v1.4.25 W7 phase 6 — proposal §4 Option C as default-value layer.
The registration form now reads
Intl.DateTimeFormat().resolvedOptions().timeZone and sends it with
the signup payload. The server:
1. Validates the value against Intl.supportedValuesOf via
isValidTimezone().
2. On any invalid value (or absence), resolves the admin-
configured server default (AppSettings.defaultUserTimezone) and
uses that.
3. On no admin default, the resolver falls back to the
'Europe/Berlin' string, which is also the User.timezone column
default — so the worst case still produces the legacy
pre-v1.4.25 behaviour.
The Zod registerSchema gains an optional 'timezone' string field
capped at 64 chars (matches the longest IANA canonical zone
identifier plus headroom). Audit-log entry now carries the resolved
zone so an operator can spot a Tokyo user mis-attributed to Berlin
if browser detection fails.
No new tests — the existing register-route integration coverage is
thin, and the v1.4.25 W7 phase 7 integration test in
Pacific/Auckland covers the full signup → measurement → export
round-trip end-to-end.
`pnpm format:check` flagged two files touched in the previous W3 +
W3b commits — `src/components/insights/insights-tab-strip.tsx` (the
new tab strip) and `src/lib/charts/x-axis-density.ts` (the rebuilt
tick-density helper). Prettier normalised the Tailwind class-name
ordering and the multi-line function signature; no behaviour change.
v1.4.25 W7 phase 5 — proposal §5 admin half.
GET /api/admin/settings now returns defaultUserTimezone (null = use
Europe/Berlin fallback). PUT accepts the field:
- empty string clears the column (resolver falls back)
- non-empty must pass isValidTimezone(); otherwise 422
- successful writes invalidate the server-default resolver cache
so the registration handler sees the new value on the next
signup without waiting 60s for the TTL
The admin form gets a third row in the General Settings section
between 'default language' and the toggles, mirroring the user
picker UX (native select over Intl.supportedValuesOf, fallback
'Europe/Berlin (default)' option clears the override). 3 new i18n
keys per locale (defaultUserTimezone +
defaultUserTimezoneDescription + defaultUserTimezoneFallback);
descriptions follow proposal §5: 'Used for new accounts that don't
carry a browser-detected zone. Does not affect existing users.'
Tests: 3 new cases in src/app/api/admin/settings/__tests__/route.test.ts
covering valid IANA write, empty-string clear, and invalid-zone
rejection.
v1.4.25 W7 phase 4 — proposal §5.
Adds a per-user timezone picker to /settings#account between
date-of-birth and language. The control is a native <select> over
Intl.supportedValuesOf('timeZone') with a 'use browser timezone'
button that pre-fills detectBrowserTimezone(). Older engines without
Intl.supportedValuesOf fall back to a free-text input — every Chrome
99+/Safari 15.4+/Firefox 99+ ships the API so the fallback is
defensive only.
Form save uses Promise.all over two PUTs:
- /api/auth/profile (email, height, dob, gender)
- /api/auth/me/timezone (single field, dedicated route)
The split keeps the timezone validation + resolver cache
invalidation on a clean path; profile errors don't poison the
timezone write and vice versa.
The new route PUT /api/auth/me/timezone:
- requireAuth gates the cookie + Bearer paths
- 422 on any string the runtime's Intl.DateTimeFormat rejects
- 200 on success, returns the persisted value
- audits 'user.timezone.update' with previous + next
- invalidates the resolver cache so the next read sees the new
value within one tick instead of waiting 60s for the TTL
i18n: 4 new keys (timezone, timezoneHint, timezoneDetect,
timezoneInvalid) in messages/de.json + messages/en.json. Hint copy
follows proposal §5: 'Used for chart axis labels, reminder times,
export timestamps, and AI Coach context. Stored data is unchanged.'
Tests: 6-case suite on the new route covers auth, valid + invalid
zones, empty / missing field, and whitespace trimming.
Marc reported the German "Einnahmetreue" component label visibly
overlapping the band-coloured component-value pill at the right of
the row on `lg+` viewports. The card's `lg:w-[220px]` width left only
~64px for the label column after the progress bar (`flex-1`) and the
right-side value pill (`w-8`) consumed the rest — fine for short
labels like "BP" / "Mood" but cropped for the longer German strings.
Two coordinated changes:
- Card width: `lg:w-[220px]` → `lg:w-[260px]` (~18 % wider on `lg+`).
- Label column: `w-16` (64px) → `w-24` (96px) with a `truncate`
fallback for any future localisation that pushes the label past
96px.
Net result: the label column has ~50 % more pixel budget than before,
which puts "Einnahmetreue" comfortably inside its slot. The card's
internal grid (label / bar / value) preserves the same gap rhythm so
the visual proportions stay familiar.
Two coupled fixes pinned by Marc on the v1.4.25 W3 walkthrough:
1. Trends row equal-height
The three trend cards (BP / Weight / Mood) on /insights sit in a
`grid-cols-1 md:grid-cols-3` grid. The `min-h-[300px]` floor
guarantees a sensible mobile height, but the AI annotation prose
varies card-to-card on desktop, leaving the tallest card pushing
only its own row member down — siblings stayed short. Added
`md:auto-rows-fr md:items-stretch` on the grid container and
`h-full` on each direct child so the row pins every card to the
tallest member's height.
