Merge remote-tracking branch 'origin/release/v1.46.0' into feat/v146-ui

# Conflicts:
#	src/__tests__/baselines/source-function-lines.json
#	src/__tests__/baselines/version-stamp-comments.json

src/__tests__/baselines/source-file-lines.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Production files over 800 lines and their length. Maintained by src/__tests__/source-size-ratchet.test.ts.",
-  "count": 91,
-  "total": 101342,
+  "count": 90,
+  "total": 100487,
   "entries": {
     "app/medications/page-client.tsx": 839,
     "components/charts/mood-chart.tsx": 1166,
@@ -12,7 +12,6 @@
     "components/insights/derived/vitals-dashboard.tsx": 1033,
     "components/insights/health-score-card.tsx": 1023,
     "components/insights/insights-tab-strip.tsx": 1086,
-    "components/layout/sidebar-nav.tsx": 855,
     "components/measurements/measurement-form.tsx": 815,
     "components/medications/detail/medication-detail-tabs.tsx": 1160,
     "components/medications/medication-table.tsx": 853,

src/__tests__/baselines/source-function-lines.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Production functions over 200 lines, keyed \"file :: name\", and their length. Maintained by src/__tests__/source-size-ratchet.test.ts.",
   "count": 355,
-  "total": 114755,
+  "total": 114640,
   "entries": {
     "app/achievements/page.tsx :: AchievementsPage": 206,
     "app/api/admin/backups/upload/route.ts :: apiHandler(arg)": 314,
@@ -143,10 +143,10 @@
     "components/labs/lab-list.tsx :: LabList": 308,
     "components/labs/ocr-review-dialog.tsx :: OcrReviewDialog": 359,
     "components/labs/ocr-row-editor.tsx :: OcrRowEditor": 393,
-    "components/layout/auth-shell.tsx :: AuthShell": 520,
+    "components/layout/auth-shell.tsx :: AuthShell": 518,
     "components/layout/bottom-nav.tsx :: BottomNav": 262,
     "components/layout/capture-picker.tsx :: CapturePicker": 235,
-    "components/layout/sidebar-nav.tsx :: SidebarNav": 372,
+    "components/layout/sidebar-nav.tsx :: SidebarNav": 356,
     "components/layout/top-bar.tsx :: TopBar": 212,
     "components/links/entity-link-picker.tsx :: EntityLinkPicker": 392,
     "components/measurement-reminders/vorsorge-dashboard-card.tsx :: VorsorgeDashboardCard": 215,
@@ -200,7 +200,7 @@
     "components/settings/ai/codex-provider-form.tsx :: CodexProviderForm": 280,
     "components/settings/ai/fallback-chain-card.tsx :: FallbackChainCard": 228,
     "components/settings/ai/runtime-actions-row.tsx :: RuntimeActionsRow": 282,
-    "components/settings/api-section.tsx :: ApiTokensCard": 366,
+    "components/settings/api-section.tsx :: ApiTokensCard": 269,
     "components/settings/coach-nudge-card.tsx :: CoachNudgeCard": 251,
     "components/settings/coach-prefs-section.tsx :: CoachPrefsSection": 350,
     "components/settings/environment-section.tsx :: EnvironmentSection": 666,

src/__tests__/baselines/version-stamp-comments.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Comment lines that open with a release version, per file under src/. Maintained by src/__tests__/version-stamp-ratchet.test.ts.",
   "count": 2898,
-  "total": 9296,
+  "total": 9294,
   "entries": {
     "__tests__/account-payload-consumer-guard.test.ts": 2,
     "__tests__/acting-account-boundary-guard.test.ts": 7,
@@ -1098,7 +1098,7 @@
     "components/layout/__tests__/shared-record-chrome.test.tsx": 1,
     "components/layout/__tests__/sidebar-nav.test.tsx": 3,
     "components/layout/account-switcher-menu.tsx": 1,
-    "components/layout/auth-shell.tsx": 15,
+    "components/layout/auth-shell.tsx": 14,
     "components/layout/bottom-nav.tsx": 8,
     "components/layout/capture-picker.tsx": 5,
     "components/layout/nav-model.ts": 17,
@@ -1359,7 +1359,7 @@
     "components/settings/ai/response-timeout-card.tsx": 1,
     "components/settings/ai/shared.ts": 4,
     "components/settings/anamnesis-section.tsx": 2,
-    "components/settings/api-section.tsx": 2,
+    "components/settings/api-section.tsx": 1,
     "components/settings/coach-memory-section.tsx": 3,
     "components/settings/coach-nudge-card.tsx": 4,
     "components/settings/coach-prefs-section.tsx": 2,

