chore(release): v1.4.40 — comprehensive Critical+High architecture closure plus iOS PB30 enablement

Eleven touch-disjoint waves landed on develop plus a six-axis QA
reconcile round before tagging. See CHANGELOG.md for the user-facing
prose; this commit message documents the wave + report inventory for
release-management traceability.

Waves shipped (each with a phase report under .planning/):

- phase-W-POOL-v1440-report.md — p-limit(4) wrapper around the
  analytics 15-way fan-out + pg.Pool max raised 10 -> 20. Closes the
  v1.4.39 empirical-trace finding #1 (Prisma pool starvation).
- phase-W-DELETED-v1440-report.md — 11 reader-tier helpers + 3
  integration contracts close audit Critical Finding #3 (soft-delete
  invisibility) across dashboard, analytics, summaries, rollup tiers,
  and the Coach snapshot path.
- phase-W-INSIGHTS-v1440-report.md — mood-rollup swap on the three
  /api/insights/{features,targets,cards} routes plus the
  compliance-rollup hook gap closure for bulk-projection mints; the
  post-QA reconcile patch closes the six remaining measurement.findMany
  sites in the cluster that still leaked tombstoned rows.
- phase-W-INFRA-v1440-report.md — rollup helper umbrella consolidation
  under src/lib/rollups/* with zero orphan re-exports; lint, typecheck,
  knip, and 93/93 rollup tests green post-restructure.
- phase-W-RSC-v1440-report.md — per-tile Suspense boundaries plus the
  queryKey factory-bypass walker test (extended to comparison/ in the
  reconcile pass).
- phase-W-PRIVACY-v1440-report.md — bilingual /privacy page with 17
  paired-section tests pinning the 9 SB-3 disclosure requirements.
- phase-W-AASA-v1440-report.md — /.well-known/apple-app-site-association
  endpoint pinned to S8WDX4W5KX.dev.healthlog.app with app-ID parity
  assertions guarding against split rotation.
- phase-W-APNS-NOTIFY-v1440-report.md — MEDICATION_REMINDER
  time-sensitive APNs payload (priority 10 + interruption-level)
  scoped via a parameterised test that pins all 6 other event-types
  do not bypass Focus. AP-2 .p8 install gates real delivery.
- phase-W-CONSENT-v1440-report.md — AI consent receipts CRUD with
  append-only invariant pinned in test; revoke-then-regrant leaves
  both rows; idempotent DELETE returns 200 + receipt: null.
- phase-W-WMY-WIRE-v1440-report.md — three previously-dead WMY readers
  (week/month/year) wired through summaries-slice and
  health-score-fast-path with a linear-composability parity test
  pinning the cross-consumer routing contract.
- phase-W-GHOSTS-v1440-report.md — ~1 177 lines of dead code removed
  across 9 atomic commits; startOfUtcDay + wallClockInTz consolidation
  eliminates a sibling-drift risk; knip whitelist trimmed to three
  files pending follow-up.

QA reconcile patches applied per the v1.4.40 QA round (six reports
under .planning/round-v1440-QA-*-findings.md):

- senior C1 — dashboard-suspense-boundaries regex aligned with the
  post-W-INFRA Thread 2 userTimezone-local lift.
- senior H1 — soft-delete filter added to the six remaining
  insights measurement.findMany sites.
- specialist H1 — Promise.allSettled around bulk-projection
  compliance recompute on both /api/medications/intake and
  /api/dashboard/summary.
- ux H1 — compare-toggle migrated to queryKeys.dashboardWidgets
  factory; walker test extended to src/components/comparison/.
- security M1 — consent artefact 64 KB cap enforced via
  Buffer.byteLength (UTF-8 bytes, not UTF-16 code units).

Quality gates green at tag: pnpm typecheck, pnpm lint, pnpm knip
--include files,dependencies,binaries,unlisted, pnpm test --run
(4726 passing / 1 skipped). Tests 4525 -> 4726 unit + 1 skipped over
the v1.4.39 -> v1.4.40 span.

