chore(release): v1.4.40 — comprehensive Critical+High architecture closure plus iOS PB30 enablement

Eleven touch-disjoint waves landed on develop plus a six-axis QA
reconcile round before tagging. See CHANGELOG.md for the user-facing
prose; this commit message documents the wave + report inventory for
release-management traceability.

Waves shipped (each with a phase report under .planning/):

- phase-W-POOL-v1440-report.md — p-limit(4) wrapper around the
  analytics 15-way fan-out + pg.Pool max raised 10 -> 20. Closes the
  v1.4.39 empirical-trace finding #1 (Prisma pool starvation).
- phase-W-DELETED-v1440-report.md — 11 reader-tier helpers + 3
  integration contracts close audit Critical Finding #3 (soft-delete
  invisibility) across dashboard, analytics, summaries, rollup tiers,
  and the Coach snapshot path.
- phase-W-INSIGHTS-v1440-report.md — mood-rollup swap on the three
  /api/insights/{features,targets,cards} routes plus the
  compliance-rollup hook gap closure for bulk-projection mints; the
  post-QA reconcile patch closes the six remaining measurement.findMany
  sites in the cluster that still leaked tombstoned rows.
- phase-W-INFRA-v1440-report.md — rollup helper umbrella consolidation
  under src/lib/rollups/* with zero orphan re-exports; lint, typecheck,
  knip, and 93/93 rollup tests green post-restructure.
- phase-W-RSC-v1440-report.md — per-tile Suspense boundaries plus the
  queryKey factory-bypass walker test (extended to comparison/ in the
  reconcile pass).
- phase-W-PRIVACY-v1440-report.md — bilingual /privacy page with 17
  paired-section tests pinning the 9 SB-3 disclosure requirements.
- phase-W-AASA-v1440-report.md — /.well-known/apple-app-site-association
  endpoint pinned to S8WDX4W5KX.dev.healthlog.app with app-ID parity
  assertions guarding against split rotation.
- phase-W-APNS-NOTIFY-v1440-report.md — MEDICATION_REMINDER
  time-sensitive APNs payload (priority 10 + interruption-level)
  scoped via a parameterised test that pins all 6 other event-types
  do not bypass Focus. AP-2 .p8 install gates real delivery.
- phase-W-CONSENT-v1440-report.md — AI consent receipts CRUD with
  append-only invariant pinned in test; revoke-then-regrant leaves
  both rows; idempotent DELETE returns 200 + receipt: null.
- phase-W-WMY-WIRE-v1440-report.md — three previously-dead WMY readers
  (week/month/year) wired through summaries-slice and
  health-score-fast-path with a linear-composability parity test
  pinning the cross-consumer routing contract.
- phase-W-GHOSTS-v1440-report.md — ~1 177 lines of dead code removed
  across 9 atomic commits; startOfUtcDay + wallClockInTz consolidation
  eliminates a sibling-drift risk; knip whitelist trimmed to three
  files pending follow-up.

QA reconcile patches applied per the v1.4.40 QA round (six reports
under .planning/round-v1440-QA-*-findings.md):

- senior C1 — dashboard-suspense-boundaries regex aligned with the
  post-W-INFRA Thread 2 userTimezone-local lift.
- senior H1 — soft-delete filter added to the six remaining
  insights measurement.findMany sites.
- specialist H1 — Promise.allSettled around bulk-projection
  compliance recompute on both /api/medications/intake and
  /api/dashboard/summary.
- ux H1 — compare-toggle migrated to queryKeys.dashboardWidgets
  factory; walker test extended to src/components/comparison/.
- security M1 — consent artefact 64 KB cap enforced via
  Buffer.byteLength (UTF-8 bytes, not UTF-16 code units).

Quality gates green at tag: pnpm typecheck, pnpm lint, pnpm knip
--include files,dependencies,binaries,unlisted, pnpm test --run
(4726 passing / 1 skipped). Tests 4525 -> 4726 unit + 1 skipped over
the v1.4.39 -> v1.4.40 span.

