Merge pull request #596 from MBombeck/sec/next-16.2.11

release/v1.32.2 — Next.js 16.2.11 security patch (4 high-severity App Router advisories)

.dockerignore

@@ -49,6 +49,7 @@ public/sw-version.js
 
 # Editor / agent worktrees + caches.
 .claude
+.worktrees
 .cursor
 .aider*
 .vscode

.env.example

@@ -98,6 +98,17 @@ API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 # Users bring their own API keys via Settings. No server-side key needed by
 # default. The admin can configure a fallback key in the Admin Panel.
 
+# Local-AI SSRF opt-in (optional). The local AI provider rejects private/
+# internal hosts by default. Set to an exact host allowlist (comma-separated,
+# e.g. "ollama.lan,10.0.0.5") or "true" for any private host — intended for a
+# self-hosted Ollama / LM Studio endpoint. See docs/integrations/ai-providers.md.
+# ALLOW_LOCAL_AI_PRIVATE_HOSTS=""
+
+# Daily-briefing output-token ceiling (optional). Default 2500, clamped to
+# 500-8000. Raise it when a verbose model's briefing JSON gets cut off
+# ("AI response was cut off"). See docs/integrations/ai-providers.md.
+# INSIGHTS_MAX_TOKENS=""
+
 # Maximum number of comprehensive-insight generations a single user can
 # trigger per hour (POST /api/insights/generate). Default 10. The 24h
 # DB cache short-circuits this for read traffic; only force=true and

.env.production.example

@@ -115,10 +115,12 @@ API_TOKEN_HMAC_KEY="<openssl rand -hex 32>"
 # hides password/passkey login entirely once set to "true" -- but only takes
 # effect when the three vars above are also fully set, so a typo can't lock
 # every user out. Enforced server-side, not just a hidden button. The native
-# iOS client authenticates via password/passkey only -- there is no OIDC
-# flow for it yet -- so OIDC_ONLY="true" locks the iOS app out of sign-in
-# entirely until a native SSO flow ships. Do not enable it on a deployment
-# with active iOS users.
+# iOS client signs in through the native OIDC SSO handoff (the app opens the
+# login URL in an in-app browser and completes at a custom-scheme callback), so
+# OIDC_ONLY="true" is supported for iOS -- but only on the app build that ships
+# that flow. An older password/passkey-only iOS build is locked out of sign-in
+# by OIDC_ONLY; confirm the app version before enabling it on a deployment with
+# active iOS users.
 # Serve the issuer over HTTPS wherever possible: sign-in material (the
 # authorization code, the token-endpoint response carrying the ID token)
 # crosses this connection. Plain HTTP is defensible only on a fully trusted

.github/workflows/coach-eval.yml

@@ -39,7 +39,7 @@ jobs:
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm

.github/workflows/dependabot-auto-merge.yml

@@ -16,7 +16,7 @@ jobs:
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: "pnpm"

.github/workflows/docker-publish.yml

@@ -37,6 +37,57 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  release-policy:
+    name: Validate release policy
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - name: Checkout full history
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Validate release policy
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
+            echo "::notice::Pull-request image validation does not publish release tags."
+            exit 0
+          fi
+
+          if [ "$GITHUB_REF_TYPE" != "tag" ] || [[ ! "$GITHUB_REF_NAME" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+            echo "::error::Release ref '$GITHUB_REF_NAME' is not a strict SemVer tag (expected vMAJOR.MINOR.PATCH with no leading zeroes or prerelease suffix)." >&2
+            exit 1
+          fi
+
+          package_version="$(node -p "require('./package.json').version")"
+          tag_version="${GITHUB_REF_NAME#v}"
+          if [ "$package_version" != "$tag_version" ]; then
+            echo "::error::package.json version '$package_version' does not match release tag '$GITHUB_REF_NAME'." >&2
+            exit 1
+          fi
+
+          git fetch --no-tags origin main:refs/remotes/origin/main
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
+            echo "::error::Release commit $GITHUB_SHA is not an ancestor of origin/main." >&2
+            exit 1
+          fi
+
+          successful_quality_runs="$(
+            gh api "repos/$GITHUB_REPOSITORY/actions/runs?head_sha=$GITHUB_SHA&event=push&status=success&per_page=100" \
+              --jq '[.workflow_runs[] | select(.name == "Security & Quality" and .head_branch == "main")] | length'
+          )"
+          if [ "$successful_quality_runs" -lt 1 ]; then
+            echo "::error::Release commit $GITHUB_SHA has no successful prior Security & Quality push run on main." >&2
+            exit 1
+          fi
+
+          echo "Release policy passed for $GITHUB_REF_NAME at $GITHUB_SHA."
+
   # ── Stage 1 ────────────────────────────────────────────────────────
   # Build each architecture on its own native GitHub-hosted runner so
   # Next.js's static-page workers run on real silicon instead of QEMU
@@ -54,6 +105,7 @@ jobs:
   # manifest in a third step, so consumers see a single tag that
   # auto-selects on `docker pull` per local platform.
   build:
+    needs: [release-policy]
     name: Build ${{ matrix.platform }}
     runs-on: ${{ matrix.runner }}
     # 25 min wall clock — native amd64 build finished inside 12 min
@@ -265,6 +317,11 @@ jobs:
     if: github.event_name != 'pull_request'
     needs: [build]
     timeout-minutes: 10
+    outputs:
+      image_ref: ${{ steps.published.outputs.image_ref }}
+      image_tag: ${{ steps.published.outputs.image_tag }}
+      image_digest: ${{ steps.published.outputs.image_digest }}
+      build_sha: ${{ steps.published.outputs.build_sha }}
     permissions:
       contents: read
       packages: write
@@ -335,9 +392,21 @@ jobs:
           docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
             $(printf '${{ env.IMAGE_REF }}@sha256:%s ' *)
 
-      - name: Inspect published manifest
+      - name: Resolve published image
+        id: published
+        env:
+          IMAGE_TAG: ${{ github.ref_name }}
         run: |
-          docker buildx imagetools inspect '${{ env.IMAGE_REF }}:${{ steps.meta.outputs.version }}'
+          image_digest="$(docker buildx imagetools inspect "${IMAGE_REF}:${IMAGE_TAG}" --format '{{json .Manifest.Digest}}' | tr -d '"')"
+          if [[ ! "$image_digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+            echo "::error::Could not resolve a valid manifest digest for ${IMAGE_REF}:${IMAGE_TAG}." >&2
+            exit 1
+          fi
+          echo "image_ref=$IMAGE_REF" >> "$GITHUB_OUTPUT"
+          echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
+          echo "image_digest=$image_digest" >> "$GITHUB_OUTPUT"
+          echo "build_sha=${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
+          docker buildx imagetools inspect "${IMAGE_REF}@${image_digest}"
 
       # v1.16.4 — sign the multi-arch manifest index (keyless, Sigstore).
       # Signing the INDEX digest covers both per-platform manifests in
@@ -357,91 +426,59 @@ jobs:
 
       - name: Sign multi-arch manifest (keyless)
         env:
-          IMAGE_VERSION: ${{ steps.meta.outputs.version }}
+          IMAGE_DIGEST: ${{ steps.published.outputs.image_digest }}
         run: |
-          digest="$(docker buildx imagetools inspect "${IMAGE_REF}:${IMAGE_VERSION}" --format '{{json .Manifest.Digest}}' | tr -d '"')"
-          if [ -z "$digest" ]; then
-            echo "::error::Could not resolve the manifest digest for ${IMAGE_REF}:${IMAGE_VERSION} — signing aborted."
-            exit 1
-          fi
-          echo "Signing ${IMAGE_REF}@${digest}"
-          cosign sign --yes "${IMAGE_REF}@${digest}"
-          echo "::notice::Image index signed (keyless): ${IMAGE_REF}@${digest}. Verify with cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github.com/${{ github.repository }}/' ${IMAGE_REF}@${digest}"
+          echo "Signing ${IMAGE_REF}@${IMAGE_DIGEST}"
+          cosign sign --yes "${IMAGE_REF}@${IMAGE_DIGEST}"
+          echo "::notice::Image index signed (keyless): ${IMAGE_REF}@${IMAGE_DIGEST}. Verify with cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github.com/${{ github.repository }}/' ${IMAGE_REF}@${IMAGE_DIGEST}"
 
-      # v1.4.15: trigger the Coolify deploy automatically once GHCR has
-      # the new image. Replaces the former manual SSH + force-pull recipe
-      # on the deployment host.
-      #
-      # Runs only on the publish path (push to `main` or to a `v*` tag), never
-      # on PRs. `continue-on-error: true` because the image is *already*
-      # published to GHCR by the time we reach this step — a Coolify-side
-      # outage must not retroactively fail the build. The maintainer still
-      # has the manual recipe as fallback.
-      #
-      # Required GitHub repository secrets (set by the maintainer once):
-      #   COOLIFY_WEBHOOK = full deploy URL incl. ?uuid=...&force=false
-      #   COOLIFY_TOKEN   = Bearer token from Coolify UI -> Keys & Tokens
-      # Both secrets are referenced exclusively here. If either is unset, the
-      # step short-circuits to a skip rather than calling Coolify with empty
-      # auth.
-      #
-      # v1.4.26 P6-3 — maintainer toggle.
-      # Three releases in a row shipped via the host-side SSH-retag fallback
-      # because the secrets above silently absent + the warn-only skip
-      # below let the workflow stay green. The `vars.COOLIFY_AUTO_DEPLOY`
-      # repository variable now distinguishes the two intended modes:
-      #
-      #   COOLIFY_AUTO_DEPLOY=on  →  if secrets present, deploy; if absent,
-      #                              FAIL the step so the maintainer sees the
-      #                              missing-secret gap on the next release.
-      #   COOLIFY_AUTO_DEPLOY=off →  unconditional skip with a notice. Use
-      #                              this when the host-side SSH recipe is
-      #                              the intended deploy path.
-      #   (unset / any other)     →  warn-and-skip (legacy behaviour).
-      #
-      # Set the variable under repo Settings → Secrets and variables →
-      # Actions → Variables (NOT Secrets — it is intentionally readable).
+  verify-published-image:
+    name: Verify exact published image
+    needs: merge
+    permissions:
+      contents: read
+      packages: read
+    uses: ./.github/workflows/post-publish-verify.yml
+    with:
+      image_ref: ${{ needs.merge.outputs.image_ref }}
+      image_tag: ${{ needs.merge.outputs.image_tag }}
+      image_digest: ${{ needs.merge.outputs.image_digest }}
+      build_sha: ${{ needs.merge.outputs.build_sha }}
+    secrets: inherit
+
+  promote:
+    name: Promote verified image to Coolify
+    needs: [merge, verify-published-image]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
       - name: Trigger Coolify deploy
-        continue-on-error: true
         env:
           COOLIFY_WEBHOOK: ${{ secrets.COOLIFY_WEBHOOK }}
           COOLIFY_TOKEN: ${{ secrets.COOLIFY_TOKEN }}
           COOLIFY_AUTO_DEPLOY: ${{ vars.COOLIFY_AUTO_DEPLOY }}
-          IMAGE_VERSION: ${{ steps.meta.outputs.version }}
+          IMAGE_TAG: ${{ needs.merge.outputs.image_tag }}
+          IMAGE_DIGEST: ${{ needs.merge.outputs.image_digest }}
+          BUILD_SHA: ${{ needs.merge.outputs.build_sha }}
         run: |
           mode="${COOLIFY_AUTO_DEPLOY:-}"
           if [ "$mode" = "off" ]; then
-            echo "::notice::COOLIFY_AUTO_DEPLOY=off — skipping registry deploy hook. Maintainer uses the host-side SSH recipe instead."
+            echo "::notice::COOLIFY_AUTO_DEPLOY=off — skipping registry deploy hook."
+            exit 0
+          fi
+          if [ "$mode" != "on" ]; then
+            echo "::warning::COOLIFY_AUTO_DEPLOY is not 'on' or 'off' — skipping auto-deploy. Set an explicit mode in repository variables."
             exit 0
           fi
           if [ -z "$COOLIFY_WEBHOOK" ] || [ -z "$COOLIFY_TOKEN" ]; then
-            if [ "$mode" = "on" ]; then
-              echo "::error::COOLIFY_AUTO_DEPLOY=on but COOLIFY_WEBHOOK or COOLIFY_TOKEN secret is missing. Set both under repo Settings → Secrets and variables → Actions, or set COOLIFY_AUTO_DEPLOY=off to silence."
-              exit 1
-            fi
-            echo "::warning::COOLIFY_WEBHOOK or COOLIFY_TOKEN secret missing — skipping auto-deploy. Configure in repo Settings → Secrets to enable, or set the COOLIFY_AUTO_DEPLOY variable to 'off' to silence this warning."
-            exit 0
+            echo "::error::COOLIFY_AUTO_DEPLOY=on but COOLIFY_WEBHOOK or COOLIFY_TOKEN secret is missing. Set both credentials or disable promotion explicitly." >&2
+            exit 1
           fi
-          # v1.4.31 — wait for GHCR cache propagation before firing
-          # the Coolify webhook. Five releases in a row (v1.4.27
-          # through v1.4.30.1) the webhook reported "finished" but
-          # Coolify still pulled the prior `:latest` digest. The
-          # `docker buildx imagetools create` + `inspect` steps
-          # above confirm the manifest exists at registry-write time,
-          # but GHCR's CDN edges can take 30-90 s to propagate the
-          # new digest. The webhook fires inside that window, so
-          # Coolify pulls "latest" while the edge still serves the
-          # prior digest, gets "no change", and returns success.
-          # Waiting out the propagation window before firing the
-          # webhook closes that gap.
-          echo "Waiting 90 s for GHCR cache propagation before triggering Coolify (image: $IMAGE_VERSION)…"
+
+          echo "Waiting 90 s for registry propagation before promoting ${IMAGE_TAG}@${IMAGE_DIGEST}."
           sleep 90
-          # v1.4.22 C3 — force=true tells Coolify to skip its image-cache
-          # and re-pull the registry digest. If the maintainer's secret
-          # URL already carries a `?force=` query, leave it alone;
-          # otherwise append `?force=true` (or `&force=true` if other
-          # query params are present) so doc-only deploys still trigger
-          # a registry-digest check.
           deploy_url="$COOLIFY_WEBHOOK"
           if ! echo "$deploy_url" | grep -q "force="; then
             if echo "$deploy_url" | grep -q "?"; then
@@ -450,18 +487,18 @@ jobs:
               deploy_url="${deploy_url}?force=true"
             fi
           fi
-          echo "Triggering Coolify deploy for ref ${{ github.ref_name }} (sha ${GITHUB_SHA::7})"
-          response=$(curl --silent --show-error --max-time 30 \
+
+          echo "Triggering Coolify deploy for ${IMAGE_TAG}@${IMAGE_DIGEST} (source ${BUILD_SHA})."
+          response="$(curl --silent --show-error --max-time 30 \
             --write-out "\n__HTTP_STATUS__:%{http_code}" \
             --request GET "$deploy_url" \
-            --header "Authorization: Bearer $COOLIFY_TOKEN")
+            --header "Authorization: Bearer $COOLIFY_TOKEN")"
           status="${response##*__HTTP_STATUS__:}"
           body="${response%__HTTP_STATUS__:*}"
           echo "Coolify response (HTTP $status):"
           echo "$body"
           if [ "$status" -lt 200 ] || [ "$status" -ge 300 ]; then
-            echo "::error::Coolify deploy webhook returned HTTP $status — image is published, but auto-deploy did not fire. Maintainer: deploy manually on the deployment host (SSH force-pull recipe, see docs/ops/deploy.md)."
+            echo "::error::Coolify deploy webhook returned HTTP $status for verified image ${IMAGE_TAG}@${IMAGE_DIGEST}." >&2
             exit 1
           fi
-          echo "::notice::Coolify auto-deploy webhook fired at $(date -u +%FT%TZ) for ref ${{ github.ref_name }} (sha ${GITHUB_SHA::7}). If /api/version doesn't reach the new tag within ~60s, re-trigger the deploy from the Coolify UI or deploy manually on the deployment host (docs/ops/deploy.md)."
-          echo "Coolify deploy queued — awaiting outgoing notification webhook to /api/internal/deploy-webhook for final status."
+          echo "Coolify deploy queued for verified image ${IMAGE_TAG}@${IMAGE_DIGEST}."

.github/workflows/e2e.yml

@@ -37,10 +37,11 @@ jobs:
       DATABASE_URL: postgresql://healthlog:healthlog@localhost:5432/healthlog?schema=public
       ENCRYPTION_KEYS: '{"v1":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}'
       ENCRYPTION_ACTIVE_KEY_ID: v1
-      API_TOKEN_HMAC_KEY: ci-hmac-key-32-bytes-min-padding-x
+      API_TOKEN_HMAC_KEY: bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
       AUTH_RP_NAME: HealthLog
       AUTH_RP_ID: localhost
       AUTH_RP_ORIGIN: http://localhost:3000
+      SESSION_COOKIE_SECURE: "false"
       NODE_ENV: production
 
     steps:
@@ -48,7 +49,7 @@ jobs:
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm
@@ -87,10 +88,11 @@ jobs:
         env:
           E2E_BASE_URL: http://localhost:3000
 
-      - name: Upload Playwright HTML report on failure
-        if: failure()
+      - name: Upload Playwright HTML report
+        if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-report
           path: playwright-report/
           retention-days: 7
+          if-no-files-found: ignore

.github/workflows/env-check.yml

@@ -31,7 +31,7 @@ jobs:
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm

.github/workflows/integration.yml

@@ -18,7 +18,7 @@ jobs:
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm
@@ -38,6 +38,6 @@ jobs:
           # string "0" — failing crypto's hex/base64 length check and breaking
           # the backups + integration-status suites for 50+ runs (regression
           # since v1.4.13). Quoting forces a literal scalar.
-          API_TOKEN_HMAC_KEY: "integration-tests-do-not-use-in-prod"
+          API_TOKEN_HMAC_KEY: "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
           ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000"
           SESSION_SECRET: "integration-tests"

.github/workflows/knip.yml

@@ -20,7 +20,7 @@ jobs:
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm

.github/workflows/post-publish-verify.yml

@@ -1,33 +1,42 @@
 name: Post-publish verify
 
-# Informational reachability gate that runs AFTER `Build & Publish Docker
-# Image` finishes a `main` (or tag) build. Pulls the just-published image
-# from GHCR and probes:
-#   - the image manifest is fetchable (i.e. the push actually completed)
-#   - the container starts and `/api/version` returns the expected version
-#   - the container's `/api/health` endpoint reports OK
-#
-# Does NOT block deploys — `continue-on-error` is set on every probe step
-# so a transient registry blip doesn't go red. This is a smoke gate the
-# v1.4.14 release would have caught: the main push appeared to "succeed"
-# from the deploy host's POV, but the host had to pull the tag image
-# because main's manifest never finished pushing.
-#
-# Triggered by `workflow_run` so it only runs after the build workflow
-# actually completes — chaining via `needs:` would force the build into
-# the same workflow file.
-
 on:
-  workflow_run:
-    workflows: ["Build & Publish Docker Image"]
-    types: [completed]
-    branches: [main]
+  workflow_call:
+    inputs:
+      image_ref:
+        description: Exact registry repository to verify
+        required: true
+        type: string
+      image_tag:
+        description: Exact published release tag
+        required: true
+        type: string
+      image_digest:
+        description: Exact published multi-arch manifest digest
+        required: true
+        type: string
+      build_sha:
+        description: Expected short source commit SHA
+        required: true
+        type: string
   workflow_dispatch:
     inputs:
+      image_ref:
+        description: Exact registry repository to verify
+        required: true
+        type: string
       image_tag:
-        description: "GHCR image tag to verify (defaults to `main`)"
-        required: false
-        default: "main"
+        description: Exact published release tag
+        required: true
+        type: string
+      image_digest:
+        description: Exact published multi-arch manifest digest
+        required: true
+        type: string
+      build_sha:
+        description: Expected short source commit SHA
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -35,14 +44,15 @@ permissions:
 
 jobs:
   verify:
-    name: Pull + smoke-test published image
+    name: Pull and smoke-test exact published image
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    # Skip if the upstream build itself failed — there's nothing to verify.
-    # Manual dispatch always runs.
-    if: >-
-      github.event_name == 'workflow_dispatch' ||
-      github.event.workflow_run.conclusion == 'success'
+    env:
+      IMAGE_REF: ${{ inputs.image_ref }}
+      IMAGE_TAG: ${{ inputs.image_tag }}
+      IMAGE_DIGEST: ${{ inputs.image_digest }}
+      BUILD_SHA: ${{ inputs.build_sha }}
+      DATABASE_URL: postgresql://healthlog:healthlog@localhost:5432/healthlog?schema=public
 
     services:
       postgres:
@@ -60,15 +70,6 @@ jobs:
           --health-retries 10
 
     steps:
-      - name: Resolve image tag
-        id: tag
-        run: |
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            echo "tag=${{ github.event.inputs.image_tag }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "tag=main" >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Log in to GHCR
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
@@ -76,69 +77,97 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Pull image
-        id: pull
-        continue-on-error: true
+      - name: Pull exact image
         run: |
-          IMAGE="ghcr.io/${{ github.repository }}:${{ steps.tag.outputs.tag }}"
-          echo "Pulling $IMAGE"
-          docker pull "$IMAGE"
-          echo "image=$IMAGE" >> "$GITHUB_OUTPUT"
+          TAG_REF="${IMAGE_REF}:${IMAGE_TAG}"
+          DIGEST_REF="${IMAGE_REF}@${IMAGE_DIGEST}"
 