src/__tests__/external-source-token-link-guard.test.ts

@@ -0,0 +1,84 @@
+/**
+ * Every write that labels a measurement `EXTERNAL` also links it to the token
+ * that carried it (#1272).
+ *
+ * The label and the link answer one question together: whether the HealthLog
+ * app writes the reading into Apple Health is the choice its person made for
+ * that token (`apple-health-mirror.ts`). An EXTERNAL row written without the
+ * link resolves to false forever, whatever the token says, and nothing in the
+ * write path would notice. So the files that resolve `EXTERNAL_SOURCE` are an
+ * inventory: a measurement writer must set `ingestTokenId` at least as often
+ * as it assigns the label, and a file that starts using the constant fails
+ * here until it is classified.
+ *
+ * A tripwire, not a proof: it counts, it does not trace data flow. The
+ * behaviour is pinned by `tests/integration/apple-health-mirror.test.ts`.
+ */
+import { describe, expect, it } from "vitest";
+import { join } from "node:path";
+
+import {
+  readSourceText,
+  stripComments,
+  walkSourceFiles,
+} from "./helpers/source-files";
+
+const SRC = join(process.cwd(), "src");
+
+/** Files that write measurement rows labelled with the constant. */
+const MEASUREMENT_WRITERS = [
+  "lib/measurements/batch-ingest/prepare.ts",
+  "lib/measurements/create/create-readings.ts",
+  "lib/measurements/create/create-sleep-stage.ts",
+];
+
+/** Files that use the constant for something other than a measurement write. */
+const NOT_MEASUREMENT_WRITES: Record<string, string> = {
+  "app/api/tokens/measurements/route.ts":
+    "counts the readings that belong to no token (a read)",
+  "lib/validations/measurement.ts": "the source enum and the edit allowlist",
+  "lib/workouts/batch-ingest/entries.ts":
+    "labels workout rows, which carry no token link",
+};
+
+function usesOfConstant(rel: string): {
+  assignments: number;
+  links: number;
+} {
+  const code = stripComments(readSourceText(join(SRC, rel)));
+  const assignments = (code.match(/\?\s*EXTERNAL_SOURCE\b/g) ?? []).length;
+  // A value written under the key, or the shorthand. Not a type member
+  // (`ingestTokenId: string | null`) and not a read (`writer.ingestTokenId`),
+  // which write nothing.
+  const links = (
+    code.match(/(?<![.\w])ingestTokenId(?:\s*:(?!\s*string\b)|\s*[,}])/g) ?? []
+  ).length;
+  return { assignments, links };
+}
+
+describe("an EXTERNAL measurement carries its token", () => {
+  const files = walkSourceFiles(SRC, { floor: 3000 })
+    .filter((p) => !p.startsWith("generated/"))
+    .filter((p) => !p.includes("__tests__"))
+    .filter((p) => !/\.test\.tsx?$/.test(p))
+    .filter((p) => p !== "lib/measurements/external-source.ts")
+    .filter((p) =>
+      /\bEXTERNAL_SOURCE\b/.test(stripComments(readSourceText(join(SRC, p)))),
+    );
+
+  it("knows every file that uses the constant", () => {
+    expect(files.length).toBeGreaterThan(0);
+    expect(files).toEqual(
+      [...MEASUREMENT_WRITERS, ...Object.keys(NOT_MEASUREMENT_WRITES)].sort(),
+    );
+  });
+
+  it.each(MEASUREMENT_WRITERS)(
+    "%s links the token wherever it assigns the label",
+    (rel) => {
+      const { assignments, links } = usesOfConstant(rel);
+      expect(assignments).toBeGreaterThan(0);
+      expect(links).toBeGreaterThanOrEqual(assignments);
+    },
+  );
+});

src/__tests__/pwa-mobile-shell-guard.test.ts

@@ -32,7 +32,10 @@ function code(source: string, fileName?: string): string {
 describe("the shell owns the safe area", () => {
   it("the authenticated shell wrapper takes the insets", () => {
     const shell = code(read("src/components/layout/auth-shell.tsx"));
-    expect(shell).toMatch(/className="shell-safe-area flex h-dvh flex-col"/);
+    expect(shell).toMatch(/<div className=\{SHELL_ROOT_CLASS\}>/);
+    expect(read("src/components/layout/shell-metrics.ts")).toMatch(
+      /SHELL_ROOT_CLASS =\s*"shell-safe-area absolute inset-0 flex flex-col"/,
+    );
   });
 
   it.each([