User-facing prose: see CHANGELOG.md.

src/app/api/analytics/__tests__/route.test.ts

@@ -73,7 +73,7 @@ vi.mock("next/headers", () => ({
   })),
 }));
 
-import { GET } from "../route";
+import { ANALYTICS_TYPE_FETCH_CONCURRENCY, GET } from "../route";
 import { prisma } from "@/lib/db";
 import { getSession } from "@/lib/auth/session";
 import { __resetAllCachesForTests } from "@/lib/cache/server-cache";
@@ -376,4 +376,71 @@ describe("GET /api/analytics", () => {
     expect(body.data.lastSeenByType.WEIGHT?.daysAgo).toBeLessThanOrEqual(6);
     expect(body.data.lastSeenByType.PULSE).toBeNull();
   });
+
+  // v1.4.40 W-POOL — pin the bounded-concurrency cap on the per-type
+  // fan-out inside `buildAnalyticsResponse`. The v1.4.39 empirical
+  // trace (`.planning/round-v1439-empirical-trace.md` §B1) showed the
+  // raw `Promise.all` over `fetchMeasurementSeriesChunked` holding
+  // ≥8 of the default-10 pg.Pool slots for 6.5 s on a power-user cold
+  // mount. The p-limit(4) wrapper keeps the same total work but caps
+  // inflight Prisma round-trips for this branch at 4.
+  //
+  // The assertion instruments the `prisma.measurement.findMany` mock
+  // to track peak inflight count + total batches. With N≥15 types and
+  // a 20 ms per-call delay, an unbounded `Promise.all` would peak at
+  // ~15 and finish in ~20 ms; the bounded version peaks at exactly 4
+  // and finishes in ~80 ms (4 batches × 20 ms ceiling).
+  it("caps per-type Prisma fan-out at ANALYTICS_TYPE_FETCH_CONCURRENCY", async () => {
+    // Default-slice path requires no coverage so the route falls into
+    // the live per-type loop where the fan-out lives.
+    vi.mocked(prisma.measurementRollup.findMany).mockResolvedValue([] as never);
+
+    let inflight = 0;
+    let peak = 0;
+    let calls = 0;
+
+    vi.mocked(prisma.measurement.findMany).mockImplementation(
+      (async () => {
+        // Only count the per-type chunked fan-out calls (not the
+        // narrower glucose / sleep-stage `findMany` reads inside the
+        // same route; those run sequentially AFTER the fan-out
+        // completes so they never overlap with peak inflight).
+        calls += 1;
+        inflight += 1;
+        peak = Math.max(peak, inflight);
+        // 20 ms is large enough to make the bounded vs unbounded
+        // distinction observable but small enough to keep the suite
+        // under a second.
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        inflight -= 1;
+        // Return an empty page so the chunked reader exits after one
+        // round-trip per type.
+        return [] as never;
+      }) as never,
+    );
+
+    const t0 = Date.now();
+    const res = await (
+      GET as unknown as (...args: never[]) => Promise<Response>
+    )();
+    const elapsed = Date.now() - t0;
+    expect(res.status).toBe(200);
+
+    // The cap itself — peak inflight Prisma reads against
+    // `measurements` never crosses the configured ceiling.
+    expect(ANALYTICS_TYPE_FETCH_CONCURRENCY).toBe(4);
+    expect(peak).toBeLessThanOrEqual(ANALYTICS_TYPE_FETCH_CONCURRENCY);
+
+    // Sanity: more than one type was actually walked, otherwise the
+    // bound is unfalsifiable.
+    expect(calls).toBeGreaterThanOrEqual(8);
+
+    // Wall-clock proves the lanes are saturated rather than serialised
+    // by accident. 4 lanes × 20 ms × ⌈calls/4⌉ ≈ 60-100 ms; an
+    // unbounded fan-out would finish in ~25-40 ms; a fully serial
+    // walk would take calls × 20 ms ≈ 300+ ms. The window catches
+    // both regressions.
+    expect(elapsed).toBeGreaterThanOrEqual(40);
+    expect(elapsed).toBeLessThan(calls * 20);
+  });
 });

src/app/api/analytics/route.ts

@@ -1,3 +1,4 @@
+import pLimit from "p-limit";
 import { prisma } from "@/lib/db";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
@@ -14,8 +15,8 @@ import type {
 } from "@/generated/prisma/client";
 import { measurementTypeEnum } from "@/lib/validations/measurement";
 import { pickCanonicalSourceRows } from "@/lib/analytics/source-priority";
-import { ensureUserRollupsFresh } from "@/lib/measurements/rollups";
-import { probeRollupCoverage } from "@/lib/measurements/rollup-coverage";
+import { ensureUserRollupsFresh } from "@/lib/rollups/measurement-rollups";
+import { probeRollupCoverage } from "@/lib/rollups/measurement-coverage";
 import { computeBpInTargetFastPath } from "@/lib/analytics/bp-in-target-fast-path";
 import { computeUserHealthScoreFastPath } from "@/lib/analytics/health-score-fast-path";
 import { computeCorrelationHypothesesFastPath } from "@/lib/analytics/correlations-fast-path";
@@ -27,6 +28,32 @@ import {
 
 export const dynamic = "force-dynamic";
 
