Merge branch 'fix/encrypt-routes-and-practitioner-contact' into release/v1.39.4

src/lib/crypto/encrypted-columns.ts

@@ -46,6 +46,13 @@ export type EncryptedColumnKind = "string" | "bytes";
  */
 export const BACKUP_CHUNK_AAD = "healthlog/data-backup-chunk/v1";
 
+/**
+ * The associated-data label a workout's GPS track is sealed with, so a value
+ * sealed for another purpose never opens as a route and a route never opens as
+ * anything else.
+ */
+export const WORKOUT_ROUTE_GEOMETRY_AAD = "healthlog/workout-route-geometry/v1";
+
 export interface EncryptedColumn {
   /** Prisma model name (PascalCase, as declared in schema.prisma). */
   readonly model: string;
@@ -354,6 +361,23 @@ export const ENCRYPTED_COLUMNS: readonly EncryptedColumn[] = [
   // (`laterality`) stays plaintext: a side alone says nothing.
   { model: "Encounter", field: "bodySiteEncrypted", kind: "bytes" },
   { model: "Practitioner", field: "noteEncrypted", kind: "bytes" },
+  // v1.39.4 — the practice's phone number and address. The name and the
+  // specialty stay plaintext: the picker searches and sorts on them.
+  { model: "Practitioner", field: "phoneEncrypted", kind: "bytes" },
+  { model: "Practitioner", field: "locationEncrypted", kind: "bytes" },
+
+  // ───── v1.39.4 workout GPS track (Bytes, binary2) ─────
+  // The GeoJSON LineString of an outdoor workout. Its first and last points
+  // are usually the person's front door. Sealed as one binary value per route
+  // (`encryptBytes`, labelled), since a track of 20 000 points is a blob
+  // rather than a short string; the binary codec implies batched rotation.
+  {
+    model: "WorkoutRoute",
+    field: "geometryEncrypted",
+    kind: "bytes",
+    codec: "binary2",
+    aad: WORKOUT_ROUTE_GEOMETRY_AAD,
+  },
 
   // ───── v1.38.0 dose free text (Bytes column) ─────
   // What the person wrote about the dose — a reaction, a sore arm, why the

src/lib/environment/__tests__/coarse-location.test.ts

@@ -0,0 +1,51 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+/**
+ * v1.39.4 — the environment module stores coordinates at 1 decimal (about
+ * 11 km), not 2 (about 1 km). The geocoder is where a picked city's
+ * coordinates enter, so its results must already be coarse.
+ */
+beforeEach(() => {
+  vi.resetModules();
+});
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+  vi.unstubAllGlobals();
+});
+
+describe("coarse location", () => {
+  it("rounds a coordinate to one decimal", async () => {
+    const { roundCoarse } = await import("../open-meteo");
+    expect(roundCoarse(52.5163)).toBe(52.5);
+    expect(roundCoarse(13.3777)).toBe(13.4);
+    expect(roundCoarse(-33.8688)).toBe(-33.9);
+    // Already coarse values pass through unchanged.
+    expect(roundCoarse(48.1)).toBe(48.1);
+  });
+
+  it("hands back geocoding results at one decimal", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        Response.json(
+          {
+            results: [
+              {
+                name: "Berlin",
+                latitude: 52.52437,
+                longitude: 13.41053,
+                country: "Germany",
+                timezone: "Europe/Berlin",
+              },
+            ],
+          },
+          { status: 200 },
+        ),
+      ),
+    );
+    const { geocodeLocation } = await import("../open-meteo");
+    const [hit] = await geocodeLocation("Berlin");
+    expect(hit).toMatchObject({ lat: 52.5, lon: 13.4 });
+  });
+});

src/lib/environment/open-meteo.ts

@@ -40,7 +40,7 @@ export const OPEN_METEO_ATTRIBUTION = "Weather data by Open-Meteo.com";
 
 /** One geocoding match — coarse city placement for the home-location picker. */
 export interface GeocodeResult {
-  /** Rounded coarse latitude (2 dp — ~1 km, the privacy floor). */
+  /** Rounded coarse latitude (1 dp, about 11 km, the privacy floor). */
   lat: number;
   /** Rounded coarse longitude (2 dp). */
   lon: number;
@@ -68,9 +68,16 @@ export interface DailyEnvironmentObservation {
   weatherCode: number | null;
 }
 
-/** Round a coordinate to 2 decimals (~1 km) — the coarse-location privacy floor. */
+/**
+ * Round a coordinate to 1 decimal, the coarse-location privacy floor: about
+ * 11 km north-south and 7 km east-west at 50° N, the size of a town or a
+ * city district rather than a street. The weather reanalysis behind the
+ * archive is gridded at 9 to 25 km, so a finer value buys no better weather.
+ * Every stored coordinate of this module goes through here (v1.39.4; it was
+ * 2 decimals, about 1 km, before).
+ */
 export function roundCoarse(value: number): number {
-  return Math.round(value * 100) / 100;
+  return Math.round(value * 10) / 10;
 }
 
 function firstNumber(value: unknown): number | null {

src/lib/environment/service.ts

@@ -24,6 +24,7 @@
 import { prisma } from "@/lib/db";
 import {
   fetchDailyEnvironment,
+  roundCoarse,
   type DailyEnvironmentObservation,
 } from "@/lib/environment/open-meteo";
 import type { EnvironmentLocationSource } from "@/generated/prisma/client";
@@ -256,8 +257,10 @@ function buildUpsert(
   obs: DailyEnvironmentObservation,
 ) {
   const data = {
-    lat: loc.lat,
-    lon: loc.lon,
+    // Already coarse at the source; rounded again so a per-day row never holds
+    // more precision than the privacy floor, whatever resolved it.
+    lat: roundCoarse(loc.lat),
+    lon: roundCoarse(loc.lon),
     locationLabel: loc.label,
     source: loc.source,
     tempMin: obs.tempMin,

src/lib/export/environment-backup.ts

@@ -60,6 +60,7 @@
  */
 import type { Prisma, PrismaClient } from "@/generated/prisma/client";
 import type { EnvironmentLocationSource } from "@/generated/prisma/client";
+import { roundCoarse } from "@/lib/environment/open-meteo";
 
