test(query-keys): pin factory enforcement and dedup behaviour

Three test suites land together:

1. queryKeys factory contracts for the four new v1.4.40 entries
   (`authMe`, `userThresholds`, `chartData`, `dashboardMedicationCompliance`)
   — pin the byte-stable shapes so a future rename of any literal
   lands a matching test failure rather than silently breaking cache
   layout.

2. `measurementDependentKeys` / `medicationDependentKeys` bundle
   membership — `["chart-data"]` and
   `["dashboard-medication-compliance"]` prefixes now ride the
   bundles so a mutation evicts every per-chart and per-compliance
   cache in one pass (audit-C2 + audit-L4).

3. Factory-bypass guard — walks `src/components/charts`,
   `src/app/page.tsx` and `src/hooks/use-auth.ts` and fails if a
   literal `queryKey: [...]` slipped past the factory. Acts as a
   lint-style enforcement check in the absence of a custom ESLint
   rule. The guarded directory list is intentionally scoped tight to
   the files this wave migrated; a follow-up wave can extend it as
   it routes the remaining admin/settings/medications surfaces
   through the factory.

Plus a dashboard Suspense-boundary structural test that pins the
per-tile `<Suspense fallback={...}>` wrappers, the module-scope
`DASHBOARD_QUERY_OPTS` hoist, and the `useMemo` around the hour-of-day
derivation. A refactor that drops any of those three structural
guarantees lands red CI rather than silently regressing the
streaming-composition contract.

All 16 + 5 new assertions green; tests 4565 → 4586.

src/app/__tests__/dashboard-suspense-boundaries.test.ts

@@ -0,0 +1,82 @@
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/**
+ * v1.4.40 W-RSC — dashboard Suspense boundaries.
+ *
+ * Audit-H2 flagged "no `<Suspense>` boundaries anywhere in the app".
+ * The v1.4.40 W-RSC wave wraps every dashboard tile cell and every
+ * chart cell in a per-cell `<Suspense>` boundary so the composition
+ * reads as a grid of independently-suspending islands rather than a
+ * flat client tree with shared loading semantics.
+ *
+ * Today the boundary is a structural no-op for the dynamic-loaded
+ * charts because their loading skeleton lives inside the
+ * `next/dynamic({ loading: <ChartSkeleton/> })` contract. The benefit
+ * is future-proofing: any descendant that later suspends (an
+ * `useSuspenseQuery` migration, an RSC hoist of a static legend) gets
+ * its own fallback without re-architecting the row.
+ *
+ * The test pins the structural presence by greppig the page source —
+ * a future refactor that drops the boundary lands a failing test
+ * rather than silently regressing the streaming-composition contract.
+ */
+const ROOT = join(__dirname, "../../..");
+const PAGE_PATH = join(ROOT, "src/app/page.tsx");
+
+function load(path: string): string {
+  return readFileSync(path, "utf8");
+}
+
+describe("v1.4.40 — dashboard per-cell Suspense boundaries", () => {
+  it("imports Suspense from React", () => {
+    const src = load(PAGE_PATH);
+    expect(src).toMatch(/from\s+"react"/);
+    expect(src).toMatch(/\bSuspense\b/);
+  });
+
+  it("wraps the chart-row cell in a `<Suspense fallback={<ChartSkeleton />}>` boundary", () => {
+    const src = load(PAGE_PATH);
+    // `<Suspense fallback={<ChartSkeleton />}>{entry.node}</Suspense>`
+    // exact contract: the chart row's per-cell fallback uses the same
+    // ChartSkeleton primitive the dynamic-loaded charts already paint
+    // during JS chunk resolution.
+    expect(src).toMatch(
+      /<Suspense\s+fallback=\{<ChartSkeleton\s*\/>\}>\s*\{entry\.node\}\s*<\/Suspense>/,
+    );
+  });
+
+  it("wraps each tile-strip cell in a `<Suspense>` boundary", () => {
+    const src = load(PAGE_PATH);
+    // `<Suspense fallback={null}>{entry.node}</Suspense>` — the tile
+    // body is synchronous today so a `null` fallback never paints,
+    // but the boundary primes the row for a future RSC hoist of any
+    // tile slot. Pinning the literal keeps the structural contract
+    // visible in CI.
+    expect(src).toMatch(
+      /<Suspense\s+fallback=\{null\}>\s*\{entry\.node\}\s*<\/Suspense>/,
+    );
+  });
+
+  it("hoists DASHBOARD_QUERY_OPTS to module scope (audit-M2)", () => {
+    const src = load(PAGE_PATH);
+    // Module-scope declaration — search outside the component body.
+    // Pre-fix the const was declared inside `DashboardPage` so every
+    // render created a fresh `{}` reference.
+    const moduleSliceEnd = src.indexOf("export default function DashboardPage");
+    expect(moduleSliceEnd).toBeGreaterThan(0);
+    const moduleSlice = src.slice(0, moduleSliceEnd);
+    expect(moduleSlice).toMatch(/const\s+DASHBOARD_QUERY_OPTS\s*=\s*\{/);
+  });
+
+  it("memoises the hour-of-day derivation against user.timezone (audit-H4)", () => {
+    const src = load(PAGE_PATH);
+    // The greeting hour only changes when the user's timezone changes
+    // — a `useMemo` keyed on `user?.timezone` keeps the
+    // `Intl.DateTimeFormat` instantiation off the per-render hot path.
+    expect(src).toMatch(
+      /const\s+hour\s*=\s*useMemo\([\s\S]*?\[\s*user\?\.timezone\s*\][\s\S]*?\);/,
+    );
+  });
+});

