From a87a144b1e6a109cbee09ed4acc78bb4bc70dbff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Mon, 20 Jul 2026 12:29:21 +0200
Subject: [PATCH] chore(release): prepare v1.31.2

---
 CHANGELOG.md | 23 +++++++++++++++++++++++
 package.json |  2 +-
 public/sw.js |  2 +-
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8f8bc8703..43f82a440 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [1.31.2] — 2026-07-20
+
+- **Provider imports now commit identity and progress atomically.** Withings,
+  WHOOP, Oura, Polar, Strava, and Apple Health reconcile external and natural
+  measurement identities under database locks, preserve tombstones, emit
+  arrivals only for genuine inserts, and advance cursors only after durable
+  writes. OAuth refresh-token rotation is serialized per user and provider.
+- **Webhook success now means the source data is durable.** moodLog writes
+  before acknowledging delivery, while Withings ECG callbacks enter a durable
+  queue with bounded retry and replay-safe processing. Operational JSON import
+  failures are reported as failures instead of misleading duplicate skips.
+- **Recovery is complete and owner-safe.** Canonical backups round-trip every
+  supported record class, including encrypted document content and soft-deleted
+  measurements. Restore rejects account mismatches before writing, validates
+  backup enums at the boundary, and preserves recovery integrity across both
+  uploaded and off-host payloads.
+- **Device and mood edits no longer lose related state.** Same-user APNs
+  registrations merge transactionally without crossing account boundaries,
+  refresh-token bindings follow the surviving device, and mood edits preserve
+  rated factors unless the caller explicitly replaces them.
+
+No migrations. No breaking changes.
+
 ## [1.31.1] — 2026-07-19
 
 - **Arrival events now follow committed inserts across every writer.** Provider
diff --git a/package.json b/package.json
index 5a5fccee2..f1b40080c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.31.1",
+  "version": "1.31.2",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
diff --git a/public/sw.js b/public/sw.js
index 743bf73d0..1b480b10f 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.31.1";
+  /* @sw-version-fallback */ "v1.31.2";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`