 /** One day's environmental observation, at the location resolved for that day. */
 export interface EnvironmentContextBackupEntry {
@@ -312,8 +313,10 @@ export async function restoreEnvironmentData(
         // neither bound goes near a `Date`.
         startDate: entry.startDate,
         endDate: entry.endDate,
-        lat: entry.lat,
-        lon: entry.lon,
+        // A file written before v1.39.4 carries 2-decimal coordinates; they
+        // come back at today's privacy floor.
+        lat: roundCoarse(entry.lat),
+        lon: roundCoarse(entry.lon),
         label: entry.label,
         ...(entry.createdAt ? { createdAt: new Date(entry.createdAt) } : {}),
         ...(entry.updatedAt ? { updatedAt: new Date(entry.updatedAt) } : {}),
@@ -326,8 +329,8 @@ export async function restoreEnvironmentData(
       data: payload.environmentContexts.map((entry) => ({
         userId: ownerId,
         date: entry.date,
-        lat: entry.lat,
-        lon: entry.lon,
+        lat: roundCoarse(entry.lat),
+        lon: roundCoarse(entry.lon),
         locationLabel: entry.locationLabel,
         source: entry.source,
         tempMin: entry.tempMin ?? null,

src/lib/export/visits-backup.ts

@@ -41,6 +41,8 @@ import type {
   Laterality,
 } from "@/generated/prisma/client";
 
+import { encryptNote } from "@/lib/crypto/note-cipher";
+import { readPractitionerContact } from "@/lib/practitioners/dto";
 import {
   recordUnknownKeys,
   type RestoreSkipLog,
@@ -58,8 +60,17 @@ export interface PractitionerBackupEntry {
   name: string;
   specialty: string | null;
   practice: string | null;
+  /**
+   * v1.39.4 — the address and phone number are encrypted at rest. A portable
+   * export carries them readable here; a disaster-recovery payload leaves
+   * these null and carries the ciphertext in the two fields below.
+   */
   location: string | null;
   phone: string | null;
+  /** Base64 ciphertext of the address, disaster-recovery payloads only. */
+  locationEncrypted?: string | null;
+  /** Base64 ciphertext of the phone number, disaster-recovery payloads only. */
+  phoneEncrypted?: string | null;
   /** Base64 ciphertext, carried verbatim — never decrypted into the file. */
   noteEncrypted: string | null;
   createdAt: string;
@@ -134,6 +145,8 @@ const PRACTITIONER_BACKUP_SELECT = {
   practice: true,
   location: true,
   phone: true,
+  locationEncrypted: true,
+  phoneEncrypted: true,
   noteEncrypted: true,
   createdAt: true,
   updatedAt: true,
@@ -236,8 +249,32 @@ export async function buildVisitsBackupSection(
       name: row.name,
       specialty: row.specialty,
       practice: row.practice,
-      location: row.location,
-      phone: row.phone,
+      // v1.39.4 — a disaster-recovery file carries the contact fields as
+      // ciphertext only, sealing a row the backfill has not reached yet on
+      // the way out; a portable export carries them readable.
+      ...(disasterRecovery
+        ? {
+            location: null,
+            phone: null,
+            locationEncrypted: encodeCiphertext(
+              row.locationEncrypted ?? encryptNote(row.location),
+            ),
+            phoneEncrypted: encodeCiphertext(
+              row.phoneEncrypted ?? encryptNote(row.phone),
+            ),
+          }
+        : {
+            location: readPractitionerContact(
+              row.locationEncrypted,
+              row.location,
+              "location",
+            ),
+            phone: readPractitionerContact(
+              row.phoneEncrypted,
+              row.phone,
+              "phone",
+            ),
+          }),
       noteEncrypted: encodeCiphertext(row.noteEncrypted),
       createdAt: row.createdAt.toISOString(),
       updatedAt: row.updatedAt.toISOString(),
@@ -336,7 +373,13 @@ export type RestoredPractitioner = Pick<
   OptionalNullable<
     Pick<
       PractitionerBackupEntry,
-      "specialty" | "practice" | "location" | "phone" | "noteEncrypted"
+      | "specialty"
+      | "practice"
+      | "location"
+      | "phone"
+      | "locationEncrypted"
+      | "phoneEncrypted"
+      | "noteEncrypted"
     >
   > & { deletedAt?: string | null };
 
@@ -405,8 +448,17 @@ export async function restoreVisitsData(
         name: entry.name,
         specialty: entry.specialty ?? null,
         practice: entry.practice ?? null,
-        location: entry.location ?? null,
-        phone: entry.phone ?? null,
+        // v1.39.4 — ciphertext wins when a disaster-recovery file carried it;
+        // a portable file's (or an older file's) readable value is sealed
+        // under this instance's key. The readable columns are never written.
+        locationEncrypted:
+          entry.locationEncrypted != null
+            ? decodeCiphertext(entry.locationEncrypted)
+            : encryptNote(entry.location),
+        phoneEncrypted:
+          entry.phoneEncrypted != null
+            ? decodeCiphertext(entry.phoneEncrypted)
+            : encryptNote(entry.phone),
         noteEncrypted:
           entry.noteEncrypted == null
             ? null

src/lib/jobs/__tests__/free-text-encryption-backfill.test.ts

@@ -1,6 +1,10 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { readNote } from "@/lib/crypto/note-cipher";
 import { encryptToBytes } from "@/lib/ai/coach/bytes-codec";
+import {
+  decryptRouteGeometry,
+  encryptRouteGeometry,
+} from "@/lib/workouts/route-geometry-cipher";
 