2. Mood chart gridline density parity
The mood chart's YAxis pins ticks to [1,2,3,4,5] (mood scale). By
default Recharts syncs CartesianGrid coordinates with YAxis ticks,
so the mini variant painted five horizontal lines while the
BP/Weight/Pulse minis painted six (their auto-generated YAxis
ticks land on ~six bands in typical health ranges). Added a
`horizontalCoordinatesGenerator` that emits six evenly-spaced
lines inside the plot area so the trends row reads as a single
rhythm.
Both changes are presentational — no chart data shape changes, no
behaviour changes, no API touched.
v1.4.25 W7 phase 3.4 — proposal §3 symptom 10.
The schema patterns on every 'format: date-time' field already
accept both 'Z' and '±HH:MM' suffixes (the Zod sources use
{ offset: true }), so the wire contract is technically correct. The
discoverability problem is that consumers reading the spec assume
'date-time' implies UTC.
Adds an explicit 'Date-time contract' paragraph to the API
description naming the convention: server responses emit the
requesting user's offset when a user context is present (exports,
doctor-report PDF), background-job-authored payloads emit 'Z',
clients must accept both.
Regenerated docs/api/openapi.yaml via pnpm openapi:generate; check
passes.
v1.4.25 W7 phase 3.3 — closes proposal §3 symptom 8.
renderDoctorReportPdfBytes now accepts an optional userTz in its
DoctorReportRenderOptions. The PDF route resolves the patient's
stored timezone via the v1.4.25 W7 resolver and threads it through
makeFormatters so date/time rows render in the user's zone.
A US patient generating a report at home in Boston now sees Eastern
time rows, not Berlin. Existing Berlin-region users see no
behaviour change — the User.timezone default is Europe/Berlin and
the formatter falls back when userTz is empty.
Client-side caller (settings dialog) is untouched in this commit — a
follow-up wave wires the auth-context value through the dialog
component.
Marc directive 2026-05-14: the page-level regenerate affordance has to
stay reachable while the user is reading the per-metric cards. Up to
v1.4.24 it lived inside the hero band's action row, which scrolled
away as soon as the user moved past the briefing.
What changed:
- New `src/components/insights/insights-tab-strip.tsx` carries the
six metric pills + the regenerate icon button. The strip is
`sticky top-0` with `bg-background/95 backdrop-blur` so it lives
above every section as the user scrolls.
- Right slot: a 44×44 icon-only `<RefreshCw>` button with
`aria-label={t("insights.regenerateAnalysis")}` and a sonner
success toast keyed to the falling edge of `regenerating`
(rising-edge guard via a ref so the toast only fires when an
in-flight regen finishes, not on every render).
- The hero strip's `onRegenerate` / `regenerating` props are gone;
its action row is now Weekly-report + Ask-the-Coach only. The
JSDoc comment block points to the new tab strip for the
regenerate affordance.
- `src/app/insights/page.tsx` mounts `<InsightsTabStrip
onRegenerate={advisor.regenerate} regenerating={...} />` and
drops the inline `InsightsSectionNav` function (its logic moved
into the new component verbatim).
- Two new translation keys added under the `insights.*` namespace:
`regenerateAnalysis` ("Analyse neu starten" / "Re-run analysis")
drives the aria-label + title; `regenerateSuccess` ("Analyse
wurde neu erstellt" / "Analysis refreshed") drives the toast.
The existing hero-strip test that pinned the regenerate slot was
flipped — the slot must NOT render under any prop combination. The
insights-polish test that asserted `<HeroStrip onRegenerate={advisor.regenerate}>`
was rewritten to assert the wiring is on `<InsightsTabStrip>` and that
the `<HeroStrip>` JSX block carries no `onRegenerate` prop.
v1.4.25 W7 phase 3.2 — extends the shared locale formatter to accept
an optional second argument carrying the per-user display timezone.
makeFormatters(locale) — unchanged, still renders in Europe/Berlin.
makeFormatters(locale, userTz) — renders in the user's zone.
The empty-string and undefined cases both fall back to
DISPLAY_TIMEZONE so admin tools, the legacy client wrapper in
src/lib/format.ts, and audit-log viewers keep behaving identically.
Three tests cover Asia/Tokyo wall-clock + date roll-over and the
empty-string fallback. No production callers yet — wire-up happens
in the per-surface commits that follow (doctor-report PDF, Coach
snapshot, chart axes).
Two carryover failures fixed in this session before the rest of W2
closes:
- tests/integration/coach-prefs.test.ts NextRequest URL mock
(v1.4.22 carryover, deferred from v1.4.23 + v1.4.24)
- e2e/chart-overlay-controls.spec.ts portalled-toggle viewport
+ e2e/charts-mobile.spec.ts Pixel-5 axis-tick visibility
Report covers root causes, file paths + line ranges, verification
exit codes for the integration suite, and the local-environment
limitation that blocked e2e verification (Node 25 vs CI's Node 22
prerender regression). Final e2e verification will arrive from the
next CI run on develop.
v1.4.25 W7 phase 3.1 — closes the export half of issue #167.
