chore(release): v1.4.27

v1.4.27 — Mobile capability and maintainer-finding cleanup.

ResponsiveSheet primitive (bottom-sheet on narrow viewports, centred dialog on desktop)
applied to BD, Weight, Glucose, Mood, Activity forms. Maintainer-finding cleanups across
Coach, Insights, Reports, Privacy. GeoLite2 offline geocoding with resilience layer
(graceful fallback when EULA not yet propagated). E2E gap-fill coverage. 450-line
release notes attached to the GitHub Release.

src/app/api/admin/audit-log/route.ts

@@ -136,6 +136,11 @@ export const GET = apiHandler(async (request: NextRequest) => {
         action: true,
         ipAddress: true,
         location: true,
+        // v1.4.27 B3 — surface the carrier chip data alongside the
+        // existing location string. Both nullable so older rows render
+        // with the same dash that `location` falls back to.
+        asn: true,
+        carrier: true,
         details: true,
         createdAt: true,
         user: {

src/app/api/admin/notifications/reminder-check/route.ts

@@ -3,7 +3,7 @@ import { apiHandler, requireAdmin } from "@/lib/api-handler";
 import { annotate, getEvent } from "@/lib/logging/context";
 import { apiSuccess } from "@/lib/api-response";
 import { parseScheduleRecurrence } from "@/lib/medication-schedule";
-import { dispatchNotification } from "@/lib/notifications/dispatcher";
+import { dispatchLocalisedNotification } from "@/lib/notifications/dispatch-localised";
 import { getUserTodayBounds, getDayOfWeekInTz } from "@/lib/timezone";
 
 export const dynamic = "force-dynamic";
@@ -138,20 +138,36 @@ export const POST = apiHandler(async () => {
         const timeWindow = `${schedule.windowStart}–${schedule.windowEnd}`;
 
         try {
+          // v1.4.27 F21 — each notification renders in the affected
+          // user's `User.locale` (the recipient is the user whose dose
+          // is overdue, not the admin running the check).
+          // `dispatchLocalisedNotification` resolves the locale from
+          // the userId inside the helper.
           if (status === "missed") {
-            await dispatchNotification({
-              eventType: "MEDICATION_REMINDER",
+            await dispatchLocalisedNotification({
               userId: med.user.id,
-              title: `Verpasst: ${med.name}`,
-              message: `<b>${med.name}</b> (${doseInfo}, ${timeWindow}) wurde als verpasst markiert.`,
+              eventType: "MEDICATION_REMINDER",
+              titleKey: "notifications.admin.reminderCheckMissedTitle",
+              messageKey: "notifications.admin.reminderCheckMissedBody",
+              params: {
+                medication: med.name,
+                dose: doseInfo,
+                window: timeWindow,
+              },
               metadata: { medicationId: med.id },
             });
           } else {
-            await dispatchNotification({
-              eventType: "MEDICATION_REMINDER",
+            await dispatchLocalisedNotification({
               userId: med.user.id,
-              title: `Erinnerung: ${med.name}`,
-              message: `Erinnerung: <b>${med.name}</b> (${doseInfo}, ${timeWindow}) wurde noch nicht eingenommen. Seit ${minutesPastEnd} Min überfällig.`,
+              eventType: "MEDICATION_REMINDER",
+              titleKey: "notifications.admin.reminderCheckOverdueTitle",
+              messageKey: "notifications.admin.reminderCheckOverdueBody",
+              params: {
+                medication: med.name,
+                dose: doseInfo,
+                window: timeWindow,
+                minutes: minutesPastEnd,
+              },
               metadata: { medicationId: med.id },
             });
           }

src/app/api/admin/notifications/test/route.ts

@@ -12,6 +12,8 @@ import type {
   ChannelType,
   NotificationPayload,
 } from "@/lib/notifications/types";
+import { defaultLocale, type Locale } from "@/lib/i18n/config";
+import { getServerTranslator } from "@/lib/i18n/server-translator";
 
 export const dynamic = "force-dynamic";
 
@@ -59,6 +61,11 @@ async function ensureTelegramChannel(userId: string): Promise<boolean> {
   return true;
 }
 
+function isLocale(value: string | null | undefined): value is Locale {
+  return value === "de" || value === "en" || value === "fr" ||
+    value === "es" || value === "it" || value === "pl";
+}
+
 export const POST = apiHandler(async () => {
   const { user } = await requireAdmin();
   annotate({ action: { name: "admin.notifications.test" } });
@@ -84,12 +91,26 @@ export const POST = apiHandler(async () => {
     });
   }
 
+  // v1.4.27 F21 — resolve the admin's persisted locale so the test
+  // notification arrives in their preferred language. The test route
+  // talks to the senders directly (not the dispatcher) because it
+  // needs per-channel success / error feedback for the UI, so we
+  // compose the payload locally rather than via
+  // `dispatchLocalisedNotification`.
+  const adminLocaleRow = await prisma.user.findUnique({
+    where: { id: user.id },
+    select: { locale: true },
+  });
+  const adminLocale: Locale = isLocale(adminLocaleRow?.locale)
+    ? adminLocaleRow.locale
+    : defaultLocale;
+  const t = getServerTranslator(adminLocale).t;
+
   const payload: NotificationPayload = {
     eventType: "SYSTEM_ALERT",
     userId: user.id,
-    title: "Test-Notification",
-    message:
-      "<b>HealthLog Test:</b> If you see this message, your notifications are working!",
+    title: t("notifications.admin.testNotificationTitle"),
+    message: t("notifications.admin.testNotificationBody"),
   };
 
