chore(release): v1.4.40 — comprehensive Critical+High architecture closure plus iOS PB30 enablement

Eleven touch-disjoint waves landed on develop plus a six-axis QA
reconcile round before tagging. See CHANGELOG.md for the user-facing
prose; this commit message documents the wave + report inventory for
release-management traceability.

Waves shipped (each with a phase report under .planning/):

- phase-W-POOL-v1440-report.md — p-limit(4) wrapper around the
  analytics 15-way fan-out + pg.Pool max raised 10 -> 20. Closes the
  v1.4.39 empirical-trace finding #1 (Prisma pool starvation).
- phase-W-DELETED-v1440-report.md — 11 reader-tier helpers + 3
  integration contracts close audit Critical Finding #3 (soft-delete
  invisibility) across dashboard, analytics, summaries, rollup tiers,
  and the Coach snapshot path.
- phase-W-INSIGHTS-v1440-report.md — mood-rollup swap on the three
  /api/insights/{features,targets,cards} routes plus the
  compliance-rollup hook gap closure for bulk-projection mints; the
  post-QA reconcile patch closes the six remaining measurement.findMany
  sites in the cluster that still leaked tombstoned rows.
- phase-W-INFRA-v1440-report.md — rollup helper umbrella consolidation
  under src/lib/rollups/* with zero orphan re-exports; lint, typecheck,
  knip, and 93/93 rollup tests green post-restructure.
- phase-W-RSC-v1440-report.md — per-tile Suspense boundaries plus the
  queryKey factory-bypass walker test (extended to comparison/ in the
  reconcile pass).
- phase-W-PRIVACY-v1440-report.md — bilingual /privacy page with 17
  paired-section tests pinning the 9 SB-3 disclosure requirements.
- phase-W-AASA-v1440-report.md — /.well-known/apple-app-site-association
  endpoint pinned to S8WDX4W5KX.dev.healthlog.app with app-ID parity
  assertions guarding against split rotation.
- phase-W-APNS-NOTIFY-v1440-report.md — MEDICATION_REMINDER
  time-sensitive APNs payload (priority 10 + interruption-level)
  scoped via a parameterised test that pins all 6 other event-types
  do not bypass Focus. AP-2 .p8 install gates real delivery.
- phase-W-CONSENT-v1440-report.md — AI consent receipts CRUD with
  append-only invariant pinned in test; revoke-then-regrant leaves
  both rows; idempotent DELETE returns 200 + receipt: null.
- phase-W-WMY-WIRE-v1440-report.md — three previously-dead WMY readers
  (week/month/year) wired through summaries-slice and
  health-score-fast-path with a linear-composability parity test
  pinning the cross-consumer routing contract.
- phase-W-GHOSTS-v1440-report.md — ~1 177 lines of dead code removed
  across 9 atomic commits; startOfUtcDay + wallClockInTz consolidation
  eliminates a sibling-drift risk; knip whitelist trimmed to three
  files pending follow-up.

QA reconcile patches applied per the v1.4.40 QA round (six reports
under .planning/round-v1440-QA-*-findings.md):

- senior C1 — dashboard-suspense-boundaries regex aligned with the
  post-W-INFRA Thread 2 userTimezone-local lift.
- senior H1 — soft-delete filter added to the six remaining
  insights measurement.findMany sites.
- specialist H1 — Promise.allSettled around bulk-projection
  compliance recompute on both /api/medications/intake and
  /api/dashboard/summary.
- ux H1 — compare-toggle migrated to queryKeys.dashboardWidgets
  factory; walker test extended to src/components/comparison/.
- security M1 — consent artefact 64 KB cap enforced via
  Buffer.byteLength (UTF-8 bytes, not UTF-16 code units).

Quality gates green at tag: pnpm typecheck, pnpm lint, pnpm knip
--include files,dependencies,binaries,unlisted, pnpm test --run
(4726 passing / 1 skipped). Tests 4525 -> 4726 unit + 1 skipped over
the v1.4.39 -> v1.4.40 span.

