chore(release): v1.32.25 — surface mirrored-medication provenance and cap external mirror growth

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.32.24
+  version: 1.32.25
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
@@ -3526,7 +3526,12 @@ paths:
       summary: Create a medication with at least one schedule
       description: Validates the body against `CreateMedicationRequest`, applies the v1.5 cross-field invariants (one-shot
         consistency, recurring default `FREQ=DAILY`, `timesOfDay` dual-write), and creates the medication + its
-        schedules in a single Prisma write. Audits as `medication.create`.
+        schedules in a single Prisma write. Audits as `medication.create`. v1.28 — a mirror create (`externalSource` +
+        `externalId`) re-posting a pair the caller already holds returns the existing medication with 200 instead of a
+        duplicate. v1.32.25 — a NEW mirror create is refused with 422 (`meta.errorCode =
+        medications.mirror.limit_exceeded`) once the caller already holds 30 medications mirrored from the same external
+        source; an idempotent re-post of a medication already mirrored is unaffected, and native creates are never
+        gated.
       requestBody:
         required: true
         content:
@@ -19794,6 +19799,15 @@ components:
             $ref: "#/components/schemas/MedicationScheduleOutput"
         category:
           $ref: "#/components/schemas/MedicationCategory"
+        externalSource:
+          anyOf:
+            - type: string
+              const: APPLE_HEALTH
+            - type: "null"
+          description: v1.32.25 — provenance of the medication. `APPLE_HEALTH` marks the row a read-only mirror of the iOS 26+
+            HealthKit Medications sync; NULL is a native HealthLog medication. Read-only echo of the stored provenance —
+            the create route sets it, the list read surfaces it so mirrored-vs-native is visible without inspecting the
+            iOS client's local registry.
         lastTakenAt:
           anyOf:
             - type: string
@@ -19851,16 +19865,18 @@ components:
         - updatedAt
         - schedules
         - category
+        - externalSource
         - lastTakenAt
         - todayEventCount
         - stockUnitsRemaining
         - stockDosesRemaining
       additionalProperties: false
-      description: List-row variant of the medication resource enriched with the joined `category`, `lastTakenAt`,
-        `todayEventCount`, and the v1.16.10 aggregated stock fields (`stockUnitsRemaining`, `stockDosesRemaining`) the
-        dashboard + iOS client consume. The base medication fields (`id`, `name`, `dose`, `treatmentClass`,
-        `dosesPerUnit`, `active`, `notificationsEnabled`, `pausedAt`, `snoozedUntil`, `startsOn`, `endsOn`, `oneShot`,
-        `createdAt`, `updatedAt`, `schedules`) are inlined; see the `Medication` component for their semantics.
+      description: List-row variant of the medication resource enriched with the joined `category`, the v1.32.25
+        `externalSource` provenance echo, `lastTakenAt`, `todayEventCount`, and the v1.16.10 aggregated stock fields
+        (`stockUnitsRemaining`, `stockDosesRemaining`) the dashboard + iOS client consume. The base medication fields
+        (`id`, `name`, `dose`, `treatmentClass`, `dosesPerUnit`, `active`, `notificationsEnabled`, `pausedAt`,
+        `snoozedUntil`, `startsOn`, `endsOn`, `oneShot`, `createdAt`, `updatedAt`, `schedules`) are inlined; see the
+        `Medication` component for their semantics.
     MedicationCategory:
       type: string
       enum: