chore(release): v1.4.25

Largest feature delta in the v1.4.x line. Insights expands into seven dedicated metric sub-pages; GLP-1 medication tracking lands end-to-end (drug-level chart with Research Mode acknowledgment, EMA titration ladder, cadence + compliance, side-effect taxonomy, pen/vial inventory); cross-source priority becomes a two-axis resolver; per-user timezone threads through ten analytics surfaces; Withings activity + sleep v2 sync; onboarding rebuilt as a nested-route wizard; Personal Records ship end-to-end; Health Score provenance accordion; Coach runs native first-party prompts across six locales with a 1800-assertion refusal-probe matrix; OpenAPI drift gate hard-fails; multi-arch GHCR image. Migrations 0043 through 0060 are additive and forward-only. PROMPT_VERSION 4.24.0 → 4.25.0 with GROUND RULE 9 (refuses dose recommendations) and GROUND RULE 15 (refuses drug-level estimates with MDR + MDCG 2021-24 cites).

See CHANGELOG.md for the full per-section delta.

src/app/api/admin/settings/__tests__/route.test.ts

@@ -434,4 +434,75 @@ describe("PUT /api/admin/settings", () => {
     const res = await PUT(r);
     expect(res.status).toBe(415);
   });
+
+  // v1.4.25 W7 — server-default timezone.
+  it("persists a valid defaultUserTimezone", async () => {
+    vi.mocked(prisma.appSettings.upsert).mockResolvedValue({
+      id: "singleton",
+      registrationEnabled: true,
+      defaultLocale: "de",
+      telegramGlobal: true,
+      ntfyGlobal: true,
+      webPushGlobal: true,
+      webPushVapidPublicKey: null,
+      webPushVapidSubject: null,
+      webPushVapidPrivateKeyEncrypted: null,
+      apiGlobal: true,
+      umamiEnabled: false,
+      umamiScriptUrl: null,
+      umamiWebsiteId: null,
+      glitchtipEnabled: false,
+      glitchtipDsn: null,
+      glitchtipEnvironment: null,
+      githubIssueRepo: null,
+      githubIssueTokenEncrypted: null,
+      bugReportEnabled: true,
+      reminderLateMinutes: 120,
+      reminderMissedMinutes: 240,
+      moodLogGlobal: true,
+      defaultUserTimezone: "Pacific/Auckland",
+    } as never);
+    const res = await PUT(jsonReq({ defaultUserTimezone: "Pacific/Auckland" }));
+    expect(res.status).toBe(200);
+    const args = vi.mocked(prisma.appSettings.upsert).mock.calls[0]?.[0];
+    expect(args?.update).toEqual({ defaultUserTimezone: "Pacific/Auckland" });
+  });
+
+  it("clears the server-default timezone when given empty string", async () => {
+    vi.mocked(prisma.appSettings.upsert).mockResolvedValue({
+      id: "singleton",
+      registrationEnabled: true,
+      defaultLocale: "de",
+      telegramGlobal: true,
+      ntfyGlobal: true,
+      webPushGlobal: true,
+      webPushVapidPublicKey: null,
+      webPushVapidSubject: null,
+      webPushVapidPrivateKeyEncrypted: null,
+      apiGlobal: true,
+      umamiEnabled: false,
+      umamiScriptUrl: null,
+      umamiWebsiteId: null,
+      glitchtipEnabled: false,
+      glitchtipDsn: null,
+      glitchtipEnvironment: null,
+      githubIssueRepo: null,
+      githubIssueTokenEncrypted: null,
+      bugReportEnabled: true,
+      reminderLateMinutes: 120,
+      reminderMissedMinutes: 240,
+      moodLogGlobal: true,
+      defaultUserTimezone: null,
+    } as never);
+    const res = await PUT(jsonReq({ defaultUserTimezone: "" }));
+    expect(res.status).toBe(200);
+    const args = vi.mocked(prisma.appSettings.upsert).mock.calls[0]?.[0];
+    expect(args?.update).toEqual({ defaultUserTimezone: null });
+  });
+
+  it("returns 422 for an invalid IANA zone in defaultUserTimezone", async () => {
+    const res = await PUT(jsonReq({ defaultUserTimezone: "Mars/Olympus" }));
+    expect(res.status).toBe(422);
+    expect(prisma.appSettings.upsert).not.toHaveBeenCalled();
+  });
 });

src/app/api/admin/settings/route.ts

@@ -11,6 +11,10 @@ import { annotate } from "@/lib/logging/context";
 import { encrypt } from "@/lib/crypto";
 import { adminSettingsSchema } from "@/lib/validations/admin";
 import { NextRequest } from "next/server";
+import {
+  invalidateServerDefaultTimezone,
+  isValidTimezone,
+} from "@/lib/tz/resolver";
 
 export const dynamic = "force-dynamic";
 
