chore(release): v1.4.40 — comprehensive Critical+High architecture closure plus iOS PB30 enablement

Eleven touch-disjoint waves landed on develop plus a six-axis QA
reconcile round before tagging. See CHANGELOG.md for the user-facing
prose; this commit message documents the wave + report inventory for
release-management traceability.

Waves shipped (each with a phase report under .planning/):

- phase-W-POOL-v1440-report.md — p-limit(4) wrapper around the
  analytics 15-way fan-out + pg.Pool max raised 10 -> 20. Closes the
  v1.4.39 empirical-trace finding #1 (Prisma pool starvation).
- phase-W-DELETED-v1440-report.md — 11 reader-tier helpers + 3
  integration contracts close audit Critical Finding #3 (soft-delete
  invisibility) across dashboard, analytics, summaries, rollup tiers,
  and the Coach snapshot path.
- phase-W-INSIGHTS-v1440-report.md — mood-rollup swap on the three
  /api/insights/{features,targets,cards} routes plus the
  compliance-rollup hook gap closure for bulk-projection mints; the
  post-QA reconcile patch closes the six remaining measurement.findMany
  sites in the cluster that still leaked tombstoned rows.
- phase-W-INFRA-v1440-report.md — rollup helper umbrella consolidation
  under src/lib/rollups/* with zero orphan re-exports; lint, typecheck,
  knip, and 93/93 rollup tests green post-restructure.
- phase-W-RSC-v1440-report.md — per-tile Suspense boundaries plus the
  queryKey factory-bypass walker test (extended to comparison/ in the
  reconcile pass).
- phase-W-PRIVACY-v1440-report.md — bilingual /privacy page with 17
  paired-section tests pinning the 9 SB-3 disclosure requirements.
- phase-W-AASA-v1440-report.md — /.well-known/apple-app-site-association
  endpoint pinned to S8WDX4W5KX.dev.healthlog.app with app-ID parity
  assertions guarding against split rotation.
- phase-W-APNS-NOTIFY-v1440-report.md — MEDICATION_REMINDER
  time-sensitive APNs payload (priority 10 + interruption-level)
  scoped via a parameterised test that pins all 6 other event-types
  do not bypass Focus. AP-2 .p8 install gates real delivery.
- phase-W-CONSENT-v1440-report.md — AI consent receipts CRUD with
  append-only invariant pinned in test; revoke-then-regrant leaves
  both rows; idempotent DELETE returns 200 + receipt: null.
- phase-W-WMY-WIRE-v1440-report.md — three previously-dead WMY readers
  (week/month/year) wired through summaries-slice and
  health-score-fast-path with a linear-composability parity test
  pinning the cross-consumer routing contract.
- phase-W-GHOSTS-v1440-report.md — ~1 177 lines of dead code removed
  across 9 atomic commits; startOfUtcDay + wallClockInTz consolidation
  eliminates a sibling-drift risk; knip whitelist trimmed to three
  files pending follow-up.

QA reconcile patches applied per the v1.4.40 QA round (six reports
under .planning/round-v1440-QA-*-findings.md):

- senior C1 — dashboard-suspense-boundaries regex aligned with the
  post-W-INFRA Thread 2 userTimezone-local lift.
- senior H1 — soft-delete filter added to the six remaining
  insights measurement.findMany sites.
- specialist H1 — Promise.allSettled around bulk-projection
  compliance recompute on both /api/medications/intake and
  /api/dashboard/summary.
- ux H1 — compare-toggle migrated to queryKeys.dashboardWidgets
  factory; walker test extended to src/components/comparison/.
- security M1 — consent artefact 64 KB cap enforced via
  Buffer.byteLength (UTF-8 bytes, not UTF-16 code units).

Quality gates green at tag: pnpm typecheck, pnpm lint, pnpm knip
--include files,dependencies,binaries,unlisted, pnpm test --run
(4726 passing / 1 skipped). Tests 4525 -> 4726 unit + 1 skipped over
the v1.4.39 -> v1.4.40 span.

User-facing prose: see CHANGELOG.md.

src/lib/__tests__/db.test.ts

@@ -0,0 +1,64 @@
+/**
+ * v1.4.40 W-POOL — pool-config contract for `src/lib/db.ts`.
+ *
+ * The v1.4.39 empirical cold-mount trace
+ * (`.planning/round-v1439-empirical-trace.md` § B2) traced the
+ * Wave-B/C dashboard-query stall to the Prisma `pg.Pool` falling
+ * back to the library default ceiling of 10 connections. W-POOL
+ * pinned the ceiling to 20 via `getPoolMax()`; this test prevents a
+ * future refactor from silently dropping the override and re-introducing
+ * the saturation regression on a power-user cold mount.
+ *
+ * The test only exercises the `getPoolMax()` env-resolver. Constructing
+ * a real `PrismaClient` requires a live `DATABASE_URL`, which would
+ * make this an integration test instead of a unit test — the helper
+ * isolation is intentional.
+ */
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { getPoolMax } from "../db";
+
+describe("getPoolMax", () => {
+  const originalEnv = process.env.DATABASE_POOL_MAX;
+
+  beforeEach(() => {
+    delete process.env.DATABASE_POOL_MAX;
+  });
+
+  afterEach(() => {
+    if (originalEnv === undefined) {
+      delete process.env.DATABASE_POOL_MAX;
+    } else {
+      process.env.DATABASE_POOL_MAX = originalEnv;
+    }
+  });
+
+  it("defaults to 20 when DATABASE_POOL_MAX is unset", () => {
+    expect(getPoolMax()).toBe(20);
+  });
+
+  it("honours DATABASE_POOL_MAX when it parses to a positive int", () => {
+    process.env.DATABASE_POOL_MAX = "30";
+    expect(getPoolMax()).toBe(30);
+  });
+
+  it("falls back to 20 on a malformed DATABASE_POOL_MAX", () => {
+    process.env.DATABASE_POOL_MAX = "not-a-number";
+    expect(getPoolMax()).toBe(20);
+  });
+
+  it("falls back to 20 on a non-positive DATABASE_POOL_MAX", () => {
+    process.env.DATABASE_POOL_MAX = "0";
+    expect(getPoolMax()).toBe(20);
+    process.env.DATABASE_POOL_MAX = "-5";
+    expect(getPoolMax()).toBe(20);
+  });
+
+  it("never returns the library default of 10 on the happy path", () => {
+    // The whole point of the W-POOL change. If anybody removes the
+    // `max:` config from `createPrismaClient` and reverts to the
+    // library default, this assertion stops the regression before the
+    // next saturated cold mount.
+    expect(getPoolMax()).toBeGreaterThanOrEqual(20);
+  });
+});

src/lib/__tests__/glucose.test.ts

@@ -1,7 +1,6 @@
 import { describe, it, expect } from "vitest";
 import {
   mgdlToMmol,
-  mmolToMgdl,
   convertGlucose,
   resolveGlucoseUnit,
   thresholdMetricForContext,
@@ -14,18 +13,6 @@ describe("glucose conversion", () => {
     expect(mgdlToMmol(70)).toBeCloseTo(3.9, 1); // hypoglycemia threshold
   });
 
-  it("converts mmol/L to mg/dL rounded to integer", () => {
-    expect(mmolToMgdl(5.5)).toBe(99);
-    expect(mmolToMgdl(7.0)).toBe(126);
-  });
-
-  it("roundtrips within 1 mg/dL", () => {
-    for (const mgdl of [70, 99, 100, 126, 140, 200, 300]) {
-      const back = mmolToMgdl(mgdlToMmol(mgdl));
-      expect(Math.abs(back - mgdl)).toBeLessThanOrEqual(1);
-    }
-  });
-
   it("convertGlucose dispatches to the right unit", () => {
     expect(convertGlucose(100, "mg/dL")).toBe(100);
     expect(convertGlucose(100, "mmol/L")).toBe(5.5);