User-facing prose: see CHANGELOG.md.

prisma/migrations/0074_v1440_consent_receipts/migration.sql

@@ -0,0 +1,34 @@
+-- v1.4.40 SB-10 — per-user AI consent receipts.
+--
+-- Append-only audit trail backing the iOS onboarding consent flow plus
+-- the operator's GDPR Art. 7 + App-Store Guideline 5.1.2(i) burden of
+-- proof for "data-collection consent is verifiable". A user revoking +
+-- re-granting consent mints a fresh row; the latest non-revoked row
+-- per (user, kind) is the source of truth for "is AI active right
+-- now".
+--
+-- Additive only. Idempotent guards mirror 0067 / 0070 / 0071.
+
+CREATE TABLE IF NOT EXISTS "consent_receipts" (
+    "id"         TEXT            NOT NULL,
+    "user_id"    TEXT            NOT NULL,
+    "kind"       TEXT            NOT NULL,
+    "artefact"   TEXT            NOT NULL,
+    "signed_at"  TIMESTAMP(3)    NOT NULL,
+    "revoked_at" TIMESTAMP(3),
+    "created_at" TIMESTAMP(3)    NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "consent_receipts_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX IF NOT EXISTS "consent_receipts_user_id_created_at_idx"
+    ON "consent_receipts" ("user_id", "created_at" DESC);
+
+DO $$ BEGIN
+    ALTER TABLE "consent_receipts"
+        ADD CONSTRAINT "consent_receipts_user_id_fkey"
+        FOREIGN KEY ("user_id") REFERENCES "users"("id")
+        ON DELETE CASCADE ON UPDATE CASCADE;
+EXCEPTION
+    WHEN duplicate_object THEN NULL;
+END $$;

prisma/schema.prisma

@@ -295,6 +295,13 @@ model User {
   // keep the row in sync so `/api/medications/intake?scope=compliance`
   // and `computeUserHealthScoreFastPath` skip the per-event findMany.
   medicationComplianceRollups MedicationComplianceRollup[]
+  // v1.4.40 SB-10 — AI consent receipts the iOS app POSTs when the user
+  // grants AI processing during onboarding. Persisted audit trail
+  // covers App-Store Guideline 5.1.2(i) ("data-collection consent must
+  // be verifiable") plus the operator's GDPR Art. 7 documentation
+  // burden. Append-only — a user revoking + re-granting consent mints
+  // a fresh row so the timeline reads chronologically.
+  consentReceipts        ConsentReceipt[]
 
   @@map("users")
 }
@@ -1917,3 +1924,39 @@ model CoachUsage {
   @@index([userId, dateKey])
   @@map("coach_usage")
 }
+
+// ─── Consent Receipts (v1.4.40 SB-10) ─────────────────────────
+//
+// Per-user audit trail of AI-processing consent grants. The iOS app
+// posts a fresh row whenever the user opts in to off-device AI flows
+// during onboarding or via Settings; append-only so a revoke + re-grant
+// cycle reads chronologically. Persists the raw signed artefact (PDF
+// receipt OR signed JWT — caller's choice) the App-Store Guideline
+// 5.1.2(i) audit needs to be verifiable. The latest row per user is
+// the source of truth for "is AI active right now" decisions; older
+// rows are kept for the GDPR Art. 7 burden of proof.
+//
+// `kind` is a free-text discriminator the iOS / web client uses to
+// distinguish "ai_full" / "ai_insights_only" / future scopes without
+// requiring a schema migration per new tier.
+model ConsentReceipt {
+  id          String   @id @default(cuid())
+  userId      String   @map("user_id")
+  kind        String
+  /// Raw consent artefact — either a base64-encoded PDF or a signed
+  /// JWT. The server does not parse this payload; the audit trail is
+  /// the storage itself plus the `signedAt` timestamp.
+  artefact    String   @db.Text
+  /// Wall-clock the client recorded the user's tap. UTC ISO-8601.
+  signedAt    DateTime @map("signed_at")
+  /// Optional revocation marker — set when a follow-up "revoke" row
+  /// is minted so the latest-per-user lookup can shortcut to "no
+  /// active consent" without diffing the kind discriminator.
+  revokedAt   DateTime? @map("revoked_at")
+  createdAt   DateTime @default(now()) @map("created_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId, createdAt(sort: Desc)])
+  @@map("consent_receipts")
+}