-      - name: Start container
-        if: steps.pull.outcome == 'success'
-        id: run
-        continue-on-error: true
+          echo "Pulling published tag $TAG_REF"
+          docker pull "$TAG_REF"
+          resolved_digest="$(docker buildx imagetools inspect "$TAG_REF" --format '{{json .Manifest.Digest}}' | tr -d '"')"
+          if [ "$resolved_digest" != "$IMAGE_DIGEST" ]; then
+            echo "::error::Published tag digest mismatch: $TAG_REF resolved to '$resolved_digest', expected '$IMAGE_DIGEST'." >&2
+            exit 1
+          fi
+
+          echo "Pulling immutable image $DIGEST_REF"
+          docker pull "$DIGEST_REF"
+
+      - name: Run migrations
         run: |
-          # Minimal env to satisfy the strict-env validators on boot.
+          DIGEST_REF="${IMAGE_REF}@${IMAGE_DIGEST}"
+          docker run --rm \
+            --network host \
+            --entrypoint node \
+            -e DATABASE_URL="$DATABASE_URL" \
+            "$DIGEST_REF" \
+            /opt/prisma-cli/node_modules/prisma/build/index.js migrate deploy
+
+      - name: Start exact image
+        run: |
+          DIGEST_REF="${IMAGE_REF}@${IMAGE_DIGEST}"
           docker run -d --name healthlog-verify \
             --network host \
-            -e DATABASE_URL='postgresql://healthlog:healthlog@localhost:5432/healthlog?schema=public' \
+            -e DATABASE_URL="$DATABASE_URL" \
             -e ENCRYPTION_KEYS='{"v1":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' \
             -e ENCRYPTION_ACTIVE_KEY_ID=v1 \
-            -e API_TOKEN_HMAC_KEY=verify-hmac-key-32-bytes-padding-x \
+            -e API_TOKEN_HMAC_KEY=cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc \
             -e AUTH_RP_NAME=HealthLog \
             -e AUTH_RP_ID=localhost \
             -e AUTH_RP_ORIGIN=http://localhost:3000 \
             -e NODE_ENV=production \
-            -e HEALTHLOG_PROCESS_TYPE=web \
             -e PORT=3000 \
-            "${{ steps.pull.outputs.image }}"
+            "$DIGEST_REF"
 
-          # Wait up to 60 s for the server to start answering.
+      - name: Verify exact version
+        run: |
+          body=""
           for i in $(seq 1 30); do
-            if curl -sf -o /dev/null http://localhost:3000/api/version; then
-              echo "ready after ${i}*2s"
+            if body="$(curl -sf http://localhost:3000/api/version)"; then
+              echo "Version endpoint ready after $((i * 2))s"
+              break
+            fi
+            sleep 2
+          done
+          if [ -z "$body" ]; then
+            echo "::error::Exact image did not expose /api/version within 60 seconds." >&2
+            docker logs healthlog-verify || true
+            exit 1
+          fi
+
+          EXPECTED_VERSION="${IMAGE_TAG#v}"
+          echo "$body" | jq .
+          if ! jq -e --arg expected "$EXPECTED_VERSION" '.data.version == $expected' <<< "$body" >/dev/null; then
+            actual="$(jq -r '.data.version // "<missing>"' <<< "$body")"
+            echo "::error::Version mismatch: exact image reports '$actual', expected '$EXPECTED_VERSION' (release tag '$IMAGE_TAG')." >&2
+            exit 1
+          fi
+          if ! jq -e --arg expected "$BUILD_SHA" '.data.buildSha == $expected' <<< "$body" >/dev/null; then
+            actual="$(jq -r '.data.buildSha // "<missing>"' <<< "$body")"
+            echo "::error::Build SHA mismatch: exact image reports '$actual', expected '$BUILD_SHA'." >&2
+            exit 1
+          fi
+
+      - name: Verify health
+        run: |
+          for i in $(seq 1 30); do
+            if body="$(curl -sf http://localhost:3000/api/health)" && jq -e '.status == "ok"' <<< "$body" >/dev/null; then
+              echo "$body" | jq .
+              echo "Health endpoint ready after $((i * 2))s"
               exit 0
             fi
             sleep 2
           done
-          echo "::warning::Container did not become ready within 60 s"
+          echo "::error::Exact image did not report healthy within 60 seconds." >&2
           docker logs healthlog-verify || true
           exit 1
 
-      - name: Probe /api/version
-        if: steps.run.outcome == 'success'
+      - name: Container logs
+        if: always()
         continue-on-error: true
-        run: |
-          set -e
-          BODY=$(curl -sf http://localhost:3000/api/version)
-          echo "$BODY" | jq .
-          VER=$(echo "$BODY" | jq -r '.data.version // .version')
-          echo "::notice::published image ${{ steps.tag.outputs.tag }} reports version=$VER"
-
-      - name: Probe /api/health
-        if: steps.run.outcome == 'success'
-        continue-on-error: true
-        run: |
-          curl -sf http://localhost:3000/api/health | jq .
-
-      - name: Container logs (always)
-        if: always() && steps.run.outcome == 'success'
-        continue-on-error: true
-        run: docker logs healthlog-verify | tail -100
+        run: docker logs healthlog-verify
 
       - name: Tear down
         if: always()
         continue-on-error: true
-        run: docker rm -f healthlog-verify || true
+        run: docker rm -f healthlog-verify

.github/workflows/security.yml

@@ -19,7 +19,7 @@ jobs:
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: "pnpm"
@@ -70,7 +70,7 @@ jobs:
 
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: "pnpm"

.gitignore

@@ -85,3 +85,7 @@ next-env.d.ts
 
 # Local screenshot/audit harnesses (repo-root for module resolution; never committed)
 .audit-*.mjs
+
+
+# Isolated development worktrees
+/.worktrees/

