feat(observability): fireAndForget breadcrumb for background side effects

Best-effort background work was swallowed with `.catch(() => {})` — a
persistent failure (a broken reminder enqueue, a lost re-auth transition)
left no annotate() or logger trail, against the project's own
'annotate() on every interesting path' rule.

Add `fireAndForget(promise, { action })`: it annotates the rejection into
the current wide event under a per-action meta key (so it rides the
central redaction at emit time — the raw message never hits the console)
and warns the action label only for failures that settle after the event
flushed. Control flow is unchanged; the promise stays fire-and-forget.

Adopt it at the meaningful sites: reminder-satisfy enqueues (measurement
+ labs writes and the five integration sync workers), the post-write
safety-floor dispatch, and the consent audit-log write. The Withings
re-auth mark stays awaited (its persisted state feeds the same response)
but now breadcrumbs its failure instead of swallowing it.

src/app/api/consent/ai/route.ts

@@ -9,6 +9,7 @@
  */
 import { NextRequest } from "next/server";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
+import { fireAndForget } from "@/lib/logging/fire-and-forget";
 import {
   apiError,
   apiSuccess,
@@ -56,10 +57,13 @@ export const POST = apiHandler(async (request: NextRequest) => {
   // reconstruct "who minted this and when" even if the receipts table
   // is rebuilt from a backup. Fire-and-forget; audit failures must
   // never bubble into a user-facing 500.
-  auditLog("consent.ai.grant", {
-    userId: user.id,
-    details: { kind, receiptId: receipt.id },
-  }).catch(() => {});
+  fireAndForget(
+    auditLog("consent.ai.grant", {
+      userId: user.id,
+      details: { kind, receiptId: receipt.id },
+    }),
+    { action: "consent.ai.audit" },
+  );
 
   annotate({
     action: { name: "consent.ai.grant" },

src/app/api/labs/ocr/commit/route.ts

@@ -11,6 +11,7 @@
  * `data` object is built field-by-field (no mass assignment).
  */
 import { NextRequest } from "next/server";
+import { fireAndForget } from "@/lib/logging/fire-and-forget";
 
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import {
@@ -210,7 +211,9 @@ async function commitOcrRows(request: NextRequest) {
   // A lab panel just landed — resolve any "annual blood panel" reminders now
   // rather than waiting on the cron. Fire-and-forget.
   if (inserted.length > 0) {
-    void enqueueReminderSatisfy(user.id).catch(() => {});
+    fireAndForget(enqueueReminderSatisfy(user.id), {
+      action: "reminder.satisfy.enqueue",
+    });
   }
 
   return apiSuccess({ inserted, skipped });

src/app/api/labs/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest } from "next/server";
+import { fireAndForget } from "@/lib/logging/fire-and-forget";
 
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import {
@@ -271,7 +272,9 @@ async function postLabResult(request: NextRequest) {
   // v1.18.1 (D2) — eventful Lab↔Vorsorge satisfaction. A lab panel just
   // landed; resolve the user's free-text "annual blood panel" reminders
   // now rather than waiting on the 15-min cron. Fire-and-forget.
-  void enqueueReminderSatisfy(user.id).catch(() => {});
+  fireAndForget(enqueueReminderSatisfy(user.id), {
+    action: "reminder.satisfy.enqueue",
+  });
 
   return apiSuccess(serialiseLabResult(created, biomarker), 201);
 }

src/app/api/measurements/batch/route.ts

@@ -34,6 +34,7 @@
  *     contract.
  */
 import { NextRequest } from "next/server";
+import { fireAndForget } from "@/lib/logging/fire-and-forget";
 import { z } from "zod/v4";
 
 import { prisma } from "@/lib/db";
@@ -682,7 +683,9 @@ async function postBatch(request: NextRequest): Promise<Response> {
     // v1.18.1 — eventful Vorsorge satisfaction. A matching reading just
     // landed; resolve the user's reminders now rather than waiting on the
     // 15-min cron. Fire-and-forget — the cron reconciles on enqueue miss.
-    void enqueueReminderSatisfy(user.id).catch(() => {});
+    fireAndForget(enqueueReminderSatisfy(user.id), {
+      action: "reminder.satisfy.enqueue",
+    });
     try {
       await enqueuePrDetection(user.id, { silent });
       await auditLog("personal_records.detection_enqueued", {

src/app/api/measurements/route.ts

@@ -1,6 +1,7 @@
 import { prisma } from "@/lib/db";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
+import { fireAndForget } from "@/lib/logging/fire-and-forget";
 import { auditLog } from "@/lib/auth/audit";
 import {
   apiSuccess,
@@ -820,7 +821,9 @@ async function postMeasurement(request: NextRequest) {
 