 // ── in-memory store backing a minimal prisma mock ──────────────────────────
 interface ConversationRow {
@@ -15,10 +19,27 @@ interface EntryRow {
   note: string | null;
   noteEncrypted: Uint8Array | null;
 }
+interface PractitionerRow {
+  id: string;
+  userId: string;
+  phone: string | null;
+  location: string | null;
+  phoneEncrypted: Uint8Array | null;
+  locationEncrypted: Uint8Array | null;
+}
+interface RouteRow {
+  id: string;
+  /** The owning workout's user; the real table reaches it through the join. */
+  userId: string;
+  geometry: unknown;
+  geometryEncrypted: Uint8Array | null;
+}
 
 const store = vi.hoisted(() => ({
   conversations: [] as ConversationRow[],
   entries: [] as EntryRow[],
+  practitioners: [] as PractitionerRow[],
+  routes: [] as RouteRow[],
 }));
 
 vi.mock("@/lib/jobs/boss-instance", () => ({ getGlobalBoss: () => null }));
@@ -27,27 +48,46 @@ vi.mock("@/lib/logging/context", () => ({ annotate: vi.fn() }));
 vi.mock("@/lib/db", () => {
   function delegate<R extends { id: string; userId: string }>(
     rows: () => R[],
-    readable: keyof R,
+    readable: Array<keyof R>,
   ) {
     return {
-      // The handler pages on `{ userId, <readable>: { not: null } }`.
-      findMany: async (args: { where: { userId: string }; take: number }) =>
-        rows()
-          .filter((r) => r.userId === args.where.userId && r[readable] !== null)
+      // The handler pages on the owner plus "a readable column is set": the
+      // user id directly, or through the workout for a route.
+      findMany: async (args: {
+        where: { userId?: string; workout?: { userId: string } };
+        take: number;
+      }) => {
+        const userId = args.where.userId ?? args.where.workout?.userId;
+        return rows()
+          .filter(
+            (r) => r.userId === userId && readable.some((k) => r[k] !== null),
+          )
           .slice(0, args.take)
-          .map((r) => ({ id: r.id })),
+          .map((r) => ({ id: r.id }));
+      },
       findUnique: async (args: { where: { id: string } }) =>
         rows().find((x) => x.id === args.where.id) ?? null,
       update: async (args: { where: { id: string }; data: Partial<R> }) => {
         const r = rows().find((x) => x.id === args.where.id)!;
-        Object.assign(r, args.data);
+        // Prisma's DbNull sentinel stores SQL NULL.
+        const data = Object.fromEntries(
+          Object.entries(args.data).map(([k, v]) => [
+            k,
+            v !== null && typeof v === "object" && !(v instanceof Uint8Array)
+              ? null
+              : v,
+          ]),
+        );
+        Object.assign(r, data);
         return r;
       },
     };
   }
   const delegates = {
-    coachConversation: delegate(() => store.conversations, "title"),
-    customMetricEntry: delegate(() => store.entries, "note"),
+    coachConversation: delegate(() => store.conversations, ["title"]),
+    customMetricEntry: delegate(() => store.entries, ["note"]),
+    practitioner: delegate(() => store.practitioners, ["phone", "location"]),
+    workoutRoute: delegate(() => store.routes, ["geometry"]),
   };
   return {
     prisma: {
@@ -61,6 +101,13 @@ vi.mock("@/lib/db", () => {
 import { runFreeTextEncryptionBackfillForUser } from "@/lib/jobs/free-text-encryption-backfill";
 
 const KEY = "a".repeat(64);
+const TRACK = {
+  type: "LineString",
+  coordinates: [
+    [13.4012, 52.5201],
+    [13.4051, 52.5233],
+  ],
+};
 
 beforeEach(() => {
   vi.stubEnv("ENCRYPTION_KEYS", "");
@@ -94,6 +141,52 @@ beforeEach(() => {
     { id: "e3", userId: "u1", note: "", noteEncrypted: null },
     { id: "e4", userId: "u2", note: "other user", noteEncrypted: null },
   ];
+  store.practitioners = [
+    {
+      id: "p1",
+      userId: "u1",
+      phone: "+49 30 1234567",
+      location: "Hauptstr. 1, Berlin",
+      phoneEncrypted: null,
+      locationEncrypted: null,
+    },
+    // Only an address: the phone ciphertext column stays as it was.
+    {
+      id: "p2",
+      userId: "u1",
+      phone: null,
+      location: "Am Markt 3",
+      phoneEncrypted: null,
+      locationEncrypted: null,
+    },
+    // Already sealed, nothing readable.
+    {
+      id: "p3",
+      userId: "u1",
+      phone: null,
+      location: null,
+      phoneEncrypted: encryptToBytes("+49 40 7654321"),
+      locationEncrypted: null,
+    },
+    {
+      id: "p4",
+      userId: "u2",
+      phone: "other user",
+      location: null,
+      phoneEncrypted: null,
+      locationEncrypted: null,
+    },
+  ];
+  store.routes = [
+    { id: "r1", userId: "u1", geometry: TRACK, geometryEncrypted: null },
+    {
+      id: "r2",
+      userId: "u1",
+      geometry: null,
+      geometryEncrypted: encryptRouteGeometry(TRACK),
+    },
+    { id: "r3", userId: "u2", geometry: TRACK, geometryEncrypted: null },
+  ];
 });
 
 afterEach(() => {
@@ -107,6 +200,8 @@ describe("runFreeTextEncryptionBackfillForUser", () => {
     expect(summary).toEqual({
       conversationTitlesMigrated: 1,
       metricNotesMigrated: 2,
+      practitionerContactsMigrated: 2,
+      routeGeometriesMigrated: 1,
     });
 
     const c1 = store.conversations.find((r) => r.id === "c1")!;
@@ -157,6 +252,43 @@ describe("runFreeTextEncryptionBackfillForUser", () => {
     });
   });
 
