fix: harden imports and daily medication state (#577)

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.31.6
+  version: 1.31.7
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
@@ -25024,6 +25024,28 @@ components:
               anyOf:
                 - type: string
                 - type: "null"
+            dueCandidates:
+              type: array
+              items:
+                type: object
+                properties:
+                  medicationId:
+                    type: string
+                  medicationName:
+                    type: string
+                  dueAt:
+                    type: string
+                  overdue:
+                    type: boolean
+                  availableFrom:
+                    type: string
+                required:
+                  - medicationId
+                  - medicationName
+                  - dueAt
+                  - overdue
+                  - availableFrom
+                additionalProperties: false
           required:
             - activeCount
             - scheduledToday
@@ -25034,12 +25056,11 @@ components:
             - nextDueMedicationName
             - nextDueMedicationId
           additionalProperties: false
-          description: "Today's medication block: active-medication count, today-window tally (scheduled / taken / skipped), and
-            the earliest next-due slot across active medications. `nextDueOverdue: true` marks an OPEN overdue slot
-            (anchor passed, still inside its catch-up band). `nextDueMedicationId` deep-links a consumer straight to the
-            overdue medication's card. Staleness contract: the snapshot is cache-served, so a `nextDueAt` in the past
-            with `nextDueOverdue: false` means the anchor passed after the snapshot was built — render the plain day
-            summary, never an overdue state."
+          description: "Today's medication block: active-medication count, today-window tally (scheduled / taken / skipped), every
+            active medication's current display-due candidate, and legacy scalar fields projected from candidate zero.
+            `overdue: true` marks an OPEN overdue slot (anchor passed, still inside its catch-up band); `availableFrom`
+            is the canonical cadence- and dose-window-derived attribution-band start. `dueCandidates` is optional so
+            older cached snapshots remain valid. Medication ids let consumers deep-link straight to the relevant card."
         healthScore:
           anyOf:
             - type: object