docs: record the settings and ECG polish under Unreleased

The mobile-consistency spec follows the change-password card to Security —
same claim, new address.

CHANGELOG.md

@@ -65,6 +65,49 @@
   optimistic paint had promised this all along, and the skipped-to-taken flip
   in the same view already behaved this way.
 
+- The Appearance list in Settings had a strip of dead space above every row
+  that the first row did not have — 24 px on a desktop, 16 px on a phone,
+  unclickable, sitting between one module and the next. The rows read a step
+  apart from the top of their own list. They now sit the same distance from
+  the line above them, and the geometry sweep measures it so it cannot drift
+  back.
+
+- The Account settings page is the profile again. Cycle tracking is a module
+  and its switch lives in the Modules hub, so the second on-ramp here is gone
+  along with the "manage in Account" link beside that switch, which pointed at
+  an anchor nothing rendered. Changing the password moved to Security, where
+  the second factors and the passkeys already are, and it leads that page.
+
+- Five module rows ran two to three times longer than their thirteen
+  neighbours: environment, external assistant access, documents, mental
+  wellbeing and nutrient intake. Every one of them ended in "off by default",
+  restating what the switch beside the row already shows. They are one
+  sentence now, like the rest. The mental-wellbeing row also named two
+  screeners where the module ships four, and what happens to your answers is
+  now said on the mental-wellbeing page itself, where you are about to give
+  them.
+
+- Research Mode is retired. It was an opt-in for the estimated GLP-1 level
+  curve, but that chart stopped consulting the flag several releases ago and
+  has been visible to everyone since — so the switch on the Advanced page
+  changed no screen in either position. The curve is simply part of the
+  medication page, and the switch, its acknowledgment dialog, and the stored
+  acknowledgment are gone. Advanced is now what it reads as: reset the data,
+  delete the account.
+
+- The ECG page opened with three lines about what HealthLog does not do
+  before showing a single recording, two of them saying the same thing. They
+  are gone; the recording's own page still states that the result shown is
+  the device's. The device's verdict now rides the timestamp as a tag instead
+  of taking a line of its own, the list shows the five most recent strips
+  rather than every one ever recorded, and a recording has its own address
+  with the back link above the heading, so a strip can be linked to and the
+  browser's own Back works.
+
+- An entry in the record switcher no longer carries the access level on a
+  line of its own. In a menu that narrow it was truncated more often than it
+  was read, and the banner states it in full once you are inside the record.
+
 ## [1.37.1] — 2026-08-08
 
 ### Added

e2e/settings-mobile-consistency.spec.ts

@@ -93,22 +93,22 @@ test.describe("Settings mobile consistency (Pixel 5)", () => {
     }
   });
 
-  test("/settings/account: action buttons do not overflow their cards", async ({
+  test("/settings/security: action buttons do not overflow their cards", async ({
     page,
   }) => {
-    await page.goto("/settings/account", { waitUntil: "networkidle" });
+    // The change-password card sits on Security now, beside the second
+    // factors and the passkeys. The claim is unchanged; the address is not.
+    await page.goto("/settings/security", { waitUntil: "networkidle" });
     // Same reason as the grid test below: gate on the element, not the
     // network, because the read underneath it happens exactly once.
     await expect(
       page.getByRole("button", { name: /change password/i }),
     ).toBeVisible();
 
-    // The account page's action button(s) must live within (or above the
-    // bottom of) the parent card. Since v1.18.1 the "restart onboarding"
-    // tour button moved to Settings → Advanced, so account carries the
-    // change-password button; the tour button is matched here too in case
-    // it is present. On mobile the button stacks below the title — it's
+    // The page's action button(s) must live within (or above the bottom of)
+    // the parent card. On mobile the button stacks below the title — it is
     // allowed to extend the card's height, but not push past the right edge.
+    // The German "Passwort ändern" is the long case this was written for.
     const overflowCheck = await page.evaluate(() => {
       const buttons = Array.from(document.querySelectorAll("button"));
       const targets = buttons.filter((b) => {
@@ -134,7 +134,7 @@ test.describe("Settings mobile consistency (Pixel 5)", () => {
 
     expect(
       overflowCheck.length,
-      "expected to find the change-password action button on /settings/account",
+      "expected to find the change-password action button on /settings/security",
     ).toBeGreaterThanOrEqual(1);
 
     for (const t of overflowCheck) {