+  it("seals practitioner phone numbers and addresses and nulls the readable columns", async () => {
+    await runFreeTextEncryptionBackfillForUser("u1");
+    const p1 = store.practitioners.find((r) => r.id === "p1")!;
+    expect(p1).toMatchObject({ phone: null, location: null });
+    expect(readNote(p1.phoneEncrypted, null)).toBe("+49 30 1234567");
+    expect(readNote(p1.locationEncrypted, null)).toBe("Hauptstr. 1, Berlin");
+    const p2 = store.practitioners.find((r) => r.id === "p2")!;
+    expect(p2.location).toBeNull();
+    expect(p2.phoneEncrypted).toBeNull();
+    expect(readNote(p2.locationEncrypted, null)).toBe("Am Markt 3");
+    const p3Before = store.practitioners.find(
+      (r) => r.id === "p3",
+    )!.phoneEncrypted;
+    expect(store.practitioners.find((r) => r.id === "p3")!.phoneEncrypted).toBe(
+      p3Before,
+    );
+    expect(store.practitioners.find((r) => r.id === "p4")).toMatchObject({
+      phone: "other user",
+      phoneEncrypted: null,
+    });
+  });
+
+  it("seals workout GPS tracks through the workout's owner and nulls the readable column", async () => {
+    const r2Before = store.routes.find((r) => r.id === "r2")!.geometryEncrypted;
+    await runFreeTextEncryptionBackfillForUser("u1");
+    const r1 = store.routes.find((r) => r.id === "r1")!;
+    expect(r1.geometry).toBeNull();
+    expect(decryptRouteGeometry(r1.geometryEncrypted!)).toEqual(TRACK);
+    expect(store.routes.find((r) => r.id === "r2")!.geometryEncrypted).toBe(
+      r2Before,
+    );
+    expect(store.routes.find((r) => r.id === "r3")).toMatchObject({
+      geometry: TRACK,
+      geometryEncrypted: null,
+    });
+  });
+
   it("is idempotent: a second run changes nothing", async () => {
     await runFreeTextEncryptionBackfillForUser("u1");
     const sealed = store.conversations.find(
@@ -166,6 +298,8 @@ describe("runFreeTextEncryptionBackfillForUser", () => {
     expect(second).toEqual({
       conversationTitlesMigrated: 0,
       metricNotesMigrated: 0,
+      practitionerContactsMigrated: 0,
+      routeGeometriesMigrated: 0,
     });
     expect(store.conversations.find((r) => r.id === "c1")!.titleEncrypted).toBe(
       sealed,

src/lib/jobs/free-text-encryption-backfill.ts

@@ -5,6 +5,14 @@
  * first Coach message, or a rename) and
  * `CustomMetricEntry.note` -> `noteEncrypted`.
  *
+ * v1.39.4 extends the same pass to three more columns that are not free text
+ * in the narrow sense but just as personal:
+ * `Practitioner.phone` -> `phoneEncrypted`,
+ * `Practitioner.location` -> `locationEncrypted` (the address book of doctors
+ * and practices), and `WorkoutRoute.geometry` -> `geometryEncrypted` (the GPS
+ * track of an outdoor workout, sealed as one binary value). A route row has no
+ * user id of its own; it is found through its workout.
+ *
  * Modelled on `med-notes-encryption-backfill.ts`: a discovery query enqueues
  * one job per user still holding an un-migrated row, the per-user handler walks
  * that user's rows, and the pass is idempotent across reboots — once a row is
@@ -29,7 +37,7 @@
  *
  * The readable columns are NOT dropped in this release. That is a follow-up
  * release, once this backfill reports zero remaining rows on every instance;
- * both columns carry the marker in `schema.prisma`.
+ * every one of them carries the marker in `schema.prisma`.
  *
  * Boot discovery is staggered past the startup storm (`startAfter`), like the
  * other boot backfills; the daily discovery tick passes no offset.
@@ -38,11 +46,13 @@
  * (`src/lib/jobs/reminder/register-maintenance.ts`) so pg-boss provisions it at
  * boot; an unregistered queue silently never drains.
  */
+import { Prisma } from "@/generated/prisma/client";
 import { prisma } from "@/lib/db";
 import { annotate } from "@/lib/logging/context";
 import { getGlobalBoss } from "@/lib/jobs/boss-instance";
 import { encryptToBytes } from "@/lib/ai/coach/bytes-codec";
 import { encryptNote } from "@/lib/crypto/note-cipher";
+import { encryptRouteGeometry } from "@/lib/workouts/route-geometry-cipher";
 
 export const FREE_TEXT_ENCRYPTION_BACKFILL_QUEUE =
   "free-text-encryption-backfill";
@@ -62,6 +72,10 @@ export interface FreeTextEncryptionBackfillPayload {
 export interface FreeTextEncryptionBackfillSummary {
   conversationTitlesMigrated: number;
   metricNotesMigrated: number;
+  /** v1.39.4 — practitioners whose phone and/or address were sealed. */
+  practitionerContactsMigrated: number;
+  /** v1.39.4 — workout GPS tracks sealed. */
+  routeGeometriesMigrated: number;
 }
 
 /**
@@ -105,6 +119,85 @@ async function migrateMetricNote(id: string): Promise<boolean> {
   });
 }
 