CHANGELOG.md

@@ -2,6 +2,730 @@
 
 ## [Unreleased]
 
+## [1.32.2] — 2026-07-23
+
+Security release. Ships on its own and ahead of everything queued, because it
+closes a set of freshly disclosed framework vulnerabilities that affect the
+running instance today.
+
+- **Next.js updated to 16.2.11**, closing four high-severity advisories in the
+  App Router: a middleware/proxy bypass, two server-side request-forgery
+  paths (rewrites and Server Actions), and a denial of service. The
+  middleware/proxy advisory is the most relevant here, since the request edge
+  enforces the public-path allowlist and the authentication redirect. No
+  application code changed; this is the dependency patch alone.
+
+Carries the fixes already merged for 1.32.1 (honest health-score absence,
+Coach score questions, Apple Health import and Pulse fidelity, three
+silent data-loss races), since those reached the trunk first. No migrations
+beyond what 1.32.1 declared (none). No breaking changes.
+
+## [1.32.1] — 2026-07-23
+
+- **The Personal Health Score reads "not enough data yet" instead of zero.**
+  An account with records that do not yet meet any score pillar's minimum
+  (for example a single mood entry, no paired blood pressure, one weight
+  reading) showed a red 0 rather than an honest absence. The score is now
+  withheld until at least one pillar is computable; a genuinely computed 0 is
+  still shown.
+- **The Coach stops refusing ordinary questions about your own scores.** A
+  question about a Sleep Score or Health Score no longer trips the
+  fabricated-clinical-risk refusal; the guard now matches the specific risk
+  calculator it was meant to catch, not the plain word "score", and still
+  blocks a genuinely invented risk figure.
+- **The Apple Health import no longer stalls at "unpacking".** A large export
+  is now unpacked as a stream rather than decompressed whole into memory on
+  the shared event loop, and a job left mid-unpack by a restart is picked up
+  by a periodic reconcile instead of sitting stuck with no error. A byte
+  ceiling still guards against a decompression bomb.
+- **The Pulse insights page shows pulse, not resting heart rate.** It no
+  longer silently swaps its main chart to resting heart rate when any resting
+  data exists; resting heart rate appears as a clearly labelled second series
+  when present, and the resting-calibrated target band no longer paints
+  behind raw pulse readings.
+- **Dashboard layout changes can no longer be reverted by a concurrent
+  score-ring save.** The instant score-ring toggle now sends only the ring
+  fields instead of resending a cached snapshot of the whole layout, closing
+  a race where an in-flight ring update could land after a tile or chart Save
+  and silently restore the older layout.
+- **Measurement-reminder cadence edits recompute against the cadence that
+  was actually saved.** Clearing an interval or a recurrence rule to switch a
+  reminder's schedule no longer leaves the next-due date computed from the
+  just-replaced value for one cycle.
+- **ntfy notification settings keep a saved auth token across unrelated
+  edits.** Toggling the channel, or editing the server URL or topic, no
+  longer silently clears a previously configured token.
+
+No migrations. No breaking changes.
+
+## [1.32.0] — 2026-07-22
+
+- **Provider ingestion and daily reactions now preserve the correct identity.**
+  Arrival reactions are bound to the exact marker revision, workout selection
+  matches field donors to the correct surviving session, long-range buckets
+  honor the user's timezone, MCP pages stay stable, and one Withings
+  subscription repair can no longer block fallback polling for other users.
+- **Large reads and writes are bounded end to end.** Measurement exports stream
+  in pages without splitting sleep sessions, oversized projections cannot evict
+  the shared cache, dense reports and metric series use database aggregation,
+  upload reads have byte, time, and concurrency limits, full-history backfills
+  share admission control, and medication imports use durable chunks with
+  resumable, bounded final rollups.
+- **Capture and history flows are complete on mobile and desktop.** Workout
+  history loads beyond the first page, metric pages open preselected capture
+  forms and return to their origin, failed water submissions retain their draft,
+  and confirmed discards clear it.
+- **Interactive forms share one safe dismissal contract.** Dirty forms require
+  confirmation across tracked Back and Forward traversals, Apple Health setup
+  exposes successful native syncs, document selection is consumed on Coach
+  dismissal but preserved across full-page Coach navigation, conversation
+  titles can be renamed with rollback, and hidden tabs refresh meaningful
+  server state.
+- **Accessibility coverage now exercises representative authenticated routes,
+  themes, dialogs, and sheets.** Small text keeps compliant contrast, OCR uses a
+  visible labeled control, workout sections use real headings, and compact
+  actions retain 44-pixel touch targets.
+- **Client and API boundaries are explicit.** Localized stable error codes cover
+  measurement, mood, lab, and onboarding failures; client fetches and query
+  keys are lint-enforced; AI overrides are documented; and large Coach,
+  report, target, and provider modules now use one-way focused builders.
+
+- **Production image processing uses the patched Sharp 0.35 runtime.** This
+  closes the current high-severity libvips advisory chain inherited through
+  Next.js while retaining verified production-build compatibility.
+
+Migrations `0264_whoop_owner_identity`, `0265_withings_subscription_state`, and
+`0266_medication_intake_import_jobs`. No breaking changes.
+
+## [1.31.8] — 2026-07-21
+
+- **MCP search cursors keep lab results stable across pages.** Distinct analyte
+  names are ordered before offset pagination, preventing repeated or skipped
+  lab entries when a client follows `nextCursor`.
+- **Opening the medication wizard no longer risks clearing entered fields.**
+  The one-shot URL flag is removed without starting a second page navigation,
+  so slower browsers keep the active wizard instance and its form state.
+
+No migrations. No breaking changes.
+
+## [1.31.7] — 2026-07-20
+
+- **Current OpenAI reasoning models use their supported request contract.**
+  Official GPT-5, o1, o3, and o4 models receive `max_completion_tokens`
+  without unsupported `temperature` or `seed` fields; compatible custom
+  gateways retain the legacy parameters they advertise.
+- **Apple Health XML cumulative totals no longer add overlapping sources.**
+  Imports aggregate each source/day independently and select the highest
+  source subtotal, while explicit provenance prevents XML estimates or late
+  legacy samples from overwriting authoritative native HealthKit statistics.
+  Existing legacy aggregates can be repaired by re-uploading their archive.
+- **Every currently actionable medication reaches Today.** Equal-time doses no
+  longer collapse to one row, overdue doses win deterministic ties, and weekly
+  or custom intake windows use the scheduling engine's real availability
+  boundary. The shared digest fixes both the web start page and iOS Home.
+
+Migration `0263_apple_health_aggregate_authority`. No breaking changes.
+
+## [1.31.6] — 2026-07-21
+
+- **The hardened runtime image can run database migrations again.** The
+  isolated Prisma CLI now exposes its pinned `dotenv` and `prisma/config`
+  dependencies to the copied production configuration while package managers
+  remain absent from the final image.
+
+No migrations. No breaking changes.
+
+## [1.31.5] — 2026-07-21
+
+- **The production image no longer ships build-time package managers.** pnpm 11
+  verifies the lockfile under explicit build-script policy, npm and Corepack
+  are removed after migrations are prepared, and linked worktrees stay out of
+  local Docker build contexts.
+
+No migrations. No breaking changes.
+
+## [1.31.4] — 2026-07-21
+
+- **Web and background processes now start and recover predictably.** Invalid
+  encryption-key configuration fails before the service accepts traffic,
+  worker-only processes report their real health, connection limits are
+  divided safely across replicas, and provider backfills keep their bounded
+  queues during reconnects.
+- **Published images are reproducible and verified before promotion.** The
+  release pipeline builds one multi-architecture image, validates its digest,
+  startup, migrations, health, and reported version, and only then promotes
+  that exact artifact to production.
+- **CI now uses isolated, deterministic test environments.** Integration tests
+  receive their own database and cryptographic settings before application
+  code loads, worktrees install hooks consistently, and browser tests use the
+  intended application process on every platform.
+- **Concurrent iOS registrations no longer fail intermittently.** Device and
+  APNs notification-channel reconciliation now share one database lock and
+  transaction, so simultaneous first registration remains idempotent.
+
+No migrations. No breaking changes.
+
+## [1.31.3] — 2026-07-20
+
+- **Document summaries now stay in the language you chose.** The same account
+  language is used whether a summary is created in the background or requested
+  from the document sheet. A saved summary remains visible and can be replaced
+  with **Generate again** after you switch languages.
+- **The Coach composer has more room on phones.** The writing field now gets
+  its own line, with document and conversation actions below it and Send on the
+  right. The unreliable browser dictation button and its dead-end permission
+  states are gone.
+
+No migrations. No breaking changes.
+
+## [1.31.2] — 2026-07-20
+
+- **Provider imports now commit identity and progress atomically.** Withings,
+  WHOOP, Oura, Polar, Strava, and Apple Health reconcile external and natural
+  measurement identities under database locks, preserve tombstones, emit
+  arrivals only for genuine inserts, and advance cursors only after durable
+  writes. OAuth refresh-token rotation is serialized per user and provider.
+- **Webhook and import success now means the source data is durable.** moodLog
+  writes before acknowledging delivery, while Withings ECG callbacks enter a
+  durable queue with bounded retry and replay-safe processing. WHOOP backfills
+  commit bounded chunks without advancing failed resource cursors, and legacy
+  mood imports use deterministic, collision-free retry identities. Operational
+  JSON import failures are reported as failures instead of misleading
+  duplicate skips.
+- **Recovery is complete, exact, and owner-safe.** Canonical backups round-trip
+  every supported record class, including encrypted document content,
+  measurement reconciliation identities, and tombstones. Restore rejects
+  account mismatches before writing, validates backup enums at the boundary,
+  processes stable measurement IDs in bounded batches, and preserves recovery
+  integrity across both uploaded and off-host payloads.
+- **Device and mood edits no longer lose related state.** Same-user APNs
+  registrations merge transactionally without crossing account boundaries,
+  refresh-token bindings follow the surviving device, and mood edits preserve
+  rated factors unless the caller explicitly replaces them.
+- **Polar sync follows the current AccessLink collection API.** Collection
+  requests no longer include the obsolete user ID path segment, and current
+  activity, Nightly Recharge, cardio-load, sleep, and SpO2 response shapes are
+  normalized without losing stable measurement identity.
+- **The July dependency bundle is included.** PDF.js 6 now releases its loading
+  task correctly; Canvas 1.0, Radix UI 1.6.2, Tailwind CSS 4.3.3, the Tailwind
+  Prettier plugin 0.8.1, and setup-node 7 are integrated.
+
+No migrations. No breaking changes.
+
+## [1.31.1] — 2026-07-19
+
+- **Arrival events now follow committed inserts across every writer.** Provider
+  re-sync updates stay silent, partial Apple Health imports retain arrivals
+  from earlier committed batches, all newly inserted workouts emit, and sleep
+  refreshes distinguish new stages from updates. Web-only processes now retry
+  their bounded send-only queue connection instead of permanently losing
+  arrival jobs after one transient startup failure.
+- **Reaction and workout generation are single-spend operations.** Durable
+  database claims close worker races and provider-retry gaps, daily token
+  reservations are atomic and reconciled on every terminal path, and both
+  generation and display honor the user's Insights and Workouts module choices
+  plus server-managed consent.
+- **AI context is narrower and more accurate.** Arrival reactions use the
+  record that actually landed, completed sleep uses the reconstructed night
+  rather than one stage segment, user-authored lab fields are fenced as data,
+  workout comparisons use canonical sessions and dates, and every metric and
+  derived-score coach entry carries its exact supported scope.
+- **Dashboard state survives old and partial clients.** Saved comparison range
+  points and newly supported metric widgets are preserved, while Today
+  freshness remains aligned across local-day boundaries, DST, tab focus, and
+  split web/worker deployments.
+
+Three migrations (0260, 0261, 0262). No breaking changes.
+
+## [1.31.0] — "The record that reacts" — 2026-07-19
+
+A milestone release: the record now visibly responds when something lands,
+instead of waiting for a daily rollup to notice.
+
+- **Today shows what just came in.** A completed night's sleep, a workout, a
+  first weigh-in of the day — the home screen now carries a calm "just in"
+  note for a few hours after each one, and at most one written line a day per
+  kind, grounded in your own numbers. Nothing changes if you run without an
+  AI provider: the sentence is the garnish, not the feature — the arrival
+  itself still appears, including on an otherwise-empty record, and an open
+  dashboard refreshes it as soon as the tab becomes visible again. The
+  underlying change that makes this possible without new polling or a flood of
+  background work: every write path that can produce a genuinely new reading
+  now emits a single typed event, day-scoped and de-duplicated, that a mass
+  import or a provider re-sync produces none of — a ten-year import or a
+  month of catch-up sync stays silent, by construction, not by luck.
+- **A finished workout gets its own paragraph.** Opening a recent session now
+  shows a short, grounded read of that one activity — duration, effort,
+  where it sits against your own recent sessions for the sport — with no
+  training advice and no target zones. It is generated once, the first time
+  you open a fresh session, never on re-sync and never for older workouts
+  already in your record.
+- **"Ask why" reaches every read-only card.** Every per-metric status card,
+  every derived-score page, and a finished workout now carries a way straight
+  into the coach, pre-loaded with just that card's own data so the
+  conversation starts already grounded — not with a blank prompt.
+- **The lab-marker card and the offline metric texts speak with the same
+  voice as everything else** — meaning first, in your own language across
+  all six locales, checked by an automated tone pass that now runs on every
+  change to these surfaces so this kind of drift gets caught before it ships
+  again.
+- **The dashboard layout stops discarding a comparison choice on save,** and
+  four clinical widgets stop disappearing from a saved layout — both from a
+  save made by a client that does not know those particular fields yet.
+- **Mood and BMI reach the app's home screen**, and a medication pen can now
+  carry the maker and printed strength that show up in the native pen list.
+- **Every new AI call this release can cause is metered and bounded**: a
+  daily cap per kind, a duplicate-content check that makes a re-post free,
+  and a token reservation that is always reconciled, including on every
+  failure path — the same discipline the rest of the AI surface already
+  holds to.
+
+Two migrations this release (0257, 0259); an additional dashboard-widget
+migration carried over from the prior line. No breaking changes.
+
+## [1.30.35] — 2026-07-19
+
+- **The metric texts you see without an AI provider now speak your
+  language.** They shipped in German and English only; French, Spanish,
+  Italian and Polish fell through to English. These are what nine metric
+  cards render whenever no provider is reachable — no key configured, an
+  outage, a spent budget — so for those readers this text was the app's
+  voice, in the wrong language. Written per language rather than
+  translated: where a sentence could not be formed naturally, that
+  language got its own sentence.
+- **The lab-marker card leads with what a value means**, like every other
+  card already did. It was the last one still instructed to state the
+  number first.
+- **The response length for a metric assessment is set in one place**
+  again, instead of one card carrying its own inline pair.
+- **The fallback texts open on something honest** rather than on an
+  instruction, and the lab-marker card no longer shows the multi-metric
+  overview tip on a single value.
+
+No migrations. No breaking changes.
+
+## [1.30.34] — 2026-07-19
+
+- **Rearranging your dashboard no longer wipes the comparison baseline.**
+  A layout save from a client that does not know about that setting — the
+  app never sends it — silently reset it to "none". Every field of the
+  layout now has to declare whether an absent value means "clear it" or
+  "leave it alone", so the next field added cannot repeat this.
+- **Four clinical widgets stopped disappearing from a saved layout.**
+  Pain, grip strength, waist and waist-to-height were dropped by the save
+  as unknown, so a placed widget was lost every time.
+- **Mood and BMI reach the app's home screen.** Both existed in the
+  record but were absent from the summary the app reads, so those two
+  tiles could not be shown while every other one worked.
+- **A pen carries its manufacturer and printed strength.** Without them,
+  containers entered on the web could not be shown in the app's pen list.
+- **Destructive controls ask first.** Signing every other device out,
+  revoking a session, and revoking a trusted device fired on a single
+  tap. A sweep found two more with neither a confirmation nor an undo: a
+  Coach reminder and a travel entry. Deleting a document still does not
+  ask — it can be undone, which covers the mis-tap.
+- **Delete confirmations stop overclaiming.** Four of them promised the
+  deletion could not be undone while the same screen offered an undo.
+  Warnings that are wrong make the ones that are right easier to ignore.
+- **The sleep-debt figure is described correctly again.** The calculation
+  changed to a running balance that credits surplus in v1.19.0; the label
+  still said "cumulative shortfall". The wrong description had spread to
+  the Coach, which was reasoning about the number on the old definition,
+  and to the published API description.
+- **The glucose reference band can be chosen on the web.** The setting
+  already worked and already fed the Coach — nothing on the web set it.
+  It selects a reference range; it is not a diagnosis and is never
+  inferred from a reading.
+
+One migration (0256), additive. No breaking changes.
+
+## [1.30.33] — 2026-07-19
+
+Security release. It ships on its own because it changes how a browser
+session is recognised.
+
+- **The session cookie is a purpose-generated secret.** It used to be the
+  session record's own database key — an identifier built to avoid
+  collisions, not to be unguessable, and one that appears wherever that
+  record is referenced. The cookie now carries 32 bytes from the system's
+  random source, and only its hash is stored, so the value in your
+  browser exists nowhere on the server.
+- **You are not signed out by this.** Sessions from before the change
+  keep working and are simply not renewed, so they run out their normal
+  30 days and disappear. Every sign-in from this release onward is on the
+  new scheme.
+- **The device list no longer hands out working credentials.** It
+  identified each device by that same record key — which, for a session
+  predating this release, is that device's cookie. It now shows an opaque
+  handle that is useless as a login, and the same handle is what signs a
+  device out.
+- **A refresh token cannot be rotated from a different device**, and an
+  expired one is refused. The test that was supposed to prove the expiry
+  passed a token that had never been issued, so it proved nothing: with
+  the expiry check deleted, the suite still went green. It is a real test
+  now.
+- **A Nightscout address is checked when you save it**, not only when it
+  happens to be probed first. The check itself already refused private,
+  loopback and cloud-metadata addresses.
+
+Operators: rotating `API_TOKEN_HMAC_KEY` now also signs out every browser
+session, not just API tokens. One migration (0255), additive.
+
+## [1.30.32] — 2026-07-19
+
+- **A withdrawn AI consent stays withdrawn.** Opening the AI settings
+  granted consent again if you had taken it back, and recorded it as
+  though you had done it yourself. A withdrawal is now a standing
+  decision that only an explicit act can lift.
+- **The web can withdraw AI consent at all.** Until now only the app
+  could; on the web, consent could be given and never taken back. The AI
+  settings show what currently stands and offer the control that changes
+  it. Withdrawing takes effect immediately and deletes nothing you have
+  recorded.
+- **Documents get read after you switch automatic reading on.** Reading
+  was only ever started at upload, so documents already in your vault
+  stayed unread no matter what the setting said. Turning it on now works
+  through what is already there, in batches, asking the same permission
+  as any other read.
+- **A quoted passage in a document review is the document's own text.**
+  The quote shown for a finding was the wording that came back from the
+  read, not the line it was taken from — so it could be a paraphrase of
+  your own record presented as a verbatim quote. The passage is now
+  looked up in the document itself, and a finding whose source cannot be
+  located says so instead of showing a quote you cannot check.
+- **Pages that arrive with your data pre-loaded now say so on the wire.**
+  They were never cacheable in practice, but nothing stated it. Anything
+  behind the sign-in wall is now marked private and uncacheable at the
+  edge, so no proxy or future change can hold one person's record and
+  hand it to someone else.
+- **Deleting your last reading of a kind no longer leaves stale weekly,
+  monthly and yearly figures.** The daily figure went; the longer spans
+  kept the old aggregate indefinitely.
+- **The documented API matches what the endpoints return.** Twenty
+  corrections, including a total that the measurements list reports in a
+  different place than the specification claimed, four medication figures
+  named wrongly, a missing intake source, and eleven error codes that
+  were never written down.
+- **A retry after an unusable AI answer asks for the right shape.** The
+  correction prompt demanded fields that do not exist and named none of
+  the ones actually required, so the one corrective attempt steered away
+  from the contract instead of towards it.
+
+No migrations. No breaking changes.
+
+## [1.30.31] — 2026-07-19
+
+- **Today shows a dose before it is late.** The card only surfaced a
+  medication once it was already overdue, so it could report nothing
+  needing attention while a dose was due. A due dose now reads as a calm
+  note, an overdue one as a warning, and a day with everything taken
+  still shows the all-clear. Reminders are unchanged — they still only
+  fire once a dose is late.
+- **The daily briefing stops disappearing.** The check that verifies
+  every figure against your own data was looking in fewer places than the
+  briefing draws from, so a briefing quoting your medication adherence or
+  a change since last month was thrown away as unverifiable. It now
+  checks against everything the briefing is built from. And when a figure
+  genuinely cannot be verified, yesterday's briefing stays up instead of
+  the section going blank.
+- **The "read the full briefing" link is gone from Today.** Tapping the
+  health-score ring already opens the same page.
+- **The close button on a document sits flush with the edge again.**
+- **A document no longer says its summary is being generated forever.**
+  Summaries are only started when a document is uploaded while automatic
+  reading is on — there is no catch-up for documents you already had, so
+  the view promised a summary that was never coming, and hid the button
+  that would have made one. It now says what actually happened — not
+  attempted, unavailable, or held back — and offers to generate one in
+  every case. A summary you generate that way is kept.
+- **Removed the "read by AI" note** at the bottom of a document.
+
+One migration (0254). No breaking changes.
+
+## [1.30.30] — 2026-07-19
+
+Four languages get their own words; a failed read stops claiming you have no data.
+
+- **Reminder notifications, the assistant's reply language, chart and calendar labels, and durations were English or German for French, Spanish, Italian and Polish.** The translations existed; the code that picked between them only knew two languages. It now uses the account's own.
+- **Polish counts correctly.** Polish has a third plural form that a two-form scheme cannot express, so counted phrases read wrong. The other five languages resolve exactly as before.
+- **A screening history that failed to load said "not taken yet".** On a mental-health surface that is a false statement about your own record — you could reasonably conclude you never completed something you did complete. That surface, and a nutrient card with the same flaw, now say the reading failed and offer to try again. Nothing retries silently: a failure you cannot see is worse than one you can.
+- Three sleep-rhythm cards that share one reading each printed the same failure notice; the page now shows it once.
+
+## [1.30.29] — 2026-07-19
+
+- **A connector token that may only read is now refused at the write itself**, not only by never being offered the write. The protection was real but rested entirely on how the connection is assembled, so a future change to that assembly could have opened writing with no test noticing. Any write added later inherits the check.
+- **Names and text read out of your records now carry an explicit boundary when handed to a connected assistant**, matching what the app already does for its own assistant.
+- **Reading a medication list from a photo measured its cost against the server-wide limit even when you use your own key.** It now uses your own limit. The older way of counting that caused this — the third surface to have it — is removed entirely rather than fixed in place, so nothing can reach for it again.
+- Removed a module that read as a check on generated recommendations but had not run for some time. It could not simply be switched on: it required fields the current format does not have, so enabling it would have rejected nearly every generation. The measurement it fed is unaffected and still runs.
+
+No breaking changes.
+
+## [1.30.28] — 2026-07-19
+
+- **Daily briefings count against the AI budget.** They were the one
+  remaining kind of generated text that did not, so a morning's briefings
+  could run past the limit you set. On your own key they count against
+  your limit, not the server's.
+
+## [1.30.27] — 2026-07-19
+
+- **The resting heart-rate chart no longer stops partway.** Older
+  readings get condensed after a while, and the chart treated the
+  condensed days as the whole story — so recent days went missing. It now
+  shows both, and says when a day is an estimate.
+- **Summaries recompute for the whole day or month.** Recomputing from a
+  point in the middle replaced the full period with a partial figure.
+  Affected summaries correct themselves the next time that day is written
+  to, or on the next nightly pass.
+- **A repeated daily total in one upload keeps the newer value.** It kept
+  the older one.
+
+No breaking changes.
+
+## [1.30.26] — 2026-07-19
+
+- **Text read out of your documents is treated as data.** Lab field
+  names were passed to the assistant unchecked, so a document whose
+  labels were written to look like instructions could influence later
+  answers. Those names are cleaned now, and document text is marked as
+  yours rather than as something addressed to the assistant.
+- **A reminder the assistant picks up from a chat is proposed, not
+  active.** It waits for you to confirm it, like its other suggestions.
+  Reminders from before this release keep working unchanged.
+
+No breaking changes.
+
+## [1.30.25] — 2026-07-19
+
+- **Generated cards count against the AI budget.** Metric cards,
+  biomarker cards, scores and the period narrative were not counted at
+  all. On your own key they count against your limit, not the server's.
+- **Switching language no longer regenerates everything twice.** The same
+  card in six languages counted as six separate jobs.
+- **Long assistant conversations get cheaper again.** Past a certain
+  length the full context was re-sent on every turn instead of once.
+
+No breaking changes.
+
+## [1.30.24] — 2026-07-19
+
+- **The safety check on generated text covers every card, in every
+  language.** It ran on the assistant's replies but not on the metric
+  cards, biomarker cards or document summaries — so a sentence the
+  assistant would refuse to send could still appear on a card. It also
+  only knew English and German wording, leaving four languages
+  unprotected. Both are fixed.
+- A document transcription is deliberately never filtered: it reproduces
+  your own document, and a letter from your prescriber is a record, not
+  advice from us.
+
+No breaking changes.
+
+## [1.30.23] — 2026-07-19
+
+- **Switching a module off now also applies to connected assistants.**
+  With a module off, a connected assistant could still read that data —
+  including the full doctor summary — and so could a shared clinician
+  link. Both now honour the switch.
+
+No breaking changes.
+
+## [1.30.22] — 2026-07-19
+
+- **Background jobs stop piling up on themselves.** Duplicate jobs were
+  meant to be collapsed but were not, so a large sync could queue
+  thousands of identical recomputations and a restart could re-queue a
+  running history import. Existing installations are updated on the next
+  start.
+
+No breaking changes.
+
+## [1.30.21] — 2026-07-19
+
+- **Dose reminders land on the right hour across a clock change.** On the
+  day the clocks change, a reminder could resolve an hour off, and the
+  same dose could end up recorded twice. Nothing stored changed.
+- **The next-dose day label was wrong** when your phone's timezone
+  differed from the one in your profile.
+
+No breaking changes.
+
+## [1.30.20] — 2026-07-19
+
+- **A restore refuses when the backup file names a different account**
+  than the backup you selected.
+
+No breaking changes.
+
+## [1.30.19] — 2026-07-19
+
+- **Switching a module off now holds everywhere.** The sync feed still
+  sent cycle data, the FHIR export still returned the full record, and
+  the dashboard summary still built glucose and sleep cards regardless of
+  the switch. Nothing is deleted — turning a module back on finds the
+  history complete.
+- **Two assistant features sent data out without checking your consent
+  first.** Both now check, and fall back to their plain text when consent
+  is absent.
+
+No breaking changes. The native app may see a 403 from the FHIR
+endpoints where a module is off.
+
+## [1.30.18] — 2026-07-19
+
+- **Health data no longer reaches the logs or the backups.** Cached
+  responses are encrypted at rest — they echo what was just saved, so
+  cycle notes and mood text sat unencrypted in every backup for a day.
+  Diagnostic log entries are now scrubbed where they are written, and a
+  failed AI request no longer records what came back with it.
+
+Log lines and backups written before this release may still contain those
+values. No breaking changes.
+
+## [1.30.17] — 2026-07-19
+
+- **API tokens enforce their scope.** A token issued for medication
+  intake reached every endpoint, including the full backup export. Routes
+  that accept a narrow token now have to say so.
+- **Revoke and re-issue any token you gave to a third party.** Treat it
+  as having had that reach for its whole lifetime.
+- **The generic "create API token" button is gone.** The token it made
+  never worked for the medication intake it advertised, while reaching
+  everything else. Tokens are issued per medication from that
+  medication's own toggle. Existing tokens stay listed and revocable.
+
+No breaking changes to the web app, the native client or the MCP
+connector.
+
+## [1.30.16] — 2026-07-19
+
+- **Resting heart rate stops being lost.** Older heart-rate readings are
+  condensed on a schedule, and a resting value is derived before the raw
+  readings go. A faulty check stopped that derivation after the first
+  run while the raw readings were still cleared, so each run lost another
+  day's resting figure for good. Days already affected cannot be
+  recovered; from here nothing further is lost.
+
+No breaking changes.
+
+## [1.30.15] — 2026-07-18
+
+- **Assessments come in the language you set.** French, Spanish, Italian
+  and Polish accounts got German or English text instead of their own.
+  Insight cards, the per-metric assessments, scores, the biomarker card
+  and the period narrative now follow your language. German and English
+  are unchanged. Stored texts in the four languages refresh on their next
+  nightly run.
+
+No breaking changes.
+
+## [1.30.14] — 2026-07-18
+
+The workouts page joins the pages that paint on first load.
+
+- **The workouts list opens with the sessions already there.** It was the last high-traffic surface still fetching its rows after the page mounted, so it showed a loading skeleton first and filled in a moment later. The list is now read on the server and handed to the page populated, the same way the dashboard, insights, medications, and coach pages already work. The list logic moved into a shared read so the page and the API endpoint go through one cached, deduplicated pass instead of two.
+- **API docs: the heart-rate bucket example matches what the server accepts.** The aggregated heart-rate `externalId` was documented with an hourly example from its first version; the contract has been 10-minute buckets since v1.30.7. The description, the example timestamp, and the min/max field notes now describe the shipped contract.
+
+No breaking changes.
+
+## [1.30.13] — 2026-07-18
+
+More pages that paint on first load.
+
+- **The insights, medications, and coach pages open with their content already there**, the same way the dashboard now does — their above-the-fold data is read on the server and handed to the page populated, instead of a shell that fills in after a second round of requests. Nothing that would trigger AI work is pre-run: the daily briefing and the coach's own reads stay on-demand as before.
+
+No breaking changes.
+
+## [1.30.12] — 2026-07-18
+
+Faster medication reads.
+
+- **The dashboard's medication section stays fast as your log grows.** Its reads now use dedicated indexes instead of scanning the full intake history on every load, so a long history no longer slows down the daily view.
+
+No breaking changes.
+
+## [1.30.11] — 2026-07-18
+
+Native single sign-on.
+
+- **The iOS app can sign in through your identity provider (OIDC SSO).** Until now, single sign-on only worked in the browser — the native app couldn't complete it, which locked native users out entirely on an SSO-only instance. The server now supports a native sign-in handoff (an in-app authorization flow that returns the app's normal token, never a cookie), so the app can offer SSO once it adopts the flow. Existing password and passkey sign-in are unchanged. Multi-factor sign-in still applies, and an SSO session never satisfies a step-up prompt — those still require your own second factor.
+
+No breaking changes.
+
+## [1.30.10] — 2026-07-18
+
+Localized insight text, and a richer workout view.
+
+- **Correlation insights now read in your language.** The "this tends to go with that — a pattern worth watching, not a cause" lines under a metric were always written in English; they now render in your interface language (German, Spanish, French, Italian, Polish), with the association-not-causation framing preserved in each.
+- **A workout you open shows more of what was recorded.** The detail view now draws the session's heart-rate curve over time, its route as a clean line, the time spent in each effort zone, per-kilometre splits, and how it compares to your own average for that sport — all from data already synced, with no new connection. Anything a given workout didn't record simply isn't shown.
+
+No migration. No breaking changes.
+
+## [1.30.9] — 2026-07-18
+
+Faster dashboard first load.
+
+- **The top card and the charts paint with their data on first load** instead of flashing empty and then filling in. The daily summary and the charts' 31-day series are now read on the server and handed to the page already populated, so there's no wait for a second round of requests after the page appears. The welcome/summary card, likely the slowest thing to show before, now lands with the first paint.
+
+No migration. No breaking changes.
+
+## [1.30.8] — 2026-07-18
+
+Hardening for the new heart-rate upload validation.
+
+- **A malformed bucket timestamp is rejected, not silently misfiled.** A bucket whose time rolled over (a 24:00, an impossible day) is now refused rather than stored under a non-standard key, where it would have failed to merge with a re-post and could land on the wrong day.
+- **The per-window low/high is sanity-checked before it counts.** A window's low and high are kept only when they are in a plausible range and sit either side of the average; a glitched reading no longer skews the day's high/low band. The average is always kept.
+
+No migration. No breaking changes.
+
+## [1.30.7] — 2026-07-18
+
+Groundwork for a tidier heart-rate history.
+
+- **The server accepts a 10-minute aggregated heart-rate upload.** A watch records heart rate every few seconds, and uploading one row per raw sample fills the measurements list with the same value repeated many times a minute. The server now takes one row per 10-minute window — its average, with the low and high of the window — and the within-day pulse curve reads it directly, so the detailed 10-minute chart and the elevated-at-rest note are preserved. The de-duplication reaches the list once the mobile app sends the aggregated shape; existing per-sample history is unaffected and reconciles itself over time.
+- **The daily high/low reflects the true spread.** A day built from 10-minute windows now reports the real intra-window extremes, not the range of the averages.
+
+No migration. No breaking changes.
+
+## [1.30.6] — 2026-07-18
+
+Accessibility pass.
+
+- **Heatmaps read to a screen reader.** The mood and medication-compliance grids now expose each recorded day — its date and value — through a hidden day list, so the per-day figures are no longer reachable by pointer only. The chart looks exactly the same.
+- **Small labels meet the minimum size.** Muted meta text across settings, admin, the coach panel, and the insights cards is lifted off the sub-`text-xs` sizes; tabular figures and chart chrome are unchanged.
+- **A couple of section headings.** Two metric-page sections became proper headings, so heading navigation lands where it should.
+
+No migration. No breaking changes.
+
+## [1.30.5] — 2026-07-18
+
+Making a shipped feature findable, and a sync-status fix.
+
+- **ECG has a home you can reach.** Recordings now have their own page in Insights, a pill in the Heart group that appears once you have a recording, and links to it from the resting-pulse and heart-rate-variability pages. Before this they were reachable from a single spot, and a deep link into the overview could land before the section had drawn. The page is unchanged in substance — the same non-diagnostic, device-attributed view.
+- **The "last synced" time stops lagging.** A sync driven by an incoming update now records the connection's last-success time straight away, instead of leaving it frozen until the next full poll — so the Settings status and the assistant's integration read reflect a sync that already happened.
+
+No migration. No breaking changes.
+
+## [1.30.4] — 2026-07-18
+
+The read-only assistant connector now reaches the full record.
+
+- **More of your data is readable.** The connector gained direct reads for nutrition and vitamins, the intraday pulse curve, and stored ECG recordings, plus discovery for a set of device metrics that were collected but not advertised — wrist temperature, cardio recovery and load, day and workout strain, sleep score, breathing disturbances, fall count, the six-minute-walk distance, stair speeds, and energy expenditure. They can now be compared and baselined by name.
+- **Correctness.** Heart-rate variability resolves whether the source records the SDNN or the RMSSD flavour, so a ring- or strap-only account is no longer reported as having none. A workout logged by two devices is counted once, matching the workouts list — this also corrects the figure the coach sees.
+- **Exposure stays deliberate.** The mental-health screeners and the environmental signals remain off the connector by construction; a metric is only readable once it has been named for it.
+
+No migration. No breaking changes.
+
+## [1.30.3] — 2026-07-18
+
+Follow-up fixes from a full quality re-check of the app.
+
+- **Correctness reaches every surface.** The timezone, window, and grain fixes now also cover the coach's correlations, the per-metric cards, and the period narrative (they had kept an older copy). Daily insight cards roll over at your own midnight, not a fixed one. Personal records that a second device had inflated are re-derived on the next start, so a genuine record can be set again.
+- **The metrics catalog** shows a loading state and a retry on error, instead of briefly reading as "not tracked".
+- **Small.** One shared info popover, larger tap targets on the view toggles, a notch-safe height fix on the coach history page, and a few wording and translation gaps closed (a body-composition caveat, study citations, the backup scope note).
+
+No breaking changes.
+
 ## [1.30.2] — 2026-07-18
 
 More audit-backlog fixes.