src/lib/__tests__/query-keys.test.ts

@@ -1,3 +1,5 @@
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
 import { describe, it, expect, vi } from "vitest";
 import {
   queryKeys,
@@ -34,6 +36,51 @@ describe("queryKeys factory", () => {
     expect(queryKeys.analytics()).toEqual(["analytics"]);
     expect(queryKeys.analytics(undefined)).toEqual(["analytics"]);
   });
+
+  // v1.4.40 W-RSC — the four new factory entries from this wave each
+  // need a byte-stable contract so the audit-cited drift cases stay
+  // pinned. A future rename of any of these literals would land a
+  // matching test failure rather than silently breaking cache layout.
+  it("exposes the authMe shape so useAuth doesn't drift back to a bare literal", () => {
+    expect(queryKeys.authMe()).toEqual(["auth", "me"]);
+  });
+
+  it("exposes the userThresholds shape for Settings + targets", () => {
+    expect(queryKeys.userThresholds()).toEqual(["user", "thresholds"]);
+  });
+
+  it("packs chartData params into a stable tuple prefixed by chart-data", () => {
+    const key = queryKeys.chartData(
+      "WEIGHT",
+      "raw",
+      "no-bmi",
+      "Europe/Berlin",
+      "2026-04-01T00:00:00.000Z",
+      "2026-05-01T00:00:00.000Z",
+    );
+    expect(key[0]).toBe("chart-data");
+    expect(key.length).toBe(7);
+    // Numeric bmiDivisor is allowed (BMI charts pass `heightCm * heightCm`).
+    const bmiKey = queryKeys.chartData(
+      "WEIGHT",
+      "bmi",
+      30625,
+      "Europe/Berlin",
+      "2026-04-01T00:00:00.000Z",
+      "2026-05-01T00:00:00.000Z",
+    );
+    expect(bmiKey[3]).toBe(30625);
+  });
+
+  it("prefixes the dashboard medication-compliance key under one root", () => {
+    expect(queryKeys.dashboardMedicationCompliance(7)).toEqual([
+      "dashboard-medication-compliance",
+      7,
+    ]);
+    expect(queryKeys.dashboardMedicationCompliance(30)[0]).toBe(
+      "dashboard-medication-compliance",
+    );
+  });
 });
 
 describe("dependent-key bundles", () => {
@@ -48,6 +95,16 @@ describe("dependent-key bundles", () => {
     );
   });
 