src/lib/__tests__/query-keys.test.ts

@@ -1,3 +1,5 @@
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
 import { describe, it, expect, vi } from "vitest";
 import {
   queryKeys,
@@ -34,6 +36,51 @@ describe("queryKeys factory", () => {
     expect(queryKeys.analytics()).toEqual(["analytics"]);
     expect(queryKeys.analytics(undefined)).toEqual(["analytics"]);
   });
+
+  // v1.4.40 W-RSC — the four new factory entries from this wave each
+  // need a byte-stable contract so the audit-cited drift cases stay
+  // pinned. A future rename of any of these literals would land a
+  // matching test failure rather than silently breaking cache layout.
+  it("exposes the authMe shape so useAuth doesn't drift back to a bare literal", () => {
+    expect(queryKeys.authMe()).toEqual(["auth", "me"]);
+  });
+
+  it("exposes the userThresholds shape for Settings + targets", () => {
+    expect(queryKeys.userThresholds()).toEqual(["user", "thresholds"]);
+  });
+
+  it("packs chartData params into a stable tuple prefixed by chart-data", () => {
+    const key = queryKeys.chartData(
+      "WEIGHT",
+      "raw",
+      "no-bmi",
+      "Europe/Berlin",
+      "2026-04-01T00:00:00.000Z",
+      "2026-05-01T00:00:00.000Z",
+    );
+    expect(key[0]).toBe("chart-data");
+    expect(key.length).toBe(7);
+    // Numeric bmiDivisor is allowed (BMI charts pass `heightCm * heightCm`).
+    const bmiKey = queryKeys.chartData(
+      "WEIGHT",
+      "bmi",
+      30625,
+      "Europe/Berlin",
+      "2026-04-01T00:00:00.000Z",
+      "2026-05-01T00:00:00.000Z",
+    );
+    expect(bmiKey[3]).toBe(30625);
+  });
+
+  it("prefixes the dashboard medication-compliance key under one root", () => {
+    expect(queryKeys.dashboardMedicationCompliance(7)).toEqual([
+      "dashboard-medication-compliance",
+      7,
+    ]);
+    expect(queryKeys.dashboardMedicationCompliance(30)[0]).toBe(
+      "dashboard-medication-compliance",
+    );
+  });
 });
 
 describe("dependent-key bundles", () => {
@@ -48,6 +95,16 @@ describe("dependent-key bundles", () => {
     );
   });
 
