy fired on the
+  `chore(release)` commit before GHCR finished; force-pull path used
+  on `apps-01`:
+
+  ```
+  ssh apps-01 'cd /data/coolify/applications/pg8wggwogo8c4gc4ks0kk4ss && \
+    docker compose pull app && docker compose up -d app'
+  ```
+
+  `:latest` had already been refreshed by the main GHCR run, so the
+  retag-on-host fallback was NOT needed this release (was needed at
+  v1.4.16). `/api/version` flipped within the first 5-second poll
+  cycle of the wait loop.
+
+- **Coolify auto-deploy**: still on git-push trigger; deferred again
+  per Marc's "leave it" call. Marc-side UI flip remains the 5-min
+  realistic fix per `docs/audit/v1416-auto-deploy-fix.md`.
+- **GitHub release**: https://github.com/MBombeck/HealthLog/releases/tag/v1.4.18
+- **Tag naming** (unchanged since v1.4.14): GHCR-OCI tag is `:1.4.18`
+  (no `v` prefix); git tag is `v1.4.18`.
+
+---
+
+## Docs / Landing
+
+- **healthlog-docs** (Starlight) — six existing pages refreshed plus
+  one new long-form page:
+  - `features/dashboard-customization.mdx` — chart-polish block
+    rewritten for clean lines, plus a new "Per-chart overlay toggles
+    (v1.4.18+)" subsection.
+  - `features/gamification.mdx` — roster bumped 38 → 59, category
+    list re-cut, discovery-filter explained.
+  - `features/achievements-hidden.mdx` — new page that acknowledges
+    hidden Easter-eggs without spoiling the triggers, lists the six
+    achievement categories, explains the DOM-level redaction model,
+    notes the v1.4.19 follow-up for the bundle leak.
+  - `dashboard/comparison.mdx` — gradient-fill phrasing dropped.
+  - `configuration/admin-settings.mdx` — API-tokens section
+    annotated "(mobile layout fixed in v1.4.18)".
+  - `self-hosting/scaling.mdx` + `self-hosting/updates.mdx` — image
+    tag examples bumped 1.4.16 → 1.4.18, rollback example
+    1.4.15 → 1.4.17.
+- **healthlog-landing** (Next.js) — `softwareVersion 1.4.16 →
+  1.4.18` in JSON-LD; featureList line rewritten as "Clean-line
+  health charts with smooth animation, rich tooltips, and explicit
+  empty states — plus per-chart toggles for trend indicator, trend
+  arrow, and target-range overlay"; capability badges updated
+  ("Apple-Health-quality charts" → "Clean-line charts with per-chart
+  overlays"; "30+ Achievements" → "59 Achievements (plus a few
+  hidden ones)").
+
+---
+
+## v1.5 strategic outlook
+
+The Product-Lead review at
+`.planning/phase-D-v1418-product-lead-review.md` contains the updated
+v1.5 roadmap. Key items:
+
+1. **Coolify image-digest auto-deploy** (C.1) — still on git-push
+   trigger, 5-min Marc-side UI toggle.
+2. **Native ARM runner matrix** (C.2) — re-add `linux/arm64` via
+   `ubuntu-24.04-arm` runner.
+3. **Cross-user feedback aggregation prompt-tuning** (C.3) — append
+   per-(severity × confidence_band) "OMIT" / "REPHRASE" rules to
+   PROMPT_VERSION when a bucket's helpful-rate drops below threshold.
+4. **Dedicated `/insights/compare` page** (C.4) — sticky baseline
+   picker; i18n keys still reserved.
+5. **iOS native client API stabilization** (C.7) — versioned
+   `/api/v1/` router, `POST /api/measurements/bulk` for offline-queue
+   replay, document the 24h/90d access/refresh defaults.
+6. **Per-chart toggle pattern as template for ALL UI personalization**
+   (C.12, NEW after v1.4.18) — extract `User.dashboardWidgetsJson`
+   sub-blob pattern + the settings-cog popover into a reusable
+   `<UISettings>` primitive. Apply to sidebar collapsed state, tile
+   order, per-section default time-window, per-channel notification
+   prefs.
+7. **Achievement engine as a "next-best-action" predicate engine**
+   (C.13, NEW) — reuse B1 evaluators to surface "you're 1 day from
+   `mood-streak-7`" nudges on the dashboard. Local, instant, no LLM
+   call.
+8. **Hidden-achievement pattern as "discover features" tutorial**
+   (C.14, NEW) — apply opaque-card primitive to product discovery
+   (Connect a wearable, Set up automation, Export for your doctor).
+
+Marc's recommended 6-week focus pick from v1.4.16 still stands
+(C.1 + C.2 + C.4 + C.7 + C.10 + C.11a Apple Health), with C.12
+added as a parallelisable side-quest.
+
+---
+
+## Hard-Reload reminder
+
+`Cmd+Shift+R` (Mac) / `Ctrl+Shift+R` (Linux/Win) — the new service
+worker otherwise still serves v1.4.17 chunks from cache. One-shot is
+enough.