+/**
+ * Migrate one practitioner's readable phone number and address into their
+ * ciphertext columns and null the readable ones, atomically and idempotently.
+ * A field that is already NULL keeps whatever ciphertext it has.
+ */
+async function migratePractitionerContact(id: string): Promise<boolean> {
+  return prisma.$transaction(async (tx) => {
+    const fresh = await tx.practitioner.findUnique({
+      where: { id },
+      select: { phone: true, location: true },
+    });
+    if (!fresh || (fresh.phone === null && fresh.location === null)) {
+      return false;
+    }
+    await tx.practitioner.update({
+      where: { id },
+      data: {
+        ...(fresh.phone !== null
+          ? { phoneEncrypted: encryptNote(fresh.phone), phone: null }
+          : {}),
+        ...(fresh.location !== null
+          ? { locationEncrypted: encryptNote(fresh.location), location: null }
+          : {}),
+      },
+    });
+    return true;
+  });
+}
+
+/**
+ * Migrate one workout's readable GPS track into `geometryEncrypted` and null
+ * the readable column, atomically and idempotently.
+ */
+async function migrateRouteGeometry(id: string): Promise<boolean> {
+  return prisma.$transaction(async (tx) => {
+    const fresh = await tx.workoutRoute.findUnique({
+      where: { id },
+      select: { geometry: true },
+    });
+    if (!fresh || fresh.geometry === null) return false;
+    await tx.workoutRoute.update({
+      where: { id },
+      data: {
+        geometryEncrypted: encryptRouteGeometry(fresh.geometry),
+        geometry: Prisma.DbNull,
+      },
+    });
+    return true;
+  });
+}
+
+/**
+ * Walk one kind of row page by page, migrating each. `page` returns the ids
+ * still holding a readable value; each migration clears it, so a migrated row
+ * drops out of the next page. A page where nothing moved (every row taken by
+ * a racing worker) ends the loop, so it always terminates.
+ */
+async function drain(
+  page: () => Promise<{ id: string }[]>,
+  migrate: (id: string) => Promise<boolean>,
+  once: (id: string) => void,
+): Promise<number> {
+  let migrated = 0;
+  for (;;) {
+    const rows = await page();
+    if (rows.length === 0) break;
+    let migratedThisPage = 0;
+    for (const { id } of rows) {
+      once(id);
+      if (await migrate(id)) {
+        migrated += 1;
+        migratedThisPage += 1;
+      }
+    }
+    if (migratedThisPage === 0) break;
+  }
+  return migrated;
+}
+
 /**
  * Per-user queue handler. Walks every un-migrated title and note of one
  * account and migrates each in its own transaction. Safe to re-run.
@@ -112,8 +205,6 @@ async function migrateMetricNote(id: string): Promise<boolean> {
 export async function runFreeTextEncryptionBackfillForUser(
   userId: string,
 ): Promise<FreeTextEncryptionBackfillSummary> {
-  let conversationTitlesMigrated = 0;
-  let metricNotesMigrated = 0;
   // Every row this pass has sealed. A row that comes back on a later page was
   // not cleared, so the pass would never converge; it stops loudly instead of
   // re-sealing the same rows forever.
@@ -127,45 +218,51 @@ export async function runFreeTextEncryptionBackfillForUser(
     sealed.add(id);
   };
 
-  // Each migration nulls the readable column, so a migrated row drops out of
-  // the next `IS NOT NULL` page.
-  for (;;) {
-    const rows = await prisma.coachConversation.findMany({
-      where: { userId, title: { not: null } },
-      select: { id: true },
-      take: PAGE_SIZE,
-    });
-    if (rows.length === 0) break;
-    let migratedThisPage = 0;
-    for (const { id } of rows) {
-      once(id);
-      if (await migrateConversationTitle(id)) {
-        conversationTitlesMigrated += 1;
-        migratedThisPage += 1;
-      }
-    }
-    // A page where nothing moved (every row taken by a racing worker) ends
-    // the loop, so it always terminates.
-    if (migratedThisPage === 0) break;
-  }
-
-  for (;;) {
-    const rows = await prisma.customMetricEntry.findMany({
-      where: { userId, note: { not: null } },
-      select: { id: true },
-      take: PAGE_SIZE,
-    });
-    if (rows.length === 0) break;
-    let migratedThisPage = 0;
-    for (const { id } of rows) {
-      once(id);
-      if (await migrateMetricNote(id)) {
-        metricNotesMigrated += 1;
-        migratedThisPage += 1;
-      }
-    }
-    if (migratedThisPage === 0) break;
-  }
+  const conversationTitlesMigrated = await drain(
+    () =>
+      prisma.coachConversation.findMany({
+        where: { userId, title: { not: null } },
+        select: { id: true },
+        take: PAGE_SIZE,
+      }),
+    migrateConversationTitle,
+    once,
+  );
+  const metricNotesMigrated = await drain(
+    () =>
+      prisma.customMetricEntry.findMany({
+        where: { userId, note: { not: null } },
+        select: { id: true },
+        take: PAGE_SIZE,
+      }),
+    migrateMetricNote,
+    once,
+  );
+  const practitionerContactsMigrated = await drain(
+    () =>
+      prisma.practitioner.findMany({
+        where: {
+          userId,
+          OR: [{ phone: { not: null } }, { location: { not: null } }],
+        },
+        select: { id: true },
+        take: PAGE_SIZE,
+      }),
+    migratePractitionerContact,
+    once,
+  );
+  // A track is the one large value here. The page holds ids only; each track
+  // is read inside its own transaction, so no more than one is in memory.
+  const routeGeometriesMigrated = await drain(
+    () =>
+      prisma.workoutRoute.findMany({
+        where: { workout: { userId }, geometry: { not: Prisma.DbNull } },
+        select: { id: true },
+        take: PAGE_SIZE,
+      }),
+    migrateRouteGeometry,
+    once,
+  );
 
   annotate({
     action: {
@@ -173,17 +270,24 @@ export async function runFreeTextEncryptionBackfillForUser(
       details: {
         conversation_titles_migrated: conversationTitlesMigrated,
         metric_notes_migrated: metricNotesMigrated,
+        practitioner_contacts_migrated: practitionerContactsMigrated,
+        route_geometries_migrated: routeGeometriesMigrated,
       },
     },
   });
 
-  return { conversationTitlesMigrated, metricNotesMigrated };
+  return {
+    conversationTitlesMigrated,
+    metricNotesMigrated,
+    practitionerContactsMigrated,
+    routeGeometriesMigrated,
+  };
 }
 