@@ -50,6 +54,10 @@ export const GET = apiHandler(async () => {
     reminderLateMinutes: settings?.reminderLateMinutes ?? 120,
     reminderMissedMinutes: settings?.reminderMissedMinutes ?? 240,
     moodLogGlobal: settings?.moodLogGlobal ?? true,
+    // v1.4.25 W7 — null means "fall back to Europe/Berlin in the
+    // resolver"; surfacing the raw value lets the admin UI render
+    // an empty picker placeholder until they opt in.
+    defaultUserTimezone: settings?.defaultUserTimezone ?? null,
   });
 });
 
@@ -186,6 +194,26 @@ export const PUT = apiHandler(async (request: NextRequest) => {
     auditDetails.reminderMissedMinutes = data.reminderMissedMinutes;
   }
 
+  // v1.4.25 W7 — server-default timezone for new signups.
+  // Empty string clears the override (resolver falls back to
+  // Europe/Berlin); a non-empty string must pass Intl validation
+  // upstream of the column write.
+  let didTouchTimezone = false;
+  if (data.defaultUserTimezone !== undefined) {
+    const trimmed = data.defaultUserTimezone.trim();
+    if (trimmed === "") {
+      updates.defaultUserTimezone = null;
+      auditDetails.defaultUserTimezone = null;
+      didTouchTimezone = true;
+    } else if (isValidTimezone(trimmed)) {
+      updates.defaultUserTimezone = trimmed;
+      auditDetails.defaultUserTimezone = trimmed;
+      didTouchTimezone = true;
+    } else {
+      return apiError("Not a valid IANA timezone.", 422);
+    }
+  }
+
   if (Object.keys(updates).length === 0) {
     return apiError("No valid fields", 422);
   }
@@ -196,6 +224,10 @@ export const PUT = apiHandler(async (request: NextRequest) => {
     create: { id: "singleton", ...updates },
   });
 
+  if (didTouchTimezone) {
+    invalidateServerDefaultTimezone();
+  }
+
   await auditLog("admin.settings.update", {
     userId: user.id,
     ipAddress: getClientIp(request),
@@ -230,5 +262,6 @@ export const PUT = apiHandler(async (request: NextRequest) => {
     reminderLateMinutes: settings.reminderLateMinutes,
     reminderMissedMinutes: settings.reminderMissedMinutes,
     moodLogGlobal: settings.moodLogGlobal,
+    defaultUserTimezone: settings.defaultUserTimezone,
   });
 });

src/app/api/admin/status/__tests__/route.test.ts

@@ -44,9 +44,17 @@ vi.mock("@/lib/jobs/worker-status", () => ({
   })),
 }));
 
+// v1.4.25 W21 Fix-K — `/api/admin/status` now reads the legacy-form
+// counter from the Withings webhook module. Mock it at module boundary
+// so the test fixture stays deterministic.
+vi.mock("@/app/api/withings/webhook/route", () => ({
+  getLegacyFormTotal: vi.fn(() => 0),
+}));
+
 import { GET } from "../route";
 import { prisma } from "@/lib/db";
 import { requireAdmin, HttpError } from "@/lib/api-handler";
+import { getLegacyFormTotal } from "@/app/api/withings/webhook/route";
 
 const ADMIN_CTX = {
   session: { id: "s1", expiresAt: new Date(Date.now() + 3_600_000) },
@@ -169,4 +177,13 @@ describe("GET /api/admin/status (integration health summary)", () => {
     const tokenCallArgs = vi.mocked(prisma.apiToken.count).mock.calls[0]?.[0];
     expect(tokenCallArgs).toEqual({ where: { revoked: false } });
   });
+
+  it("surfaces the legacy Withings webhook counter on the counters block (Fix-K sec-M2)", async () => {
+    vi.mocked(getLegacyFormTotal).mockReturnValue(7);
+    const res = await GET();
+    const body = (await res.json()) as {
+      data: { counters: { withingsWebhookLegacyFormTotal: number } };
+    };
+    expect(body.data.counters.withingsWebhookLegacyFormTotal).toBe(7);
+  });
 });

src/app/api/admin/status/route.ts

@@ -3,6 +3,7 @@ import { apiHandler, requireAdmin } from "@/lib/api-handler";
 import { apiSuccess } from "@/lib/api-response";
 import { annotate } from "@/lib/logging/context";
 import { getWorkerStatus } from "@/lib/jobs/worker-status";
+import { getLegacyFormTotal } from "@/app/api/withings/webhook/route";
 import { readFileSync } from "node:fs";
 
 // Build timestamp (set at build time via next.config)
@@ -89,5 +90,11 @@ export const GET = apiHandler(async () => {
       webPush: webPushConfigured ? { configured: true } : null,
       bugReport: bugReportConfigured ? { configured: true } : null,
     },
+    // v1.4.25 W21 Fix-K — in-memory counters that the release-gate can
+    // read to confirm "legacy form usage trending toward zero" before
+    // the v1.4.27 cut of the legacy Withings webhook route.
+    counters: {
+      withingsWebhookLegacyFormTotal: getLegacyFormTotal(),
+    },
   });
 });