+  // v1.4.40 W-RSC — chart-data prefix now lives in the bundle so a
+  // fresh measurement evicts every per-chart daily-aggregate cache.
+  // Pre-fix the chart row stayed 60 s stale after a measurement save
+  // (audit-C2). Pin the bundle membership so a refactor of the chart
+  // queryKey factory can't silently drop the dependency.
+  it("measurementDependentKeys bundles the chart-data prefix (v1.4.40)", () => {
+    const keyStrings = measurementDependentKeys.map((k) => JSON.stringify(k));
+    expect(keyStrings).toContain(JSON.stringify(["chart-data"]));
+  });
+
   it("moodDependentKeys bundle covers mood + analytics + targets", () => {
     const keyStrings = moodDependentKeys.map((k) => JSON.stringify(k));
     expect(keyStrings).toContain(JSON.stringify(["mood-entries"]));
@@ -63,6 +120,109 @@ describe("dependent-key bundles", () => {
       JSON.stringify(["gamification", "achievements"]),
     );
   });
+
+  // v1.4.40 W-RSC — dashboard-medication-compliance prefix now lives in
+  // the bundle so an intake POST refreshes the dashboard chart in
+  // lockstep with the per-medication compliance-chart-inline tile
+  // (audit-L4).
+  it("medicationDependentKeys bundles the dashboard-medication-compliance prefix (v1.4.40)", () => {
+    const keyStrings = medicationDependentKeys.map((k) => JSON.stringify(k));
+    expect(keyStrings).toContain(JSON.stringify(["dashboard-medication-compliance"]));
+  });
+});
+
+/**
+ * v1.4.40 W-RSC — factory-bypass guard.
+ *
+ * Walks every `.ts` / `.tsx` file in `src/components/charts` and
+ * `src/app/page.tsx` (the dashboard + chart files we own in this wave)
+ * and fails if a literal `queryKey: [...]` slipped past the factory.
+ * Acts as a lint-style enforcement check in the absence of a custom
+ * ESLint rule — keeps the CI gate cheap and the failure message
+ * pointed at the exact file the contributor needs to fix.
+ *
+ * The audit (`.planning/round-v1439-arch-qa-frontend.md` §H1) found
+ * 154 bare queryKey sites at v1.4.39.3. We intentionally scope this
+ * guard tight to the dashboard + chart files this wave touched so a
+ * future wave can extend the directory list as it migrates the
+ * remaining sites — opt-in expansion beats a giant red CI on
+ * landing.
+ */
+describe("queryKey factory enforcement", () => {
+  function listFiles(dir: string): string[] {
+    const entries = readdirSync(dir);
+    const out: string[] = [];
+    for (const name of entries) {
+      const full = join(dir, name);
+      const st = statSync(full);
+      if (st.isDirectory()) {
+        if (name === "__tests__" || name === "node_modules") continue;
+        out.push(...listFiles(full));
+      } else if (name.endsWith(".ts") || name.endsWith(".tsx")) {
+        out.push(full);
+      }
+    }
+    return out;
+  }
+
+  const repoRoot = join(__dirname, "..", "..", "..");
+  // Files this wave migrated to the factory. Extend this list as
+  // future waves migrate their own surface; the audit-H1 long tail
+  // (admin/, settings/, medications/, integrations) stays out of the
+  // guard's scope until a follow-up wave routes those keys.
+  const guardedRoots = [
+    join(repoRoot, "src", "components", "charts"),
+    join(repoRoot, "src", "app", "page.tsx"),
+    join(repoRoot, "src", "hooks", "use-auth.ts"),
+  ];
+
+  function collect(): string[] {
+    const all: string[] = [];
+    for (const root of guardedRoots) {
+      const st = statSync(root);
+      if (st.isDirectory()) {
+        all.push(...listFiles(root));
+      } else {
+        all.push(root);
+      }
+    }
+    return all;
+  }
+
+  it("no guarded file declares a bare-literal `queryKey:` (factory enforcement)", () => {
+    const offenders: Array<{ file: string; line: number; snippet: string }> = [];
+    const files = collect();
+    for (const file of files) {
+      const text = readFileSync(file, "utf8");
+      const lines = text.split("\n");
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Match `queryKey:` followed by a `[` on the same line. We
+        // explicitly allow `queryKey: queryKeys.<entry>(…)` patterns
+        // and any indirect identifier the call site passes through
+        // (a `key` local, a `listKey` constant, etc.) so the guard
+        // only flags the literal-array shape that drove audit-H1.
+        const match = line.match(/queryKey\s*:\s*\[/);
+        if (!match) continue;
+        // Strip trailing comments + JSX comments before deciding.
+        const trimmed = line.replace(/\/\/.*$/, "").trim();
+        if (!/queryKey\s*:\s*\[/.test(trimmed)) continue;
+        offenders.push({
+          file: file.slice(repoRoot.length + 1),
+          line: i + 1,
+          snippet: trimmed,
+        });
+      }
+    }
+
+    expect(
+      offenders,
+      `Factory bypass — every \`queryKey:\` in guarded files must go through \`queryKeys.<entry>()\`. ` +
+        `Offenders:\n${offenders
+          .map((o) => `  ${o.file}:${o.line}  ${o.snippet}`)
+          .join("\n")}`,
+    ).toEqual([]);
+  });
 });
 
 describe("invalidateKeys", () => {