CSV/JSON exports previously emitted timestamps via .toISOString(),
producing 2026-05-15T09:00:00.000Z. Excel and LibreOffice drop the
trailing Z silently and render the bare datetime in the viewer's
locale, so a Warsaw user reads UTC as local time — 11:00 entries
display as 09:00 in their spreadsheet.
Export helpers now accept an optional userTz argument and emit
ISO-8601 with the user's UTC offset
(2026-05-15T11:00:00+02:00). The offset survives the round-trip and
the on-screen value is unambiguous regardless of the spreadsheet's
defaults. Routes resolve the user's stored timezone via the v1.4.25
W7 phase 2 resolver and thread it through formatMeasurements /
formatIntakeEvents / formatMoodEntries.
Backward-compatible: userTz is optional. When omitted (admin tools,
canonical-backup-on-disk shape) the helpers fall back to
.toISOString(), keeping the legacy contract for the JSON full-backup
route that the upload-restore validator depends on.
Surfaces touched:
- src/lib/export.ts (3 formatters + helper)
- src/app/api/export/measurements/route.ts
- src/app/api/export/medications/route.ts (intake history block)
- src/app/api/export/mood/route.ts
- src/app/api/export/route.ts (legacy aggregate route)
Tests: 5 new cases in src/lib/__tests__/export.test.ts covering
Berlin / Auckland / New_York offsets, the no-userTz fallback, and
the mood-entry case where the stored YYYY-MM-DD date column stays
unchanged (see proposal §6.3 for the read-side rationale).
Two specs have been red on main since the v1.4.20 hero rewrite, spamming
the GitHub Actions failure mailer on every push:
1. chart-overlay-controls.spec.ts — the test opens the dashboard's chart
overlay popover and toggles 'target range' on. The Radix dropdown
content portals to the document body, so on the 393×851 Pixel 5 and
near the bottom of the 1280×720 desktop viewport the toggle's bbox
lands below the fold. `click({force:true})` still asserts the bbox
intersects the viewport and refuses to fire, and
`scrollIntoViewIfNeeded` on the portalled content is a no-op because
the portal sits outside the page scroll container. Switching to
`dispatchEvent('click')` synthesises a click directly on the element
without any actionability or viewport check; Radix Switch's native
click handler fires `onCheckedChange` and the PUT lands as expected.
2. charts-mobile.spec.ts — the 30-day-window tick-count assertion times
out waiting for `.recharts-xAxis .recharts-cartesian-axis-tick text`
to be visible. Recharts does paint the <text> ticks into the SVG, but
the chart card on Pixel-5 is taller than the 851-px viewport, so the
bottom-anchored x-axis labels stay below the fold even after
`scrollIntoViewIfNeeded` brings the card's top into view. The
downstream `evaluate` only needs the ticks attached to the DOM (it
counts them via querySelectorAll), so `state: 'attached'` is both
sufficient and viewport-tolerant.
Neither fix changes the assertion semantics — both still exercise the
same user-visible behaviour against the same selectors. The CI mailer
should fall silent after the next push.
v1.4.25 W7 phase 2 — adds src/lib/tz/resolver.ts with:
- resolveUserTimezone(userId) reads User.timezone with a 60s
process-level cache and falls back to the server default.
- resolveServerDefaultTimezone() reads AppSettings.defaultUserTimezone
with the same TTL, falling back to 'Europe/Berlin'.
- detectBrowserTimezone() — client-only Intl helper.
- formatInUserTz(date, tz, shape) emits ISO-8601-with-offset (for
exports — issue #167 fix), wall-clock (for chart axis labels),
datetime (for PDFs / notifications), and date-only (parallel to
berlinDayKey but parameterised).
- userDayKey(date, tz) — day-bucket helper parallel to
berlinDayKey() but user-scoped.
- isValidTimezone() / listSupportedTimezones() for write-path
validation and the picker UI.
29-test suite covers cache hit/miss, fallback chain, invalid tz
handling, DST (Berlin Jan = +01:00, May = +02:00), Pacific/Auckland
(UTC+12), America/New_York (UTC-04 in May), and the Berlin-vs-Auckland
midnight round-trip that makes the per-user feature visible.
The /insights page rendered both <InsightAdvisorCard> (the polished
severity-ordered recommendations grid + per-rec rationale + confidence
meter + medical-citation footnotes shipped in v1.4.16 phase D
reconcile) AND <InsightStatusCard title={t("insights.generalStatusTitle")}>
(the v1.4.15 text-only summary). The page comment at the advisor
wiring acknowledged the status card "was intended to be replaced"
during D-reconcile but the status mount was never removed, so users
saw two cards saying the same thing — one labelled
"KI-Gesundheitsanalyse" and one labelled "Allgemeiner
Gesundheitszustand".
Removed:
- The <section id="section-general"> block + its <InsightStatusCard>.
- The `generalStatus` useQuery + the unused `GeneralStatusData`
interface.
- The `generalStatus?.updatedAt` entry from freshestUpdatedAt(); the
other six per-section caches still feed the hero's "Generated …"
caption.