 /**
- * Discovery. Finds every user still holding a readable title or note and
- * enqueues one backfill job per account. The 0357 partial indexes match both
- * predicates, so the scan is index-only and converges to empty. pg-boss
+ * Discovery. Finds every user still holding a readable value in any of the
+ * columns above and enqueues one backfill job per account. The 0357 and 0361
+ * partial indexes match the predicates, so the scan is index-only and converges to empty. pg-boss
  * `singletonKey` coalesces duplicate sends. Best-effort: errors come back
  * through the result value so worker boot never fails on a miss.
  */
@@ -197,18 +301,26 @@ export async function enqueueBootTimeFreeTextEncryptionBackfill(
   }
 
   try {
-    const [titleUsers, noteUsers] = await Promise.all([
+    const found = await Promise.all([
       prisma.$queryRaw<{ user_id: string }[]>`
         SELECT DISTINCT user_id FROM coach_conversations
         WHERE title IS NOT NULL`,
       prisma.$queryRaw<{ user_id: string }[]>`
         SELECT DISTINCT user_id FROM custom_metric_entries
         WHERE note IS NOT NULL`,
+      prisma.$queryRaw<{ user_id: string }[]>`
+        SELECT DISTINCT user_id FROM practitioners
+        WHERE phone IS NOT NULL OR location IS NOT NULL`,
+      prisma.$queryRaw<{ user_id: string }[]>`
+        SELECT DISTINCT w.user_id FROM workout_routes r
+        JOIN workouts w ON w.id = r.workout_id
+        WHERE r.geometry IS NOT NULL`,
     ]);
 
     const userIds = new Set<string>();
-    for (const { user_id } of titleUsers) userIds.add(user_id);
-    for (const { user_id } of noteUsers) userIds.add(user_id);
+    for (const rows of found) {
+      for (const { user_id } of rows) userIds.add(user_id);
+    }
 
     let enqueued = 0;
     let skipped = 0;

src/lib/jobs/job-outcome.ts

@@ -158,6 +158,7 @@ export const JOB_FACT_ALLOWLIST: ReadonlySet<string> = new Set([
   "per_sample_rows_soft_deleted",
   "persisted",
   "plan_reviews_minted",
+  "practitioner_contacts_migrated",
   "pr_detection_inserted",
   "pr_detection_jobs",
   "pr_detection_ties",
@@ -192,6 +193,7 @@ export const JOB_FACT_ALLOWLIST: ReadonlySet<string> = new Set([
   "retried",
   "reviewed",
   "rollup_failed",
+  "route_geometries_migrated",
   "rotate_dropped",
   "rotate_errors",
   "rotate_rotated",

src/lib/jobs/reminder/register-maintenance.ts

@@ -355,7 +355,8 @@ const MED_NOTES_ENCRYPTION_BACKFILL_CRON = "5 4 * * *";
 // past the startup storm) enqueues one per-user job; a daily 04:07
 // Europe/Berlin discovery tick re-fans for rows written by a previous-release
 // process after the upgrade. Two minutes after the medication-note tick so the
-// two do not share a poll.
+// two do not share a poll. v1.39.4 adds the practitioner phone + address and
+// the workout GPS track to the same pass.
 const FREE_TEXT_ENCRYPTION_BACKFILL_CRON = "7 4 * * *";
 
 const allQueues = [
@@ -687,7 +688,7 @@ const queuePolicies: QueuePolicyTable = {
   [FREE_TEXT_ENCRYPTION_BACKFILL_QUEUE]: {
     policy: "exclusive",
     reason:
-      "Per-user Coach title + custom-metric note encryption backfill; discovery drops the user once no readable value remains.",
+      "Per-user encryption backfill (Coach title, custom-metric note, practitioner phone + address, workout GPS track); discovery drops the user once no readable value remains.",
   },
   [DOCUMENT_THUMBNAIL_BACKFILL_QUEUE]: {
     policy: "exclusive",
@@ -1246,6 +1247,8 @@ export async function registerMaintenanceQueues(
       let discoveryFailed = 0;
       let titles = 0;
       let notes = 0;
+      let contacts = 0;
+      let routes = 0;
       for (const job of jobs) {
         const { userId } = job.data;
         if (!userId) {
@@ -1260,14 +1263,20 @@ export async function registerMaintenanceQueues(
           continue;
         }
         try {
-          const { conversationTitlesMigrated, metricNotesMigrated } =
-            await runFreeTextEncryptionBackfillForUser(userId);
+          const {
+            conversationTitlesMigrated,
+            metricNotesMigrated,
+            practitionerContactsMigrated,
+            routeGeometriesMigrated,
+          } = await runFreeTextEncryptionBackfillForUser(userId);
           users++;
           titles += conversationTitlesMigrated;
           notes += metricNotesMigrated;
+          contacts += practitionerContactsMigrated;
+          routes += routeGeometriesMigrated;
           workerLog(
             "info",
-            `[free-text-encryption-backfill] user=${userId} titles=${conversationTitlesMigrated} notes=${metricNotesMigrated}`,
+            `[free-text-encryption-backfill] user=${userId} titles=${conversationTitlesMigrated} notes=${metricNotesMigrated} contacts=${practitionerContactsMigrated} routes=${routeGeometriesMigrated}`,
           );
         } catch (err) {
           recordError();
@@ -1287,6 +1296,8 @@ export async function registerMaintenanceQueues(
         discovery_failed: discoveryFailed,
         conversation_titles_migrated: titles,
         metric_notes_migrated: notes,
+        practitioner_contacts_migrated: contacts,
+        route_geometries_migrated: routes,
       });
     },
   );

src/lib/jobs/workout-insight-generate.ts

@@ -67,6 +67,7 @@ import {
   meetsDurationFloor,
   workoutInsightInputHash,
 } from "@/lib/workouts/insight-gates";
+import { readRouteGeometry } from "@/lib/workouts/route-geometry-cipher";
 import { getAgeFromDateOfBirth } from "@/lib/analytics/pulse-targets";
 import {
   computeZones,
@@ -245,7 +246,7 @@ export async function runWorkoutInsightGenerate(
       minHeartRate: true,
       elevationM: true,
       metadata: true,
-      route: { select: { geometry: true } },
+      route: { select: { geometry: true, geometryEncrypted: true } },
       samples: { select: { samples: true } },
     },
   });
@@ -372,7 +373,9 @@ export async function runWorkoutInsightGenerate(
       tz,
       hrSeries,
       zones,
-      routeGeometry: row.route?.geometry ?? null,
+      // Opened in memory only to derive metres climbed; the track itself
+      // never reaches the prompt.
+      routeGeometry: row.route ? readRouteGeometry(row.route) : null,
       history,
     });
     const inputHash = workoutInsightInputHash(

