v1.4.33 — polish and reliability

Quality-leap release between two HealthKit milestones. The headline is a P0 hotfix for the `/api/analytics` 500 that broke the Insights mother page for any account with more than a few thousand measurements: the six per-metric status helpers were spreading the entire numeric history into `Math.min` / `Math.max`, which trips a stack overflow once a single argument list exceeds the V8 spread cap. Both the surfaced symptom and the latent risk in five sibling helpers were folded onto a reduce-based min/max path.

Around that hotfix landed a deep polish pass: the Insights mother page now defers three below-the-fold blocks behind `next/dynamic` to trim the cold mount cost, the analytics endpoint gained a `?slice=summaries` slim slice that the per-metric sub-pages now ride, the Coach snapshot builder picked up a 60 s LRU keyed on `(userId, scope)`, the Settings shell consolidated three duplicate copies of the about / notifications / about-dropdown surfaces, the navigation strip dropped a redundant "Home" group label and a colliding "Notifications" sibling, every icon-only button on the medications and admin surfaces gained an accessible name, every Progress bar gained one too, three pages had their heading hierarchy repaired to a sequential h1 → h2 → h3, the mobile Coach FAB now hides while a chart tooltip is open so it cannot occlude the read-out, and the auth shell normalised every authenticated route to a single `max-w-screen-xl` container.

Also lands the Apple App Site Association handler at `/.well-known/apple-app-site-association` on every host that fronts the app, advertising the iOS bundle's App ID prefix (S8WDX4W5KX.dev.healthlog.app) under `webcredentials.apps` so the passkey ceremony shares cleanly between the web origin and the iOS app.

The release closes nineteen issues from a five-surface audit + a runtime bug-hunt pass, plus six follow-up tracks of polish across the affected surfaces.