   const results: Array<{

src/app/api/audit-log/route.ts

@@ -1,46 +0,0 @@
-import { prisma } from "@/lib/db";
-import { apiHandler, requireAuth } from "@/lib/api-handler";
-import { annotate } from "@/lib/logging/context";
-import { apiSuccess } from "@/lib/api-response";
-import { NextRequest } from "next/server";
-
-/**
- * Get audit log entries for the current user.
- * Query params: limit (default 50, max 200), offset (default 0)
- */
-export const GET = apiHandler(async (request: NextRequest) => {
-  const { user } = await requireAuth();
-  annotate({ action: { name: "audit-log.list" } });
-
-  const { searchParams } = new URL(request.url);
-  const limit = Math.min(
-    Math.max(1, parseInt(searchParams.get("limit") ?? "50", 10) || 50),
-    200,
-  );
-  const offset = Math.max(
-    0,
-    parseInt(searchParams.get("offset") ?? "0", 10) || 0,
-  );
-
-  const [entries, total] = await Promise.all([
-    prisma.auditLog.findMany({
-      where: { userId: user.id },
-      orderBy: { createdAt: "desc" },
-      take: limit,
-      skip: offset,
-      select: {
-        id: true,
-        action: true,
-        ipAddress: true,
-        location: true,
-        details: true,
-        createdAt: true,
-      },
-    }),
-    prisma.auditLog.count({
-      where: { userId: user.id },
-    }),
-  ]);
-
-  return apiSuccess({ entries, meta: { total, limit, offset } });
-});

src/app/api/insights/generate/__tests__/route.test.ts

@@ -77,7 +77,6 @@ vi.mock("@/lib/insights/features", () => ({
 }));
 
 vi.mock("@/lib/insights/prompt", () => ({
-  getInsightsSystemPrompt: vi.fn(() => "system"),
   buildUserPrompt: vi.fn(() => "user"),
 }));
 

src/app/api/internal/deploy-webhook/__tests__/route.test.ts

@@ -9,7 +9,7 @@ vi.mock("@/lib/api-handler", () => ({
 
 vi.mock("@/lib/db", () => ({
   prisma: {
-    user: { findMany: vi.fn() },
+    user: { findMany: vi.fn(), findUnique: vi.fn() },
   },
 }));
 
@@ -21,6 +21,14 @@ vi.mock("@/lib/notifications/dispatcher", () => ({
   dispatchNotification: vi.fn().mockResolvedValue(undefined),
 }));
 
+// v1.4.27 F21 — the deploy-webhook route now wraps every admin alert
+// in `dispatchLocalisedNotification`, which delegates to the base
+// dispatcher. Mock the localised helper so the route-level tests stay
+// hermetic and we can assert recipient-specific calls directly.
+vi.mock("@/lib/notifications/dispatch-localised", () => ({
+  dispatchLocalisedNotification: vi.fn().mockResolvedValue(undefined),
+}));
+
 vi.mock("@/lib/rate-limit", () => ({
   checkRateLimit: vi.fn(),
   rateLimitHeaders: vi.fn(() => ({})),
@@ -38,6 +46,7 @@ import { POST, GET } from "../route";
 import { prisma } from "@/lib/db";
 import { auditLog } from "@/lib/auth/audit";
 import { dispatchNotification } from "@/lib/notifications/dispatcher";
+import { dispatchLocalisedNotification } from "@/lib/notifications/dispatch-localised";
 import { checkRateLimit } from "@/lib/rate-limit";
 import { getEvent } from "@/lib/logging/context";
 
@@ -142,10 +151,11 @@ describe("POST /api/internal/deploy-webhook", () => {
         }),
       }),
     );
+    expect(dispatchLocalisedNotification).not.toHaveBeenCalled();
     expect(dispatchNotification).not.toHaveBeenCalled();
   });
 
-  it("failure payload writes system.deploy.failure audit row AND fans a SYSTEM_ALERT to every admin", async () => {
+  it("failure payload writes system.deploy.failure audit row AND fans a localised SYSTEM_ALERT to every admin", async () => {
     vi.mocked(prisma.user.findMany).mockResolvedValueOnce([
       { id: "admin-1" },
       { id: "admin-2" },
@@ -176,20 +186,30 @@ describe("POST /api/internal/deploy-webhook", () => {
       }),
     );
 
-    expect(dispatchNotification).toHaveBeenCalledTimes(2);
-    expect(dispatchNotification).toHaveBeenCalledWith(
+    // v1.4.27 F21 — the route now wraps every admin alert in
+    // `dispatchLocalisedNotification`, which composes the title and
+    // body from translation keys against the admin's locale before
+    // delegating to the base dispatcher. The test asserts the per-admin
+    // call carries the right translation keys and params; the actual
+    // string composition is covered in admin-locale.test.ts.
+    expect(dispatchLocalisedNotification).toHaveBeenCalledTimes(2);
+    expect(dispatchLocalisedNotification).toHaveBeenCalledWith(
       expect.objectContaining({
-        eventType: "SYSTEM_ALERT",
         userId: "admin-1",
-        title: expect.stringContaining("Deploy failed"),
-        message: expect.stringContaining("container exited 137"),
+        titleKey: "notifications.admin.deployFailedTitle",
+        messageKey: "notifications.admin.deployFailedBody",
+        params: expect.objectContaining({
+          application: "HealthLog",
+          error: "container exited 137",
+          deployment: "dep-456",
+        }),
         metadata: expect.objectContaining({
           source: "deploy-webhook",
           deploymentUuid: "dep-456",
         }),
       }),
     );
-    expect(dispatchNotification).toHaveBeenCalledWith(
+    expect(dispatchLocalisedNotification).toHaveBeenCalledWith(
       expect.objectContaining({ userId: "admin-2" }),
     );
   });
@@ -208,7 +228,7 @@ describe("POST /api/internal/deploy-webhook", () => {
       "system.deploy.unknown",
       expect.any(Object),
     );
-    expect(dispatchNotification).not.toHaveBeenCalled();
+    expect(dispatchLocalisedNotification).not.toHaveBeenCalled();
   });
 
   it("emits a Wide Event warning when a deploy fails but no admin user exists", async () => {
@@ -229,7 +249,7 @@ describe("POST /api/internal/deploy-webhook", () => {
     expect(addWarning).toHaveBeenCalledWith(
       expect.stringMatching(/no admin user/i),
     );
-    expect(dispatchNotification).not.toHaveBeenCalled();
+    expect(dispatchLocalisedNotification).not.toHaveBeenCalled();
   });
 
   it("returns 429 and skips audit + alert when rate-limited", async () => {
@@ -247,7 +267,7 @@ describe("POST /api/internal/deploy-webhook", () => {
     );
     expect(res.status).toBe(429);
     expect(auditLog).not.toHaveBeenCalled();
-    expect(dispatchNotification).not.toHaveBeenCalled();
+    expect(dispatchLocalisedNotification).not.toHaveBeenCalled();
   });
 
   it("tolerates malformed (non-string) status fields by treating them as unknown", async () => {
@@ -257,7 +277,7 @@ describe("POST /api/internal/deploy-webhook", () => {
     expect(res.status).toBe(200);
     const body = (await res.json()) as { outcome: string };
     expect(body.outcome).toBe("unknown");
-    expect(dispatchNotification).not.toHaveBeenCalled();
+    expect(dispatchLocalisedNotification).not.toHaveBeenCalled();
   });
 
   it("preserves the full Coolify payload in the audit-log raw field for forward compat", async () => {

src/app/api/internal/deploy-webhook/route.ts

@@ -5,7 +5,7 @@ import { annotate, getEvent } from "@/lib/logging/context";
 import { auditLog } from "@/lib/auth/audit";
 import { checkRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
 import { getClientIp, safeJson } from "@/lib/api-response";
-import { dispatchNotification } from "@/lib/notifications/dispatcher";
+import { dispatchLocalisedNotification } from "@/lib/notifications/dispatch-localised";
 import { prisma } from "@/lib/db";
 
 /**
@@ -119,22 +119,24 @@ async function notifyAdminsOfFailure(event: NormalizedEvent): Promise<void> {
     return;
   }
 
-  const title = `Deploy failed: ${event.applicationName}`;
-  const message = [
-    `The Coolify deploy for ${event.applicationName} reported a failure.`,
-    event.error ? `Error: ${event.error}` : null,
-    event.deploymentUuid ? `Deployment: ${event.deploymentUuid}` : null,
-    "Logs: https://apps-01.bombeck.io",
-  ]
-    .filter((line): line is string => line !== null)
-    .join("\n");
-
+  // v1.4.27 F21 — each admin sees the alert in their own User.locale.
+  // The body is composed inside `dispatchLocalisedNotification` from
+  // translation keys; the static "Error:" / "Deployment:" / "Logs:"
+  // labels are emitted as a single param-substituted body key so all
+  // six locale bundles can render them natively. The deployment-uuid
+  // and error lines fall back to an empty string when missing so the
+  // surrounding template still composes cleanly.
   for (const admin of admins) {
-    await dispatchNotification({
-      eventType: "SYSTEM_ALERT",
+    await dispatchLocalisedNotification({
       userId: admin.id,
-      title,
-      message,
+      titleKey: "notifications.admin.deployFailedTitle",
+      messageKey: "notifications.admin.deployFailedBody",
+      params: {
+        application: event.applicationName,
+        error: event.error ?? "",
+        deployment: event.deploymentUuid ?? "",
+        logsUrl: "https://apps-01.bombeck.io",
+      },
       metadata: {
         source: "deploy-webhook",
         applicationName: event.applicationName,

src/app/api/settings/__tests__/telegram-test-locale.test.ts

@@ -0,0 +1,202 @@
+/**
+ * v1.4.27 F21 — settings/telegram/test locale path.
+ *
+ * Asserts the per-user Telegram test message renders in the user's
+ * persisted `User.locale` rather than the hardcoded English string
+ * the pre-fix route used. The actual translator behaviour is covered
+ * by `notifications/__tests__/admin-locale.test.ts`; this file is
+ * the route-level smoke test that confirms the wiring.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/lib/api-handler", () => ({
+  apiHandler: <T extends (...args: unknown[]) => unknown>(fn: T) => fn,
+  requireAuth: vi.fn(),
+}));
+
+vi.mock("@/lib/db", () => ({
+  prisma: {
+    user: { findUnique: vi.fn() },
+  },
+}));
+
+vi.mock("@/lib/api-response", () => ({
+  apiSuccess: (data: unknown) => ({ ok: true, data }),
+  apiError: (message: string, status: number) => ({
+    ok: false,
+    error: message,
+    status,
+  }),
+}));
+
+vi.mock("@/lib/crypto", () => ({
+  decrypt: (s: string) => `decrypted(${s})`,
+}));
+
+const sendTelegramMessageMock = vi.fn();
+vi.mock("@/lib/telegram", () => ({
+  sendTelegramMessage: (...args: unknown[]) => sendTelegramMessageMock(...args),
+}));
+
+vi.mock("@/lib/rate-limit", () => ({
+  checkRateLimit: vi.fn(),
+}));
+
+vi.mock("@/lib/logging/context", () => ({
+  annotate: vi.fn(),
+}));
+
+const tCalls: Array<{ locale: string; key: string }> = [];
+vi.mock("@/lib/i18n/server-translator", () => ({
+  getServerTranslator: (locale: string) => ({
+    locale,
+    t: (key: string) => {
+      tCalls.push({ locale, key });
+      const fakeStrings: Record<string, Record<string, string>> = {
+        de: {
+          "notifications.user.telegramTestBody":
+            "HealthLog: Verbindung hergestellt. Telegram-Benachrichtigungen sind aktiv.",
+        },
+        en: {
+          "notifications.user.telegramTestBody":
+            "HealthLog: connection successful. Telegram notifications are active.",
+        },
+        fr: {
+          "notifications.user.telegramTestBody":
+            "HealthLog: connexion réussie. Les notifications Telegram sont actives.",
+        },
+      };
+      return (fakeStrings[locale] ?? fakeStrings.en)[key] ?? key;
+    },
+  }),
+}));
+
+import { POST } from "../telegram/test/route";
+import { prisma } from "@/lib/db";
+import { requireAuth } from "@/lib/api-handler";
+import { checkRateLimit } from "@/lib/rate-limit";
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  tCalls.length = 0;
+  vi.mocked(requireAuth).mockResolvedValue({
+    user: { id: "user-1" },
+  } as never);
+  vi.mocked(checkRateLimit).mockResolvedValue({
+    allowed: true,
+    remaining: 5,
+    resetAt: Date.now() + 60_000,
+  } as never);
+  sendTelegramMessageMock.mockResolvedValue({ ok: true });
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("POST /api/settings/telegram/test — locale-aware message", () => {
+  it("sends the German body when User.locale=de", async () => {
+    vi.mocked(prisma.user.findUnique).mockResolvedValueOnce({
+      telegramBotToken: "enc-token",
+      telegramChatId: "chat-1",
+      locale: "de",
+    } as never);
+
+    const result = await (POST as () => Promise<unknown>)();
+
+    expect(sendTelegramMessageMock).toHaveBeenCalledTimes(1);
+    const [, , body] = sendTelegramMessageMock.mock.calls[0];
+    expect(body).toBe(
+      "HealthLog: Verbindung hergestellt. Telegram-Benachrichtigungen sind aktiv.",
+    );
+    expect(tCalls).toEqual([
+      {
+        locale: "de",
+        key: "notifications.user.telegramTestBody",
+      },
+    ]);
+    expect((result as { ok: boolean }).ok).toBe(true);
+  });
+
+  it("sends the French body when User.locale=fr", async () => {
+    vi.mocked(prisma.user.findUnique).mockResolvedValueOnce({
+      telegramBotToken: "enc-token",
+      telegramChatId: "chat-1",
+      locale: "fr",
+    } as never);
+
+    await (POST as () => Promise<unknown>)();
+
+    const [, , body] = sendTelegramMessageMock.mock.calls[0];
+    expect(body).toBe(
+      "HealthLog: connexion réussie. Les notifications Telegram sont actives.",
+    );
+  });
+
+  it("falls back to the default locale (en) when User.locale is null", async () => {
+    vi.mocked(prisma.user.findUnique).mockResolvedValueOnce({
+      telegramBotToken: "enc-token",
+      telegramChatId: "chat-1",
+      locale: null,
+    } as never);
+
+    await (POST as () => Promise<unknown>)();
+
+    const [, , body] = sendTelegramMessageMock.mock.calls[0];
+    expect(body).toBe(
+      "HealthLog: connection successful. Telegram notifications are active.",
+    );
+    expect(tCalls[0].locale).toBe("en");
+  });
+
+  it("falls back to the default locale (en) when User.locale is unsupported", async () => {
+    vi.mocked(prisma.user.findUnique).mockResolvedValueOnce({
+      telegramBotToken: "enc-token",
+      telegramChatId: "chat-1",
+      locale: "klingon",
+    } as never);
+
+    await (POST as () => Promise<unknown>)();
+
+    expect(tCalls[0].locale).toBe("en");
+  });
+
+  it("returns a 422 error when bot token is not configured", async () => {
+    vi.mocked(prisma.user.findUnique).mockResolvedValueOnce({
+      telegramBotToken: null,
+      telegramChatId: null,
+      locale: "de",
+    } as never);
+
+    const result = await (POST as () => Promise<unknown>)();
+
+    expect(sendTelegramMessageMock).not.toHaveBeenCalled();
+    expect((result as { status: number }).status).toBe(422);
+  });
+
+  it("returns a 429 error when rate-limited", async () => {
+    vi.mocked(checkRateLimit).mockResolvedValueOnce({
+      allowed: false,
+      remaining: 0,
+      resetAt: Date.now() + 60_000,
+    } as never);
+
+    const result = await (POST as () => Promise<unknown>)();
+
+    expect(sendTelegramMessageMock).not.toHaveBeenCalled();
+    expect((result as { status: number }).status).toBe(429);
+  });
+
+  it("returns a 422 error when the Telegram send fails", async () => {
+    vi.mocked(prisma.user.findUnique).mockResolvedValueOnce({
+      telegramBotToken: "enc-token",
+      telegramChatId: "chat-1",
+      locale: "en",
+    } as never);
+    sendTelegramMessageMock.mockResolvedValueOnce({ ok: false });
+
+    const result = await (POST as () => Promise<unknown>)();
+
+    expect((result as { status: number }).status).toBe(422);
+  });
+});

src/app/api/settings/telegram/test/route.ts

@@ -5,6 +5,13 @@ import { sendTelegramMessage } from "@/lib/telegram";
 import { checkRateLimit } from "@/lib/rate-limit";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { defaultLocale, type Locale } from "@/lib/i18n/config";
+import { getServerTranslator } from "@/lib/i18n/server-translator";
+
+function isLocale(value: string | null | undefined): value is Locale {
+  return value === "de" || value === "en" || value === "fr" ||
+    value === "es" || value === "it" || value === "pl";
+}
 
 /**
  * Send a test Telegram message to verify the bot token and chat ID.
@@ -19,18 +26,27 @@ export const POST = apiHandler(async () => {
 
   const dbUser = await prisma.user.findUnique({
     where: { id: user.id },
-    select: { telegramBotToken: true, telegramChatId: true },
+    select: { telegramBotToken: true, telegramChatId: true, locale: true },
   });
 
   if (!dbUser?.telegramBotToken || !dbUser?.telegramChatId) {
     return apiError("Bot token and chat ID must be saved first", 422);
   }
 
+  // v1.4.27 F21 — the test body now reads from the user's persisted
+  // locale rather than the hardcoded English string. The route talks
+  // to `sendTelegramMessage` directly (it needs the boolean send
+  // result for the UI) so we compose the body via the server
+  // translator rather than going through the dispatcher.
+  const userLocale: Locale = isLocale(dbUser.locale)
+    ? dbUser.locale
+    : defaultLocale;
+  const t = getServerTranslator(userLocale).t;
   const botToken = decrypt(dbUser.telegramBotToken);
   const result = await sendTelegramMessage(
     botToken,
     dbUser.telegramChatId,
-    "HealthLog: Connection successful! Telegram notifications are active.",
+    t("notifications.user.telegramTestBody"),
   );
 
   if (!result.ok) {

src/app/api/version/__tests__/route.test.ts

@@ -4,11 +4,17 @@ vi.mock("@/lib/api-handler", () => ({
   apiHandler: <T extends (...args: unknown[]) => unknown>(fn: T) => fn,
 }));
 
+const offlineGeoReadyMock = vi.fn(() => false);
+vi.mock("@/lib/geo", () => ({
+  offlineGeoReady: () => offlineGeoReadyMock(),
+}));
+
 import { GET } from "../route";
 
 beforeEach(() => {
   delete process.env.NEXT_PUBLIC_APP_BUILD_SHA;
   delete process.env.NEXT_PUBLIC_APP_BUILT_AT;
+  offlineGeoReadyMock.mockReturnValue(false);
 });
 
 interface VersionEnvelope {
@@ -20,6 +26,7 @@ interface VersionEnvelope {
     repository: string;
     changelog: string;
     docs: string;
+    offlineGeoEnabled: boolean;
   };
 }
 
@@ -49,4 +56,18 @@ describe("GET /api/version", () => {
     expect(body.data.buildSha).toBe("abc1234");
     expect(body.data.builtAt).toBe("2026-05-08T12:00:00.000Z");
   });
+
+  it("reports offlineGeoEnabled=false when the GeoLite2 databases are absent", async () => {
+    offlineGeoReadyMock.mockReturnValue(false);
+    const response = await (GET as unknown as () => Promise<Response>)();
+    const body = (await response.json()) as VersionEnvelope;
+    expect(body.data.offlineGeoEnabled).toBe(false);
+  });
+
+  it("reports offlineGeoEnabled=true when the GeoLite2 databases are present", async () => {
+    offlineGeoReadyMock.mockReturnValue(true);
+    const response = await (GET as unknown as () => Promise<Response>)();
+    const body = (await response.json()) as VersionEnvelope;
+    expect(body.data.offlineGeoEnabled).toBe(true);
+  });
 });

src/app/api/version/route.ts

@@ -1,16 +1,24 @@
 import { apiHandler } from "@/lib/api-handler";
 import { apiSuccess } from "@/lib/api-response";
+import { offlineGeoReady } from "@/lib/geo";
 import packageJson from "../../../../package.json";
 
-export const dynamic = "force-static";
-export const revalidate = false;
+// v1.4.27 R5 — `offlineGeoEnabled` reads from the same source the geo
+// resolver uses for the runtime fallback gate, so the public state and
+// the runtime behaviour cannot disagree. The check hits the filesystem
+// (`existsSync` on the `.empty` marker + the City MMDB) which forces
+// the route to be dynamic — the previous `force-static` setting would
+// have frozen the answer at build time.
+export const dynamic = "force-dynamic";
 
 /**
  * GET /api/version
  *
  * Public endpoint exposing the running build's version. Used by the
- * Settings → About surface, the footer of every page, and the
- * "Check for updates" button (which compares against the GHCR API).
+ * Settings → About surface, the footer of every page, the
+ * "Check for updates" button (which compares against the GHCR API),
+ * and the admin status-summary row that surfaces the offline-geo
+ * availability state.
  *
  * The build SHA and built-at timestamp come from environment variables
  * baked at image build time:
@@ -21,11 +29,18 @@ export const revalidate = false;
  *
  * For local `pnpm dev` neither is set; the route returns `null` and
  * the UI falls back to "development" wording.
+ *
+ * `offlineGeoEnabled` is `true` when the GeoLite2-City MMDB is present
+ * at the configured `GEOLITE2_DIR` and no `.empty` marker is set.
+ * When `false` the runtime falls back to the online `ipwho.is`
+ * provider and the resolver emits a one-shot admin notification on
+ * first use.
  */
 export const GET = apiHandler(async () => {
   const version = packageJson.version;
   const buildSha = process.env.NEXT_PUBLIC_APP_BUILD_SHA?.trim() || null;
   const builtAt = process.env.NEXT_PUBLIC_APP_BUILT_AT?.trim() || null;
+  const offlineGeoEnabled = offlineGeoReady();
 
   return apiSuccess({
     version,
@@ -35,5 +50,6 @@ export const GET = apiHandler(async () => {
     repository: "https://github.com/MBombeck/HealthLog",
     changelog: "https://github.com/MBombeck/HealthLog/blob/main/CHANGELOG.md",
     docs: "https://docs.healthlog.dev",
+    offlineGeoEnabled,
   });
 });