src/lib/openapi/routes/environment.ts

@@ -11,7 +11,7 @@
  * the `environment` module off, every one of the six paths answers 403
  * `module.disabled` before it does anything else.
  *
- * Coordinates are rounded to ~city granularity (2 dp) on the way in, as a
+ * Coordinates are rounded to 1 decimal (about 11 km) on the way in, as a
  * floor under whatever precision a client sends. That rounding is why the
  * geocode results and the stored home read back coarser than they were
  * picked.
@@ -58,8 +58,10 @@ const geocodeQuery = geocodeQuerySchema.meta({
 
 const environmentHome = z
   .object({
-    lat: z.number().describe("Coarse latitude, rounded to 2 dp (~1 km)."),
-    lon: z.number().describe("Coarse longitude, rounded to 2 dp."),
+    lat: z
+      .number()
+      .describe("Coarse latitude, rounded to 1 decimal (about 11 km)."),
+    lon: z.number().describe("Coarse longitude, rounded to 1 decimal."),
     label: z.string().nullable(),
     timezone: z
       .string()
@@ -142,8 +144,8 @@ const environmentOverview = z
 
 const geocodeResult = z
   .object({
-    lat: z.number().describe("Coarse latitude, rounded to 2 dp."),
-    lon: z.number().describe("Coarse longitude, rounded to 2 dp."),
+    lat: z.number().describe("Coarse latitude, rounded to 1 decimal."),
+    lon: z.number().describe("Coarse longitude, rounded to 1 decimal."),
     label: z
       .string()
       .describe(
@@ -186,7 +188,7 @@ export const environmentPaths: NonNullable<ZodOpenApiObject["paths"]> = {
       tags: ["Environment"],
       summary: "Set the coarse home location",
       description:
-        "Stores the picked city and stamps the effective-from instant. Coordinates are rounded to 2 dp server-side regardless of what was sent.\n\nRe-stamping is the part worth knowing: EVERY write moves `since` to now, including one that changes only the label. Days before the new `since` stop resolving against this home, so a correction to an existing home un-attributes the history that home used to cover.\n\nOn success a lookback fetch is enqueued so recent days populate without waiting for the nightly tick. That enqueue is best-effort — it no-ops cleanly when no worker is bound and the response is a 200 either way.\n\nBody cap 4 KiB. Module-gated.",
+        "Stores the picked city and stamps the effective-from instant. Coordinates are rounded to 1 decimal (about 11 km) server-side regardless of what was sent.\n\nRe-stamping is the part worth knowing: EVERY write moves `since` to now, including one that changes only the label. Days before the new `since` stop resolving against this home, so a correction to an existing home un-attributes the history that home used to cover.\n\nOn success a lookback fetch is enqueued so recent days populate without waiting for the nightly tick. That enqueue is best-effort — it no-ops cleanly when no worker is bound and the response is a 200 either way.\n\nBody cap 4 KiB. Module-gated.",
       requestBody: {
         required: true,
         content: { "application/json": { schema: homeLocationRequest } },
@@ -309,7 +311,7 @@ export const environmentPaths: NonNullable<ZodOpenApiObject["paths"]> = {
       tags: ["Environment"],
       summary: "Add a travel override",
       description:
-        "Declares that the account was somewhere other than home for an inclusive date range; the days it covers resolve against this location instead. Coordinates are rounded to 2 dp server-side.\n\nAdding one enqueues a refresh over exactly the declared window so its days re-resolve. Nothing checks for overlap with an existing override — two ranges covering the same day are accepted, and the worker picks between them.\n\nBody cap 4 KiB. Module-gated.",
+        "Declares that the account was somewhere other than home for an inclusive date range; the days it covers resolve against this location instead. Coordinates are rounded to 1 decimal (about 11 km) server-side.\n\nAdding one enqueues a refresh over exactly the declared window so its days re-resolve. Nothing checks for overlap with an existing override — two ranges covering the same day are accepted, and the worker picks between them.\n\nBody cap 4 KiB. Module-gated.",
       requestBody: {
         required: true,
         content: { "application/json": { schema: travelLocationRequest } },

src/lib/practitioners/dto.ts

@@ -5,6 +5,13 @@
  * them. The free-text note lives in `noteEncrypted` (Bytes) and is decrypted
  * fail-soft on read, so a key-rotation gap on one row reads as a missing note
  * rather than 500-ing the address book.
+ *
+ * v1.39.4 — the phone number and the address follow the note into Bytes
+ * ciphertext (`phoneEncrypted`, `locationEncrypted`). They read the same way,
+ * with one addition: a row the boot-time backfill has not reached yet still
+ * holds them in the readable columns, which are read only when there is no
+ * ciphertext. A ciphertext that does not open reads as absent, never as the
+ * readable column.
  */
 import { decryptFromBytes } from "@/lib/ai/coach/bytes-codec";
 import { getEvent } from "@/lib/logging/context";
@@ -39,14 +46,40 @@ export function decryptPractitionerNote(
   }
 }
 
+/**
+ * A contact field (phone, address): the ciphertext when the row has one, the
+ * legacy readable column otherwise. Fail-soft on the ciphertext, like the note.
+ */
+export function readPractitionerContact(
+  ciphertext: Uint8Array | null,
+  legacy: string | null,
+  field: "phone" | "location",
+): string | null {
+  if (!ciphertext || ciphertext.byteLength === 0) return legacy;
+  try {
+    return decryptFromBytes(ciphertext);
+  } catch (err) {
+    getEvent()?.addWarning(
+      `practitioner ${field} decrypt failed: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    );
+    return null;
+  }
+}
+
 export function toPractitionerDTO(row: Practitioner): PractitionerDTO {
   return {
     id: row.id,
     name: row.name,
     specialty: row.specialty,
     practice: row.practice,
-    location: row.location,
-    phone: row.phone,
+    location: readPractitionerContact(
+      row.locationEncrypted,
+      row.location,
+      "location",
+    ),
+    phone: readPractitionerContact(row.phoneEncrypted, row.phone, "phone"),
     note: decryptPractitionerNote(row.noteEncrypted),
     createdAt: row.createdAt.toISOString(),
     updatedAt: row.updatedAt.toISOString(),