+/**
+ * v1.4.40 W-POOL — bound the per-type analytics fan-out below to ≤ 4
+ * concurrent Prisma round-trips.
+ *
+ * The v1.4.39 empirical cold-mount trace
+ * (`.planning/round-v1439-empirical-trace.md` § B1) recorded thick
+ * `/api/analytics` running 15× `fetchMeasurementSeriesChunked` in
+ * parallel via a bare `Promise.all` (this file's `route.ts:261-269`
+ * pre-fix), each pulling chunked findMany pages of 5 000 rows. The
+ * combined fan-out held ≥ 8 of the default-10 `pg.Pool` slots for
+ * 6.5 s on Marc's 347k-row tenant, starving every other Wave-B / C
+ * dashboard query.
+ *
+ * Capping the concurrency to 4 keeps the same total work but holds
+ * at most 4 pool slots for the analytics branch at any moment. With
+ * the W-POOL ceiling raised to 20 (`src/lib/db.ts:getPoolMax`),
+ * every other dashboard query has ≥ 16 free slots regardless of how
+ * many types analytics is mid-walk over. The thick endpoint pays a
+ * small (~10–15 %) absolute wall-clock cost on a single cold mount —
+ * 15 chunks across 4 lanes = 4 batches instead of 1 — but is already
+ * wrapped in the 60s `caches.analytics` LRU so the user-visible
+ * impact is only the very first mount, in exchange for the chart-tile
+ * burst paying ~5 s less of pool wait time on every mount thereafter.
+ */
+export const ANALYTICS_TYPE_FETCH_CONCURRENCY = 4;
+
 /**
  * v1.4.33 C1 — pull `?slice=…` from either a NextRequest (the
  * route's production wrapper) or a plain `Request` (the integration
@@ -181,12 +208,9 @@ async function buildAnalyticsResponse(user: AuthedUser) {
   // cost flat across the three branches.
   const coverage = await probeRollupCoverage(user.id);
 
-  // v1.4.25 W7b — every day-bucket call inside this route now honours
-  // the user's display timezone. The legacy `berlinDayKey()` import
-  // remains for sleep-stage and correlation paths that share their
-  // helper signature with non-tz-aware code (`computeSleepStageBreakdown`
-  // is called with a userId only); the per-call sites below all pass
-  // `userTz` through `userDayKey()`.
+  // v1.4.25 W7b — every day-bucket call inside this route honours the
+  // user's display timezone via `userDayKey(date, userTz)` (the legacy
+  // `berlinDayKey()` helper was retired in v1.4.40).
   const userTz = user.timezone ?? DEFAULT_TIMEZONE;
 
   // Derived from canonical enum so a new measurement type is auto-summarised
@@ -258,8 +282,15 @@ async function buildAnalyticsResponse(user: AuthedUser) {
   const lastSeenByType: Record<string, { lastSeenAt: string } | null> = {};
 
   let totalRowsReadForAggregate = 0;
+  // v1.4.40 W-POOL — bounded-concurrency wrapper for the 15-way
+  // per-type fan-out below. See `ANALYTICS_TYPE_FETCH_CONCURRENCY`
+  // above + `.planning/round-v1439-empirical-trace.md` § B1 for the
+  // pool-saturation root cause. Same total work, ≤ 4 pool slots held
+  // by this branch at any moment.
+  const typeFetchLimit = pLimit(ANALYTICS_TYPE_FETCH_CONCURRENCY);
   const measurementsByType = await Promise.all(
     types.map((type) =>
+      typeFetchLimit(() =>
       fetchMeasurementSeriesChunked(user.id, type, {
         includeSleepStage: true,
         // v1.4.39 W-SINCE — trailing 425-day floor for the live read.
@@ -348,6 +379,7 @@ async function buildAnalyticsResponse(user: AuthedUser) {
           summary: summarize(datapoints),
         };
       }),
+      ),
     ),
   );
 
@@ -477,6 +509,7 @@ async function buildAnalyticsResponse(user: AuthedUser) {
       userId: user.id,
       type: "BLOOD_GLUCOSE",
       measuredAt: { gte: glucoseSince },
+      deletedAt: null,
     },
     orderBy: { measuredAt: "asc" },
     select: { value: true, measuredAt: true, glucoseContext: true },
@@ -586,6 +619,7 @@ async function computeSleepStageBreakdown(
       type: "SLEEP_DURATION",
       sleepStage: { not: null },
       measuredAt: { gte: since },
+      deletedAt: null,
     },
     select: { value: true, measuredAt: true, sleepStage: true },
   });
@@ -695,6 +729,7 @@ async function fetchMeasurementSeriesChunked(
         userId,
         type,
         ...(options.since ? { measuredAt: { gte: options.since } } : {}),
+        deletedAt: null,
       },
       orderBy: [{ measuredAt: "asc" }, { id: "asc" }],
       select: {