chore(release): v1.4.40 — comprehensive Critical+High architecture closure plus iOS PB30 enablement

Eleven touch-disjoint waves landed on develop plus a six-axis QA
reconcile round before tagging. See CHANGELOG.md for the user-facing
prose; this commit message documents the wave + report inventory for
release-management traceability.

Waves shipped (each with a phase report under .planning/):

- phase-W-POOL-v1440-report.md — p-limit(4) wrapper around the
  analytics 15-way fan-out + pg.Pool max raised 10 -> 20. Closes the
  v1.4.39 empirical-trace finding #1 (Prisma pool starvation).
- phase-W-DELETED-v1440-report.md — 11 reader-tier helpers + 3
  integration contracts close audit Critical Finding #3 (soft-delete
  invisibility) across dashboard, analytics, summaries, rollup tiers,
  and the Coach snapshot path.
- phase-W-INSIGHTS-v1440-report.md — mood-rollup swap on the three
  /api/insights/{features,targets,cards} routes plus the
  compliance-rollup hook gap closure for bulk-projection mints; the
  post-QA reconcile patch closes the six remaining measurement.findMany
  sites in the cluster that still leaked tombstoned rows.
- phase-W-INFRA-v1440-report.md — rollup helper umbrella consolidation
  under src/lib/rollups/* with zero orphan re-exports; lint, typecheck,
  knip, and 93/93 rollup tests green post-restructure.
- phase-W-RSC-v1440-report.md — per-tile Suspense boundaries plus the
  queryKey factory-bypass walker test (extended to comparison/ in the
  reconcile pass).
- phase-W-PRIVACY-v1440-report.md — bilingual /privacy page with 17
  paired-section tests pinning the 9 SB-3 disclosure requirements.
- phase-W-AASA-v1440-report.md — /.well-known/apple-app-site-association
  endpoint pinned to S8WDX4W5KX.dev.healthlog.app with app-ID parity
  assertions guarding against split rotation.
- phase-W-APNS-NOTIFY-v1440-report.md — MEDICATION_REMINDER
  time-sensitive APNs payload (priority 10 + interruption-level)
  scoped via a parameterised test that pins all 6 other event-types
  do not bypass Focus. AP-2 .p8 install gates real delivery.
- phase-W-CONSENT-v1440-report.md — AI consent receipts CRUD with
  append-only invariant pinned in test; revoke-then-regrant leaves
  both rows; idempotent DELETE returns 200 + receipt: null.
- phase-W-WMY-WIRE-v1440-report.md — three previously-dead WMY readers
  (week/month/year) wired through summaries-slice and
  health-score-fast-path with a linear-composability parity test
  pinning the cross-consumer routing contract.
- phase-W-GHOSTS-v1440-report.md — ~1 177 lines of dead code removed
  across 9 atomic commits; startOfUtcDay + wallClockInTz consolidation
  eliminates a sibling-drift risk; knip whitelist trimmed to three
  files pending follow-up.

QA reconcile patches applied per the v1.4.40 QA round (six reports
under .planning/round-v1440-QA-*-findings.md):

- senior C1 — dashboard-suspense-boundaries regex aligned with the
  post-W-INFRA Thread 2 userTimezone-local lift.
- senior H1 — soft-delete filter added to the six remaining
  insights measurement.findMany sites.
- specialist H1 — Promise.allSettled around bulk-projection
  compliance recompute on both /api/medications/intake and
  /api/dashboard/summary.
- ux H1 — compare-toggle migrated to queryKeys.dashboardWidgets
  factory; walker test extended to src/components/comparison/.
- security M1 — consent artefact 64 KB cap enforced via
  Buffer.byteLength (UTF-8 bytes, not UTF-16 code units).

Quality gates green at tag: pnpm typecheck, pnpm lint, pnpm knip
--include files,dependencies,binaries,unlisted, pnpm test --run
(4726 passing / 1 skipped). Tests 4525 -> 4726 unit + 1 skipped over
the v1.4.39 -> v1.4.40 span.