src/lib/validations/backup.ts

@@ -1109,6 +1109,9 @@ const practitionerBackupSchema = z
     practice: z.string().nullable().optional(),
     location: z.string().nullable().optional(),
     phone: z.string().nullable().optional(),
+    /// v1.39.4 — the address and phone ciphertext, DR payloads only.
+    locationEncrypted: base64BytesSchema.nullable().optional(),
+    phoneEncrypted: base64BytesSchema.nullable().optional(),
     noteEncrypted: base64BytesSchema.nullable().optional(),
     createdAt: isoDateTime,
     updatedAt: isoDateTime,

src/lib/workouts/__tests__/route-geometry-cipher.test.ts

@@ -0,0 +1,66 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { Buffer } from "node:buffer";
+
+import { _resetCryptoCacheForTests, encryptBytes } from "@/lib/crypto";
+import {
+  decryptRouteGeometry,
+  encryptRouteGeometry,
+  readRouteGeometry,
+} from "../route-geometry-cipher";
+
+const TRACK = {
+  type: "LineString",
+  coordinates: [
+    [13.4012, 52.5201, 34.5],
+    [13.4051, 52.5233, 36],
+  ],
+};
+
+beforeEach(() => {
+  vi.stubEnv("ENCRYPTION_KEYS", "");
+  vi.stubEnv("ENCRYPTION_ACTIVE_KEY_ID", "");
+  vi.stubEnv("ENCRYPTION_KEY", "d".repeat(64));
+  _resetCryptoCacheForTests();
+});
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+  _resetCryptoCacheForTests();
+});
+
+describe("route geometry cipher", () => {
+  it("round-trips a track and keeps no coordinate readable in the sealed bytes", () => {
+    const sealed = encryptRouteGeometry(TRACK);
+    expect(Buffer.from(sealed).toString("latin1")).not.toContain("52.5201");
+    expect(decryptRouteGeometry(sealed)).toEqual(TRACK);
+  });
+
+  it("prefers the ciphertext, falls back to the legacy column, and is null for neither", () => {
+    const sealed = encryptRouteGeometry(TRACK);
+    expect(
+      readRouteGeometry({
+        geometry: { stale: true },
+        geometryEncrypted: sealed,
+      }),
+    ).toEqual(TRACK);
+    expect(
+      readRouteGeometry({ geometry: TRACK, geometryEncrypted: null }),
+    ).toBe(TRACK);
+    expect(readRouteGeometry({ geometry: null, geometryEncrypted: null })).toBe(
+      null,
+    );
+  });
+
+  it("does not open a value sealed for another purpose", () => {
+    const other = encryptBytes(Buffer.from(JSON.stringify(TRACK)));
+    expect(() => decryptRouteGeometry(new Uint8Array(other))).toThrow();
+  });
+
+  it("throws on a ciphertext that does not open instead of using the legacy column", () => {
+    const sealed = encryptRouteGeometry(TRACK);
+    sealed[sealed.byteLength - 1] ^= 0xff;
+    expect(() =>
+      readRouteGeometry({ geometry: TRACK, geometryEncrypted: sealed }),
+    ).toThrow();
+  });
+});

src/lib/workouts/route-geometry-cipher.ts

@@ -0,0 +1,56 @@
+/**
+ * Workout GPS track ↔ encrypted column (v1.39.4).
+ *
+ * `WorkoutRoute.geometry` held the GeoJSON LineString of every outdoor workout
+ * readable in the database, and the first and last points of most tracks are
+ * the person's front door. From v1.39.4 the track is stored in
+ * `geometryEncrypted`: the JSON text sealed as one binary AES-256-GCM value
+ * (`encryptBytes`, labelled with {@link WORKOUT_ROUTE_GEOMETRY_AAD}). The
+ * binary codec rather than the base64 string codec the notes use, because a
+ * track of 20 000 points is a blob and base64 would add a third to it.
+ *
+ * Every reader goes through {@link readRouteGeometry}: the ciphertext when a
+ * row has one, the legacy readable column for a row the boot-time backfill has
+ * not reached yet. A ciphertext that does not open throws (fail-closed), the
+ * same posture as `readNote`; it is never replaced by the readable column.
+ *
+ * The wire shape is unchanged: readers hand back the same GeoJSON object the
+ * JSONB column used to return.
+ */
+import { Buffer } from "node:buffer";
+
+import { decryptBytes, encryptBytes } from "@/lib/crypto";
+import { WORKOUT_ROUTE_GEOMETRY_AAD } from "@/lib/crypto/encrypted-columns";
+
+/** Seal a route's GeoJSON geometry for `WorkoutRoute.geometryEncrypted`. */
+export function encryptRouteGeometry(
+  geometry: unknown,
+): Uint8Array<ArrayBuffer> {
+  const sealed = encryptBytes(
+    Buffer.from(JSON.stringify(geometry), "utf8"),
+    WORKOUT_ROUTE_GEOMETRY_AAD,
+  );
+  const out = new Uint8Array(new ArrayBuffer(sealed.byteLength));
+  out.set(sealed);
+  return out;
+}
+
+/** Open a sealed route geometry. Throws on a bad key id or a tampered value. */
+export function decryptRouteGeometry(sealed: Uint8Array): unknown {
+  const plain = decryptBytes(Buffer.from(sealed), WORKOUT_ROUTE_GEOMETRY_AAD);
+  return JSON.parse(plain.toString("utf8")) as unknown;
+}
+
+/**
+ * The geometry a route row holds: the ciphertext first, the legacy readable
+ * column only when there is no ciphertext. Null when the row holds neither.
+ */
+export function readRouteGeometry(row: {
+  geometry?: unknown;
+  geometryEncrypted?: Uint8Array | null;
+}): unknown {
+  if (row.geometryEncrypted && row.geometryEncrypted.byteLength > 0) {
+    return decryptRouteGeometry(row.geometryEncrypted);
+  }
+  return row.geometry ?? null;
+}