- The "section-general" entry from the sticky pill nav (it had
nothing left to scroll to).
Kept:
- The /api/insights/general-status route + the underlying
generateGeneralStatusForUser lib — the reminder worker still
pre-warms the daily general-status cache for users opted in to the
briefing notification. Added a JSDoc @deprecated note on the route
pointing new callers at <InsightAdvisorCard> /
useInsightsAdvisorQuery().
- The insights.generalStatusTitle + insights.generalStatusBadge.*
translation keys — they're still referenced by the per-section
badge labels (insights.generalStatusBadge.good / .watch /
.critical map traffic-light states on every metric section, not
just the dropped general one).
v1.4.25 W7 phase 1 — adds AppSettings.defaultUserTimezone for the
per-user-timezone feature (Option B from
.planning/feature-user-timezone.md §4).
User.timezone already exists in the schema as a NOT NULL column with
'Europe/Berlin' default — it is the canonical per-user display zone
and needs no change. The only new piece is the server-wide default
for new accounts that don't carry a browser-detected zone in the
registration payload. Nullable so the resolver can fall back to
'Europe/Berlin' on every existing instance without an admin touching
anything.
Forward-only ALTER TABLE ADD COLUMN, no NOT NULL, no rename, no drop.
The two failing cases in tests/integration/coach-prefs.test.ts were invoking
the route's GET handler with zero arguments — `(GET as () => Promise<Response>)()`.
The apiHandler wrapper at src/lib/api-handler.ts:46-47 reads args[0].url to
build the Wide Event `http.path`, so the call threw
`TypeError: Cannot read properties of undefined (reading 'url')` before the
route body ever ran. Other integration tests already pass a real Request to
GET (see analytics-health-score, chart-overlay-prefs); aligning this test to
the same pattern restores parity with production where Next.js always
invokes route handlers with a Request.
The api-handler wrapper itself was left untouched — defending against a
caller passing undefined would mask the same bug in any future test.
v1.4.24 (security + accessibility hardening) shipped directly on main as
a hotfix-style release. Back-merging the two main-only commits
(ca03c60 chore(release): v1.4.24, 604009d per-user timezone proposal)
into develop so the v1.4.25 work continues on the standard branch model.
# Conflicts:
# .planning/ROADMAP.md
Issue #167 (Warsaw user, v1.4.23) reports that the CSV export reads as
UTC because `Date.prototype.toISOString()` writes the `Z` suffix and
spreadsheet viewers drop the marker. The technical bug is small — 4
lines in `src/lib/export.ts` — but the architectural surface it
exposes is large: the whole app is hardcoded to `Europe/Berlin` for
display, analytics buckets, reminder cron, Withings sync mapping,
charts, PDF, Coach context (10 distinct symptoms total).
This commit records the long-form analysis so a future planning pass
does not start from zero:
- `.planning/feature-user-timezone.md` — full proposal: symptom
catalogue across 10 surfaces, design space (A: export-only quick
fix, B: per-user `displayTimezone` setting, C: rejected
auto-detect), migration strategy with concrete file/line touches,
the date-string risk split (`MoodEntry.date` freeze vs
`MedicationSchedule.windowStart` re-anchor — they need different
contracts), DST edge cases, parametrised test plan (Berlin / UTC /
New York / Tokyo / Kiritimati), and open product-call questions
for the v1.5 planning pass.
- `.planning/v15-backlog.md` — one-line carry under a new "From issue
triage" section pointing at the proposal.
- `.planning/ROADMAP.md` — reserved-milestones block notes per-user
timezone as a v1.5 candidate, with v1.6+ as fallback if v1.5 stays
iOS-focused.
Scope-clean: the v1.4.25 quick fix (ISO-8601-with-offset CSV) is
documented as independent. It closes#167 on its own without
touching the architectural scope captured here.
STATE ticks all Wave 7 sub-items: pre-release verify, format + planning
+ openapi sweep commits, version bump + CHANGELOG, release-merge, tag,
GHCR build, Coolify deploy (via host-side retag fallback after the
auto-deploy path skipped on missing secrets and the :latest digest
cache pinned to v1.4.22), /api/version=1.4.23, smoke, GH release,
docs + landing sync, release brief, v1.5 P1 plan refresh cross-link.
ROADMAP moves the v1.4.23 milestone into the Previous-milestone slot
(Waves 1-7 all done) and scaffolds v1.4.24 at the top with the
deferred items from v1423-backlog: Pearson incomplete-beta, OpenAPI
drift gate flip, settings-cog UX consolidation, NextRequest URL mock
fix, security MED + LOW cluster, S-05 simplify.
Release brief at docs/audit/v1423-summary.md mirrors the v1421-summary
structure: lead, live state, smoke, wave-by-wave overview, iOS
readiness statement with the 13 DTO open questions cross-link, branch
model, carry-overs, strategic next.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pre-iOS prep + hygiene. Apple Health backend foundation (schema +
batch ingest + APNs scaffolding), OpenAPI generator + warn-only CI
gate, per-device refresh-token revocation + device-management
endpoints, Coach Apple Health metric slot at PROMPT_VERSION 4.23.0,
per-user Coach prefs surface, per-message thumbs feedback loop.
