fix(measurements): hour-bucket a CGM glucose series inside the 90-day window

A sensor reading every five minutes puts about 26 000 glucose readings in
a 90-day window, and the per-kind series sent every one of them raw. The
hourly bucketing that already applies to a dense heart-rate stream now
applies to glucose too, with the same 10 000-reading cap: the hour's mean
converted once to the user's unit, statistics over every raw reading.
A fingerstick meter stays far under the cap and keeps its raw points.

The doctor report keeps glucose raw inside 90 days. Its clinical panel is
computed from the raw readings of every source, while the day path works
from canonical-source day buckets, so the two do not give the same figures
when a meter and a sensor overlap.

src/app/api/measurements/series/__tests__/route.test.ts

@@ -631,6 +631,85 @@ describe("GET /api/measurements/series — dense-kind day-bucketing (v1.28.25)",
     expect(bucketSql.slice(1)).toContain("hour");
   });
 
+  it("hour-buckets a CGM glucose window too dense to send raw, in the user's unit", async () => {
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({
+      glucoseUnit: "mmol/L",
+    } as never);
+    // A sensor reading every five minutes for 90 days.
+    vi.mocked(prisma.measurement.count).mockResolvedValue(25_920 as never);
+    vi.mocked(prisma.$queryRaw)
+      .mockResolvedValueOnce([
+        {
+          bucket_start: new Date("2026-06-01T08:00:00Z"),
+          mean: 100,
+          min_value: 90,
+          max_value: 112,
+        },
+      ] as never)
+      .mockResolvedValueOnce([
+        { n: 25_920, mean: 118.004, min: 48, max: 260, sd: 36.004 },
+      ] as never);
+
+    const res = await GET(req("kind=glucose&days=90"));
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      data: {
+        unit: string;
+        points: Array<Record<string, unknown>>;
+        stats: {
+          count: number;
+          mean: number;
+          min: number;
+          max: number;
+          stdDev: number;
+        };
+      };
+    };
+    expect(prisma.measurement.findMany).not.toHaveBeenCalled();
+    expect(vi.mocked(prisma.measurement.count).mock.calls[0]?.[0]).toEqual(
+      expect.objectContaining({
+        where: expect.objectContaining({ type: "BLOOD_GLUCOSE" }),
+      }),
+    );
+    expect(body.data.unit).toBe("mmol/L");
+    // Converted once at serialization; no band on a glucose point.
+    expect(body.data.points).toEqual([
+      {
+        id: "hour:2026-06-01T08:00:00.000Z",
+        at: "2026-06-01T08:00:00.000Z",
+        value: 5.5,
+        secondary: null,
+      },
+    ]);
+    // Stats describe every reading (mg/dL aggregate, converted once).
+    expect(body.data.stats).toEqual({
+      count: 25_920,
+      mean: 6.5,
+      min: 2.7,
+      max: 14.4,
+      stdDev: 2,
+    });
+    const bucketSql = vi.mocked(prisma.$queryRaw).mock.calls[0] as unknown[];
+    expect(bucketSql.slice(1)).toContain("hour");
+  });
+
+  it("keeps fingerstick glucose at or under the row cap raw", async () => {
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    vi.mocked(prisma.measurement.count).mockResolvedValue(360 as never);
+    vi.mocked(prisma.measurement.findMany).mockResolvedValue([
+      { id: "g1", value: 104, measuredAt: new Date("2026-06-01T07:12:00Z") },
+    ] as never);
+    const res = await GET(req("kind=glucose&days=90"));
+    const body = (await res.json()) as {
+      data: { points: Array<Record<string, unknown>> };
+    };
+    expect(prisma.$queryRaw).not.toHaveBeenCalled();
+    expect(body.data.points).toEqual([
+      { id: "g1", at: "2026-06-01T07:12:00.000Z", value: 104, secondary: null },
+    ]);
+  });
+
   it("keeps a pulse window at or under the row cap raw", async () => {
     vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
     vi.mocked(prisma.measurement.count).mockResolvedValue(10_000 as never);

src/app/api/measurements/series/route.ts

@@ -52,17 +52,20 @@ const DENSE_SERIES_RAW_WINDOW_DAYS = 90;
 const DENSE_SERIES_KINDS: ReadonlySet<string> = new Set(["glucose", "pulse"]);
 
 /**
- * #1023 — inside the raw window, a pulse series with more rows than this is
- * bucketed per local hour in SQL instead of sent raw.
+ * #1023 — inside the raw window, a pulse or glucose series with more rows
+ * than this is bucketed per local hour in SQL instead of sent raw.
  *
  * A watch that records heart rate once a minute puts 43 000 rows in the
  * default 30-day window and 130 000 in 90 days: a 15 MB response the client
  * could not draw at that resolution anyway, built from as many objects on the
- * server. Hourly buckets carry the hour's mean with its low/high band, the
- * shape an hourly-bucket import already has, and cap the answer at 24 points
- * a day. The cap sits far above what sparse sources produce (a cuff, hourly
- * buckets over 90 days, a watch sampling every five minutes over 30 days), so
- * those series stay raw and unchanged.
+ * server. A CGM reading every five minutes puts 26 000 glucose rows in 90
+ * days, the same problem at a smaller scale. Hourly buckets carry the hour's
+ * mean (pulse also its low/high band, the shape an hourly-bucket import
+ * already has) and cap the answer at 24 points a day; the statistics stay
+ * computed over every raw reading. The cap sits far above what sparse sources
+ * produce (a cuff, fingerstick glucose, hourly buckets over 90 days, a watch
+ * sampling every five minutes over 30 days), so those series stay raw and
+ * unchanged.
  */
 const DENSE_SERIES_RAW_ROW_CAP = 10_000;
 
@@ -368,18 +371,18 @@ export const GET = apiHandler(async (request: NextRequest) => {
     });
   } else if (
     (DENSE_SERIES_KINDS.has(kind) && days > DENSE_SERIES_RAW_WINDOW_DAYS) ||
-    (kind === "pulse" &&
+    (DENSE_SERIES_KINDS.has(kind) &&
       (await prisma.measurement.count({
         where: {
           userId: user.id,
-          type: "PULSE",
+          type: KIND_TO_TYPE[kind],
           measuredAt: { gte: since },
           deletedAt: null,
         },
       })) > DENSE_SERIES_RAW_ROW_CAP)
   ) {
-    // Day buckets past the raw window; hour buckets for a pulse stream too
-    // dense to send raw inside it.
+    // Day buckets past the raw window; hour buckets for a pulse or CGM
+    // stream too dense to send raw inside it.
     const grain = days > DENSE_SERIES_RAW_WINDOW_DAYS ? "day" : "hour";
     // v1.28.25 — long-window read of a sample-dense kind (CGM glucose,
     // per-sample / hourly pulse). Day-bucket in SQL instead of walking