chore(release): v1.4.40 — comprehensive Critical+High architecture closure plus iOS PB30 enablement

Eleven touch-disjoint waves landed on develop plus a six-axis QA
reconcile round before tagging. See CHANGELOG.md for the user-facing
prose; this commit message documents the wave + report inventory for
release-management traceability.

Waves shipped (each with a phase report under .planning/):

- phase-W-POOL-v1440-report.md — p-limit(4) wrapper around the
  analytics 15-way fan-out + pg.Pool max raised 10 -> 20. Closes the
  v1.4.39 empirical-trace finding #1 (Prisma pool starvation).
- phase-W-DELETED-v1440-report.md — 11 reader-tier helpers + 3
  integration contracts close audit Critical Finding #3 (soft-delete
  invisibility) across dashboard, analytics, summaries, rollup tiers,
  and the Coach snapshot path.
- phase-W-INSIGHTS-v1440-report.md — mood-rollup swap on the three
  /api/insights/{features,targets,cards} routes plus the
  compliance-rollup hook gap closure for bulk-projection mints; the
  post-QA reconcile patch closes the six remaining measurement.findMany
  sites in the cluster that still leaked tombstoned rows.
- phase-W-INFRA-v1440-report.md — rollup helper umbrella consolidation
  under src/lib/rollups/* with zero orphan re-exports; lint, typecheck,
  knip, and 93/93 rollup tests green post-restructure.
- phase-W-RSC-v1440-report.md — per-tile Suspense boundaries plus the
  queryKey factory-bypass walker test (extended to comparison/ in the
  reconcile pass).
- phase-W-PRIVACY-v1440-report.md — bilingual /privacy page with 17
  paired-section tests pinning the 9 SB-3 disclosure requirements.
- phase-W-AASA-v1440-report.md — /.well-known/apple-app-site-association
  endpoint pinned to S8WDX4W5KX.dev.healthlog.app with app-ID parity
  assertions guarding against split rotation.
- phase-W-APNS-NOTIFY-v1440-report.md — MEDICATION_REMINDER
  time-sensitive APNs payload (priority 10 + interruption-level)
  scoped via a parameterised test that pins all 6 other event-types
  do not bypass Focus. AP-2 .p8 install gates real delivery.
- phase-W-CONSENT-v1440-report.md — AI consent receipts CRUD with
  append-only invariant pinned in test; revoke-then-regrant leaves
  both rows; idempotent DELETE returns 200 + receipt: null.
- phase-W-WMY-WIRE-v1440-report.md — three previously-dead WMY readers
  (week/month/year) wired through summaries-slice and
  health-score-fast-path with a linear-composability parity test
  pinning the cross-consumer routing contract.
- phase-W-GHOSTS-v1440-report.md — ~1 177 lines of dead code removed
  across 9 atomic commits; startOfUtcDay + wallClockInTz consolidation
  eliminates a sibling-drift risk; knip whitelist trimmed to three
  files pending follow-up.

QA reconcile patches applied per the v1.4.40 QA round (six reports
under .planning/round-v1440-QA-*-findings.md):

- senior C1 — dashboard-suspense-boundaries regex aligned with the
  post-W-INFRA Thread 2 userTimezone-local lift.
- senior H1 — soft-delete filter added to the six remaining
  insights measurement.findMany sites.
- specialist H1 — Promise.allSettled around bulk-projection
  compliance recompute on both /api/medications/intake and
  /api/dashboard/summary.
- ux H1 — compare-toggle migrated to queryKeys.dashboardWidgets
  factory; walker test extended to src/components/comparison/.
- security M1 — consent artefact 64 KB cap enforced via
  Buffer.byteLength (UTF-8 bytes, not UTF-16 code units).

Quality gates green at tag: pnpm typecheck, pnpm lint, pnpm knip
--include files,dependencies,binaries,unlisted, pnpm test --run
(4726 passing / 1 skipped). Tests 4525 -> 4726 unit + 1 skipped over
the v1.4.39 -> v1.4.40 span.

