The R4 design review flagged /about as missing the TOC the /privacy
page carries. /about is two sections (Project + Credits) and fits the
fold on every viewport, so a collapsible TOC costs a tap to expand
for negligible payoff. Pin the decision in the file header so a
future reader does not re-open the question on a future polish
sweep.
Both pages anchored their sections at scroll-mt-20 (80 px). The sticky
header pads safe-area-inset-top (~47 px on a notch device) plus py-3
plus an inner min-h-11 link, landing around 115 px — past the 80 px
offset. Lifting to scroll-mt-28 (112 px) clears the header on every
viewport we ship to without over-padding the desktop case.
The /about page (GeoLite2 attribution) was listed in proxy.ts
PUBLIC_PATHS but missed in AuthShell's client-side PUBLIC_PATHS, so
unauthenticated visitors bounced through /auth/login. Add /about to
the AuthShell list and treat it as a standalone public page (same
edge-to-edge render as /privacy).
Apply safe-area-inset-top on the privacy and about sticky headers so
iOS notch / Dynamic Island viewports don't overlap the brand row. Add
a default-closed Contents <details> TOC at the top of the privacy
policy and wrap every HealthKit identifier <code> with break-all so
long camelCase strings (heartRateVariabilitySDNN,
environmentalAudioExposure) wrap inside narrow viewports.
Final surface sweep for the v1.4.27 tap-target work: the chart band
overlay, the error-details action row, and the public-page header
links.
- `health-chart.tsx`: band overlay used to inset `right: 18px` while
the underlying ComposedChart margin is `right: 8`, so the colour
band drifted left of the plotted line by 10 px on every viewport.
Pin the overlay to the chart's actual right edge.
- `error-details.tsx`: drop `size="sm"` from the retry, copy, and
report-issue buttons so they sit at the default 40 px primitive
height — clears the WCAG 2.5.5 floor on touch.
- `auth/login/page.tsx`: back-to-passkey toggle wraps in `inline-flex
min-h-11 w-full` so the form-mode swap is reachable on touch.
- `privacy/page.tsx` and `about/page.tsx`: header HealthLog + Sign-in
links wrap in `inline-flex min-h-11` so the public-page chrome
clears the floor.
Rewrites src/lib/geo.ts so lookupIpLocation reads from the bundled
MaxMind GeoLite2-City MMDB first and falls back to the existing
ipwho.is path only for IPs the offline DB cannot resolve. Adds a
sibling lookupIpAsn that returns { asn, carrier } from the
GeoLite2-ASN MMDB so the admin login-overview can grow a carrier
chip alongside the auth-provider chip.
The MMDB files are too large to vendor in git. scripts/fetch-geolite2.sh
downloads them at build time using a MaxMind license key; the
Dockerfile copies assets/geolite2/ into /opt/geolite2/. When the
license key is absent or the files are missing the image still
builds and the resolver falls back to ipwho.is (v1.4.26 behaviour).
GeoLite2 is CC BY-SA 4.0 — attribution lives on the new public
/about page and in docs/audit/v1427-summary.md.
Marc-André Bombeck