Seven W5 hygiene items closed alongside.
User-visible delta is small on purpose — the weight is in the
contract surface the iOS app gets to compile against on day zero.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
zod-openapi emits long descriptions inline; the committed copy carried
a stale newline+indent fold. Generator output is what `pnpm openapi:check`
compares against, so re-snapshot before tagging.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Captures the artifacts referenced from STATE.md, v1423-backlog.md, and
phase-W6-v1423-reconcile-report.md but never committed during the
wave-close ticks. W1 research = Apple Health type mapping + APNs
library decision + OpenAPI tooling choice; W5 v1422 reviews + W6
v1423 reviews are the six-brief multi-agent QA inputs that drove the
reconcile commit chain.
Leaves the pre-existing stale untracked entries (v1422-w1a probes,
audit-a6 scripts, export-route directories) untouched — those predate
v1.4.23.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mostly table column normalisation under docs/audit/ + planning, object-
literal expansion in src/lib/ai/coach/snapshot.ts after the W4 F6 Apple
Health metric block landed, and small wrap/unwrap line adjustments in
the device + APNs routes / tests touched across W3/W4/W5 sessions.
No behavioural change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
11 reconcile commits across Sessions A/B/D/E/F closed 1 CRIT and
all 9 HIGH findings. STATE.md ticks Wave 6; v1423-backlog.md
captures the deferred MED + LOW items + the settings-cog-vs-thumbs
debate for v1.4.24.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Coolify runbook + audit briefs scrub the live deploy URL to a
placeholder (Sec-MED-2). Real values live in repo secrets.
- /api/auth/me/devices isCurrent now compares against the session's
device id, not the unauthenticated X-Device-Id header (Sr-MED-5).
- Migration 0036 sleep-duration unit shift documented + verification
command added to the coolify-auto-deploy howto.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reviewer note: W5 H7 wrote Coach assistant prose plaintext into
recommendation_feedback.recommendation_text. Same prose lives
encrypted in coach_messages — backups captured the leak.
Migration 0042_coach_feedback_message_ref adds nullable coachMessageId
(FK + cascade) and drops recommendation_text. Aggregator joins +
decrypts on read; admin view reads through the same path.
Fixes: Sr-H3 (Wave-6 v1.4.23 senior-dev review)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reviewer note: src/app/api/analytics/route.ts fanned out 17+
unbounded prisma.measurement.findMany per request — growth linear
in HealthKit-days. Replace with prisma.groupBy where possible;
chunked-paged with take=5000 where running-window slope or paired
correlations require row-level access. Wide-event annotation
analytics.bp_aggregate.row_count for slow-query attribution.
Fixes: Sr-H1 (Wave-6 v1.4.23 senior-dev review)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Both DELETE /api/devices/[id] and DELETE /api/auth/me/devices/[id]
performed the same four-write cascade (refresh-token lookup, refresh
revoke, access-token revoke, device delete) as separate Prisma calls.
A partial failure between the third and fourth write left the device
row alive with all its tokens revoked - the user's iPad showed in the
device list as "still registered" but every request returned 401.
Extract the cascade into a shared revokeDeviceCascade() helper and
wrap the writes in prisma.$transaction so they commit atomically.
Both routes now call the helper; the audit-log via tag and the wide
event action name stay route-local.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three small reuse wins from the W6 simplify review:
- openapi/registry.ts swaps the lazy require() for a static import.
The ESLint disable + as-cast carried no real benefit; the only
callers always loaded the route table anyway.
- Extract useCoachPrefs() into a shared hook so the settings sheet
and message thread share one queryKey + one fallback shape. Removes
the drift between the two existing inline blocks.
- Replace the 9-deep wantsX boolean ladder in coach snapshot with a
single CoachScopeSource -> MeasurementType[] map. Drives both the
WHERE type IN (...) build and the appleHealthBlocks gate, so adding
a new metric is one entry instead of three parallel edits.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Render a skeleton shell while the persisted Coach prefs are loading
so the form never paints DEFAULT_COACH_PREFS as a ghost between mount
and the query resolving. Emit a sonner toast on save success before
closing the sheet so the action is visibly acknowledged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The Apple Health pink chip rendered only inside the desktop `<Table>`
cell. iOS users — the audience that actually consumes Apple Health
data — land on the mobile card branch and saw no source indicator at
all, risking duplicate hand-entries on top of synced rows. Add a
compact badge inline with the timestamp on the mobile card so the
distinction lands at every viewport. Component test asserts the
`measurement-source-badge` testid appears twice (desktop + mobile)
so the next layout refactor can't silently drop one branch.
Also extends the `POST /api/devices` unit test mocks for the
NotificationChannel auto-upsert added in the previous commit, plus a
new test that pins the same-user apnsToken collision path returning
201 idempotently (the cross-user path keeps its 409).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two collision paths let the same APNs token attach to multiple Device
rows for one user, fanning a single push out to two rows and double-
charging the APNs quota:
1. The cross-user-hijack guard filtered `NOT: { userId }` so it
skipped same-user collisions entirely.