CLAUDE.md

@@ -86,9 +86,10 @@ The architecture map in `.planning/codebase/arch.md` walks each layer with file:
 
 - **UI work follows the design standards.** `.planning/audits/2026-07-05-fable/UI-STANDARDS.md` is the binding design rulebook (card anatomy via TileHeader, spacing scale, text-colour rules — foreground for content, muted for meta only —, token discipline, primitive mapping). Read it before touching any surface; deviations need a written reason in the PR. Where the standards conflict with older in-file comments, the standards win.
 - **RSC by default.** Server components are the default; add `"use client"` only when a hook, state, or browser API actually needs it.
-- **Every API route wraps in `apiHandler`.** Verified — zero exceptions in the current tree. Every body-accepting route runs Zod `safeParse` and returns 422 via `returnAllZodIssues` (multi-issue envelope sanitised against echoed input through `sanitiseZodIssues`).
+- **Every API route wraps in `apiHandler`, with three documented exceptions.** The MCP OAuth routes (`mcp/oauth/{authorize,token,register}`) use `withBackgroundEvent` instead, because OAuth requires RFC-format error bodies that the standard envelope cannot express. They carry the same protections by hand — rate limit, body cap, kill switch, mandatory PKCE-S256, redirect-URI allowlist. Every other route wraps. Every body-accepting route runs Zod `safeParse` and returns 422 via `returnAllZodIssues` (multi-issue envelope sanitised against echoed input through `sanitiseZodIssues`).
 - **`userId` is always narrowed from session or Bearer.** No route accepts `userId` as a body field — it comes from `requireAuth()` and feeds the Prisma `where`. The batch endpoints (`/api/measurements/batch`, `/api/mood-entries/bulk`, `/api/medications/intake/bulk`, `/api/workouts/batch`) don't even declare a `userId` field in their Zod schemas.
-- **No mass assignment.** Every `prisma.X.{create,update}({ data: ... })` builds its `data` object field-by-field from `parsed.data`, never by spreading the parsed object whole. `tokens.create` hardcodes the narrow scope so the user-facing endpoint can never mint a wildcard token.
+- **No mass assignment.** Every `prisma.X.{create,update}({ data: ... })` builds its `data` object field-by-field from `parsed.data`, never by spreading the parsed object whole. `tokens.create` builds `permissions` from a hardcoded literal, never from request input.
+- **Bearer scope is fail-closed.** `requireAuth()` with no argument admits a cookie session or a wildcard (`["*"]`) token only — a narrow-scope token is refused with 403 and an `undeclared_scope` audit row. A route that means to accept a narrow token names the scope: `requireAuth(FHIR_READ_SCOPE)`. Adding a route therefore cannot silently widen an existing token's reach, because the default arm denies. Only the login / passkey / refresh paths mint `["*"]`; every user-facing mint is narrow, and narrow now means narrow. Two surfaces resolve a Bearer token outside `requireAuth` — `/api/ingest/medication` and `/mcp` — and that set is frozen by a structural test (`src/__tests__/bearer-scope-enforcement-guard.test.ts`).
 - **`requireAdmin()` is cookie-only.** Bearer tokens — even with `["*"]` scope — cannot reach admin endpoints. This is a structural boundary in `requireAdmin()` (`src/lib/api-handler.ts`), not a runtime check that future code can soften.
 - **Raw SQL is parameter-bound or whitelist-spliced.** Every `$queryRaw` uses tagged-template parameters. Every `$queryRawUnsafe` / `$executeRawUnsafe` either passes positional `$N` placeholders with an argument array OR splices a value already asserted against a closed enum + regex (see the whitelist-splice block in `src/lib/rollups/measurement-rollups.ts`, around the `$queryRawUnsafe` calls). Inline comments document the whitelist at the splice point.
 - **TanStack Query keys live in the centralised factory.** `src/lib/query-keys/` (16 modules, `index.ts` barrel) is the only legal source of `queryKey` / `mutationKey` arrays. The in-repo ESLint rule `healthlog/queryKey-factory` (set to `error`) flags any bare array. Same-key + different `queryFn` shape silently poisons the cache; the factory prevents it. Every read unwraps `(await res.json()).data` from the envelope.
@@ -165,7 +166,7 @@ The native SwiftUI client lives in a separate repository and rides public beta v
 - The `clientManaged` opt-in on `PATCH /api/auth/me/notification-prefs` suppresses server-side `MEDICATION_REMINDER` APNs for clients that manage their own local reminders. The cron skips dose-due APNs when the flag is `true` and emits a `medication_reminder.suppressed_client_managed` wide-event annotation per skip.
 - `push_attempts` table holds the last 90 days of APNS / Web-Push / Telegram / NTFY delivery attempts (channel + eventType + result + reason + createdAt). The admin diagnostic endpoint at `/api/admin/notifications/diagnostic` surfaces masked device tokens + channel state + last 20 attempts for the calling user.
 - Any request / response schema change must regen `docs/api/openapi.yaml` and commit the result. CI fails on drift.
-- The iOS app authenticates via password/passkey only (`src/lib/auth/native-client.ts`) — there is no OIDC flow for native clients yet. `OIDC_ONLY=true` is enforced server-side on those same routes, so enabling it locks every iOS user out of sign-in until a native SSO flow ships. Don't recommend it to an operator running the iOS app.
+- The iOS app signs in via the native OIDC SSO handoff **or** password/passkey. The native SSO leg: the app opens `GET /api/auth/oidc/login?client=native&code_challenge=<S256>` in an `ASWebAuthenticationSession`, the callback returns to the fixed compiled-in scheme `healthlog://oidc-callback` with a one-time `code=hlh_…` (or an `mfa_ticket` when the account has a second factor), and the app exchanges the code at `POST /api/auth/oidc/native/token` for the standard native bundle (`src/lib/auth/oidc-native-handoff.ts`). The `healthlog://` scheme is a compile-time constant — no `redirect_uri` param, no env allowlist (the open-redirect class is removed by construction). The token pair NEVER rides a URL; only the opaque handoff code / MFA ticket do. The SSO login can never satisfy `requireFreshMfa` step-up — the native transport is Bearer and `requireFreshMfa` is cookie-only, and even the web path sets `mfaVerifiedAt` only from the app's own factor. `OIDC_ONLY=true` is now supported for iOS but requires the app build that ships this flow; an older password/passkey-only build is locked out. The MFA-verify and `/api/auth/refresh` routes that complete/rotate an OIDC login are deliberately not OIDC-only-blocked.
 
 ## DO-NOTs
 

Dockerfile

@@ -1,14 +1,15 @@
 # ── Stage 1: Dependencies ──────────────────────────────────
-FROM node:22-alpine AS deps
-RUN corepack enable && corepack prepare pnpm@latest --activate
+FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS deps
+RUN corepack enable && corepack prepare pnpm@11.15.1 --activate
 WORKDIR /app
 
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY scripts/prepare.mjs scripts/prepare.mjs
 RUN pnpm install --frozen-lockfile --prod=false
 
 # ── Stage 2: Build ─────────────────────────────────────────
-FROM node:22-alpine AS builder
-RUN corepack enable && corepack prepare pnpm@latest --activate
+FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS builder
+RUN corepack enable && corepack prepare pnpm@11.15.1 --activate
 WORKDIR /app
 
 # v1.4.43 B11 — version build-arg threaded into the layer cache key.
@@ -45,17 +46,15 @@ ENV NEXT_TELEMETRY_DISABLED=1
 RUN pnpm build
 
 # ── Stage 3: Production runner ─────────────────────────────
-FROM node:22-alpine AS runner
+FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS runner
 # `tzdata` is required so Europe/Berlin schedules (pg-boss cron, locale-aware
 # timestamp formatting) resolve to the actual offset instead of silently
 # falling back to UTC on Alpine images that ship without it.
-RUN apk add --no-cache tzdata && \
-    corepack enable && corepack prepare pnpm@latest --activate
+RUN apk add --no-cache tzdata
 WORKDIR /app
 
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
-ENV NODE_PATH="/opt/pg-boss/node_modules"
 ENV TZ=Europe/Berlin
 
 # v1.4.43 B11 — forward NEXT_PUBLIC_APP_VERSION from the builder stage
@@ -80,6 +79,10 @@ RUN addgroup --system --gid 1001 nodejs && \
 COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+# Next's standalone output must carry the externalized worker dependencies.
+# Prisma's pure-JS adapter stays bundled; only modules loaded through native
+# Node resolution belong in this runtime assertion.
+RUN node -e "require.resolve('pg-boss'); require.resolve('pg')"
 
 # @napi-rs/canvas (document PDF rasterization): Next's file tracer copies the
 # native binary's package into the standalone tree but NOT the pnpm symlinks that
@@ -123,20 +126,19 @@ COPY --from=builder /app/prisma ./prisma
 COPY --from=builder /app/prisma.config.ts ./prisma.config.ts
 COPY --from=builder /app/src/generated ./src/generated
 
-# Install all worker runtime dependencies in a shared prefix.
-# NODE_PATH makes them available to Node.js module resolution.
-# These packages are listed in next.config.ts serverExternalPackages
-# and are NOT bundled by Next.js — they must exist at runtime.
-RUN mkdir -p /opt/pg-boss && \
-    cd /opt/pg-boss && \
-    npm init -y && \
-    npm install --omit=dev pg-boss@12.18 @prisma/adapter-pg@7.8 pg@8.20
-
-# Install Prisma CLI + engines for runtime migrations (isolated from Next standalone tree)
+# Install the migration CLI, its config dependency, and a pinned launcher for
+# the maintenance scripts already shipped in the standalone tree. The Prisma
+# config loads dotenv from /app, so expose the isolated copy there before
+# stripping npm/Corepack and their caches from the runtime surface.
 RUN mkdir -p /opt/prisma-cli && \
     cd /opt/prisma-cli && \
     npm init -y && \
-    npm install --omit=dev prisma@7.8 @prisma/engines@7.8
+    npm install --omit=dev prisma@7.8 @prisma/engines@7.8 tsx@4.23.1 dotenv@17.4.2 && \
+    ln -sfn /opt/prisma-cli/node_modules/.bin/tsx /usr/local/bin/healthlog-tsx && \
+    ln -sfn /opt/prisma-cli/node_modules/dotenv /app/node_modules/dotenv && \
+    ln -sfn /opt/prisma-cli/node_modules/prisma /app/node_modules/prisma && \
+    rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack /root/.cache/node/corepack /root/.npm && \
+    rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/pnpm /usr/local/bin/pnpx
 
 # v1.4.27 B3 — offline GeoLite2 databases for IP→location and IP→ASN
 # lookups. The MMDB files live in `/opt/geolite2/` and are read by

bundle-budget.json

@@ -1,11 +1,11 @@
 {
-  "$comment": "Client-bundle budgets, enforced by scripts/check-bundle-budget.mjs (--check) after `next build` in CI. Values are KB gzip and include the shared rootMainFiles baseline. Measured at v1.27.15 + the mobile/PWA fix wave: / 417, /insights 402, /measurements 405, /insights/mood 419, total 2683, baseline 129 — budgets carry ~10-15% headroom so the gate catches step changes (a statically imported ~100 KB catalog, a ~90 KB duplicated library chunk), not noise. Raise a number consciously, in the PR that pays the cost, with the reason in the PR body.",
+  "$comment": "Client-bundle budgets, enforced by scripts/check-bundle-budget.mjs (--check) after `next build` in CI. Values are KB gzip and include the shared rootMainFiles baseline. Measured at v1.32.0 after the correctness/UX architecture wave: / 425, /insights 411, /measurements 412, /insights/mood 428, total 2982, baseline 129. Route caps retain focused headroom; the aggregate cap allows normal chunk noise while still catching a new ~90 KB duplicated library. Message catalogs and duplicate Recharts chunks have dedicated structural guards.",
   "routesKbGz": {
     "/page": 460,
     "/insights/page": 445,
     "/measurements/page": 445,
     "/insights/mood/page": 460
   },
-  "totalClientKbGz": 2950,
+  "totalClientKbGz": 3050,
   "maxRechartsChunks": 1
 }

docker-compose.yml

@@ -227,7 +227,7 @@ services:
       test:
         [
           "CMD-SHELL",
-          "wget --no-verbose --tries=1 --spider http://127.0.0.1:3000/api/version || exit 1",
+          "wget --no-verbose --tries=1 --spider http://127.0.0.1:3000/api/health || exit 1",
         ]
       interval: 30s
       timeout: 5s
@@ -245,7 +245,7 @@ services:
   #     dockerfile: Dockerfile
   #   container_name: healthlog-worker
   #   environment:
-  #     DATABASE_URL: "postgresql://healthlog:${POSTGRES_PASSWORD}@db:5432/healthlog?schema=public"
+  #     DATABASE_URL: "postgresql://healthlog:${POSTGRES_PASSWORD}@db:5432/healthlog?schema=public&connection_limit=${DB_CONNECTION_LIMIT:-20}&pool_timeout=${DB_POOL_TIMEOUT:-20}"
   #     NODE_ENV: production
   #     ENCRYPTION_KEY: "${ENCRYPTION_KEY}"
   #     ENCRYPTION_KEYS: "${ENCRYPTION_KEYS:-}"

docker-entrypoint.sh

@@ -9,7 +9,7 @@ set -e
 # Validating here guarantees a clear, deploy-platform-agnostic
 # failure message before we touch the database.
 missing=""
-for var in DATABASE_URL ENCRYPTION_KEY API_TOKEN_HMAC_KEY; do
+for var in DATABASE_URL API_TOKEN_HMAC_KEY; do
   eval "value=\$$var"
   if [ -z "$value" ]; then
     missing="$missing $var"
@@ -21,6 +21,48 @@ if [ -n "$missing" ]; then
   exit 1
 fi
 
+# ENCRYPTION_KEYS supersedes the legacy single key, so validate the same
+# fail-closed shape the runtime crypto loader accepts before touching the DB.
+if ! node -e '
+  const validKey = (value) => {
+    if (typeof value !== "string") return false;
+    if (/^[0-9a-fA-F]{64}$/.test(value)) return true;
+    if (!/^[A-Za-z0-9+/=]+$/.test(value)) return false;
+    try { return Buffer.from(value, "base64").length === 32; }
+    catch { return false; }
+  };
+  const rawKeyring = (process.env.ENCRYPTION_KEYS || "").trim();
+  if (rawKeyring) {
+    let keyring;
+    try { keyring = JSON.parse(rawKeyring); }
+    catch { throw new Error("ENCRYPTION_KEYS is invalid JSON"); }
+    if (!keyring || typeof keyring !== "object" || Array.isArray(keyring)) {
+      throw new Error("ENCRYPTION_KEYS is invalid: expected an object map");
+    }
+    const entries = Object.entries(keyring);
+    if (
+      entries.length === 0 ||
+      entries.some(([id, value]) =>
+        !/^[A-Za-z0-9_-]{1,32}$/.test(id) || !validKey(value)
+      )
+    ) {
+      throw new Error("ENCRYPTION_KEYS is invalid: every entry must be a valid 32-byte key");
+    }
+    const activeId =
+      (process.env.ENCRYPTION_ACTIVE_KEY_ID || "").trim() ||
+      (entries.length === 1 ? entries[0][0] : "");
+    if (!activeId || !Object.prototype.hasOwnProperty.call(keyring, activeId)) {
+      throw new Error("ENCRYPTION_ACTIVE_KEY_ID must name an entry in ENCRYPTION_KEYS");
+    }
+  } else if (!validKey((process.env.ENCRYPTION_KEY || "").trim())) {
+    throw new Error("ENCRYPTION_KEY is missing or invalid");
+  }
+'; then
+  echo "HealthLog: ERROR — encryption configuration is invalid." >&2
+  echo "HealthLog: set a valid ENCRYPTION_KEY or ENCRYPTION_KEYS with ENCRYPTION_ACTIVE_KEY_ID." >&2
+  exit 1
+fi
+
 # ── Wait for PostgreSQL ──────────────────────────────────────
 MAX_RETRIES=30
 RETRY=0

docs/integrations/apple-health.md

@@ -112,29 +112,50 @@ mapped set (workout routes, ECG voltage traces) is counted in
 ### Cumulative HK type → daily aggregate
 
 Cumulative quantity types — steps, active energy, walking/running
-distance, flights climbed — get **collapsed into one row per
-user-local day** to match the iOS daily-aggregation convention.
+distance, flights climbed, time in daylight, and fall count — get
+**collapsed into one estimated row per user-local day**. `export.xml`
+contains source-specific records, not HealthKit's canonical daily
+statistics, so the importer does not sum different devices or apps
+into a source-blind total.
 
+- Records are grouped by type, local day, and a SHA-256 hash of the
+  available source name, source version, and device attributes.
+  Values sum within each identified source-day; the largest
+  source-day subtotal is selected deterministically. If every source
+  attribute is absent, records remain separate rather than being
+  trusted as one source. Raw source and device labels are not
+  persisted.
+- The row records `EXPORT_XML_SOURCE_MAX` provenance, its distinct
+  contributor count, and the selected non-identifying source hash.
 - External ID format: `stats:<HKType>:<YYYY-MM-DD>` (e.g.
   `stats:HKQuantityTypeIdentifierStepCount:2026-05-15`).
 - The day boundary respects the user's timezone preference. The
   worker defaults to `Europe/Berlin` when no preference is set
-  (`src/lib/jobs/apple-health-import-worker.ts:132-133`).
-- A second import of the same archive re-folds the same days onto
-  the same external IDs — the values update in place rather than
-  duplicating.
+  (`src/lib/jobs/apple-health-import-worker.ts`).
+- XML intervals are not reconstructed or split. A record crossing
+  midnight is assigned using its mapped timestamp and remains covered
+  by the explicit estimate contract.
+- A second import re-folds the same days onto the same external IDs.
+  Equal-authority estimates update idempotently rather than duplicate.
+
+The terminal job result exposes
+`cumulativeEstimates: { days, rows }`; the web import card warns when
+one or more cumulative days used this estimate path.
 