     // v1.18.1 — eventful Vorsorge satisfaction. Resolve the user's
     // reminders against the just-landed readings now. Fire-and-forget.
-    void enqueueReminderSatisfy(user.id).catch(() => {});
+    fireAndForget(enqueueReminderSatisfy(user.id), {
+      action: "reminder.satisfy.enqueue",
+    });
 
     // v1.18.6 — absolute clinical safety-floor check on the just-written
     // readings (confirm-gated, module-gated, never diagnoses). The combined
@@ -828,19 +831,22 @@ async function postMeasurement(request: NextRequest) {
     // The transient per-entry `symptomsPresent` flag (ORed across the batch)
     // lifts a confirmed breach to the symptom-coupled emergency copy.
     // Fire-and-forget — a notification failure never fails the write.
-    void runSafetyFloorCheck({
-      userId: user.id,
-      written: results.map((r) => ({
-        type: r.type,
-        value: r.value,
-        measuredAt: r.measuredAt,
-        glucoseContext: r.glucoseContext,
-      })),
-      symptomsPresent: parsed.data.measurements.some(
-        (m) => m.symptomsPresent === true,
-      ),
-      timezone: user.timezone ?? undefined,
-    }).catch(() => {});
+    fireAndForget(
+      runSafetyFloorCheck({
+        userId: user.id,
+        written: results.map((r) => ({
+          type: r.type,
+          value: r.value,
+          measuredAt: r.measuredAt,
+          glucoseContext: r.glucoseContext,
+        })),
+        symptomsPresent: parsed.data.measurements.some(
+          (m) => m.symptomsPresent === true,
+        ),
+        timezone: user.timezone ?? undefined,
+      }),
+      { action: "measurement.safety_floor.check" },
+    );
 
     // v1.5.0 — refresh the persistent rollup table for every distinct
     // (type, day) the batch touched so the next analytics / coach read
@@ -967,7 +973,9 @@ async function postMeasurement(request: NextRequest) {
 
   // v1.18.1 — eventful Vorsorge satisfaction. Resolve the user's reminders
   // against the just-landed reading now. Fire-and-forget.
-  void enqueueReminderSatisfy(user.id).catch(() => {});
+  fireAndForget(enqueueReminderSatisfy(user.id), {
+    action: "reminder.satisfy.enqueue",
+  });
 
   // v1.18.6 — absolute clinical safety-floor check (confirm-gated,
   // module-gated, never diagnoses). A single-entry POST carries only one arm
@@ -975,19 +983,22 @@ async function postMeasurement(request: NextRequest) {
   // batch path; a lone glucose reading is evaluated here. The transient
   // `symptomsPresent` flag lifts a confirmed breach to the emergency copy.
   // Fire-and-forget — a notification failure never fails the write.
-  void runSafetyFloorCheck({
-    userId: user.id,
-    written: [
-      {
-        type: measurement.type,
-        value: measurement.value,
-        measuredAt: measurement.measuredAt,
-        glucoseContext: measurement.glucoseContext,
-      },
-    ],
-    symptomsPresent,
-    timezone: user.timezone ?? undefined,
-  }).catch(() => {});
+  fireAndForget(
+    runSafetyFloorCheck({
+      userId: user.id,
+      written: [
+        {
+          type: measurement.type,
+          value: measurement.value,
+          measuredAt: measurement.measuredAt,
+          glucoseContext: measurement.glucoseContext,
+        },
+      ],
+      symptomsPresent,
+      timezone: user.timezone ?? undefined,
+    }),
+    { action: "measurement.safety_floor.check" },
+  );
 
   // v1.5.0 — refresh the persistent rollup row for the affected
   // (type, day) tuple. Runs inline so the next read of the

src/app/api/withings/status/route.ts

@@ -83,7 +83,22 @@ export const GET = apiHandler(async () => {
       // the sync path does.
       const message = error instanceof Error ? error.message : String(error);
       if (isWithingsRefreshReauthFailure(message)) {
-        await markReauthRequired(user.id, "withings", message).catch(() => {});
+        // Awaited so the persisted re-auth state is reflected in this same
+        // status response — but a persistence failure must not fail the read.
+        // Breadcrumb it instead of swallowing silently (the message rides the
+        // central annotate/redact path, never the raw console).
+        await markReauthRequired(user.id, "withings", message).catch(
+          (error: unknown) => {
+            annotate({
+              meta: {
+                "fire_and_forget.integration.reauth.mark": {
+                  error: error instanceof Error ? error.message : String(error),
+                  provider: "withings",
+                },
+              },
+            });
+          },
+        );
       }
     }
   }