src/app/api/workouts/__tests__/canonical-dedup.test.ts

@@ -0,0 +1,211 @@
+/**
+ * Unit suite for `GET /api/workouts` — the canonical-dedup contract.
+ *
+ * v1.4.27 B7 / BL-P2-3 — wires `pickCanonicalWorkout()` into the read
+ * path. The test pins the contract:
+ *   - twin workouts on the same `(sportType, ±5 min)` cluster
+ *     collapse to a single row;
+ *   - the source ladder picks APPLE_HEALTH over WITHINGS over MANUAL;
+ *   - the `meta.droppedDuplicates` count reflects the diff between
+ *     the raw fetch and the canonical subset.
+ */
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import { NextRequest } from "next/server";
+
+vi.mock("@/lib/db", () => ({
+  prisma: {
+    workout: {
+      findMany: vi.fn(),
+    },
+  },
+}));
+
+vi.mock("@/lib/auth/session", () => ({ getSession: vi.fn() }));
+
+vi.mock("@/lib/auth/audit", () => ({
+  auditLog: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() }));
+
+vi.mock("next/headers", () => ({
+  headers: vi.fn(async () => ({ get: () => null })),
+  cookies: vi.fn(async () => ({
+    get: () => undefined,
+    set: () => {},
+    delete: () => {},
+  })),
+}));
+
+import { GET } from "../route";
+import { prisma } from "@/lib/db";
+import { getSession } from "@/lib/auth/session";
+
+const SESSION_OK = {
+  session: { id: "sess-1", expiresAt: new Date(Date.now() + 3_600_000) },
+  user: { id: "user-1", username: "marc", role: "USER" as const },
+};
+
+function makeRequest(query = ""): NextRequest {
+  return new NextRequest(`http://localhost/api/workouts${query}`, {
+    method: "GET",
+  });
+}
+
+interface FakeWorkoutRow {
+  id: string;
+  source: string;
+  externalId: string | null;
+  sportType: string;
+  startedAt: Date;
+  endedAt: Date;
+  durationSec: number;
+  distanceMeters: number | null;
+  avgHeartRate: number | null;
+  maxHeartRate: number | null;
+  energyKcal: number | null;
+  createdAt: Date;
+}
+
+function makeRow(
+  id: string,
+  source: string,
+  startedAt: string,
+  sportType = "RUNNING",
+): FakeWorkoutRow {
+  const start = new Date(startedAt);
+  return {
+    id,
+    source,
+    externalId: source === "MANUAL" ? null : `ext-${id}`,
+    sportType,
+    startedAt: start,
+    endedAt: new Date(start.getTime() + 30 * 60_000),
+    durationSec: 1800,
+    distanceMeters: 5000,
+    avgHeartRate: 145,
+    maxHeartRate: 170,
+    energyKcal: 320,
+    createdAt: start,
+  };
+}
+
+describe("GET /api/workouts — canonical dedup", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+  });
+
+  it("collapses an APPLE_HEALTH + WITHINGS twin to the Apple row", async () => {
+    const apple = makeRow("w-apple", "APPLE_HEALTH", "2026-05-15T07:00:00Z");
+    const withings = makeRow("w-withings", "WITHINGS", "2026-05-15T07:01:30Z");
+
+    vi.mocked(prisma.workout.findMany).mockResolvedValueOnce([
+      apple,
+      withings,
+    ] as never);
+
+    const res = await GET(makeRequest());
+    const body = await res.json();
+
+    expect(res.status).toBe(200);
+    expect(body.data.workouts).toHaveLength(1);
+    expect(body.data.workouts[0].id).toBe("w-apple");
+    expect(body.data.meta.droppedDuplicates).toBe(1);
+    expect(body.data.meta.clusters).toBe(1);
+  });
+
+  it("keeps two workouts when they are outside the proximity window", async () => {
+    const morning = makeRow("w-am", "APPLE_HEALTH", "2026-05-15T07:00:00Z");
+    const evening = makeRow("w-pm", "APPLE_HEALTH", "2026-05-15T18:00:00Z");
+
+    vi.mocked(prisma.workout.findMany).mockResolvedValueOnce([
+      morning,
+      evening,
+    ] as never);
+
+    const res = await GET(makeRequest());
+    const body = await res.json();
+
+    expect(body.data.workouts).toHaveLength(2);
+    expect(body.data.meta.droppedDuplicates).toBe(0);
+    expect(body.data.meta.clusters).toBe(2);
+  });
+
+  it("keeps two workouts when sportType differs at the same instant", async () => {
+    const run = makeRow("w-run", "APPLE_HEALTH", "2026-05-15T07:00:00Z", "RUNNING");
+    const walk = makeRow("w-walk", "APPLE_HEALTH", "2026-05-15T07:00:00Z", "WALKING");
+
+    vi.mocked(prisma.workout.findMany).mockResolvedValueOnce([
+      run,
+      walk,
+    ] as never);
+
+    const res = await GET(makeRequest());
+    const body = await res.json();
+
+    expect(body.data.workouts).toHaveLength(2);
+    expect(body.data.meta.droppedDuplicates).toBe(0);
+  });
+
+  it("honours the limit query parameter after dedup", async () => {
+    const rows = Array.from({ length: 8 }, (_, i) =>
+      makeRow(
+        `w-${i}`,
+        "APPLE_HEALTH",
+        new Date(2026, 4, 15, 7 + i, 0, 0).toISOString(),
+      ),
+    );
+    vi.mocked(prisma.workout.findMany).mockResolvedValueOnce(rows as never);
+
+    const res = await GET(makeRequest("?limit=3"));
+    const body = await res.json();
+
+    expect(body.data.workouts).toHaveLength(3);
+    expect(body.data.meta.limit).toBe(3);
+  });
+
+  it("paginates across cluster boundaries without double-counting deduped rows", async () => {
+    // Eight twin clusters: each cluster has an APPLE_HEALTH + WITHINGS
+    // row within the 5 min window. The picker collapses each cluster to
+    // its Apple row, so the canonical projection has 8 rows. Page 1
+    // (offset=0, limit=4) must yield Apple rows for clusters 7–4
+    // (descending). Page 2 (offset=4, limit=4) must yield Apple rows
+    // for clusters 3–0 with no overlap and no gaps. `meta.total` must
+    // reflect the deduped count (8), not the raw row count (16).
+    const rows: FakeWorkoutRow[] = [];
+    for (let i = 0; i < 8; i++) {
+      const start = new Date(2026, 4, 15, 7 + i, 0, 0).toISOString();
+      const start2 = new Date(2026, 4, 15, 7 + i, 1, 30).toISOString();
+      rows.push(makeRow(`apple-${i}`, "APPLE_HEALTH", start));
+      rows.push(makeRow(`withings-${i}`, "WITHINGS", start2));
+    }
+    // Mock returns the full filtered set; the route paginates after
+    // dedup.
+    vi.mocked(prisma.workout.findMany).mockResolvedValue(rows as never);
+
+    const page1 = await GET(makeRequest("?limit=4&offset=0"));
+    const page1Body = await page1.json();
+    const page2 = await GET(makeRequest("?limit=4&offset=4"));
+    const page2Body = await page2.json();
+
+    expect(page1Body.data.workouts).toHaveLength(4);
+    expect(page2Body.data.workouts).toHaveLength(4);
+    expect(page1Body.data.meta.total).toBe(8);
+    expect(page2Body.data.meta.total).toBe(8);
+    expect(page1Body.data.meta.droppedDuplicates).toBe(8);
+    expect(page2Body.data.meta.droppedDuplicates).toBe(8);
+
+    const page1Ids = page1Body.data.workouts.map((w: { id: string }) => w.id);
+    const page2Ids = page2Body.data.workouts.map((w: { id: string }) => w.id);
+    // No overlap across the page boundary.
+    expect(page1Ids.filter((id: string) => page2Ids.includes(id))).toEqual([]);
+    // All eight clusters are covered between the two pages.
+    expect([...page1Ids, ...page2Ids].sort()).toEqual(
+      Array.from({ length: 8 }, (_, i) => `apple-${i}`).sort(),
+    );
+    // Descending order is preserved within each page.
+    expect(page1Ids).toEqual(["apple-7", "apple-6", "apple-5", "apple-4"]);
+    expect(page2Ids).toEqual(["apple-3", "apple-2", "apple-1", "apple-0"]);
+  });
+});