 ### Re-import idempotency
 
 The two-axis idempotency story:
 
 1. **File-level** — re-uploading the same `export.zip` (same SHA-256
-   of bytes) short-circuits to the previous job before the parser
-   even starts.
+   of bytes) short-circuits to the previous job only when that job
+   used the current parser revision. Existing jobs are revision 1;
+   new jobs use revision 2, so a pre-fix successful archive can be
+   deliberately processed again under the corrected aggregation.
 2. **Record-level** — when an older `export.zip` is re-exported from
    iOS (same history, slightly newer device timestamps), every
-   record's external ID stays stable. The upsert path matches on
-   `(userId, externalId)` and updates instead of inserting.
+   record's external ID stays stable. The serialized reconciliation
+   path matches the canonical identity and updates instead of
+   inserting.
 
 Practically: a user who exports monthly and re-imports each archive
 sees fresh data merged in without duplicates. The job result line
@@ -150,14 +171,34 @@ is identical to the user-facing flow.
 
 The `ImportJob` row carries `triggeredByAdminId = admin.id` so the
 status endpoint admits both the target user and the triggering
-admin. Idempotency is scoped by target user — an admin re-uploading
-the same archive for the same user resolves to the previous job.
+admin. Idempotency is scoped by target user and parser revision — an
+admin re-uploading the same archive for the same user resolves to the
+previous current-revision job.
 
 Typical use: migrating a friend's history into their HealthLog
 account when they cannot run the import themselves, or backfilling
 a household member's data after the admin received the `export.zip`
 out of band.
 
+## Aggregate authority and recovery
+
+Native HealthKit daily statistics submitted by the iOS batch endpoint
+are canonical and carry `HEALTHKIT_STATISTICS` provenance. XML
+source-maximum estimates carry `EXPORT_XML_SOURCE_MAX`. Both use the
+same serialized reconciler with this ordering:
+
+`LEGACY_UNKNOWN < EXPORT_XML_SOURCE_MAX < HEALTHKIT_STATISTICS`
+
+A later XML import cannot overwrite native statistics. Native
+statistics repair an XML estimate or legacy row in either arrival
+order, and every material reconciled update or resurrection increments
+`syncVersion`. Existing Apple Health `stats:*` rows are migrated to
+`LEGACY_UNKNOWN`; they are never guessed or heuristically promoted.
+To recover an already-corrupted legacy total, the user must re-upload
+the original archive under parser revision 2 or sync native HealthKit
+statistics. Without either input, the correct per-source total cannot
+be reconstructed from the stored aggregate.
+
 ## Source-priority interaction
 
 HealthLog's source ladder is **APPLE_HEALTH ≻ WITHINGS ≻ MANUAL ≻
@@ -169,12 +210,12 @@ max). The defaults live in `src/lib/validations/source-priority.ts:205-220`.
 
 Concrete consequences:
 
-- If you already sync steps from a Withings ScanWatch and also import
-  Apple Health, the Apple-Health-aggregated stream wins for the day —
-  iOS HealthKit folds the watch sensor + iPhone motion data into a
-  single canonical stream, so it is the most complete cumulative
-  source. The Withings rows stay in the database as an audit trail
-  but drop out of the per-day aggregation.
+- Native HealthKit cumulative statistics are the canonical Apple
+  Health stream for a day and outrank both XML estimates and Withings
+  cumulative rows. An XML upload chooses the largest source subtotal
+  only; it never claims to reproduce HealthKit's device de-duplication.
+  Lower-priority rows stay in the database as an audit trail but drop
+  out of the displayed per-day aggregation.
 - If you weigh yourself on a Withings scale and also import Apple
   Health (which received the same reading via the Health Mate iOS
   app), the Withings row wins for display. Apple Health is

docs/ops/backup-restore.md

@@ -84,9 +84,9 @@ pnpm dlx tsx scripts/restore-backup.ts \
   /tmp/restored.json
 ```
 
-The production standalone image strips `tsx`, so a bare
-`pnpm tsx scripts/...` fails inside the container — always invoke
-one-shot scripts via `pnpm dlx tsx`.
+Run this command from a source checkout with the production backup variables
+exported. The script imports the full application dependency graph, which the
+minimal production image does not expose as an operator scripting environment.
 
 The script downloads the object, decrypts it, and writes the JSON dump
 to disk. Importing the JSON back into a HealthLog instance is left to

docs/ops/intake-repair.md

@@ -46,24 +46,23 @@ metadata (`medication_schedules`):
 Always. The default mode only reports and never mutates:
 
 ```bash
-# inside the app container (or any checkout) — DATABASE_URL must point
-# at the target database
-pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts
+# inside the production app container — DATABASE_URL is inherited
+healthlog-tsx scripts/repair-intake-anomalies.ts
 
 # scoped to one account
-pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts --user <userId>
+healthlog-tsx scripts/repair-intake-anomalies.ts --user <userId>
+
+# source-checkout equivalent
+pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts
 ```
 
 The script is self-contained: its only import is `pg` and it reads
 `DATABASE_URL` straight from the environment (no dotenv, no `@/` path
-alias, no `src/` imports). That matters in the production container —
-the standalone image ships no project `node_modules`, so the previous
-revision died there with `Cannot find module 'dotenv/config'`. Inside
-the image `pg` resolves via `NODE_PATH=/opt/pg-boss/node_modules`; in a
-checkout it resolves from the project `node_modules`; the
-`--package pg --package tsx` pins cover any environment with neither.
-Use `pnpm dlx`, not bare `pnpm tsx` — the standalone image also strips
-`tsx`.
+alias, no `src/` imports). The production image provides the pinned
+`healthlog-tsx` launcher and resolves `pg` from its standalone runtime tree
+without retaining a package manager. In a source checkout, `pg` resolves from
+the project `node_modules`; `pnpm dlx --package pg --package tsx ...` also
+works in an environment where neither dependency is installed.
 
 The dry-run prints every duplicate group (which row would be kept, which
 would be tombstoned), a table of implausible rows (id, medication,
@@ -74,7 +73,7 @@ would write), and a table of stale-anchor pending rows.
 ## Applying the fix
 
 ```bash
-pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts --fix
+healthlog-tsx scripts/repair-intake-anomalies.ts --fix
 ```
 
 `--fix` does five things:
@@ -92,7 +91,7 @@ pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts --fix
   in explicitly:
 
   ```bash
-  pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts --fix --tombstone-implausible
+  healthlog-tsx scripts/repair-intake-anomalies.ts --fix --tombstone-implausible
   ```
 
   `--tombstone-implausible` is refused without `--fix`.
@@ -139,7 +138,7 @@ slot anchors:
 The default run only **reports** the proposals. Apply them explicitly:
 
 ```bash
-pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts --backfill-eras
+healthlog-tsx scripts/repair-intake-anomalies.ts --backfill-eras
 ```
 
 Review the dry-run table first — the inference is a heuristic. A wrongly

docs/self-hosting/getting-started.md

@@ -47,11 +47,11 @@ echo "ENCRYPTION_KEY=$(openssl rand -hex 32)"       >> .env
 echo "API_TOKEN_HMAC_KEY=$(openssl rand -hex 32)"   >> .env
 ```
 
-| Variable             | Purpose                                                                                | Rotation cost                                          |
-| -------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------ |
-| `POSTGRES_PASSWORD`  | Bundled Postgres password — used by both the `db` service and `DATABASE_URL`           | Database restart + connection-string update            |
-| `ENCRYPTION_KEY`     | AES-256-GCM key for at-rest secrets (Withings tokens, AI provider keys, VAPID secrets) | Coordinated; see `docs/ops/encryption-key-rotation.md` |
-| `API_TOKEN_HMAC_KEY` | HMAC-SHA256 key for hashing Bearer API tokens before storage                           | Invalidates every issued `hlk_*` token                 |
+| Variable             | Purpose                                                                                | Rotation cost                                                              |
+| -------------------- | -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| `POSTGRES_PASSWORD`  | Bundled Postgres password — used by both the `db` service and `DATABASE_URL`           | Database restart + connection-string update                                |
+| `ENCRYPTION_KEY`     | AES-256-GCM key for at-rest secrets (Withings tokens, AI provider keys, VAPID secrets) | Coordinated; see `docs/ops/encryption-key-rotation.md`                     |
+| `API_TOKEN_HMAC_KEY` | HMAC-SHA256 key for hashing Bearer API tokens and web session cookies before storage   | Invalidates every issued `hlk_*` token and signs out every browser session |
 
 You do **not** edit `DATABASE_URL` on the bundled `docker-compose.yml`
 stack: compose constructs the connection string inside the `app`

docs/self-hosting/mcp.md

@@ -65,10 +65,10 @@ Still in **Settings → MCP → Tokens**:
 3. **Copy the `hlk_…` value now** — it is shown exactly once and cannot
    be retrieved again. Tokens default to a 90-day lifetime.
 
-The token never carries the `*` wildcard and never the
-`medication:ingest` scope the generic `/api/tokens` mints — it is the
-least-privilege MCP scope and nothing more. The same list shows
-last-used time and lets you revoke any token.
+The token never carries the `*` wildcard and never a medication-ingest
+scope — it is the least-privilege MCP scope and nothing more, and it is
+bound to the MCP surface: it is refused on every REST route. The same
+list shows last-used time and lets you revoke any token.
 
 Cloud connectors that use OAuth (next section) mint the same
 `health:read` scope automatically, so for Claude.ai / ChatGPT you do not

e2e/achievements.spec.ts

@@ -195,7 +195,11 @@ test.describe("achievements page renders all four card states", () => {
 
     // Page heading present
     await expect(
-      page.getByRole("heading", { name: "Achievements" }),
+      page.getByRole("main").getByRole("heading", {
+        name: "Achievements",
+        level: 1,
+        exact: true,
+      }),
     ).toBeVisible({ timeout: 5000 });
 
     // Unlocked public — title visible

e2e/ai-provider-dropdown.spec.ts

@@ -121,4 +121,222 @@ test.describe("Settings → AI provider dropdown UX (B2)", () => {
       await expect(page.locator(`[data-chain-row="${slug}"]`)).toBeVisible();
     }
   });
+  test("provider editors submit once by Enter or click and isolate connection tests", async ({
+    page,
+  }) => {
+    const patchBodies: Array<Record<string, unknown>> = [];
+    let releasePendingPatch: () => void = () => undefined;
+    let holdNextPatch = false;
+    let testConnectionRequests = 0;
+    let providerState: Record<string, unknown> = {
+      provider: null,
+      model: null,
+      baseUrl: null,
+      responseTimeoutSeconds: null,
+      hasAnthropicKey: false,
+      anthropicKeyPreview: null,
+      hasLocalKey: false,
+      hasOpenaiKey: false,
+      openaiKeyPreview: null,
+    };
+
+    await page.route("**/api/insights/settings", (route) =>
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          data: {
+            codexStatus: "disconnected",
+            codexConnectedAt: null,
+            hasAdminKey: false,
+            codexOauthConfigured: true,
+            privacyMode: "aggregated",
+            lastInsightAt: null,
+          },
+          error: null,
+        }),
+      }),
+    );
+    await page.route("**/api/user/ai-provider", async (route) => {
+      if (route.request().method() === "PATCH") {
+        const body = route.request().postDataJSON() as Record<string, unknown>;
+        patchBodies.push(body);
+        providerState = { ...providerState, ...body };
+        if (holdNextPatch) {
+          holdNextPatch = false;
+          await new Promise<void>((resolve) => {
+            releasePendingPatch = resolve;
+          });
+        }
+      }
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ data: providerState, error: null }),
+      });
+    });
+    await page.route("**/api/insights/provider-chain", (route) =>
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          data: {
+            activeProvider: "codex",
+            cachedActiveProvider: null,
+            configuredChain: [
+              { providerType: "codex", available: true },
+              { providerType: "openai", available: true },
+              { providerType: "anthropic", available: true },
+              { providerType: "local", available: true },
+            ],
+          },
+          error: null,
+        }),
+      }),
+    );
+    await page.route("**/api/ai/test", (route) => {
+      testConnectionRequests += 1;
+      return route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          data: { ok: true, providerType: "local", model: "test-model" },
+          error: null,
+        }),
+      });
+    });
+
+    const providerHydrated = page.waitForResponse("**/api/user/ai-provider");
+    await page.goto("/settings/ai?provider=openai", {
+      waitUntil: "domcontentloaded",
+    });
+    await providerHydrated;
+
+    const select = page.getByTestId("ai-active-provider-select");
+
+    async function assertEnterAndClickSubmitOnce({
+      provider,
+      formTestId,
+      inputId,
+      enterValue,
+      clickValue,
+      expectedField,
+    }: {
+      provider: "openai" | "anthropic" | "local";
+      formTestId: string;
+      inputId: string;
+      enterValue: string;
+      clickValue: string;
+      expectedField: string;
+    }) {
+      await select.selectOption(provider);
+      const form = page.getByTestId(formTestId);
+      await expect(form).toHaveJSProperty("tagName", "FORM");
+      const input = page.locator(`#${inputId}`);
+      const save = form.locator('button[type="submit"]');
+      await expect(save).toHaveCount(1);
+
+      await input.fill(enterValue);
+      const enterBaseline = patchBodies.length;
+      await input.press("Enter");
+      await expect.poll(() => patchBodies.length).toBe(enterBaseline + 1);
+      await page.waitForTimeout(50);
+      expect(patchBodies).toHaveLength(enterBaseline + 1);
+      expect(patchBodies.at(-1)?.[expectedField]).toBe(enterValue);
+
+      await input.fill(clickValue);
+      const clickBaseline = patchBodies.length;
+      await save.click();
+      await expect.poll(() => patchBodies.length).toBe(clickBaseline + 1);
+      await page.waitForTimeout(50);
+      expect(patchBodies).toHaveLength(clickBaseline + 1);
+      expect(patchBodies.at(-1)?.[expectedField]).toBe(clickValue);
+    }
+
+    await assertEnterAndClickSubmitOnce({
+      provider: "openai",
+      formTestId: "ai-provider-config-openai",
+      inputId: "ai-openai-key",
+      enterValue: "sk-enter-openai",
+      clickValue: "sk-click-openai",
+      expectedField: "openaiKey",
+    });
+    await assertEnterAndClickSubmitOnce({
+      provider: "anthropic",
+      formTestId: "ai-provider-config-anthropic",
+      inputId: "ai-anthropic-key",
+      enterValue: "sk-ant-enter",
+      clickValue: "sk-ant-click",
+      expectedField: "anthropicKey",
+    });
+    await assertEnterAndClickSubmitOnce({
+      provider: "local",
+      formTestId: "ai-provider-config-local",
+      inputId: "ai-local-base-url",
+      enterValue: "http://localhost:11434/v1",
+      clickValue: "http://localhost:11435/v1",
+      expectedField: "baseUrl",
+    });
+
+    const timeoutForm = page.locator("form").filter({
+      has: page.locator("#ai-response-timeout"),
+    });
+    const timeoutInput = page.locator("#ai-response-timeout");
+    const timeoutSave = timeoutForm.locator('button[type="submit"]');
+    await expect(timeoutForm).toHaveCount(1);
+    await expect(timeoutSave).toHaveCount(1);
+
+    await timeoutInput.fill("9");
+    const invalidTimeoutBaseline = patchBodies.length;
+    await timeoutInput.press("Enter");
+    await expect(timeoutForm.locator("p.text-destructive")).toBeVisible();
+    expect(patchBodies).toHaveLength(invalidTimeoutBaseline);
+
+    await timeoutInput.fill("180");
+    const timeoutEnterBaseline = patchBodies.length;
+    await timeoutInput.press("Enter");
+    await expect.poll(() => patchBodies.length).toBe(timeoutEnterBaseline + 1);
+    await page.waitForTimeout(50);
+    expect(patchBodies).toHaveLength(timeoutEnterBaseline + 1);
+    expect(patchBodies.at(-1)?.responseTimeoutSeconds).toBe(180);
+
+    await timeoutInput.fill("240");
+    const timeoutClickBaseline = patchBodies.length;
+    await timeoutSave.click();
+    await expect.poll(() => patchBodies.length).toBe(timeoutClickBaseline + 1);
+    await page.waitForTimeout(50);
+    expect(patchBodies).toHaveLength(timeoutClickBaseline + 1);
+    expect(patchBodies.at(-1)?.responseTimeoutSeconds).toBe(240);
+
+    holdNextPatch = true;
+    await page.locator("#ai-local-base-url").fill("http://localhost:11436/v1");
+    const pendingBaseline = patchBodies.length;
+    await page
+      .getByTestId("ai-provider-config-local")
+      .evaluate((form: HTMLFormElement) => {
+        form.requestSubmit();
+        form.requestSubmit();
+      });
+    await expect.poll(() => patchBodies.length).toBe(pendingBaseline + 1);
+    await expect(
+      page
+        .getByTestId("ai-provider-config-local")
+        .locator('button[type="submit"]'),
+    ).toBeDisabled();
+    await page.waitForTimeout(50);
+    expect(patchBodies).toHaveLength(pendingBaseline + 1);
+
+    const testConnection = page.getByTestId("ai-test-active-provider");
+    await expect(testConnection).toHaveAttribute("type", "button");
+    await testConnection.click();
+    await expect.poll(() => testConnectionRequests).toBe(1);
+    expect(patchBodies).toHaveLength(pendingBaseline + 1);
+
+    releasePendingPatch();
+    await expect(
+      page
+        .getByTestId("ai-provider-config-local")
+        .locator('button[type="submit"]'),
+    ).toBeEnabled();
+  });
 });

e2e/coach-conversation-rename.spec.ts

@@ -0,0 +1,115 @@
+import { expect, test } from "@playwright/test";
+import { setTimeout as delay } from "node:timers/promises";
+
+import { STORAGE_STATE_PATH } from "./setup/global-setup";
+
+const CONVERSATION_ID = "conversation-rename-e2e";
+const INITIAL_TITLE = "Morning check-in";
+const RENAMED_TITLE = "Weekly health review";
+
+test.describe("Coach conversation rename", () => {
+  test.use({ storageState: STORAGE_STATE_PATH });
+
+  test("renames by keyboard once and survives reload on desktop and mobile", async ({
+    page,
+  }) => {
+    let persistedTitle = INITIAL_TITLE;
+    let patchCount = 0;
+
+    await page.route(
+      /\/api\/insights\/chat(?:\/[^?]+)?(?:\?|$)/,
+      async (route) => {
+        const request = route.request();
+        const url = new URL(request.url());
+        if (
+          request.method() === "PATCH" &&
+          url.pathname === `/api/insights/chat/${CONVERSATION_ID}`
+        ) {
+          patchCount += 1;
+          const payload = JSON.parse(request.postData() ?? "{}") as {
+            title: string;
+          };
+          persistedTitle = payload.title;
+          await delay(150);
+          await route.fulfill({
+            status: 200,
+            contentType: "application/json",
+            body: JSON.stringify({
+              data: { id: CONVERSATION_ID, title: persistedTitle },
+              error: null,
+            }),
+          });
+          return;
+        }
+
+        return route.fulfill({
+          status: 200,
+          contentType: "application/json",
+          body: JSON.stringify({
+            data: {
+              conversations: [
+                {
+                  id: CONVERSATION_ID,
+                  title: persistedTitle,
+                  createdAt: "2026-07-20T10:00:00.000Z",
+                  updatedAt: "2026-07-20T10:00:00.000Z",
+                  messageCount: 2,
+                  fenced: false,
+                  attachments: [],
+                  documentTitle: null,
+                },
+              ],
+              nextCursor: null,
+            },
+            error: null,
+          }),
+        });
+      },
+    );
+
+    await page.goto("/coach/conversations", {
+      waitUntil: "domcontentloaded",
+    });
+
+    const item = page.locator('[data-slot="coach-conversations-item"]');
+    await expect(item).toContainText(INITIAL_TITLE, { timeout: 10_000 });
+
+    const renameButton = item.locator(
+      '[data-slot="coach-conversation-rename"]',
+    );
+    await renameButton.click();
+    const input = item.locator('[data-slot="coach-conversation-rename-input"]');
+    await expect(input).toBeFocused();
+
+    await input.fill("Discard this draft");
+    await input.press("Escape");
+    await expect(input).toHaveCount(0);
+    await expect(item).toContainText(INITIAL_TITLE);
+    expect(patchCount).toBe(0);
+
+    await renameButton.click();
+    const activeInput = item.locator(
+      '[data-slot="coach-conversation-rename-input"]',
+    );
+    await activeInput.fill(`  ${RENAMED_TITLE}  `);
+    await activeInput.evaluate((element) => {
+      element.dispatchEvent(
+        new KeyboardEvent("keydown", { key: "Enter", bubbles: true }),
+      );
+      element.dispatchEvent(
+        new KeyboardEvent("keydown", { key: "Enter", bubbles: true }),
+      );
+    });
+
+    await expect(activeInput).toBeDisabled();
+    await expect(item).toContainText(RENAMED_TITLE);
+    await expect(activeInput).toHaveCount(0, { timeout: 10_000 });
+    expect(patchCount).toBe(1);
+
+    await page.reload({ waitUntil: "domcontentloaded" });
+    await expect(
+      page.locator('[data-slot="coach-conversations-item"]'),
+    ).toContainText(RENAMED_TITLE, { timeout: 10_000 });
+    expect(patchCount).toBe(1);
+  });
+});

e2e/codex-flow.spec.ts

@@ -93,7 +93,14 @@ test.describe("settings AI codex device flow (mocked)", () => {
       }),
     );
 