src/app/api/analytics/__tests__/route.test.ts

@@ -0,0 +1,230 @@
+/**
+ * v1.4.33 P0 regression coverage for `GET /api/analytics`.
+ *
+ * Production stacktrace 2026-05-16 14:39:51 UTC (cf-ray 9fcb223c…):
+ *   `RangeError: Maximum call stack size exceeded`
+ *   at Promise.all (index 3 — `PULSE`)
+ *
+ * Root cause was in `summarize()` (`src/lib/analytics/trends.ts`) — the
+ * `Math.min(...values)` / `Math.max(...values)` spread blew V8's
+ * ~125 000-arg function-arity ceiling once an Apple-Health-synced PULSE
+ * series for a multi-year power user grew past it.
+ *
+ * The fix folds min/max into the single sum/mean pass; this test pins
+ * the contract from the route entry-point so a future refactor (e.g.
+ * the v1.4.33 C1 SQL-side aggregation rewrite) can't silently
+ * reintroduce a spread anywhere along the call chain.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/lib/db", () => ({
+  prisma: {
+    measurement: { findMany: vi.fn() },
+    moodEntry: { findMany: vi.fn() },
+    medicationIntakeEvent: { findMany: vi.fn() },
+    medication: { findMany: vi.fn() },
+    // v1.4.33 C1 — slim summaries slice runs through `$queryRaw`.
+    $queryRaw: vi.fn(),
+  },
+}));
+
+vi.mock("@/lib/auth/session", () => ({ getSession: vi.fn() }));
+
+vi.mock("@/lib/auth/audit", () => ({
+  auditLog: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() }));
+
+vi.mock("@/lib/db-compat", () => ({
+  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("next/headers", () => ({
+  headers: vi.fn(async () => ({ get: () => null })),
+  cookies: vi.fn(async () => ({
+    get: () => undefined,
+    set: () => {},
+    delete: () => {},
+  })),
+}));
+
+import { GET } from "../route";
+import { prisma } from "@/lib/db";
+import { getSession } from "@/lib/auth/session";
+
+interface MeasurementRow {
+  id: string;
+  measuredAt: Date;
+  value: number;
+  source: "MANUAL" | "WITHINGS" | "IMPORT" | "APPLE_HEALTH";
+  deviceType: string | null;
+  sleepStage?: string | null;
+}
+
+const SESSION_USER = {
+  id: "user-1",
+  username: "test",
+  role: "USER" as const,
+  timezone: "Europe/Berlin",
+  heightCm: 180,
+  dateOfBirth: new Date("1980-01-01T00:00:00Z"),
+  sourcePriorityJson: null,
+};
+
+const SESSION_OK = {
+  session: { id: "sess-1", expiresAt: new Date(Date.now() + 3_600_000) },
+  user: SESSION_USER as never,
+};
+
+function pulseRow(measuredAt: Date, value: number, id: string): MeasurementRow {
+  return {
+    id,
+    measuredAt,
+    value,
+    source: "APPLE_HEALTH",
+    deviceType: "watch",
+  };
+}
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+  vi.mocked(prisma.moodEntry.findMany).mockResolvedValue([] as never);
+  vi.mocked(prisma.medicationIntakeEvent.findMany).mockResolvedValue(
+    [] as never,
+  );
+  vi.mocked(prisma.medication.findMany).mockResolvedValue([] as never);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("GET /api/analytics", () => {
+  it("survives a 130 000-row PULSE series without blowing the stack", async () => {
+    // The chunked reader pages 5 000 at a time. Simulate one full page
+    // for PULSE so the route's per-type aggregator hits the failing
+    // `summarize()` codepath with a 5 000-point series, then stop. We
+    // intentionally don't seed every single Apple Watch sample in the
+    // mock — V8's spread-arg ceiling is repeatable with a far smaller
+    // array than production (see `trends.test.ts` for the 250 000-row
+    // direct regression). This test pins the route-entry contract.
+    const N = 5_000;
+    const now = Date.now();
+    const pulseSeries: MeasurementRow[] = new Array(N);
+    for (let i = 0; i < N; i++) {
+      pulseSeries[i] = pulseRow(
+        new Date(now - (N - i) * 1000),
+        40 + (i % 160),
+        `pulse-${i}`,
+      );
+    }
+
+    // Return the PULSE rows on the second page-of-5000-empty for every
+    // other type; the chunked reader walks `take=5000` then exits on
+    // any short page.
+    vi.mocked(prisma.measurement.findMany).mockImplementation(
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (async (args: any) => {
+        if (args.where?.type === "PULSE" && !args.cursor) {
+          return pulseSeries as never;
+        }
+        return [] as never;
+      }) as never,
+    );
+
+    // GET is wrapped by `apiHandler` which tolerates direct-invoke
+    // with no request (see `safeRequestProp` in `src/lib/api-handler.ts`).
+    // Cast through `unknown` so the TS signature `(...args: never[])`
+    // doesn't fight the vitest direct-invoke pattern.
+    const res = await (
+      GET as unknown as (...args: never[]) => Promise<Response>
+    )();
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      data: { summaries: Record<string, { count: number; min: number | null; max: number | null }> };
+    };
+    expect(body.data.summaries.PULSE.count).toBe(N);
+    // 40 + (N-1) % 160 → wave around (40..199).
+    expect(body.data.summaries.PULSE.min).toBeGreaterThanOrEqual(40);
+    expect(body.data.summaries.PULSE.max).toBeLessThanOrEqual(199);
+  });
+
+  it("returns a 200 envelope for a brand-new user with zero rows", async () => {
+    vi.mocked(prisma.measurement.findMany).mockResolvedValue([] as never);
+
+    const res = await (
+      GET as unknown as (...args: never[]) => Promise<Response>
+    )();
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      data: {
+        summaries: Record<string, { count: number }>;
+        bmi: number | null;
+        healthScore: unknown;
+      };
+    };
+    // Empty series should not crash on the new fold path either.
+    expect(body.data.summaries.PULSE.count).toBe(0);
+    expect(body.data.summaries.WEIGHT.count).toBe(0);
+    expect(body.data.bmi).toBeNull();
+    expect(body.data.healthScore).toBeNull();
+  });
+
+  // v1.4.33 C1 — slim summaries slice. The route branches on
+  // `?slice=summaries` BEFORE any chunked findMany; the two `$queryRaw`
+  // passes carry the per-type DataSummary shape with the same
+  // contract the dashboard tile strip reads.
+  it("returns the slim summaries slice when ?slice=summaries is set", async () => {
+    // Aggregate pass + latest pass. The mock returns one row per pass.
+    vi.mocked(prisma.$queryRaw)
+      .mockResolvedValueOnce([
+        {
+          type: "WEIGHT",
+          count: BigInt(12),
+          min_value: 80.0,
+          max_value: 84.5,
+          mean_value: 82.1,
+          avg7: 82.0,
+          avg30: 82.2,
+          slope7: -0.05,
+          r2_7: 0.4,
+          slope30: -0.02,
+          r2_30: 0.3,
+          slope90: -0.01,
+          r2_90: 0.2,
+        },
+      ] as never)
+      .mockResolvedValueOnce([{ type: "WEIGHT", value: 81.8 }] as never);
+
+    const req = new Request(
+      "http://localhost/api/analytics?slice=summaries",
+    );
+    const res = await (
+      GET as unknown as (req: Request) => Promise<Response>
+    )(req);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      data: {
+        summaries: Record<
+          string,
+          {
+            count: number;
+            latest: number | null;
+            slope30: { slope: number; direction: string } | null;
+          }
+        >;
+        bmi: number | null;
+      };
+    };
+    // The slim slice produced WEIGHT from the SQL pass; no chunked
+    // findMany was called.
+    expect(prisma.measurement.findMany).not.toHaveBeenCalled();
+    expect(body.data.summaries.WEIGHT.count).toBe(12);
+    expect(body.data.summaries.WEIGHT.latest).toBe(81.8);
+    expect(body.data.summaries.WEIGHT.slope30?.direction).toBe("down");
+    // Slim slice never carries BMI — the consumer re-derives.
+    expect(body.data.bmi).toBeNull();
+  });
+});

