Per-commit subjects, deliverable-vs-actual verification matrix for
every fix-plan item, the orphan-endpoint grep table that grounds the
five-endpoint v1.4.28 defer, and the seven recorded deviations from
the original fix-plan scope.
The /api/audit-log GET handler has zero runtime callers in src/, tests/,
scripts/, or docs/ — verified via grep against the route path plus the
auditLog model name. The admin counterpart at /api/admin/audit-log is
the surface every consumer reads from. Drops the orphan route file
outright per the v1.4.27 fix-plan Section 4 Decision A.
The five admin / monitoring endpoints flagged for the scope-
maximization sweep all carry a README + CHANGELOG documentation
reference, which the fix-plan classes as a consumer for the
defer-on-tie rule:
/api/admin/ai-settings — README L362–363, CHANGELOG L752
/api/admin/backup/test — README L368, CHANGELOG L752
/api/admin/status-overview — README L367, CHANGELOG L753
/api/monitoring/glitchtip/test — README L381
/api/monitoring/umami/test — README L382
All five defer to v1.4.28 for a maintainer call — either wire each to
a real consumer or drop the route + README mention together. Seeds
the v1.4.28 backlog entry with the per-endpoint grep findings so the
decision is one read away.
Also seeds the v1.4.28 backlog with the missing `insights.coach.window.lastYear`
i18n key across the six locale bundles — owned by the i18n bucket.
Captures the i18n cleanup pass: 154 dead-key paths retired across
six locales (~924 strings), 38 new keys added for B1/B3/B4/B5
component-side inserts, locale-native date format ordering for
FR/ES/IT/PL, drift-guard test pinning the GLP-1 / carrier / empty-
state / notification / personal-record key sets, mood-label
shared module landing BL-P6-11.
Also lands the four probe scripts (.planning/v1427-b6-*.mjs) used
to enumerate dead keys and build the new key inserts, sibling to
the existing .planning/v1422-w1a-*.mjs audit artifacts.
- Three R3a contributor reports (B3 GeoIP+ASN, B4 Coach+Insights,
B5 Notifications) — B1 and B2 already committed theirs.
- v1.4.27 mobile-capability audit and fix plan inserted between
R3b and R4: seven parallel auditors per surface area, a single
consolidator, then a parallel fix-pass against the consolidated
bucket list.
Lists the four B2 commits, the scope of each, the translation-key
plumbing left for the localisation pass, why the optional Playwright
timing test was skipped, and the deviations from the original
fix-plan dispatch.
Consolidates the six R1 audit reports (R1.1 dashboard, R1.2 settings/admin,
R1.3 coach/insights, R1.4 notifications, R1.5 iOS offline-first research,
R1.6 backlog sweep) plus the 17 backlog items pulled forward into a single
fix-surface plan with seven touch-disjoint buckets, a file-touch collision
matrix with zero same-line collisions and four sequenced edits, and a
Round 3 dispatch sequence (5 parallel + 2 sequenced). Decides /api/audit-log
to DELETE as an orphan endpoint, parks all four iOS server-side preps
(syncVersion, deletedAt, GET /api/sync/state, ETag) to v1.4.28, and adds
22-offline-first-architecture.md to the iOS handoff doc-pack carrying R1.5's
research forward for the iOS-side reader.
Logs the production-alarm hotfix shipped in `fec02aa` under a new
"Resolved by v1.4.26" section so the backlog stays honest about what
landed on develop after the v1.4.25 tag.
Replace the seed skeleton with the final navigation map for the
21-file doc-pack.
Inventory: 21 rows pinned against the actual filenames + final
token estimates (total ~89400 tokens / ~57000 words).
Question → File map: 38 real entries mapping concrete iOS-Claude
questions to file + section anchors. Covers source-priority,
MeasurementType enum, MDR boundary, APNs flow, Withings OAuth,
HealthKit batch ingest, Coach SSE, Health Score, PR detection,
migrations 0051-0060, OpenAPI hard-flip gate, error codes,
Idempotency-Key, rate-limiting, PROMPT_VERSION,
RESEARCH_MODE_DISCLAIMER_VERSION, TanStack Query, chart hex literals,
locale keys, dev server, Simulator API token, v1.4.26 inventory.
Reading-orders-by-goal: 16 scenarios with file lists + estimated
cumulative tokens. Cold-start, tag-a-release, new endpoint, Coach
feature, Apple Health sync, workout ingest, GLP-1 work (critical
research-first), pre-PR gate, screen design, Settings → Sources,
Health Score tile, Withings reconnect, onboarding wizard, CI setup.
Stop-here-markers index: per-file summary of what each file's STOP
HERE block (or inline warnings) covers, so iOS-Claude can lookup
and exit.
TL;DR refresh: 2 sentences pinning v1.4.25 stack + v1.5 = iOS +
deeper Apple Health.
Cross-link audit: every <file>.md reference in every sibling now
resolves to a real file. 16 broken references found + patched in
the prior commit.
Sibling docs (00..20 except README) referenced 16 file names that don't
exist in the final pack — names like 10-coach-pipeline.md, 12-ai-coach.md,
15-withings-bridge.md, 17-personal-records.md, 18-onboarding.md,
19-deploy-runtime.md, 02-architecture.md, 03-system-overview.md,
10-architecture.md, 12-ai-providers.md, 13-medical-content.md,
09-ui-state.md. Every one mapped to a real file in the final pack;
patched all cross-links in:
- 00-philosophy.md (STOP HERE table)
- 01-repo-tour.md (deploy link + STOP HERE table)
- 02-server-architecture.md (6 Detail-in references + STOP HERE table)
- 03-api-contracts.md (STOP HERE table)
- 04-data-model.md (prerequisites + What is NOT in this file)
- 05-auth-flows.md (What is NOT in this file)
- 06-ios-responsibilities.md (prerequisites)
- 07-server-responsibilities.md (prerequisites)
- 08-locked-contracts.md (What is NOT in this file)
- 11-web-ui-tour.md (prerequisites)
- 12-design-system.md (prerequisites)
- 13-state-management.md (prerequisites)
- 14-coach-mental-model.md (prerequisites)
- 17-error-handling.md (What is NOT in this file)
- 18-pattern-cookbook.md (prerequisites)
- 19-i18n-system.md (prerequisites)
- 20-glossary.md (multiple Coach + provider references)
Every cross-link in the doc-pack now resolves to an existing file or to
a section heading inside an existing file.
The remaining two files of D. 06-ios-responsibilities.md enumerates the five
domains the iOS app owns (HealthKit, Keychain, APNs, offline cache, deep
links) plus the MDR-critical 'don't cross this line' warnings.
07-server-responsibilities.md is the inverse — 22 domains the server
already handles, so iOS Claude knows what NOT to reinvent.
Three of D's five files. The Coach + Insights + Health-Score surfaces are
server-resident; iOS Claude must consume, not reimplement. Documents the
layered prompt builder, GROUND RULES 1-15 (including W4d/W19c safety
contracts that hold the EU MDR line), the safety-contract matrix loader,
cache-invalidation rules, source-attribution provenance, and the
deterministic asOf discipline introduced in v1.4.25 Fix-G.
Closes the W21 reconcile pass. Captures the six commits, the 49 new
test assertions, three documented deviations (inventory-section
keeping its details shell, medication-form parseDose left alone,
apiError signature broadening), and final-gate evidence.
Marc-André Bombeck