+  // v1.4.40 W-RSC — chart-data prefix now lives in the bundle so a
+  // fresh measurement evicts every per-chart daily-aggregate cache.
+  // Pre-fix the chart row stayed 60 s stale after a measurement save
+  // (audit-C2). Pin the bundle membership so a refactor of the chart
+  // queryKey factory can't silently drop the dependency.
+  it("measurementDependentKeys bundles the chart-data prefix (v1.4.40)", () => {
+    const keyStrings = measurementDependentKeys.map((k) => JSON.stringify(k));
+    expect(keyStrings).toContain(JSON.stringify(["chart-data"]));
+  });
+
   it("moodDependentKeys bundle covers mood + analytics + targets", () => {
     const keyStrings = moodDependentKeys.map((k) => JSON.stringify(k));
     expect(keyStrings).toContain(JSON.stringify(["mood-entries"]));
@@ -63,6 +120,110 @@ describe("dependent-key bundles", () => {
       JSON.stringify(["gamification", "achievements"]),
     );
   });
+
+  // v1.4.40 W-RSC — dashboard-medication-compliance prefix now lives in
+  // the bundle so an intake POST refreshes the dashboard chart in
+  // lockstep with the per-medication compliance-chart-inline tile
+  // (audit-L4).
+  it("medicationDependentKeys bundles the dashboard-medication-compliance prefix (v1.4.40)", () => {
+    const keyStrings = medicationDependentKeys.map((k) => JSON.stringify(k));
+    expect(keyStrings).toContain(JSON.stringify(["dashboard-medication-compliance"]));
+  });
+});
+
+/**
+ * v1.4.40 W-RSC — factory-bypass guard.
+ *
+ * Walks every `.ts` / `.tsx` file in `src/components/charts` and
+ * `src/app/page.tsx` (the dashboard + chart files we own in this wave)
+ * and fails if a literal `queryKey: [...]` slipped past the factory.
+ * Acts as a lint-style enforcement check in the absence of a custom
+ * ESLint rule — keeps the CI gate cheap and the failure message
+ * pointed at the exact file the contributor needs to fix.
+ *
+ * The audit (`.planning/round-v1439-arch-qa-frontend.md` §H1) found
+ * 154 bare queryKey sites at v1.4.39.3. We intentionally scope this
+ * guard tight to the dashboard + chart files this wave touched so a
+ * future wave can extend the directory list as it migrates the
+ * remaining sites — opt-in expansion beats a giant red CI on
+ * landing.
+ */
+describe("queryKey factory enforcement", () => {
+  function listFiles(dir: string): string[] {
+    const entries = readdirSync(dir);
+    const out: string[] = [];
+    for (const name of entries) {
+      const full = join(dir, name);
+      const st = statSync(full);
+      if (st.isDirectory()) {
+        if (name === "__tests__" || name === "node_modules") continue;
+        out.push(...listFiles(full));
+      } else if (name.endsWith(".ts") || name.endsWith(".tsx")) {
+        out.push(full);
+      }
+    }
+    return out;
+  }
+
+  const repoRoot = join(__dirname, "..", "..", "..");
+  // Files this wave migrated to the factory. Extend this list as
+  // future waves migrate their own surface; the audit-H1 long tail
+  // (admin/, settings/, medications/, integrations) stays out of the
+  // guard's scope until a follow-up wave routes those keys.
+  const guardedRoots = [
+    join(repoRoot, "src", "components", "charts"),
+    join(repoRoot, "src", "components", "comparison"),
+    join(repoRoot, "src", "app", "page.tsx"),
+    join(repoRoot, "src", "hooks", "use-auth.ts"),
+  ];
+
+  function collect(): string[] {
+    const all: string[] = [];
+    for (const root of guardedRoots) {
+      const st = statSync(root);
+      if (st.isDirectory()) {
+        all.push(...listFiles(root));
+      } else {
+        all.push(root);
+      }
+    }
+    return all;
+  }
+
+  it("no guarded file declares a bare-literal `queryKey:` (factory enforcement)", () => {
+    const offenders: Array<{ file: string; line: number; snippet: string }> = [];
+    const files = collect();
+    for (const file of files) {
+      const text = readFileSync(file, "utf8");
+      const lines = text.split("\n");
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Match `queryKey:` followed by a `[` on the same line. We
+        // explicitly allow `queryKey: queryKeys.<entry>(…)` patterns
+        // and any indirect identifier the call site passes through
+        // (a `key` local, a `listKey` constant, etc.) so the guard
+        // only flags the literal-array shape that drove audit-H1.
+        const match = line.match(/queryKey\s*:\s*\[/);
+        if (!match) continue;
+        // Strip trailing comments + JSX comments before deciding.
+        const trimmed = line.replace(/\/\/.*$/, "").trim();
+        if (!/queryKey\s*:\s*\[/.test(trimmed)) continue;
+        offenders.push({
+          file: file.slice(repoRoot.length + 1),
+          line: i + 1,
+          snippet: trimmed,
+        });
+      }
+    }
+
+    expect(
+      offenders,
+      `Factory bypass — every \`queryKey:\` in guarded files must go through \`queryKeys.<entry>()\`. ` +
+        `Offenders:\n${offenders
+          .map((o) => `  ${o.file}:${o.line}  ${o.snippet}`)
+          .join("\n")}`,
+    ).toEqual([]);
+  });
 });
 
 describe("invalidateKeys", () => {