+    // Hydration gate — the settings query is fired by the same client
+    // boundary that renders the Codex form, so its response proves React
+    // has attached the CTA's click handler. On mobile the SSR-painted button
+    // can otherwise be clicked before hydration and the event is lost.
+    const codexFormHydrated = page.waitForResponse("**/api/insights/settings");
+
     await page.goto("/settings/ai", { waitUntil: "domcontentloaded" });
+    await codexFormHydrated;
 
     // Step 1 — CTA visible
     const cta = page.getByRole("button", {

e2e/documents-ai.spec.ts

@@ -283,11 +283,18 @@ test.describe("document vault — AI assist + content search", () => {
     await expect(hint).toBeVisible();
     const indexAll = page.locator('[data-slot="content-index-all"]');
     await expect(indexAll).toBeVisible();
-    await indexAll.click();
-
-    await expect(
-      page.getByText("Indexing 5 document(s) in the background."),
-    ).toBeVisible();
+    const reindexRequest = page.waitForRequest(
+      (request) =>
+        request.method() === "POST" &&
+        new URL(request.url()).pathname === "/api/documents/inbound/reindex",
+    );
+    await Promise.all([
+      reindexRequest,
+      expect(
+        page.getByText("Indexing 5 document(s) in the background."),
+      ).toBeVisible(),
+      indexAll.click(),
+    ]);
     expect(reindexCalls).toBe(1);
   });
 
@@ -351,24 +358,24 @@ test.describe("document vault — AI assist + content search", () => {
     expect(indexHadJsonBody).toBe(false);
   });
 
-  // ── (h) Provenance: a provider-read document is marked "Read by AI" ──────
+  // ── (h) The detail view does not label how the text was extracted ────────
 
-  test("a vision-indexed document surfaces the AI-read provenance", async ({
+  test("a vision-indexed document carries no extraction-provenance line", async ({
     page,
   }) => {
-    // CONTENT_DOC_ID is seeded with source "vision" (an AI provider read it).
-    // No mocks: the real detail GET threads the provenance through. v1.28.38 —
-    // the vault card no longer carries the AI-read glyph (it looked wrong on
-    // the card face); the provenance now lives as a calm muted meta line in the
-    // document DETAIL view. Deep-link straight to the document so the sheet
-    // opens deterministically (the vault grid is virtualized).
+    // CONTENT_DOC_ID is seeded with source "vision". The detail view used to
+    // print a "Read by AI" meta line under the summary; it told the reader
+    // nothing they could act on — how the text came out of the page is our
+    // plumbing, not their business — so it is gone. This test keeps it gone:
+    // the sheet still opens on the deep link, and the line stays absent.
     await page.goto(`/documents?doc=${CONTENT_DOC_ID}`);
     const sheet = page.getByRole("dialog");
     await expect(sheet).toBeVisible();
 
-    const marker = sheet.locator('[data-slot="document-detail-ai-read"]');
-    await expect(marker).toBeVisible();
-    await expect(marker).toHaveText("Read by AI");
+    await expect(
+      sheet.locator('[data-slot="document-detail-ai-read"]'),
+    ).toHaveCount(0);
+    await expect(sheet.getByText("Read by AI")).toHaveCount(0);
   });
 
   // ── (f) Text-mode refuses a non-image before any OCR/upload ──────────────

e2e/documents.spec.ts

@@ -99,6 +99,42 @@ async function runAxe(page: Page) {
   return blocking;
 }
 
+async function mockDocumentCoach(page: Page): Promise<void> {
+  const fulfil = (
+    route: Parameters<Parameters<Page["route"]>[1]>[0],
+    data: unknown,
+  ) =>
+    route.fulfill({
+      status: 200,
+      contentType: "application/json",
+      body: JSON.stringify({ data, error: null }),
+    });
+
+  await page.route("**/api/documents/inbound/usage", (route) =>
+    fulfil(route, {
+      usedBytes: 4096,
+      quotaBytes: 1_073_741_824,
+      maxFileBytes: DEFAULT_MAX_FILE_BYTES,
+      acceptedExtensions: [".pdf", ".png", ".jpg", ".jpeg", ".webp"],
+      linkedEpisodes: [],
+      assistAvailable: true,
+      contentIndex: { enabled: true, indexedCount: 1, totalCount: 1 },
+    }),
+  );
+  await page.route("**/api/documents/inbound/capability", (route) =>
+    fulfil(route, {
+      available: true,
+      mode: "vision",
+      reason: null,
+      pdfSupported: true,
+      egress: "external",
+    }),
+  );
+  await page.route("**/api/auth/me/documents-auto-ai-read", (route) =>
+    fulfil(route, { documentsAutoAiRead: false }),
+  );
+}
+
 test.describe("document vault", () => {
   test.use({ storageState: STORAGE_STATE_PATH });
 
@@ -191,6 +227,121 @@ test.describe("document vault", () => {
     await expect(page).not.toHaveURL(/doc=/);
   });
 
+  test("ordinary card selection owns doc history and preserves unrelated query state", async ({
+    page,
+  }) => {
+    await page.goto(`/documents?episode=${KNIE_EPISODE_ID}&view=compact&q=MRT`);
+    await expect(openButton(page, "MRT Knie")).toBeVisible();
+    await openButton(page, "MRT Knie").click();
+    const detail = page.getByRole("dialog", { name: "MRT Knie" });
+
+    await expect
+      .poll(() => new URL(page.url()).searchParams.get("doc"))
+      .toBe(MRT_DOC_ID);
+    expect(new URL(page.url()).searchParams.get("episode")).toBe(
+      KNIE_EPISODE_ID,
+    );
+    expect(new URL(page.url()).searchParams.get("view")).toBe("compact");
+    expect(new URL(page.url()).searchParams.get("q")).toBe("MRT");
+
+    await page.goBack();
+    await expect(detail).not.toBeVisible();
+    expect(new URL(page.url()).searchParams.get("doc")).toBeNull();
+    expect(new URL(page.url()).searchParams.get("view")).toBe("compact");
+
+    await page.goForward();
+    await expect(detail).toBeVisible();
+
+    await page.keyboard.press("Escape");
+    await expect(detail).not.toBeVisible();
+    await expect
+      .poll(() => new URL(page.url()).searchParams.get("doc"))
+      .toBeNull();
+    expect(new URL(page.url()).searchParams.get("episode")).toBe(
+      KNIE_EPISODE_ID,
+    );
+    expect(new URL(page.url()).searchParams.get("view")).toBe("compact");
+    expect(new URL(page.url()).searchParams.get("q")).toBe("MRT");
+  });
+
+  test("Coach close and overlay dismissal consume the document handoff", async ({
+    page,
+  }) => {
+    await mockDocumentCoach(page);
+    await page.goto(`/documents?episode=${KNIE_EPISODE_ID}&view=compact&q=MRT`);
+    await expect(openButton(page, "MRT Knie")).toBeVisible();
+    await openButton(page, "MRT Knie").click();
+    await expect
+      .poll(() => new URL(page.url()).searchParams.get("doc"))
+      .toBe(MRT_DOC_ID);
+
+    const detail = page.getByRole("dialog", { name: "MRT Knie" });
+    await detail.locator('[data-slot="document-chat-open"]').click();
+    const drawer = page.locator('[data-slot="coach-drawer"]');
+    await expect(drawer).toBeVisible();
+    await expect(detail).not.toBeVisible();
+
+    await drawer.locator('[data-slot="coach-drawer-close"]').click();
+    await expect(drawer).not.toBeVisible();
+    await expect
+      .poll(() => new URL(page.url()).searchParams.get("doc"))
+      .toBeNull();
+    expect(new URL(page.url()).searchParams.get("episode")).toBe(
+      KNIE_EPISODE_ID,
+    );
+    expect(new URL(page.url()).searchParams.get("view")).toBe("compact");
+    expect(new URL(page.url()).searchParams.get("q")).toBe("MRT");
+    await expect(detail).not.toBeVisible();
+
+    await page.reload();
+    await expect(detail).not.toBeVisible();
+    expect(new URL(page.url()).searchParams.get("doc")).toBeNull();
+
+    await expect(openButton(page, "MRT Knie")).toBeVisible();
+    await openButton(page, "MRT Knie").click();
+    await expect(detail).toBeVisible();
+    await detail.locator('[data-slot="document-chat-open"]').click();
+    await expect(drawer).toBeVisible();
+    await page
+      .locator('[data-slot="sheet-overlay"]')
+      .last()
+      .click({ position: { x: 2, y: 2 } });
+    await expect(drawer).not.toBeVisible();
+    await expect
+      .poll(() => new URL(page.url()).searchParams.get("doc"))
+      .toBeNull();
+    await expect(detail).not.toBeVisible();
+  });
+
+  test("Ask Coach maximize then browser back restores the selected document", async ({
+    page,
+  }) => {
+    await mockDocumentCoach(page);
+    await page.goto(`/documents?episode=${KNIE_EPISODE_ID}&view=compact&q=MRT`);
+    await expect(openButton(page, "MRT Knie")).toBeVisible();
+    await openButton(page, "MRT Knie").click();
+    await expect
+      .poll(() => new URL(page.url()).searchParams.get("doc"))
+      .toBe(MRT_DOC_ID);
+
+    const detail = page.getByRole("dialog", { name: "MRT Knie" });
+    await detail.locator('[data-slot="document-chat-open"]').click();
+    const drawer = page.locator('[data-slot="coach-drawer"]');
+    await expect(drawer).toBeVisible();
+    await drawer.locator('[data-slot="coach-drawer-maximize"]').click();
+    await expect.poll(() => new URL(page.url()).pathname).toBe("/coach");
+    expect(new URL(page.url()).searchParams.get("doc")).toBe(MRT_DOC_ID);
+
+    await page.goBack();
+    await expect.poll(() => new URL(page.url()).pathname).toBe("/documents");
+    await expect(detail).toBeVisible();
+    const restoredUrl = new URL(page.url());
+    expect(restoredUrl.searchParams.get("doc")).toBe(MRT_DOC_ID);
+    expect(restoredUrl.searchParams.get("episode")).toBe(KNIE_EPISODE_ID);
+    expect(restoredUrl.searchParams.get("view")).toBe("compact");
+    expect(restoredUrl.searchParams.get("q")).toBe("MRT");
+  });
+
   test("the condition page links into the vault and back", async ({ page }) => {
     await page.goto(`/illness/${KNIE_EPISODE_ID}`);
     const card = page.locator('[data-slot="episode-documents-card"]');
@@ -210,10 +361,16 @@ test.describe("document vault", () => {
     await page.goto("/documents");
     await uploadViaPicker(page, `${title}.pdf`, uniquePdf(title));
     await page.getByRole("searchbox", { name: "Search documents" }).fill(title);
+    // The uploaded card is optimistic and can paint before the 200 ms search
+    // draft is committed to the URL. Opening it earlier races that pending
+    // replace against the detail's `?doc=` history entry and closes the sheet.
+    await expect
+      .poll(() => new URL(page.url()).searchParams.get("q"))
+      .toBe(title);
     await expect(openButton(page, `${title}.pdf`)).toBeVisible();
 
     await openButton(page, `${title}.pdf`).click();
-    const sheet = page.getByRole("dialog");
+    const sheet = page.getByRole("dialog", { name: `${title}.pdf` });
     await expect(sheet).toBeVisible();
     await sheet.getByRole("button", { name: "Delete" }).click();
 

e2e/insights-scroll-restoration.spec.ts

@@ -29,6 +29,12 @@ test.describe("v1.4.28 — insights scroll restoration", () => {
   }) => {
     await page.goto("/insights", { waitUntil: "domcontentloaded" });
 
+    // A visible server-rendered link is not yet an interactive React link.
+    // Wait for this client component's hydration boundary before scrolling or
+    // clicking so the pointer gesture cannot race React replacing the anchor.
+    const tabStrip = page.locator("[data-slot='insights-tab-strip']");
+    await expect(tabStrip).toHaveAttribute("data-hydrated", "true");
+
     // v1.25.1 — the app-wide scroll-to-top resets the `#main-content`
     // scroll container on every route change (auth-shell), with a
     // `window.scrollTo(0,0)` fallback for the body-scrolled shells. The
@@ -53,18 +59,24 @@ test.describe("v1.4.28 — insights scroll restoration", () => {
         window.scrollTo({ top: 600, behavior: "auto" });
       }
     });
+    await expect.poll(readScrollTop).toBeGreaterThan(100);
 
-    // Click the first available sub-page pill.
-    const subPagePill = page
-      .locator("[data-slot='insights-tab-strip-pill']")
-      .nth(1);
+    // Recovery is always present and remains a direct link across responsive
+    // pill grouping. Target its route contract instead of a mutable list index.
+    const subPagePill = tabStrip.locator(
+      "[data-slot='insights-tab-strip-pill'][href='/insights/recovery']",
+    );
     await expect(subPagePill).toBeVisible();
     await subPagePill.click();
-    await page.waitForURL(/\/insights\//);
+    await expect(page).toHaveURL(/\/insights\/recovery\/?$/);
 
-    // Back to the mother page via the overview pill (pill index 0).
-    await page.locator("[data-slot='insights-tab-strip-pill']").first().click();
-    await page.waitForURL(/\/insights\/?$/);
+    // Back to the mother page through the overview pill.
+    const overviewPill = tabStrip.locator(
+      "[data-slot='insights-tab-strip-pill'][href='/insights']",
+    );
+    await expect(overviewPill).toBeVisible();
+    await overviewPill.click();
+    await expect(page).toHaveURL(/\/insights\/?$/);
 
     // The shell's route-change effect resets the scroll on the next tick;
     // `useScrollResetOnRoute` defers to `requestAnimationFrame`. Wait for it
@@ -91,6 +103,12 @@ test.describe("v1.4.28 — insights scroll restoration", () => {
   }) => {
     await page.goto("/insights", { waitUntil: "domcontentloaded" });
     const nav = page.locator("[data-slot='insights-tab-strip']");
+    const innerScroller = nav.locator(
+      "[data-slot='insights-tab-strip-scroller']",
+    );
+    await expect(nav).toHaveAttribute("data-hydrated", "true");
+    await expect(innerScroller).toBeVisible();
+
     const navOverflowX = await nav.evaluate(
       (el) => getComputedStyle(el).overflowX,
     );
@@ -100,7 +118,6 @@ test.describe("v1.4.28 — insights scroll restoration", () => {
     expect(navOverflowX).not.toBe("auto");
     expect(navOverflowX).not.toBe("scroll");
 
-    const innerScroller = nav.locator("> div > div").first();
     const innerOverflowX = await innerScroller.evaluate(
       (el) => getComputedStyle(el).overflowX,
     );

e2e/medications-wizard-daily.spec.ts

@@ -20,8 +20,9 @@ import { STORAGE_STATE_PATH } from "./setup/global-setup";
 /**
  * v1.5.4 — Medication wizard end-to-end — daily cadence.
  *
- * Walks the 7-step daily path through the modal dialog. The dialog
- * mounts when `/medications/new` redirects to `/medications?new=1`.
+ * Walks the 7-step daily path through the modal dialog. The shared helper
+ * opens `/medications?new=1` directly so cadence coverage is independent of
+ * the legacy `/medications/new` redirect.
  * The DE label surface (the maintainer's primary locale) is the assertion
  * surface — "Schritt N von 7" tracks the visible counter.
  */

e2e/medications-wizard-helpers.ts

@@ -120,8 +120,9 @@ export async function stubDashboardAnalytics(page: Page): Promise<void> {
 }
 
 /**
- * Open the wizard dialog by hitting `/medications/new` (which
- * redirects to `/medications?new=1` and opens the create dialog).
+ * Open the wizard directly on `/medications?new=1`. The redirect from the
+ * legacy `/medications/new` route is a separate concern; these cadence specs
+ * exercise the wizard without racing that server navigation.
  */
 export async function openCreateWizard(page: Page): Promise<void> {
   // Pin the German locale for the wizard flow. The app default locale is
@@ -136,12 +137,14 @@ export async function openCreateWizard(page: Page): Promise<void> {
     {
       name: "healthlog-locale",
       value: "de",
-      url: page.url().startsWith("http")
-        ? new URL(page.url()).origin
-        : "http://localhost:3000",
+      url: new URL(process.env.E2E_BASE_URL ?? "http://localhost:3000").origin,
     },
   ]);
-  await page.goto("/medications/new", { waitUntil: "domcontentloaded" });
+  await page.goto("/medications?new=1", { waitUntil: "load" });
+  await page.waitForURL(
+    (url) => url.pathname === "/medications" && !url.searchParams.has("new"),
+    { timeout: 10_000 },
+  );
   await expect(
     page.locator('[data-slot="medication-wizard-dialog"]'),
   ).toBeVisible({ timeout: 10_000 });

e2e/medications-wizard-oneshot.spec.ts

@@ -33,6 +33,29 @@ import { STORAGE_STATE_PATH } from "./setup/global-setup";
 test.describe("medication wizard — one-shot", () => {
   test.use({ storageState: STORAGE_STATE_PATH });
 
+  test("does not replay the one-shot URL flag after history traversal", async ({
+    page,
+  }) => {
+    await stubDashboardAnalytics(page);
+    await openCreateWizard(page);
+
+    await page.keyboard.press("Escape");
+    await expect(
+      page.locator('[data-slot="medication-wizard-dialog"]'),
+    ).toHaveCount(0);
+
+    await page.locator('a[href="/"]:visible').first().click();
+    await page.waitForURL((url) => url.pathname === "/");
+    await page.goBack();
+    await page.waitForURL(
+      (url) => url.pathname === "/medications" && !url.searchParams.has("new"),
+    );
+
+    await expect(
+      page.locator('[data-slot="medication-wizard-dialog"]'),
+    ).toHaveCount(0);
+  });
+
   test("creates a single-dose medication end-to-end", async ({ page }) => {
     test.slow();
     await stubDashboardAnalytics(page);

e2e/mobile-viewport.spec.ts

@@ -206,7 +206,7 @@ test.describe("mobile-viewport smoke", () => {
     // 1) The center capture action opens the capture picker.
     await page.getByTestId("bottom-nav-capture").click();
     await expect(page.getByTestId("capture-picker-options")).toBeVisible();
-    for (const kind of ["measurement", "medication", "mood"]) {
+    for (const kind of ["measurement", "medication", "mood", "water"]) {
       await expect(page.getByTestId(`capture-picker-${kind}`)).toBeVisible();
     }
     // Dismiss the picker before opening the hub.