2. The `apns_token` index was non-unique.
Drop the `NOT: { userId }` clause so the lookup catches both cases —
cross-user collisions still 409, same-user collisions fall through to
the existing legacy-token upsert path. Pair with migration 0041
introducing a partial UNIQUE index over `apns_token IS NOT NULL` and
dropping the redundant non-unique sibling. Apple's APNs contract
guarantees one token per (device, app), so global uniqueness matches
the upstream invariant.
Migration is strictly additive at the rolling-upgrade boundary; the
NULL-allowed partial-index shape preserves legacy iOS rows without an
APNs handshake. Schema-side comment documents why the partial index is
introduced via raw SQL (Prisma can't express it natively) and warns
against re-adding the non-unique sibling.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The dispatcher's APNS branch only fires when a NotificationChannel of
type APNS exists for the user, but no production code path created one.
Every iOS install needed a manual settings toggle that doesn't exist,
making the v1.4.23 W3 APNs cascade unreachable in real traffic.
When `POST /api/devices` accepts an apnsToken, eagerly upsert the
channel row with an encrypted empty config — the per-device token and
environment live on the Device row by design, so the channel only
exists to flip the dispatcher's gate. Mirrors the legacy Telegram
on-first-dispatch auto-migration but eager so the very first reminder
after registration routes through APNs.
Adds an integration test that registers a device with apnsToken and
asserts the channel row exists, registers without one and asserts
absence, and re-registers the same apnsToken and asserts idempotency
(channel count stays at one).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The coach-feedback slug was registered in ADMIN_SECTION_SLUGS and the
page rendered correctly via /admin/[section], but the entry was never
added to the hand-maintained ADMIN_SECTIONS array. Operators could only
reach the view by typing the URL directly. Add the entry next to
ai-quality so the two AI-quality views sit together, and add a drift
guard test that walks ADMIN_SECTION_SLUGS and asserts every slug has a
matching nav entry. Same drift class would recur on the next admin
section addition without the guard.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Eight commits closed all seven items from `.planning/v1422-backlog.md`.
STATE entry documents the per-item changes; new
`phase-W5-v1423-report.md` captures the H5 deploy decision, the H7
admin view path + the first useful question it answers, and the
OpenAPI registry additions (3 routes — H4 GET + PUT, H7 POST).
Test deltas: 2191 → 2223 unit (+32), +2 integration files, no
regressions.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The v1.4.22 prose rewrite shipped without a way for users to signal
whether the new tone is landing. v1.4.23 H7 closes that loop with a
light-touch thumbs row + an admin first-week dashboard.
Schema: extend `RecommendationFeedback` with a polymorphic
`target_type` column (default "recommendation" so legacy rows stay
representative) plus a nullable `reason` field. New index on
(target_type, created_at) so the aggregator can scan per-surface
buckets without a full sweep. Migration `0040_recommendation_feedback_target_type`.
Route: POST /api/insights/chat/messages/:id/feedback. Body
{ rating: "helpful" | "unhelpful", reason?: string }. Verifies
ownership (404 on cross-account messages — no existence leak),
decrypts the message body for the dedup key, and writes the row with
target_type="coach" + a metric-source string encoding the user's
active prefs (`coach:tone=warm:verbosity=default`). Per-user 60/h rate
limit. 409 on a P2002 (already_rated) so a double-click is a no-op.
Aggregator: new `buildCoachFeedbackBuckets()` slices Coach rows by
(promptVersion, tone, verbosity). The summary blob the worker writes
to AppSettings.adminAiInsightsFeedbackSummary now carries both
`buckets` (pre-existing) and `coachBuckets` (H7 addition). Targets
the same singleton row so no second worker handler is needed.
Admin view: `/admin/coach-feedback` (new section slug) renders the
Coach buckets as a small DataTable (prompt version × tone × verbosity
× helpful × not-helpful × n × helpful-rate). Helpful-rate column
tinted via Dracula tokens (green ≥80%, yellow ≥50%, orange below).
First useful question this answers: "Is the v1.4.22 prose rewrite
landing well, or did the warm tone overshoot?" If the helpful-rate
for PROMPT_VERSION 4.23.x drops below 50% within the first 100
ratings, v1.4.24 walks the persona back.
UI: `<ThumbsUp>` / `<ThumbsDown>` buttons (lucide icons, no emoji)
under each persisted assistant bubble. Streaming bubbles + refusals
+ error bubbles skip the row so users can't rate before the message
lands on disk. Localised "Thanks for the signal." after submit.
OpenAPI: spec carries the new POST route + the request schema.
Coverage now includes the H4 + H7 routes — three additions over
v1.4.22 baseline.
Tests +9 unit (aggregator Coach-bucket slicing, admin section
render-paths) plus an integration round-trip for the route.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The Pearson p-value derives from the Fisher's-Z normal approximation.
At low df (df < 18, n < 20) the normal approx is generous in the
wrong direction — at df=12 a true p≈0.04 reports as p≈0.025, sneaking
past the p<0.05 surfacing gate. The v1.4.22 product-lead memo flagged
this as Code-MED-03 with a deadline of "before v1.5/v1.6 auto-
discovery ships" because the false-positive cost compounds when
correlations get auto-generated.