User-facing prose: see CHANGELOG.md.

src/__tests__/api/auth/registration-status/route.test.ts

@@ -0,0 +1,116 @@
+/**
+ * v1.4.40 W-INSIGHTS SB-7 — pin the four discovery branches of
+ * `GET /api/auth/registration-status`.
+ *
+ * The route is read-only; the iOS sign-in flow + the web onboarding
+ * dispatcher both depend on its envelope shape (`registrationEnabled`
+ * boolean) staying byte-stable. A regression that flipped the
+ * fail-closed branch to fail-open would silently allow registration on
+ * a self-hosted deployment whose admin set `registrationEnabled: false`
+ * and an upstream DB blip lost the row.
+ *
+ * Four branches walked:
+ *
+ *   1. **Singleton row exists with `registrationEnabled: true`** →
+ *      envelope reports `true`.
+ *   2. **Singleton row exists with `registrationEnabled: false`** →
+ *      envelope reports `false`. (Admin-disabled tenant — invite-only.)
+ *   3. **Singleton row missing (`findUnique` returns `null`)** →
+ *      envelope reports the schema default `true` (open registration —
+ *      the no-config baseline for a fresh self-hosted instance).
+ *   4. **`findUnique` throws** (DB outage / connection drop) → envelope
+ *      fails closed with `false`. Critical: a DB blip on a tenant
+ *      that has disabled registration must NOT unlock the sign-up
+ *      flow.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/lib/db", () => ({
+  prisma: {
+    appSettings: {
+      findUnique: vi.fn(),
+    },
+  },
+}));
+
+vi.mock("@/lib/auth/audit", () => ({
+  auditLog: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/lib/db-compat", () => ({
+  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() }));
+
+vi.mock("next/headers", () => ({
+  headers: vi.fn(async () => ({ get: () => null })),
+  cookies: vi.fn(async () => ({
+    get: () => undefined,
+    set: () => {},
+    delete: () => {},
+  })),
+}));
+
+import { GET } from "@/app/api/auth/registration-status/route";
+import { prisma } from "@/lib/db";
+
+const callGet = GET as unknown as (...args: never[]) => Promise<Response>;
+
+interface RegistrationStatusBody {
+  data: { registrationEnabled: boolean };
+}
+
+beforeEach(() => {
+  vi.resetAllMocks();
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("GET /api/auth/registration-status", () => {
+  it("reports `true` when the singleton row carries registrationEnabled: true", async () => {
+    vi.mocked(prisma.appSettings.findUnique).mockResolvedValue({
+      id: "singleton",
+      registrationEnabled: true,
+    } as never);
+
+    const res = await callGet();
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as RegistrationStatusBody;
+    expect(body.data.registrationEnabled).toBe(true);
+  });
+
+  it("reports `false` when the singleton row carries registrationEnabled: false (admin-disabled tenant)", async () => {
+    vi.mocked(prisma.appSettings.findUnique).mockResolvedValue({
+      id: "singleton",
+      registrationEnabled: false,
+    } as never);
+
+    const res = await callGet();
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as RegistrationStatusBody;
+    expect(body.data.registrationEnabled).toBe(false);
+  });
+
+  it("falls back to the schema default `true` when the singleton row is missing (fresh self-hosted instance)", async () => {
+    vi.mocked(prisma.appSettings.findUnique).mockResolvedValue(null as never);
+
+    const res = await callGet();
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as RegistrationStatusBody;
+    expect(body.data.registrationEnabled).toBe(true);
+  });
+
+  it("fails closed with `false` when the DB lookup throws (defense-in-depth against silent unlock)", async () => {
+    vi.mocked(prisma.appSettings.findUnique).mockRejectedValue(
+      new Error("connection terminated"),
+    );
+
+    const res = await callGet();
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as RegistrationStatusBody;
+    expect(body.data.registrationEnabled).toBe(false);
+  });
+});