e2e/mood-timestamp.spec.ts

@@ -0,0 +1,62 @@
+import { expect, test } from "@playwright/test";
+
+import { STORAGE_STATE_PATH } from "./setup/global-setup";
+
+test.describe("mood timestamp capture", () => {
+  test.use({ storageState: STORAGE_STATE_PATH });
+
+  test("keeps Time visible while details are collapsed and submits the selected instant", async ({
+    page,
+  }) => {
+    let submitted: Record<string, unknown> | null = null;
+
+    await page.route("**/api/mood-entries*", async (route) => {
+      if (route.request().method() === "POST") {
+        submitted = route.request().postDataJSON() as Record<string, unknown>;
+        await route.fulfill({
+          status: 201,
+          contentType: "application/json",
+          body: JSON.stringify({ data: { id: "created-mood" }, error: null }),
+        });
+        return;
+      }
+
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          data: { entries: [], meta: { total: 0, limit: 50, offset: 0 } },
+          error: null,
+        }),
+      });
+    });
+
+    await page.goto("/mood", { waitUntil: "domcontentloaded" });
+    await page.getByRole("button", { name: "Add", exact: true }).click();
+    await page.getByRole("radio", { name: "Amazing" }).click();
+
+    const details = page.getByRole("button", { name: "Note & details" });
+    await expect(details).toHaveAttribute("aria-expanded", "false");
+
+    const timestamp = page.locator('[data-slot="date-time-field"]');
+    await expect(timestamp).toBeVisible();
+    const dateInput = timestamp.locator(
+      '[data-slot="date-field"] input[type="text"]',
+    );
+    const timeInput = timestamp.locator(
+      '[data-slot="time-field"] input[type="text"]',
+    );
+    await dateInput.fill("2026-01-15");
+    await dateInput.blur();
+    await timeInput.fill("09:45");
+    await timeInput.blur();
+
+    await page.getByRole("button", { name: "Save", exact: true }).click();
+
+    await expect.poll(() => submitted).not.toBeNull();
+    expect(submitted).toMatchObject({
+      mood: "SUPER_GUT",
+      moodLoggedAt: "2026-01-15T08:45:00.000Z",
+    });
+  });
+});

e2e/settings-export.spec.ts

@@ -94,9 +94,27 @@ test.describe("Settings → Export & Import", () => {
   }) => {
     // v1.18.0 (S5) — the panel (and its disclosure) live on the
     // dedicated Gesundheitsakte section now.
+    await page.route("**/api/share-links", async (route) => {
+      if (route.request().method() !== "GET") {
+        await route.continue();
+        return;
+      }
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ data: [], error: null, meta: null }),
+      });
+    });
+    const sharingDataReady = page.waitForResponse(
+      (response) =>
+        response.status() === 200 &&
+        response.request().method() === "GET" &&
+        new URL(response.url()).pathname === "/api/share-links",
+    );
     await page.goto("/settings/gesundheitsakte", {
       waitUntil: "domcontentloaded",
     });
+    await sharingDataReady;
     const toggle = page.getByTestId("health-record-included-data-toggle");
     await expect(toggle).toBeVisible({ timeout: 10_000 });
     // Collapsed on first render — the checklist panel is absent.

e2e/settings-integrations-mobile.spec.ts

@@ -198,3 +198,44 @@ test.describe("/settings/integrations Pixel-5 layout", () => {
     }
   });
 });
+
+test.describe("Apple Health guidance", () => {
+  test.use({ storageState: STORAGE_STATE_PATH });
+
+  test("opens on Integrations and reaches the one-shot import fallback", async ({
+    page,
+  }) => {
+    await page.route("**/api/integrations/healthkit", (route) =>
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          data: { entries: [], lastSyncedAt: null },
+          error: null,
+        }),
+      }),
+    );
+
+    await page.goto("/settings/integrations");
+
+    const card = page.getByTestId("apple-health-card");
+    await expect(card).toBeVisible();
+    await expect(card).toContainText("HealthLog iOS app");
+    await expect(card).toContainText("not a web or OAuth connection");
+    await expect(page.getByTestId("apple-health-status")).toHaveAttribute(
+      "data-state",
+      "setup",
+    );
+
+    const importLink = page.getByTestId("apple-health-import-link");
+    await expect(importLink).toHaveAttribute(
+      "href",
+      "/settings/export#settings-section-import-title",
+    );
+    await page.goto("/settings/export#settings-section-import-title");
+    await expect(page).toHaveURL(
+      /\/settings\/export#settings-section-import-title$/,
+    );
+    await expect(page.getByTestId("import-card-apple-health")).toBeVisible();
+  });
+});

e2e/setup/global-setup.ts

@@ -97,6 +97,8 @@ export default async function globalSetup(config: FullConfig): Promise<void> {
     // that tries to click a header / sidebar / quick-add button times
     // out (50+ failed CI runs since v1.4.13). Specs that need the
     // tour can opt back in by mocking `/api/auth/me`.
+    // Nutrients is intentionally opt-in in production. The shared fixture
+    // enables it because the water-capture specs exercise that real gate.
     await pool.query(
       `INSERT INTO users
         (id, username, email, password_hash, role,
@@ -105,14 +107,16 @@ export default async function globalSetup(config: FullConfig): Promise<void> {
          codex_connection_status,
          insights_privacy_mode,
          onboarding_completed_at,
-         onboarding_tour_completed)
+         onboarding_tour_completed,
+         module_preferences_json)
        VALUES ($1, $2, $3, $4, $5,
                $6, $6,
                180, $7, 'MALE',
                'disconnected',
                'aggregated',
                $6,
-               true)
+               true,
+               '{"nutrients":true}'::jsonb)
        ON CONFLICT (username) DO UPDATE SET
          email = EXCLUDED.email,
          password_hash = EXCLUDED.password_hash,
@@ -129,7 +133,8 @@ export default async function globalSetup(config: FullConfig): Promise<void> {
          insights_cached_at = NULL,
          insights_cached_text = NULL,
          onboarding_completed_at = EXCLUDED.onboarding_completed_at,
-         onboarding_tour_completed = EXCLUDED.onboarding_tour_completed`,
+         onboarding_tour_completed = EXCLUDED.onboarding_tour_completed,
+         module_preferences_json = EXCLUDED.module_preferences_json`,
       [
         cuid(),
         E2E_USER.username,
@@ -141,6 +146,19 @@ export default async function globalSetup(config: FullConfig): Promise<void> {
       ],
     );
 
+    // Repeated local E2E runs reuse the same seeded account and database.
+    // Its owner-scoped share-link bucket lasts an hour, so otherwise the third
+    // run can start above the 20-operation ceiling and fail before exercising
+    // the share flow. Reset only this fixture user's bucket; never touch
+    // unrelated rate-limit state in a developer database.
+    await pool.query(
+      `DELETE FROM rate_limits
+       WHERE key = 'share-link:' || (
+         SELECT id::text FROM users WHERE username = $1
+       )`,
+      [E2E_USER.username],
+    );
+
     // Opt the seed account into cycle tracking. The user is seeded as
     // `MALE`, and v1.18.0 resolves the `cycle` module through
     // `isCycleEnabled(gender, CycleProfile)` — NULL `cycleTrackingEnabled`

e2e/share-documents.spec.ts

@@ -57,7 +57,14 @@ interface CreatedShare {
 async function createShareWithDocs(page: Page): Promise<CreatedShare> {
   const label = `${SHARE_DOC_PREFIX} ${Date.now()}`;
 
+  const sharingDataReady = page.waitForResponse(
+    (response) =>
+      response.status() === 200 &&
+      response.request().method() === "GET" &&
+      new URL(response.url()).pathname === "/api/share-links",
+  );
   await page.goto("/settings/sharing");
+  await sharingDataReady;
   await page.locator("#share-label").fill(label);
 
   // Open the document picker and isolate the seeded trio.
@@ -69,13 +76,18 @@ async function createShareWithDocs(page: Page): Promise<CreatedShare> {
   // Exactly the three share-fixture documents match the prefix.
   const rows = list.getByRole("button");
   await expect(rows).toHaveCount(3);
-  for (let i = 0; i < 3; i++) await rows.nth(i).click();
+  for (let i = 0; i < 3; i++) {
+    const row = rows.nth(i);
+    await row.click();
+    await expect(row).toHaveAttribute("aria-pressed", "true");
+  }
   await page.getByRole("button", { name: "Done" }).click();
 
   // Three chips staged before create.
   await expect(
     page.getByTestId("share-attached-chips").getByRole("listitem"),
   ).toHaveCount(3);
+  await expect(page.getByRole("button", { name: "Create link" })).toBeEnabled();
 
   await page.getByRole("button", { name: "Create link" }).click();
 
@@ -150,9 +162,14 @@ test.describe("clinician document sharing", () => {
       clinician.getByRole("heading", { name: "Documents" }),
     ).toBeVisible();
     // Class A image → inline <img> at the token-scoped serve route.
-    await expect(
-      clinician.locator(`img[src*="/d/${SHARE_JPEG_DOC_ID}"]`),
-    ).toBeVisible();
+    const inlineImage = clinician.getByRole("img", {
+      name: "Share e2e scan",
+    });
+    await expect(inlineImage).toBeVisible();
+    await expect(inlineImage).toHaveAttribute(
+      "src",
+      new RegExp(`/d/${SHARE_JPEG_DOC_ID}$`),
+    );
     // Class A PDF → inline <iframe> at the same route family.
     await expect(
       clinician.locator(`iframe[src*="/d/${SHARE_PDF_DOC_ID}"]`),

e2e/today-just-in.spec.ts

@@ -0,0 +1,151 @@
+import { expect, test } from "@playwright/test";
+import pg from "pg";
+
+import { E2E_USER, STORAGE_STATE_PATH } from "./setup/global-setup";
+
+/**
+ * v1.31.0 — Today reacts in place.
+ *
+ * The milestone's actual moment: new data lands, and the ALREADY-OPEN
+ * dashboard starts reading differently on the cadence it already runs. No new
+ * poll, no push, no socket — a state change, not a notification.
+ *
+ * The spec drives that end-to-end against the real read path:
+ *
+ *   1. load the dashboard with nothing fresh — no chip, day is provisional;
+ *   2. land last night's sleep through the REAL batch endpoint, and the
+ *      arrival marker the spine's worker would have written;
+ *   3. surface the tab's real visibility-change signal — the browser event
+ *      TanStack Query's focus manager consumes for
+ *      `refetchOnWindowFocus: "always"` (alongside the 120 s foreground poll);
+ *      using that existing trigger keeps the test inside the real cadence
+ *      while staying well under the poll interval;
+ *   4. assert the chip appeared and the phase flipped — in place, no reload.
+ *
+ * The marker is seeded directly rather than waited for from pg-boss: whether
+ * the queue drains inside the e2e web server is the SPINE's contract and has
+ * its own tests. What this spec owns is everything downstream of a marker
+ * existing — the read path, the DTO, and the surface.
+ *
+ * Assertions anchor on `data-slot` / `data-phase`, never on visible text:
+ * responsive `sm:hidden` classes have broken `getByText` in this repo before.
+ */
+test.use({ storageState: STORAGE_STATE_PATH });
+
+/** The user's local day, in the same profile-tz space the digest files under. */
+function localDayKey(at: Date, timeZone: string): string {
+  // en-CA renders ISO-ordered YYYY-MM-DD, which is exactly the key shape.
+  return new Intl.DateTimeFormat("en-CA", {
+    timeZone,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+  }).format(at);
+}
+
+test("a fresh arrival surfaces the just-in chip and flips the day in place", async ({
+  page,
+}) => {
+  const dbUrl = process.env.DATABASE_URL;
+  test.skip(!dbUrl, "DATABASE_URL is required to seed the arrival marker");
+
+  const pool = new pg.Pool({ connectionString: dbUrl });
+
+  try {
+    const { rows } = await pool.query<{ id: string; timezone: string | null }>(
+      "SELECT id, timezone FROM users WHERE username = $1",
+      [E2E_USER.username],
+    );
+    expect(rows.length, "seeded e2e user must exist").toBe(1);
+    const userId = rows[0].id;
+    const timezone = rows[0].timezone ?? "UTC";
+
+    // A clean slate: no marker, and last night's sleep not yet in. Both are
+    // preconditions for the "before" assertion to mean anything.
+    await pool.query("DELETE FROM arrival_reactions WHERE user_id = $1", [
+      userId,
+    ]);
+    await pool.query(
+      "UPDATE users SET morning_digest_refreshed_on = NULL WHERE id = $1",
+      [userId],
+    );
+
+    // ── BEFORE ────────────────────────────────────────────────────────────
+    // The globally-seeded account is intentionally empty. Wait until the
+    // digest settles, then prove there is no stale hero or arrival chip.
+    await page.goto("/");
+    await expect(page.locator('[data-slot="today-hero-skeleton"]')).toHaveCount(
+      0,
+    );
+    const hero = page.locator('[data-slot="today-hero"]');
+    await expect(hero).toHaveCount(0);
+
+    // ── NEW DATA LANDS ────────────────────────────────────────────────────
+    // Last night's sleep through the real ingest route, on the session the
+    // storage state already carries.
+    const now = new Date();
+    const wokeAt = new Date(now.getTime() - 60 * 60_000);
+    const fellAsleepAt = new Date(wokeAt.getTime() - 7 * 60 * 60_000);
+
+    const batch = await page.request.post("/api/measurements/batch", {
+      data: {
+        entries: [
+          {
+            hkIdentifier: "HKCategoryTypeIdentifierSleepAnalysis",
+            value: 420,
+            unit: "min",
+            startDate: fellAsleepAt.toISOString(),
+            endDate: wokeAt.toISOString(),
+            externalId: `e2e-just-in-${now.getTime()}`,
+            sleepStage: 3,
+          },
+        ],
+      },
+    });
+    expect(
+      batch.ok(),
+      `sleep batch must be accepted (got ${batch.status()})`,
+    ).toBe(true);
+
+    // The marker the spine's worker writes on a salient arrival, plus the
+    // morning-refresh stamp it rides alongside — the two rows that together
+    // make the day final and the arrival news.
+    const localDate = localDayKey(now, timezone);
+    await pool.query(
+      `INSERT INTO arrival_reactions
+         (id, user_id, kind, local_date, occurred_at, arrived_at, created_at)
+       VALUES ($1, $2, 'sleep_night', $3, $4, NOW(), NOW())
+       ON CONFLICT (user_id, kind, local_date) DO UPDATE
+         SET occurred_at = EXCLUDED.occurred_at,
+             arrived_at = NOW()`,
+      [`c${now.getTime()}justin000000`, userId, localDate, wokeAt],
+    );
+    await pool.query(
+      "UPDATE users SET morning_digest_refreshed_on = $2 WHERE id = $1",
+      [userId, localDate],
+    );
+
+    // The tab becomes visible — the browser signal TanStack Query's focus
+    // manager consumes. The digest refetches in place; the page never reloads.
+    await page.evaluate(() =>
+      window.dispatchEvent(new Event("visibilitychange")),
+    );
+
+    await expect(hero.locator('[data-slot="today-hero-just-in"]')).toBeVisible({
+      timeout: 20_000,
+    });
+    await expect(hero).toHaveAttribute("data-phase", "final", {
+      timeout: 20_000,
+    });
+    // Sleep is in, so the provisional freshness note is gone with it.
+    await expect(
+      hero.locator('[data-slot="today-hero-sleep-pending"]'),
+    ).toHaveCount(0);
+    // The chip names the arrival kind — the stable attribute, not the copy.
+    await expect(
+      hero.locator('[data-slot="today-hero-just-in"]'),
+    ).toHaveAttribute("data-just-in-kind", "sleep_night");
+  } finally {
+    await pool.end();
+  }
+});

e2e/v1427-measurements-add-param.spec.ts

@@ -5,21 +5,14 @@ import { STORAGE_STATE_PATH } from "./setup/global-setup";
 /**
  * v1.4.27 MB6 — `/measurements?add=<TYPE>` consumer.
  *
- * The insights empty-state CTAs link here with a `?add=<TYPE>` query
- * param. The page reads the param during render, opens the
- * Add-Measurement primitive, pre-selects the matching type, then
- * `router.replace("/measurements")` strips the query so the back
- * button drops the user on the bare list instead of re-opening the
- * dialog.
+ * Insight metric actions link here with `?add=<TYPE>` and an optional,
+ * allowlisted `returnTo`. The page opens the responsive capture primitive,
+ * pre-selects the matching type, and strips the query without losing the
+ * one-shot return context.
  *
- * Three contracts under test:
- *   1. The primitive opens on first paint.
- *   2. The form's type combobox shows the requested type.
- *   3. The URL settles on `/measurements` (no `?add=`).
- *
- * Pixel 5 is the load-bearing project — every CTA hop originates from
- * the mobile-first empty-state surfaces. Desktop Chrome covers the
- * regression path through the dashboard quick-entry.
+ * The browser contract covers the populated-page action, legacy preselection,
+ * failure retention, success return, and rejection of an external destination.
+ * Playwright runs every case in both the desktop Chromium and Pixel 5 projects.
  */
 test.describe("v1.4.27 — /measurements?add= consumer", () => {
   test.use({ storageState: STORAGE_STATE_PATH });
@@ -49,6 +42,57 @@ test.describe("v1.4.27 — /measurements?add= consumer", () => {
     );
   });
 
+  test("a populated metric action opens the matching preselected capture", async ({
+    page,
+  }) => {
+    await page.route(/\/api\/analytics(\?|$)/, (route) =>
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          data: {
+            summaries: {
+              WEIGHT: {
+                latest: 78.4,
+                count: 4,
+                min: 77.9,
+                max: 78.8,
+                mean: 78.3,
+                median: 78.25,
+              },
+            },
+            bpInTargetPct: null,
+            glucoseByContext: {},
+          },
+          error: null,
+        }),
+      }),
+    );
+
+    await page.goto("/insights/weight", { waitUntil: "domcontentloaded" });
+    // The action is server-rendered before React can handle client navigation.
+    // Pin the click to the Insights surface's existing hydration contract so
+    // it cannot race hydration and get replayed as a no-op.
+    await expect(
+      page.locator('[data-slot="insights-tab-strip"]'),
+    ).toHaveAttribute("data-hydrated", "true");
+
+    const capture = page.locator('[data-slot="metric-add-reading"]');
+    await expect(capture).toBeVisible();
+    await expect(capture).toHaveAttribute(
+      "href",
+      "/measurements?add=WEIGHT&returnTo=%2Finsights%2Fweight",
+    );
+    await capture.click();
+    await expect(page).toHaveURL(/\/measurements(?:\?|$)/);
+
+    const content = page.locator('[data-slot="responsive-sheet-content"]');
+    await expect(content).toBeVisible();
+    await expect(content.getByRole("combobox").first()).toContainText(
+      /weight|gewicht/i,
+    );
+  });
+
   for (const { param, label } of [
     { param: "WEIGHT", label: /weight|gewicht/i },
     { param: "BLOOD_PRESSURE", label: /blood pressure|blutdruck/i },
@@ -76,6 +120,117 @@ test.describe("v1.4.27 — /measurements?add= consumer", () => {
     });
   }
 