Two paths considered:
- Rigorous: drop in a 30-LOC incomplete-beta implementation so the
p-value is accurate at every df. Cleanest fix, no test churn.
- Conservative: raise `MIN_PAIRED_N` from 14 to 20 so the borderline
band is excluded entirely. Smaller patch, no maths-library
dependency.
v1.4.23 ships the conservative fix. The rigorous incomplete-beta
swap is queued as a v1.4.24 candidate; if usage data from the
v1.4.16 B5e feedback aggregator later shows users miss the
borderline cards, the rigorous path lands then.
Trade-off: a small set of borderline-significance correlation cards
stop rendering. Acceptable for v1.5 — the prompt-injection guards +
warm Coach prose make it more important to under-report than over-
report patterns.
Tests +1 (`pearson` n=15 → insufficient pin) plus an existing
`correlateBpCompliance` n=13 test renamed to n=15 + the noise-fixture
extended from 15 to 20 entries to clear the new gate.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The schema declared `MedicationSchedule.daysOfWeek` (mapped to
`days_of_week`) but no migration ever created the column. Code
paths in src/components/medications/*, src/app/api/medications/*,
src/app/api/admin/notifications/reminder-check/*, and the
achievements route all reference it via the comma-separated
"0,1,3,5" recurrence string.
Pre-v1.4.23 deploys silently survived because the existing query
sites only selected the column on SELECT — Postgres would have
failed loudly the moment a user actually saved a non-default
recurrence string via the medication form.
Migration `0039_medication_schedule_days_of_week` adds the column
nullable, default NULL. NULL means "daily" — `parseScheduleRecurrence(null)`
already returns the all-7-days set, so existing rows get the correct
semantics without backfill.
H5 decision rationale: deploy (Option A) over drop (Option B). The
field is referenced by 9 source files across 4 user-visible surfaces
(medication form, card, intake list, reminder dispatcher). Removing
it would force a UI rewrite of the recurrence picker and break
existing test fixtures. Deploying matches the schema's stated intent
and unblocks the v1.4.21 senior-dev review's MED-5 flag.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The v1.4.22 B5 audit removed the placeholder cog from the Coach
drawer header because it had no real wiring. v1.4.23 H4 returns
the cog with an actual settings surface backed by a per-user
preferences row.
Schema: nullable JSONB column `users.coach_prefs_json` (migration
0038_coach_prefs). Null = legacy v1.4.22 defaults; non-null carries
`{ tone, verbosity, excludeMetrics, showEvidenceByDefault }` validated
by the Zod schema in `src/lib/validations/coach-prefs.ts`.
Routes: GET + PUT `/api/auth/me/coach-prefs`. PUT validates the body,
persists the canonical defaulted form, and emits an
`auth.me.coach-prefs.put` annotation with the four-knob meta. OpenAPI
registry covers both verbs; the spec regenerates without drift.
Coach prompt builder: `getCoachSystemPrompt(locale, prefs)` prepends a
per-user OVERRIDE paragraph for non-default tone (neutral / concise)
and verbosity (brief / detailed). Concise tone forces brief verbosity
regardless of the explicit selection — concise == short. Default
prefs leave the prompt unchanged so the v1.4.22 train stays in place.
Snapshot builder: reads the prefs row BEFORE any measurement query
and intersects `excludeMetrics` with the resolved scope. The model
never sees data the user opted out of — that's the load-bearing
order: filter first, query second.
UI: settings cog in the drawer header opens a right-edge `<Sheet>`
with three Select pickers (tone, verbosity) and one Switch column
(per-metric exclusions + showEvidenceByDefault). Save calls the PUT
route and invalidates the `["coach-prefs"]` query so the next reply
honours the new defaults without a reload. EN + DE i18n keys for
every label and hint.
Message-thread reads the same `["coach-prefs"]` cache and toggles the
`open` attribute on the evidence `<details>` element when
`showEvidenceByDefault` is true.
Tests +24 unit (coach-prefs schema, system-prompt prefix, snapshot
mock for new prefs row). Integration round-trip seeds a session,
PUTs a non-default prefs shape, asserts the GET reflects the saved
values + the DB row carries the canonical defaulted form.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The v1.4.20 implementation reset the composer by mounting the
`<CoachDrawer>` with `key={prefill}`. That weaponised React's
key-reset to flush internal state every prefill change — Sr-HIGH-4
flagged it as a smell because the next refactor that touches the
drawer's mount point silently loses the reset semantics.
Replace with the controlled-prop pattern React documents at
https://react.dev/learn/you-might-not-need-an-effect#adjusting-some-state-when-a-prop-changes:
new `useResettableValue` hook reads the controlled prefill, mirrors
it via a sibling useState pair, and seeds the composer with the new
value when the prop changes. Render-phase setState — ESLint-clean
against `react-hooks/set-state-in-effect`. The user can still type
freely; the drawer only resets when the parent changes which
suggested-prompt chip is active.
`nextResettableValue` exposes the comparison contract as a pure
helper so the unit test can pin the (Object.is) semantics without
standing up a React renderer.
The `<CoachDrawer key={…}>` is gone from the insights page mount.
