chore(release): v1.4.40 — comprehensive Critical+High architecture closure plus iOS PB30 enablement

Eleven touch-disjoint waves landed on develop plus a six-axis QA
reconcile round before tagging. See CHANGELOG.md for the user-facing
prose; this commit message documents the wave + report inventory for
release-management traceability.

Waves shipped (each with a phase report under .planning/):

- phase-W-POOL-v1440-report.md — p-limit(4) wrapper around the
  analytics 15-way fan-out + pg.Pool max raised 10 -> 20. Closes the
  v1.4.39 empirical-trace finding #1 (Prisma pool starvation).
- phase-W-DELETED-v1440-report.md — 11 reader-tier helpers + 3
  integration contracts close audit Critical Finding #3 (soft-delete
  invisibility) across dashboard, analytics, summaries, rollup tiers,
  and the Coach snapshot path.
- phase-W-INSIGHTS-v1440-report.md — mood-rollup swap on the three
  /api/insights/{features,targets,cards} routes plus the
  compliance-rollup hook gap closure for bulk-projection mints; the
  post-QA reconcile patch closes the six remaining measurement.findMany
  sites in the cluster that still leaked tombstoned rows.
- phase-W-INFRA-v1440-report.md — rollup helper umbrella consolidation
  under src/lib/rollups/* with zero orphan re-exports; lint, typecheck,
  knip, and 93/93 rollup tests green post-restructure.
- phase-W-RSC-v1440-report.md — per-tile Suspense boundaries plus the
  queryKey factory-bypass walker test (extended to comparison/ in the
  reconcile pass).
- phase-W-PRIVACY-v1440-report.md — bilingual /privacy page with 17
  paired-section tests pinning the 9 SB-3 disclosure requirements.
- phase-W-AASA-v1440-report.md — /.well-known/apple-app-site-association
  endpoint pinned to S8WDX4W5KX.dev.healthlog.app with app-ID parity
  assertions guarding against split rotation.
- phase-W-APNS-NOTIFY-v1440-report.md — MEDICATION_REMINDER
  time-sensitive APNs payload (priority 10 + interruption-level)
  scoped via a parameterised test that pins all 6 other event-types
  do not bypass Focus. AP-2 .p8 install gates real delivery.
- phase-W-CONSENT-v1440-report.md — AI consent receipts CRUD with
  append-only invariant pinned in test; revoke-then-regrant leaves
  both rows; idempotent DELETE returns 200 + receipt: null.
- phase-W-WMY-WIRE-v1440-report.md — three previously-dead WMY readers
  (week/month/year) wired through summaries-slice and
  health-score-fast-path with a linear-composability parity test
  pinning the cross-consumer routing contract.
- phase-W-GHOSTS-v1440-report.md — ~1 177 lines of dead code removed
  across 9 atomic commits; startOfUtcDay + wallClockInTz consolidation
  eliminates a sibling-drift risk; knip whitelist trimmed to three
  files pending follow-up.

QA reconcile patches applied per the v1.4.40 QA round (six reports
under .planning/round-v1440-QA-*-findings.md):

- senior C1 — dashboard-suspense-boundaries regex aligned with the
  post-W-INFRA Thread 2 userTimezone-local lift.
- senior H1 — soft-delete filter added to the six remaining
  insights measurement.findMany sites.
- specialist H1 — Promise.allSettled around bulk-projection
  compliance recompute on both /api/medications/intake and
  /api/dashboard/summary.
- ux H1 — compare-toggle migrated to queryKeys.dashboardWidgets
  factory; walker test extended to src/components/comparison/.
- security M1 — consent artefact 64 KB cap enforced via
  Buffer.byteLength (UTF-8 bytes, not UTF-16 code units).

Quality gates green at tag: pnpm typecheck, pnpm lint, pnpm knip
--include files,dependencies,binaries,unlisted, pnpm test --run
(4726 passing / 1 skipped). Tests 4525 -> 4726 unit + 1 skipped over
the v1.4.39 -> v1.4.40 span.

User-facing prose: see CHANGELOG.md.

src/lib/tz/format.ts

@@ -121,7 +121,7 @@ export type FormatInUserTzShape =
  *     `DISPLAY_TIMEZONE`.
  *
  *   - "date" — `2026-05-11` (ISO date in the user's zone). Used as a
- *     day-bucket key parallel to the legacy `berlinDayKey()`.
+ *     stable day-bucket key for per-user aggregation.
  */
 export function formatInUserTz(
   date: Date,
@@ -151,11 +151,11 @@ export function formatInUserTz(
 }
 
 /**
- * Day-bucket key in the user's timezone. Mirrors `berlinDayKey()` but
- * parameterised. Used as a stable Map key for daily aggregation so a
- * 23:30-local reading lands on today's bucket regardless of UTC
- * offset. The legacy `berlinDayKey()` stays for surfaces that are
- * not yet user-scoped (admin tables, audit log viewer).
+ * Day-bucket key in the user's timezone. Used as a stable Map key for
+ * daily aggregation so a 23:30-local reading lands on today's bucket
+ * regardless of UTC offset. Every display surface in v1.4.40 anchors
+ * here — the legacy Berlin-only `berlinDayKey()` was retired in that
+ * release.
  */
 export function userDayKey(date: Date, tz: string): string {
   return formatInUserTz(date, tz, "date");

src/lib/tz/start-of-utc-day.ts

@@ -0,0 +1,20 @@
+/**
+ * UTC-anchored start-of-day truncation shared by the measurement +
+ * mood rollup writers.
+ *
+ * Both rollup tables store TIMESTAMPTZ bucket starts. Anchoring on the
+ * UTC calendar day (rather than the user's local day) keeps the bucket
+ * key deterministic across timezone-shifting consumers — the same
+ * convention `date_trunc('day', measured_at AT TIME ZONE 'UTC')` would
+ * produce on the read side. The display surfaces re-bucket into the
+ * user's timezone via `userDayKey()` from `./format`.
+ *
+ * v1.4.40 W-GHOSTS consolidated two byte-identical local copies
+ * (`src/lib/measurements/rollups.ts` + `src/lib/mood/rollups.ts`) into
+ * this module so future writers cannot drift independently.
+ */
+export function startOfUtcDay(d: Date): Date {
+  return new Date(
+    Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate(), 0, 0, 0, 0),
+  );
+}

src/lib/tz/wall-clock.ts

@@ -0,0 +1,84 @@
+/**
+ * Wall-clock-in-timezone helper shared by the medication scheduling
+ * + compliance-rollup paths.
+ *
+ * Decomposes a `Date` instant into the year/month/day/hour/minute/
+ * second/weekday tuple an observer in `tz` would read off a wall
+ * clock at that moment. Honours DST because `Intl.DateTimeFormat`
+ * does.
+ *
+ * When `tz` is omitted the helper falls back to the host's system-
+ * local representation so the v1.4.25 W19e callers that pre-date the
+ * per-user timezone work keep their original shape.
+ *
+ * v1.4.40 W-GHOSTS consolidated two file-local copies
+ * (`compliance-rollups.ts` returning `{year,month,day}` only +
+ * `scheduling/cadence.ts` returning the full tuple) into this single
+ * canonical export. The cross-tz ±3 h guard hinges on these helpers
+ * staying in lock-step; keeping them as separate definitions made
+ * silent drift a real failure mode.
+ */
+export interface WallClockParts {
+  year: number;
+  /** 1–12 (January = 1, December = 12). */
+  month: number;
+  /** 1–31. */
+  day: number;
+  /** 0–23 (24 normalised to 0 to match Date.getHours() semantics). */
+  hour: number;
+  minute: number;
+  second: number;
+  /** 0 = Sunday … 6 = Saturday. */
+  weekday: number;
+}
+
+const WEEKDAY_MAP: Record<string, number> = {
+  Sun: 0,
+  Mon: 1,
+  Tue: 2,
+  Wed: 3,
+  Thu: 4,
+  Fri: 5,
+  Sat: 6,
+};
+
+export function wallClockInTz(
+  date: Date,
+  tz: string | undefined,
+): WallClockParts {
+  if (!tz) {
+    return {
+      year: date.getFullYear(),
+      month: date.getMonth() + 1,
+      day: date.getDate(),
+      hour: date.getHours(),
+      minute: date.getMinutes(),
+      second: date.getSeconds(),
+      weekday: date.getDay(),
+    };
+  }
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone: tz,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+    hour12: false,
+    weekday: "short",
+  }).formatToParts(date);
+  const get = (type: Intl.DateTimeFormatPartTypes): string =>
+    parts.find((p) => p.type === type)?.value ?? "0";
+  let hour = Number(get("hour"));
+  if (hour === 24) hour = 0;
+  return {
+    year: Number(get("year")),
+    month: Number(get("month")),
+    day: Number(get("day")),
+    hour,
+    minute: Number(get("minute")),
+    second: Number(get("second")),
+    weekday: WEEKDAY_MAP[get("weekday")] ?? 0,
+  };
+}