User-facing prose: see CHANGELOG.md.

src/__tests__/api/analytics/since-cap.test.ts

@@ -76,11 +76,11 @@ vi.mock("@/lib/logging/context", async () => {
 // The three fast-paths and the rollup helpers are exercised by their
 // own tests; here we stub them so the route's per-type read is the
 // only Prisma traffic the test observes.
-vi.mock("@/lib/measurements/rollups", () => ({
+vi.mock("@/lib/rollups/measurement-rollups", () => ({
   ensureUserRollupsFresh: vi.fn().mockResolvedValue(undefined),
 }));
 
-vi.mock("@/lib/measurements/rollup-coverage", () => ({
+vi.mock("@/lib/rollups/measurement-coverage", () => ({
   probeRollupCoverage: vi.fn().mockResolvedValue(new Map()),
 }));
 
@@ -150,10 +150,10 @@ beforeEach(async () => {
   // module scope only sets the initial implementation, and the slim
   // slice test must observe a resolved value not `undefined`.
   const { ensureUserRollupsFresh } = await import(
-    "@/lib/measurements/rollups"
+    "@/lib/rollups/measurement-rollups"
   );
   const { probeRollupCoverage } = await import(
-    "@/lib/measurements/rollup-coverage"
+    "@/lib/rollups/measurement-coverage"
   );
   const { computeBpInTargetFastPath } = await import(
     "@/lib/analytics/bp-in-target-fast-path"

src/__tests__/api/auth/registration-status/route.test.ts

@@ -0,0 +1,116 @@
+/**
+ * v1.4.40 W-INSIGHTS SB-7 — pin the four discovery branches of
+ * `GET /api/auth/registration-status`.
+ *
+ * The route is read-only; the iOS sign-in flow + the web onboarding
+ * dispatcher both depend on its envelope shape (`registrationEnabled`
+ * boolean) staying byte-stable. A regression that flipped the
+ * fail-closed branch to fail-open would silently allow registration on
+ * a self-hosted deployment whose admin set `registrationEnabled: false`
+ * and an upstream DB blip lost the row.
+ *
+ * Four branches walked:
+ *
+ *   1. **Singleton row exists with `registrationEnabled: true`** →
+ *      envelope reports `true`.
+ *   2. **Singleton row exists with `registrationEnabled: false`** →
+ *      envelope reports `false`. (Admin-disabled tenant — invite-only.)
+ *   3. **Singleton row missing (`findUnique` returns `null`)** →
+ *      envelope reports the schema default `true` (open registration —
+ *      the no-config baseline for a fresh self-hosted instance).
+ *   4. **`findUnique` throws** (DB outage / connection drop) → envelope
+ *      fails closed with `false`. Critical: a DB blip on a tenant
+ *      that has disabled registration must NOT unlock the sign-up
+ *      flow.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/lib/db", () => ({
+  prisma: {
+    appSettings: {
+      findUnique: vi.fn(),
+    },
+  },
+}));
+
+vi.mock("@/lib/auth/audit", () => ({
+  auditLog: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/lib/db-compat", () => ({
+  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() }));
+
+vi.mock("next/headers", () => ({
+  headers: vi.fn(async () => ({ get: () => null })),
+  cookies: vi.fn(async () => ({
+    get: () => undefined,
+    set: () => {},
+    delete: () => {},
+  })),
+}));
+
+import { GET } from "@/app/api/auth/registration-status/route";
+import { prisma } from "@/lib/db";
+
+const callGet = GET as unknown as (...args: never[]) => Promise<Response>;
+
+interface RegistrationStatusBody {
+  data: { registrationEnabled: boolean };
+}
+
+beforeEach(() => {
+  vi.resetAllMocks();
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("GET /api/auth/registration-status", () => {
+  it("reports `true` when the singleton row carries registrationEnabled: true", async () => {
+    vi.mocked(prisma.appSettings.findUnique).mockResolvedValue({
+      id: "singleton",
+      registrationEnabled: true,
+    } as never);
+
+    const res = await callGet();
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as RegistrationStatusBody;
+    expect(body.data.registrationEnabled).toBe(true);
+  });
+
+  it("reports `false` when the singleton row carries registrationEnabled: false (admin-disabled tenant)", async () => {
+    vi.mocked(prisma.appSettings.findUnique).mockResolvedValue({
+      id: "singleton",
+      registrationEnabled: false,
+    } as never);
+
+    const res = await callGet();
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as RegistrationStatusBody;
+    expect(body.data.registrationEnabled).toBe(false);
+  });
+
+  it("falls back to the schema default `true` when the singleton row is missing (fresh self-hosted instance)", async () => {
+    vi.mocked(prisma.appSettings.findUnique).mockResolvedValue(null as never);
+
+    const res = await callGet();
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as RegistrationStatusBody;
+    expect(body.data.registrationEnabled).toBe(true);
+  });
+
+  it("fails closed with `false` when the DB lookup throws (defense-in-depth against silent unlock)", async () => {
+    vi.mocked(prisma.appSettings.findUnique).mockRejectedValue(
+      new Error("connection terminated"),
+    );
+
+    const res = await callGet();
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as RegistrationStatusBody;
+    expect(body.data.registrationEnabled).toBe(false);
+  });
+});