Tests +5: pure-function coverage of unchanged value (no reset),
prefill change (reset), null↔empty transition (reset), suggestion
chip → cleared prefill (reset), and NaN-to-NaN edge case (no reset
under Object.is).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The W2-of-v1.4.20 BD-Zielbereich fix needed the complete sys + dia
series to compute the all-time + prior-month + prior-year windows,
so it pulled both tables via single-shot `findMany`. For a 5-year
power user (~9 000 rows per side) that's a 50-100 ms Prisma round-
trip and a ~2 MB working-set allocation per /api/analytics request.
Switch to a cursor-paged 5 000-row chunked read via the new
`fetchBpSeriesChunked()` helper. The accumulated `BpReading[]` is the
same shape `computeBpInTargetWindows()` already consumed; the
working-set ceiling is now `BP_CHUNK_SIZE` instead of unbounded. Safety
bound at 1 000 pages = 5 M rows so a cursor-staleness bug can't loop
forever.
Wide-event annotation `analytics.bp_in_target.row_count` (+ per-side
`sys_rows` / `dia_rows`) lets ops attribute slow requests to outlier
users without rerunning the DB queries.
Integration test seeds a 6 000-row dataset (3 000 sys + 3 000 dia)
spanning a chunk boundary and asserts the response shape stays the
same — last30Days, last7Days, allTime windows all carry the
hand-derivable percentages.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The W3-of-v1.4.22 sentinel parser silently dropped malformed rows and
fired `coach.keyvalues.parse_failed` only when the entire block was
unusable. Mixed-format drift (one row breaks, the other six parse)
landed without any signal. Surface it.
- `SentinelParseResult.malformedEntries[]` records each skipped row
with a typed reason (`missing_colon` / `value_overflow` /
`label_overflow` / `no_END_marker` / `byte_overflow` /
`schema_invalid`). Block-level failures (truncation, missing close
marker) land here as synthetic entries so the wide-event always
carries a typed cause.
- Per-row label and value caps moved out of the Zod schema into the
parser so the row-level reason can be `label_overflow` /
`value_overflow` rather than the catch-all `schema_invalid`.
- Chat route splits the annotation: `coach.keyvalues.parse_partial`
when at least one row parsed AND at least one row failed, the
existing `coach.keyvalues.parse_failed` stays for full-block
failures. Both annotations carry the per-line reason array.
- Backwards-compatible `parseKeyValueLine` wrapper preserved.
Tests +5: label_overflow, value_overflow, byte_overflow,
mixed-malformed entry assertions, and a tryParseKeyValueLine
direct-API surface check.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Wave 4 closes the v1.4.23 foundation track. F5 (OpenAPI 3.1 drift
gate, warn-only for v1.4.23), F6 (Coach schema slot for Apple Health
metrics + PROMPT_VERSION 4.23.0), F7 (per-device refresh-token reuse
detection + device-management endpoints), and F8 (Coolify auto-deploy
runbook) all green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two halves of the contract — workflow-side webhook (v1.4.22 C3 force=true
already in place) and Coolify-side image-digest watch toggle — must
both be on for tag pushes to land on production without an SSH retag.
The runbook in .planning/coolify-auto-deploy-howto.md now spells out
both pieces verbatim plus the verification curl + host-side fallback.
The workflow gains a single ::notice:: line after the webhook call so
future Actions runs surface the timestamp + sha for triage without
opening the verbose log.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds GET /api/auth/me/devices to list a user's paired devices
(label, lastSeen, channels, isCurrent marker) plus matching DELETE
routes at /api/auth/me/devices/[id] and /api/devices/[id]. Revoke
cascades: every refresh token bound to the device is killed alongside
its paired access tokens, then the device row is deleted.
Cross-user attempts return 404 (no enumeration leak). The duplicated
/api/devices/[id] endpoint is the native-friendly URL the iOS client
calls on APNs token rotation, mirroring the W3 open question.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pre-1.4.23, a replay attempt on a single device's stale refresh token
revoked every refresh token the user owned — signing them out of every
device. The legitimate two-device case (iPad + iPhone, one drops into
airplane mode and rotates) hit the same code path. v1.4.23 scopes the
blast radius to rows matching the offending refresh row's deviceId so
only the suspect device is signed out.
Legacy tokens issued before v1.4.23 carry deviceId=null and fall back
to the wider revoke — a safety hatch we keep until the last 60-day
refresh token from the old policy expires.
The native-client routes already forward X-Device-Id on every refresh,
so the legitimate path always carries a deviceId. A missing deviceId
on a replay is itself a suspicious signal, hence the conservative
fall-through.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Extends the strict insight schema, Coach snapshot pipeline, and
provenance envelope with the seven Apple Health categories that landed
in Wave 2 (HRV, sleep, resting HR, steps, active energy, flights,
distance, VO2 max, body temperature). All fields are additive and
optional — web-only accounts pay zero extra SQL and the prompt's new
GROUND RULE 12 instructs the model to stay silent when the snapshot
doesn't carry the HealthKit blocks.
Ratchets PROMPT_VERSION 4.22.0 → 4.23.0 and refreshes the
sourceMetric / trendAnnotations enums in both EN + DE. Two new test
files pin the prompt body and the snapshot fan-out.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