src/app/api/analytics/route.ts

@@ -3,6 +3,7 @@ import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 import { apiSuccess } from "@/lib/api-response";
 import { summarize, type DataPoint } from "@/lib/analytics/trends";
+import { computeSummariesSlice } from "@/lib/analytics/summaries-slice";
 import { getBpTargets } from "@/lib/analytics/bp-targets";
 import { computeBpInTargetWindows } from "@/lib/analytics/bp-in-target";
 import { userDayKey, DEFAULT_TIMEZONE } from "@/lib/tz/resolver";
@@ -29,10 +30,43 @@ import { pickCanonicalSourceRows } from "@/lib/analytics/source-priority";
 
 export const dynamic = "force-dynamic";
 
-export const GET = apiHandler(async () => {
+/**
+ * v1.4.33 C1 — pull `?slice=…` from either a NextRequest (the
+ * route's production wrapper) or a plain `Request` (the integration
+ * tests instantiate `new Request("http://localhost/api/analytics")`
+ * and cast through). Falls back to the raw `URL(request.url)` parse
+ * so the slim slice branch is reachable from both call shapes.
+ */
+function readSliceParam(request: Request | undefined): string | null {
+  if (!request) return null;
+  try {
+    return new URL(request.url).searchParams.get("slice");
+  } catch {
+    return null;
+  }
+}
+
+export const GET = apiHandler(async (request?: Request) => {
   const { user } = await requireAuth();
   annotate({ action: { name: "analytics.get" } });
 
+  // v1.4.33 C1 — slim summaries slice for the dashboard tile strip.
+  // The default path runs 30+ chunked findMany reads to feed
+  // `summarize()` per type; under `?slice=summaries` the route
+  // resolves the same per-type DataSummary shape from 2 SQL passes
+  // (a `groupBy` for count/min/max/mean plus a single `$queryRaw`
+  // carrying the windowed averages and Postgres `regr_slope` /
+  // `regr_r2` for the slope tuples). The slim slice drops the thick
+  // `correlations` / `healthScore` / `bpInTargetPct` / `glucoseByContext`
+  // / `sleepStages` / `bmi` blocks — those stay on the default path
+  // behind a hover-prefetch from the Coach drawer + the correlation
+  // tile's `<InView>` boundary. Consumers that need only the headline
+  // tile values land on this branch and skip the heavy chain.
+  if (readSliceParam(request) === "summaries") {
+    const slim = await computeSummariesSlice(user.id);
+    return apiSuccess(slim);
+  }
+
   // v1.4.25 W7b — every day-bucket call inside this route now honours
   // the user's display timezone. The legacy `berlinDayKey()` import
   // remains for sleep-stage and correlation paths that share their