src/__tests__/api/well-known.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, it } from "vitest";
+
+/**
+ * SB-4 (v1.4.40) — Apple App Site Association (AASA) handler contract.
+ *
+ * iOS Universal Links and Web Credentials both fetch
+ * `/.well-known/apple-app-site-association` without credentials and feed
+ * the body to Apple's swcd / aasa-validator. Both pieces of Apple
+ * tooling are strict about three things:
+ *
+ *   1. The exact JSON shape — `applinks.details[].appID` (the
+ *      `<TeamID>.<BundleID>` prefix) plus `applinks.details[].paths`
+ *      (the URL-prefix allow-list), and `webcredentials.apps` (the same
+ *      App ID prefix) for passkey origin-sharing.
+ *   2. The `Content-Type` header — must be `application/json` *without*
+ *      a `charset` parameter. `application/json; charset=utf-8` makes
+ *      Apple's CDN proxy refuse to mirror the file, which silently
+ *      breaks Universal Links on every device.
+ *   3. The response answers 200 to an unauthenticated GET (covered by
+ *      `proxy-well-known-public.test.ts` at the proxy layer).
+ *
+ * This file pins (1) and (2). Any drift means iOS PB30 (App-Store
+ * submission) regresses without a CI signal.
+ */
+
+import { GET } from "@/app/.well-known/apple-app-site-association/route";
+
+const APP_ID = "S8WDX4W5KX.dev.healthlog.app";
+
+describe("/.well-known/apple-app-site-association (SB-4)", () => {
+  it("answers 200", async () => {
+    const res = GET();
+    expect(res.status).toBe(200);
+  });
+
+  it("uses Content-Type: application/json with no charset", async () => {
+    const res = GET();
+    const contentType = res.headers.get("content-type");
+    // Apple's aasa-validator + swcd reject any `charset=…` parameter
+    // on the AASA file. The handler MUST emit the bare media type.
+    expect(contentType).toBe("application/json");
+  });
+
+  it("sets a Cache-Control directive that allows mirroring", async () => {
+    const res = GET();
+    const cacheControl = res.headers.get("cache-control");
+    expect(cacheControl).toBeTruthy();
+    // Public + max-age so Apple's CDN (one-hour TTL) can mirror the
+    // file without falling back to private/no-store behaviour.
+    expect(cacheControl).toMatch(/public/);
+    expect(cacheControl).toMatch(/max-age=\d+/);
+  });
+
+  it("emits the SB-4 payload shape exactly", async () => {
+    const res = GET();
+    const body = await res.json();
+    expect(body).toEqual({
+      applinks: {
+        details: [
+          {
+            appID: APP_ID,
+            paths: ["*"],
+          },
+        ],
+      },
+      webcredentials: {
+        apps: [APP_ID],
+      },
+    });
+  });
+
+  it("uses the same App ID prefix for applinks and webcredentials", async () => {
+    // Apple's passkey origin-pairing requires the iOS bundle and the
+    // website origin to advertise the same App ID. Splitting these two
+    // entries (e.g. a stale Team ID on one side) breaks passkey login
+    // without a redirect / status-code signal — the only symptom is a
+    // silent fall-back to password login on iOS.
+    const res = GET();
+    const body = (await res.json()) as {
+      applinks: { details: Array<{ appID: string }> };
+      webcredentials: { apps: string[] };
+    };
+    expect(body.applinks.details[0].appID).toBe(body.webcredentials.apps[0]);
+  });
+});