src/app/api/workouts/batch/route.ts

@@ -356,21 +356,51 @@ async function postBatch(request: NextRequest): Promise<Response> {
           // is NULL-distinct, so two manual entries on the same instant
           // would both insert. We look these up by the deterministic
           // (userId, source, startedAt, sportType) tuple for each row.
-          const manualMatches = await Promise.all(
-            withoutExternal.map((p) =>
-              tx.workout.findFirst({
-                where: {
-                  userId: user.id,
+          //
+          // v1.4.27 B7 / BL-code-M3 — single batched findMany with one
+          // OR-row per entry instead of N serial findFirst probes. For
+          // a 100-row batch this cuts the per-batch round-trip count
+          // from 1 + N to 2; the per-entry "most-recent createdAt"
+          // tie-break is preserved by sorting the returned rows in
+          // memory and keying on the deterministic tuple.
+          type ManualMatch = { id: string; createdAt: Date };
+          const manualMatchesById = new Map<string, ManualMatch>();
+          if (withoutExternal.length > 0) {
+            const manualRows = await tx.workout.findMany({
+              where: {
+                userId: user.id,
+                route: null,
+                OR: withoutExternal.map((p) => ({
                   source: p.row.source,
                   startedAt: p.row.startedAt as Date,
                   sportType: p.row.sportType,
-                  route: null,
-                },
-                select: { id: true },
-                orderBy: { createdAt: "desc" },
-              }),
-            ),
-          );
+                })),
+              },
+              select: {
+                id: true,
+                source: true,
+                startedAt: true,
+                sportType: true,
+                createdAt: true,
+              },
+              orderBy: { createdAt: "desc" },
+            });
+            for (const row of manualRows) {
+              const key = `${row.source}::${row.startedAt.getTime()}::${row.sportType}`;
+              const existing = manualMatchesById.get(key);
+              if (!existing || existing.createdAt < row.createdAt) {
+                manualMatchesById.set(key, {
+                  id: row.id,
+                  createdAt: row.createdAt,
+                });
+              }
+            }
+          }
+          const manualMatches = withoutExternal.map((p) => {
+            const key = `${p.row.source}::${(p.row.startedAt as Date).getTime()}::${p.row.sportType}`;
+            const match = manualMatchesById.get(key);
+            return match ? { id: match.id } : null;
+          });
 
           const routesToInsert: Prisma.WorkoutRouteCreateManyInput[] = [];
           for (let i = 0; i < withExternal.length; i++) {

src/app/api/workouts/route.ts

@@ -0,0 +1,155 @@
+/**
+ * `GET /api/workouts` — paginated workout list with canonical-source
+ * deduplication.
+ *
+ * Consumers (v1.4.27+):
+ *   1. The /insights workouts surface (and future /workouts page) reads
+ *      from this endpoint so duplicate twin workouts (Apple Watch
+ *      writing a workout that Withings also published over its server-
+ *      to-server feed) collapse to a single canonical row.
+ *   2. The native iOS app drains historical workouts through the same
+ *      surface — Apple Health is the canonical ladder anchor, so an
+ *      iOS-originated request typically returns its own rows back.
+ *
+ * Dedup contract:
+ *   - The route reads `DEFAULT_WORKOUT_SOURCE_PRIORITY` from
+ *     `pick-canonical-workout.ts` (APPLE_HEALTH > WITHINGS > MANUAL >
+ *     IMPORT) with the ±5 min cluster window. A per-user workout
+ *     ladder override is reserved for the v1.5 Settings surface; the
+ *     server already honours it transparently through the picker's
+ *     options bag when the field lands in `User.sourcePriorityJson`.
+ *   - Per-cluster the picker keeps the row from the highest-priority
+ *     source present; the others are dropped from the canonical list.
+ *
+ * Query params:
+ *   - `limit` (default 50, max 200)
+ *   - `offset` (default 0)
+ *   - `since` / `until` — ISO timestamps, inclusive. Optional.
+ *   - `sportType` — narrow to one HKWorkoutActivityType. Optional.
+ *
+ * Pagination contract:
+ *   Dedup runs over the full filtered row set, then `offset` / `limit`
+ *   slice the canonical projection. A naive `skip` + per-window dedup
+ *   double-counts boundary clusters across pages because a cluster
+ *   whose first member sits in page N-1 and whose later member sits in
+ *   page N would be dropped on N-1 and surface again on N. Workout
+ *   volume for HealthLog is bounded (single user, tens of workouts per
+ *   week — single-digit MB at the table's busiest), so reading the
+ *   full filtered set per request is well within budget. If the
+ *   workload ever grows to where this matters, a `(startedAt, id)`
+ *   cursor with a deterministic over-fetch window is the next step.
+ *
+ * v1.4.27 B7 / BL-P2-3 — wires `pickCanonicalWorkout()` into the read
+ * path. v1.4.27 R4 RC3 — corrects the pagination so `meta.total`
+ * reflects the deduped count and cluster boundaries no longer leak
+ * across pages.
+ */
+import { NextRequest } from "next/server";
+
+import { prisma } from "@/lib/db";
+import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { annotate } from "@/lib/logging/context";
+import { apiSuccess } from "@/lib/api-response";
+import {
+  pickCanonicalWorkout,
+  DEFAULT_WORKOUT_SOURCE_PRIORITY,
+  DEFAULT_WORKOUT_PROXIMITY_MINUTES,
+  type WorkoutPickerRow,
+} from "@/lib/sources/pick-canonical-workout";
+
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 200;
+
+export const GET = apiHandler(async (request: NextRequest) => {
+  const { user } = await requireAuth();
+  annotate({ action: { name: "workouts.list" } });
+
+  const { searchParams } = new URL(request.url);
+  const limit = Math.min(
+    Math.max(
+      1,
+      parseInt(searchParams.get("limit") ?? String(DEFAULT_LIMIT), 10) ||
+        DEFAULT_LIMIT,
+    ),
+    MAX_LIMIT,
+  );
+  const offset = Math.max(
+    0,
+    parseInt(searchParams.get("offset") ?? "0", 10) || 0,
+  );
+  const since = searchParams.get("since");
+  const until = searchParams.get("until");
+  const sportType = searchParams.get("sportType");
+
+  const where: Record<string, unknown> = { userId: user.id };
+  if (since || until) {
+    const range: Record<string, Date> = {};
+    if (since) {
+      const d = new Date(since);
+      if (!Number.isNaN(d.getTime())) range.gte = d;
+    }
+    if (until) {
+      const d = new Date(until);
+      if (!Number.isNaN(d.getTime())) range.lte = d;
+    }
+    if (Object.keys(range).length > 0) {
+      where.startedAt = range;
+    }
+  }
+  if (sportType) {
+    where.sportType = sportType;
+  }
+
+  // Read the full filtered set then dedupe once. See the file-level
+  // "Pagination contract" note for the reason this is preferred over
+  // a per-page over-fetch + slice. The picker is O(n) on cluster
+  // building plus O(k) per cluster (k = open clusters of the same
+  // sport type) and the workout table is bounded.
+  const rows = await prisma.workout.findMany({
+    where,
+    orderBy: { startedAt: "desc" },
+    select: {
+      id: true,
+      source: true,
+      externalId: true,
+      sportType: true,
+      startedAt: true,
+      endedAt: true,
+      durationSec: true,
+      distanceMeters: true,
+      avgHeartRate: true,
+      maxHeartRate: true,
+      energyKcal: true,
+      createdAt: true,
+    },
+  });
+
+  // The picker only inspects `source`, `startedAt`, `sportType`, and
+  // `id`. The rest of the selected columns ride through untouched on
+  // the returned subset.
+  const pickerRows = rows as Array<(typeof rows)[number] & WorkoutPickerRow>;
+  const { canonical, clusters } = pickCanonicalWorkout(pickerRows, {
+    sourcePriority: DEFAULT_WORKOUT_SOURCE_PRIORITY,
+    proximityMinutes: DEFAULT_WORKOUT_PROXIMITY_MINUTES,
+  });
+
+  // The picker sorts ascending for deterministic cluster building.
+  // Restore descending order on the canonical projection so the API
+  // matches the orderBy contract above.
+  const canonicalDesc = [...canonical].sort(
+    (a, b) => b.startedAt.getTime() - a.startedAt.getTime(),
+  );
+
+  const page = canonicalDesc.slice(offset, offset + limit);
+
+  return apiSuccess({
+    workouts: page,
+    meta: {
+      total: canonicalDesc.length,
+      limit,
+      offset,
+      droppedDuplicates: rows.length - canonicalDesc.length,
+      clusters: clusters.length,
+    },
+  });
+});