docs: capture v1.34.2 dependency remediation

.planning/STATE.md

@@ -0,0 +1,62 @@
+# Project State
+
+## Project Reference
+
+See: .planning/PROJECT.md (updated 2026-06-18)
+
+**Core value:** The user understands their own health at a glance, coherent across every module.
+**Current focus:** Milestone v1.18.6 — Phase 1 (Module Consistency + Disclaimer) ready to plan
+
+## Current Position
+
+Phase: 1 of 5 (Module Consistency + Disclaimer)
+Plan: — (not yet planned)
+Status: Ready to plan
+Last activity: 2026-06-18 — ROADMAP.md created; 5 phases defined, 29/29 v1 requirements mapped
+
+Progress: [░░░░░░░░░░] 0%
+
+## Performance Metrics
+
+**Velocity:**
+- Total plans completed: 0
+- Average duration: —
+- Total execution time: —
+
+**By Phase:**
+
+| Phase | Plans | Total | Avg/Plan |
+|-------|-------|-------|----------|
+| - | - | - | - |
+
+*Updated after each plan completion*
+
+## Accumulated Context
+
+### Roadmap Evolution
+
+- Phase 1 added: v1.34.1 dashboard insights records admin and integration reliability
+
+### Decisions
+
+- **Disclaimer**: One-time onboarding acknowledgment only; remove all per-page banners; text reachable in Settings (legal).
+- **BP guideline**: ESH-2023 default, no per-user toggle; ESC/AHA surfaces as context only.
+- **Single-setting card**: Always wrap in a standard card, even one setting.
+- **Proactive nudge**: Option A — create conversation + write nudge as initial message BEFORE notification dispatch.
+- **Deep knowledge articles**: Deferred to docs.healthlog.dev (hybrid); app keeps concise cited tooltips.
+
+### Pending Todos
+
+1 pending — dependency advisory remediation is scheduled for v1.34.2.
+
+### Blockers/Concerns
+
+- Phase 5 (SHIP) is strictly sequential; depends on all four parallel phases merging cleanly with green CI.
+- SLP-01 (sleep stage breakdown) has a deferred dependency: real hypnogram ingestion is v2 (SLP-FUT). Decision = remove the misleading element rather than add ingestion in this release.
+- SHIP-02 requires OpenAPI regen; any schema touch in Phases 1–4 must be flagged to the Phase 5 executor.
+
+## Session Continuity
+
+Last session: 2026-06-18
+Stopped at: Roadmap created; all 29 v1 requirements mapped; ready to plan Phase 1.
+Resume file: None

.planning/todos/pending/2026-07-29-remediate-deferred-dependency-advisories-in-v1-34-2.md

@@ -0,0 +1,39 @@
+---
+created: 2026-07-29T14:44:48.825Z
+title: Remediate deferred dependency advisories in v1.34.2
+area: tooling
+files:
+  - package.json
+  - pnpm-lock.yaml
+  - pnpm-workspace.yaml
+  - .planning/phases/01-v1-34-1-dashboard-insights-records-admin-and-integration-reliability/01-DEPENDENCY-AUDIT.md
+---
+
+## Problem
+
+The dated v1.34.1 audit reports 19 transitive advisories: 9 High, 9 Moderate
+and 1 Low. The High records are currently confined to lint, test, build and
+bundle-analysis tooling. Five known Moderate Hono/@hono/node-server/Valibot
+records remain in the production dependency graph, although HealthLog does not
+directly import their affected adapters, JSX utilities or flattening paths.
+
+The release owner explicitly decided not to churn dependencies during the
+already-gated v1.34.1 point release. The exact advisory IDs, installed versions,
+roots and reachability assessment are recorded in `01-DEPENDENCY-AUDIT.md`.
+
+## Solution
+
+Prepare v1.34.2 immediately after v1.34.1:
+
+1. Upgrade the direct roots or use the narrowest safe transitive resolution for
+   Hono, @hono/node-server, Valibot, ESLint, Testcontainers, Tailwind/PostCSS,
+   bundle analyzer and Vite/esbuild.
+2. Do not apply blind overrides where the owning package has not declared a
+   compatible range.
+3. Re-run MCP/Prisma boundary tests, all unit and real-PostgreSQL integration
+   suites, production build/bundle, desktop/mobile Playwright and a final
+   Standard Codex Security working-tree scan.
+4. Re-run `pnpm audit --json` and reconcile every advisory by ID and resolved
+   production reachability.
+5. Preserve the intentional `@openai/codex-security` installation while
+   reviewing the package/lock/workspace delta independently from v1.34.1.