User-facing prose: see CHANGELOG.md.

src/app/__tests__/dashboard-suspense-boundaries.test.ts

@@ -0,0 +1,84 @@
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/**
+ * v1.4.40 W-RSC — dashboard Suspense boundaries.
+ *
+ * Audit-H2 flagged "no `<Suspense>` boundaries anywhere in the app".
+ * The v1.4.40 W-RSC wave wraps every dashboard tile cell and every
+ * chart cell in a per-cell `<Suspense>` boundary so the composition
+ * reads as a grid of independently-suspending islands rather than a
+ * flat client tree with shared loading semantics.
+ *
+ * Today the boundary is a structural no-op for the dynamic-loaded
+ * charts because their loading skeleton lives inside the
+ * `next/dynamic({ loading: <ChartSkeleton/> })` contract. The benefit
+ * is future-proofing: any descendant that later suspends (an
+ * `useSuspenseQuery` migration, an RSC hoist of a static legend) gets
+ * its own fallback without re-architecting the row.
+ *
+ * The test pins the structural presence by greppig the page source —
+ * a future refactor that drops the boundary lands a failing test
+ * rather than silently regressing the streaming-composition contract.
+ */
+const ROOT = join(__dirname, "../../..");
+const PAGE_PATH = join(ROOT, "src/app/page.tsx");
+
+function load(path: string): string {
+  return readFileSync(path, "utf8");
+}
+
+describe("v1.4.40 — dashboard per-cell Suspense boundaries", () => {
+  it("imports Suspense from React", () => {
+    const src = load(PAGE_PATH);
+    expect(src).toMatch(/from\s+"react"/);
+    expect(src).toMatch(/\bSuspense\b/);
+  });
+
+  it("wraps the chart-row cell in a `<Suspense fallback={<ChartSkeleton />}>` boundary", () => {
+    const src = load(PAGE_PATH);
+    // `<Suspense fallback={<ChartSkeleton />}>{entry.node}</Suspense>`
+    // exact contract: the chart row's per-cell fallback uses the same
+    // ChartSkeleton primitive the dynamic-loaded charts already paint
+    // during JS chunk resolution.
+    expect(src).toMatch(
+      /<Suspense\s+fallback=\{<ChartSkeleton\s*\/>\}>\s*\{entry\.node\}\s*<\/Suspense>/,
+    );
+  });
+
+  it("wraps each tile-strip cell in a `<Suspense>` boundary", () => {
+    const src = load(PAGE_PATH);
+    // `<Suspense fallback={null}>{entry.node}</Suspense>` — the tile
+    // body is synchronous today so a `null` fallback never paints,
+    // but the boundary primes the row for a future RSC hoist of any
+    // tile slot. Pinning the literal keeps the structural contract
+    // visible in CI.
+    expect(src).toMatch(
+      /<Suspense\s+fallback=\{null\}>\s*\{entry\.node\}\s*<\/Suspense>/,
+    );
+  });
+
+  it("hoists DASHBOARD_QUERY_OPTS to module scope (audit-M2)", () => {
+    const src = load(PAGE_PATH);
+    // Module-scope declaration — search outside the component body.
+    // Pre-fix the const was declared inside `DashboardPage` so every
+    // render created a fresh `{}` reference.
+    const moduleSliceEnd = src.indexOf("export default function DashboardPage");
+    expect(moduleSliceEnd).toBeGreaterThan(0);
+    const moduleSlice = src.slice(0, moduleSliceEnd);
+    expect(moduleSlice).toMatch(/const\s+DASHBOARD_QUERY_OPTS\s*=\s*\{/);
+  });
+
+  it("memoises the hour-of-day derivation against user.timezone (audit-H4)", () => {
+    const src = load(PAGE_PATH);
+    // The greeting hour only changes when the user's timezone changes
+    // — a `useMemo` keyed on the lifted `userTimezone` local keeps the
+    // `Intl.DateTimeFormat` instantiation off the per-render hot path.
+    // Post-W-INFRA Thread 2: `user?.timezone` is lifted to a `userTimezone`
+    // local one line above the `useMemo` so the dep array stays stable.
+    expect(src).toMatch(
+      /const\s+hour\s*=\s*useMemo\([\s\S]*?\[\s*userTimezone\s*\][\s\S]*?\);/,
+    );
+  });
+});