+  test("keeps the one-shot sheet and entered values when the write fails", async ({
+    page,
+  }) => {
+    await page.route("**/api/measurements*", async (route) => {
+      if (route.request().method() === "POST") {
+        await route.fulfill({
+          status: 500,
+          contentType: "application/json",
+          body: JSON.stringify({ data: null, error: "Write failed" }),
+        });
+        return;
+      }
+      await route.fallback();
+    });
+
+    await page.goto("/measurements?add=WEIGHT&returnTo=%2Finsights%2Fweight", {
+      waitUntil: "domcontentloaded",
+    });
+
+    const content = page.locator('[data-slot="responsive-sheet-content"]');
+    await expect(content).toBeVisible();
+    await expect(content.getByRole("combobox").first()).toContainText(
+      /weight|gewicht/i,
+    );
+    await content.locator("#value").fill("78.4");
+    await content.locator("#notes").fill("Keep this note");
+    await page
+      .getByRole("button", { name: /save|speichern/i })
+      .last()
+      .click();
+
+    await expect(content.getByRole("alert")).toBeVisible();
+    await expect(content.locator("#value")).toHaveValue("78.4");
+    await expect(content.locator("#notes")).toHaveValue("Keep this note");
+    await expect(content).toBeVisible();
+    expect(new URL(page.url()).pathname).toBe("/measurements");
+  });
+
+  test("returns to the validated metric route only after a successful write", async ({
+    page,
+  }) => {
+    await page.route("**/api/measurements*", async (route) => {
+      if (route.request().method() === "POST") {
+        await route.fulfill({
+          status: 200,
+          contentType: "application/json",
+          body: JSON.stringify({
+            data: { id: "contextual-e2e", success: true },
+            error: null,
+          }),
+        });
+        return;
+      }
+      await route.fallback();
+    });
+
+    await page.goto("/measurements?add=WEIGHT&returnTo=%2Finsights%2Fweight", {
+      waitUntil: "domcontentloaded",
+    });
+
+    const content = page.locator('[data-slot="responsive-sheet-content"]');
+    await expect(content.getByRole("combobox").first()).toContainText(
+      /weight|gewicht/i,
+    );
+    await content.locator("#value").fill("78.4");
+    await Promise.all([
+      page.waitForURL((url) => url.pathname === "/insights/weight"),
+      page
+        .getByRole("button", { name: /save|speichern/i })
+        .last()
+        .click(),
+    ]);
+  });
+
+  test("rejects an external return target after a successful write", async ({
+    page,
+  }) => {
+    await page.route("**/api/measurements*", async (route) => {
+      if (route.request().method() === "POST") {
+        await route.fulfill({
+          status: 200,
+          contentType: "application/json",
+          body: JSON.stringify({
+            data: { id: "contextual-e2e", success: true },
+            error: null,
+          }),
+        });
+        return;
+      }
+      await route.fallback();
+    });
+
+    await page.goto(
+      "/measurements?add=WEIGHT&returnTo=https%3A%2F%2Fevil.example%2Fsteal",
+      { waitUntil: "domcontentloaded" },
+    );
+    const appOrigin = new URL(page.url()).origin;
+
+    const content = page.locator('[data-slot="responsive-sheet-content"]');
+    await content.locator("#value").fill("78.4");
+    await page
+      .getByRole("button", { name: /save|speichern/i })
+      .last()
+      .click();
+
+    await expect(content).toHaveCount(0);
+    const settled = new URL(page.url());
+    expect(settled.origin).toBe(appOrigin);
+    expect(settled.pathname).toBe("/measurements");
+  });
+
   test("unknown ?add value is dropped silently and the page renders empty", async ({
     page,
   }) => {

e2e/water-capture.spec.ts

@@ -0,0 +1,144 @@
+import { expect, test } from "@playwright/test";
+
+import { STORAGE_STATE_PATH } from "./setup/global-setup";
+import {
+  mockDashboardSnapshot,
+  WEIGHT_ONLY_SUMMARIES,
+} from "./utils/mock-dashboard-snapshot";
+
+test.describe("water capture", () => {
+  test.use({ storageState: STORAGE_STATE_PATH });
+
+  test("opens globally, waits for success, and retains failed input", async ({
+    page,
+  }, testInfo) => {
+    await mockDashboardSnapshot(page, { summaries: WEIGHT_ONLY_SUMMARIES });
+    await page.route(/\/api\/analytics(\?|$)/, (route) =>
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          data: { summaries: {}, bpInTargetPct: null, glucoseByContext: {} },
+          error: null,
+        }),
+      }),
+    );
+    await page.route("**/api/mood/analytics", (route) =>
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          data: { entries: [], summary: { count: 0 } },
+          error: null,
+        }),
+      }),
+    );
+
+    let writeCount = 0;
+    let confirmSuccess: (() => void) | undefined;
+    const successConfirmed = new Promise<void>((resolve) => {
+      confirmSuccess = resolve;
+    });
+    await page.route("**/api/nutrients/water", async (route) => {
+      writeCount += 1;
+      if (writeCount === 1) {
+        await successConfirmed;
+        await route.fulfill({
+          status: 200,
+          contentType: "application/json",
+          body: JSON.stringify({ data: { amountMl: 250 }, error: null }),
+        });
+        return;
+      }
+      await route.fulfill({
+        status: 500,
+        contentType: "application/json",
+        body: JSON.stringify({ data: null, error: "write failed" }),
+      });
+    });
+
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    await page.waitForLoadState("networkidle");
+
+    const openWater = async (toastMayOverlap = false) => {
+      if (testInfo.project.name === "chromium-mobile") {
+        const capture = page.getByTestId("bottom-nav-capture");
+        if (toastMayOverlap) {
+          await capture.dispatchEvent("click");
+        } else {
+          await capture.click();
+        }
+        const option = page.getByTestId("capture-picker-water");
+        await expect(option).toBeVisible();
+        const box = await option.boundingBox();
+        expect(box?.height ?? 0).toBeGreaterThanOrEqual(44);
+        if (toastMayOverlap) {
+          await option.dispatchEvent("click");
+        } else {
+          await option.click();
+        }
+      } else {
+        await page.locator('[data-tour-id="dashboard-quick-add"]').click();
+        await page.getByRole("menuitem", { name: "Log water" }).click();
+      }
+      await expect(
+        page.getByRole("heading", { name: "Add water" }),
+      ).toBeVisible();
+      if (testInfo.project.name === "chromium-mobile") {
+        const actions = page
+          .getByRole("dialog")
+          .locator(
+            '[data-slot="water-quick-add-chips"] button, form button[type="submit"]',
+          );
+        await expect(actions).toHaveCount(4);
+        for (const action of await actions.all()) {
+          await expect(action).toHaveAccessibleName(/.+/);
+          const actionBox = await action.boundingBox();
+          expect(actionBox?.height ?? 0).toBeGreaterThanOrEqual(44);
+        }
+      }
+    };
+
+    await openWater();
+    const amount = page.getByRole("spinbutton", {
+      name: "Custom amount (mL)",
+    });
+    await amount.fill("250");
+    const submit = page
+      .getByRole("dialog")
+      .getByRole("button", { name: "Add", exact: true });
+    await amount.press("Enter");
+
+    await expect(submit).toBeDisabled();
+    await expect(amount).toHaveValue("250");
+    await expect(page.getByText("250 mL water added.")).toHaveCount(0);
+
+    confirmSuccess?.();
+    await expect(page.getByText("250 mL water added.")).toBeVisible();
+    await expect(page.getByRole("heading", { name: "Add water" })).toHaveCount(
+      0,
+    );
+    expect(writeCount).toBe(1);
+
+    await openWater(true);
+    const failedAmount = page.getByRole("spinbutton", {
+      name: "Custom amount (mL)",
+    });
+    await expect(failedAmount).toHaveValue("");
+    await failedAmount.fill("375");
+    await page
+      .getByRole("dialog")
+      .getByRole("button", { name: "Add", exact: true })
+      .click();
+
+    await expect(
+      page.getByText("Couldn't save that — try again."),
+    ).toBeVisible();
+    await expect(failedAmount).toHaveValue("375");
+    await expect(
+      page.getByRole("heading", { name: "Add water" }),
+    ).toBeVisible();
+    await expect(page.getByText("375 mL water added.")).toHaveCount(0);
+    expect(writeCount).toBe(2);
+  });
+});

e2e/workouts-infinite-history.spec.ts

@@ -0,0 +1,140 @@
+import { expect, test } from "@playwright/test";
+
+import { STORAGE_STATE_PATH } from "./setup/global-setup";
+
+interface MockWorkout {
+  id: string;
+  sportType: string;
+  startedAt: string;
+  endedAt: string;
+  durationSec: number;
+  distanceM: null;
+  activeEnergyKcal: null;
+  avgHr: null;
+  maxHr: null;
+  source: string;
+  externalId: string;
+}
+
+function workout(id: number): MockWorkout {
+  return {
+    id: `workout-${id}`,
+    sportType: "running",
+    startedAt: "2026-07-20T08:00:00.000Z",
+    endedAt: "2026-07-20T08:30:00.000Z",
+    durationSec: 1800,
+    distanceM: null,
+    activeEnergyKcal: null,
+    avgHr: null,
+    maxHr: null,
+    source: "APPLE_HEALTH",
+    externalId: `external-${id}`,
+  };
+}
+
+test.describe("workout history pagination", () => {
+  test.use({ storageState: STORAGE_STATE_PATH });
+
+  test("loads canonical rows beyond 100 once without duplicate ids", async ({
+    page,
+  }) => {
+    const firstPage = Array.from({ length: 100 }, (_, index) =>
+      workout(index + 1),
+    );
+    const secondPage = [
+      workout(100),
+      ...Array.from({ length: 99 }, (_, index) => workout(index + 101)),
+    ];
+    const thirdPage = [workout(200), workout(201)];
+    const observedOffsets: number[] = [];
+    let releaseFirstPage!: () => void;
+    const firstPageGate = new Promise<void>((resolve) => {
+      releaseFirstPage = resolve;
+    });
+    let releaseSecondPage!: () => void;
+    const secondPageGate = new Promise<void>((resolve) => {
+      releaseSecondPage = resolve;
+    });
+
+    await page.route(/\/api\/workouts(?:\?|$)/, async (route) => {
+      const url = new URL(route.request().url());
+      const limit = Number(url.searchParams.get("limit") ?? "50");
+      const offset = Number(url.searchParams.get("offset") ?? "0");
+
+      if (limit !== 100) {
+        await route.fulfill({
+          contentType: "application/json",
+          body: JSON.stringify({
+            data: {
+              workouts: firstPage.slice(0, limit),
+              meta: {
+                total: 201,
+                limit,
+                offset,
+                droppedDuplicates: 0,
+              },
+            },
+            error: null,
+          }),
+        });
+        return;
+      }
+
+      observedOffsets.push(offset);
+      if (offset === 0) await firstPageGate;
+      if (offset === 100) await secondPageGate;
+      const workouts =
+        offset === 0 ? firstPage : offset === 100 ? secondPage : thirdPage;
+
+      await route.fulfill({
+        contentType: "application/json",
+        body: JSON.stringify({
+          data: {
+            workouts,
+            meta: {
+              total: 201,
+              limit,
+              offset,
+              droppedDuplicates: 0,
+            },
+          },
+          error: null,
+        }),
+      });
+    });
+
+    await page.goto("/insights/workouts");
+    await expect(page.locator('[data-slot="workouts-loading"]')).toBeVisible();
+    await expect(page.locator('[data-slot="workout-list-row"]')).toHaveCount(0);
+    releaseFirstPage();
+
+    const rows = page.locator('[data-slot="workout-list-row"]');
+    await expect(rows).toHaveCount(100);
+    await expect(page.locator('[data-slot="workouts-loading"]')).toHaveCount(0);
+
+    const loadMore = page.getByRole("button", { name: "Load more workouts" });
+    await loadMore.click();
+    await expect(
+      page.getByRole("button", { name: "Loading more workouts" }),
+    ).toBeDisabled();
+    releaseSecondPage();
+
+    await expect(
+      page.locator('a[href="/insights/workouts/workout-101"]'),
+    ).toHaveCount(1);
+    await expect(
+      page.locator('a[href="/insights/workouts/workout-100"]'),
+    ).toHaveCount(1);
+    await expect(rows).toHaveCount(199);
+
+    await page.getByRole("button", { name: "Load more workouts" }).click();
+    await expect(
+      page.locator('a[href="/insights/workouts/workout-201"]'),
+    ).toHaveCount(1);
+    await expect(rows).toHaveCount(201);
+    await expect(
+      page.getByRole("button", { name: "Load more workouts" }),
+    ).toHaveCount(0);
+    expect(observedOffsets).toEqual([0, 100, 200]);
+  });
+});

eslint-plugins/healthlog/__tests__/api-fetch-required.test.mjs

@@ -0,0 +1,72 @@
+import { describe, it } from "vitest";
+import { RuleTester } from "eslint";
+import rule from "../api-fetch-required.js";
+
+RuleTester.describe = describe;
+RuleTester.it = it;
+RuleTester.itOnly = it.only;
+
+const ruleTester = new RuleTester({
+  languageOptions: {
+    ecmaVersion: 2023,
+    sourceType: "module",
+    parserOptions: { ecmaFeatures: { jsx: true } },
+  },
+});
+
+ruleTester.run("api-fetch-required", rule, {
+  valid: [
+    {
+      code: "apiGet(endpoint); apiFetchRaw(externalUrl);",
+      filename: "/repo/src/components/example.tsx",
+    },
+    {
+      code: 'fetch("/api/server-prefetch");',
+      filename: "/repo/src/app/server-page.tsx",
+    },
+    {
+      code: 'fetch("https://example.test/data");',
+      filename: "/repo/src/lib/server-only.ts",
+    },
+    {
+      code: "fetch(path, init);",
+      filename: "/repo/src/lib/api/api-fetch.ts",
+    },
+    {
+      code: 'fetch("/api/mock");',
+      filename: "/repo/src/components/__tests__/example.test.tsx",
+    },
+  ],
+  invalid: [
+    {
+      code: "fetch(endpoint);",
+      filename: "/repo/src/components/example.tsx",
+      errors: [{ messageId: "rawApiFetch" }],
+    },
+    {
+      code: "window.fetch(`/api/${id}`);",
+      filename: "/repo/src/components/example.tsx",
+      errors: [{ messageId: "rawApiFetch" }],
+    },
+    {
+      code: 'globalThis.fetch("https://example.test/data");',
+      filename: "/repo/src/hooks/use-example.ts",
+      errors: [{ messageId: "rawApiFetch" }],
+    },
+    {
+      code: '"use client"; self.fetch(url);',
+      filename: "/repo/src/app/client-page.tsx",
+      errors: [{ messageId: "rawApiFetch" }],
+    },
+    {
+      code: '"use client"; fetch(endpoint);',
+      filename: "/repo/src/lib/i18n/context.tsx",
+      errors: [{ messageId: "rawApiFetch" }],
+    },
+    {
+      code: 'window["fetch"](endpoint);',
+      filename: "/repo/src/components/example.tsx",
+      errors: [{ messageId: "rawApiFetch" }],
+    },
+  ],
+});

eslint-plugins/healthlog/__tests__/queryKey-factory.test.mjs

@@ -0,0 +1,64 @@
+import { describe, it } from "vitest";
+import { RuleTester } from "eslint";
+import plugin from "../queryKey-factory.js";
+
+RuleTester.describe = describe;
+RuleTester.it = it;
+RuleTester.itOnly = it.only;
+
+const ruleTester = new RuleTester({
+  languageOptions: {
+    ecmaVersion: 2023,
+    sourceType: "module",
+    parserOptions: { ecmaFeatures: { jsx: true } },
+  },
+});
+
+const rule = plugin.rules["queryKey-factory"];
+
+ruleTester.run("queryKey-factory", rule, {
+  valid: [
+    {
+      code: "useQuery({ queryKey: queryKeys.example(id) });",
+      filename: "/repo/src/components/example.tsx",
+    },
+    {
+      code: "const key = queryKeys.example(id); useQuery({ queryKey: key });",
+      filename: "/repo/src/hooks/use-example.ts",
+    },
+    {
+      code: 'export const example = () => ["example"];',
+      filename: "/repo/src/lib/query-keys/example.ts",
+    },
+    {
+      code: 'useQuery({ queryKey: ["fixture"] });',
+      filename: "/repo/src/components/__tests__/example.test.tsx",
+    },
+    {
+      code: 'useQuery({ queryKey: ["server-prefetch"] });',
+      filename: "/repo/src/app/server-page.tsx",
+    },
+  ],
+  invalid: [
+    {
+      code: 'useQuery({ queryKey: ["unguarded-component"] });',
+      filename: "/repo/src/components/custom-metrics/example.tsx",
+      errors: [{ messageId: "bareArray" }],
+    },
+    {
+      code: 'useMutation({ mutationKey: ["unguarded-hook"] });',
+      filename: "/repo/src/hooks/use-example.ts",
+      errors: [{ messageId: "bareArray" }],
+    },
+    {
+      code: '"use client"; useQuery({ queryKey: ["client-app"] });',
+      filename: "/repo/src/app/previously-unguarded/page.tsx",
+      errors: [{ messageId: "bareArray" }],
+    },
+    {
+      code: '"use client"; useQuery({ queryKey: ["client-lib"] });',
+      filename: "/repo/src/lib/client-state.tsx",
+      errors: [{ messageId: "bareArray" }],
+    },
+  ],
+});

eslint-plugins/healthlog/api-fetch-required.js

@@ -1,35 +1,24 @@
 /**
- * @fileoverview ESLint rule — client-side `/api/...` calls must route
- * through the typed `apiFetch` wrapper.
+ * @fileoverview ESLint rule — client-side requests must route through the
+ * typed API-fetch entry points.
  *
- * `src/lib/api/api-fetch.ts` owns the `.ok` check, the
- * `{ data, error, meta? }` envelope unwrap, and the `ApiError` shape
- * (message via `readError`, `status`, error-side `meta`). A raw
- * `fetch("/api/…")` in a component re-implements that contract by hand
- * — the exact drift this wrapper retired — so this rule flags it at
- * authoring time and in CI.
+ * A raw `fetch(...)` in a client module can hide a same-origin API request
+ * behind a variable, endpoint map, or conditional. Checking only literal
+ * `/api/...` arguments therefore leaves the envelope and error contract open
+ * to bypass. This rule rejects every bare Fetch API call in the client surface,
+ * regardless of argument shape.
  *
- * Complements `healthlog/safe-fetch-required`: that rule covers
- * OUTBOUND egress (absolute / variable-sourced URLs) and exempts
- * same-origin relative paths; this rule covers exactly those same-origin
- * `/api/...` paths inside the client surface.
+ * Use `apiGet` / `apiPost` / `apiPut` / `apiPatch` / `apiDelete` for envelope
+ * JSON. Use `apiFetchEnvelope` when success metadata is required, and
+ * `apiFetchRaw` for deliberate Response-level work such as external requests,
+ * downloads, streams, beacons, or manual status branching.
  *
- * Allowed:
- *   - `apiFetch` / verb helpers / `apiFetchEnvelope` / `apiFetchRaw` —
- *     distinct identifiers, never match.
- *   - calls inside `src/lib/api/api-fetch.ts` — the wrapper's own `fetch`.
- *   - test files (`*.test.ts(x)`, `__tests__/`, `__mocks__/`) — they
- *     mock or assert against `fetch` directly.
- *
- * The check is a syntactic `CallExpression` match against a bare
- * `fetch(` callee (Identifier `fetch`) and `globalThis.fetch(` /
- * `window.fetch(` / `self.fetch(` member forms, where the first
- * argument is a string literal or template literal whose head starts
- * with `/api/`. Variable-sourced or absolute URLs are the
- * safe-fetch-required rule's territory and stay out of scope here.
+ * Components and hooks are client-facing by convention. Other `src/` modules
+ * are guarded when they declare top-level `"use client"`; `src/lib/queries/`
+ * remains an explicit client-transitive root. Server-only modules, tests,
+ * mocks, and the wrapper implementation are exempt.
  *
  * @see src/lib/api/api-fetch.ts
- * @see eslint-plugins/healthlog/safe-fetch-required.js
  */
 
 "use strict";
@@ -39,20 +28,9 @@
 // `String#includes`, mirroring the safe-fetch-required convention.
 const EXEMPT_FILES = ["src/lib/api/api-fetch.ts"];
 
-// Enforce across the client-facing source roots. `src/lib/` stays out:
-// server-side lib code never self-calls `/api/` routes, and the
-// safe-fetch rule already covers its outbound calls. `src/hooks/` is
-// client-only by construction (v1.16.4) — its `/api/` reads route
-// through the wrapper like every component. `src/lib/queries/` is the
-// one `src/lib/` exception: it holds client-only TanStack-Query hooks
-// (every file is `"use client"`), so its `/api/` reads route through the
-// wrapper too.
-const ENFORCED_ROOTS = [
-  "src/components/",
-  "src/app/",
-  "src/hooks/",
-  "src/lib/queries/",
-];
+// Components and hooks are client-facing by convention. Query modules are
+// client-transitive even if a future refactor moves the directive to a barrel.
+const CLIENT_ROOTS = ["src/components/", "src/hooks/", "src/lib/queries/"];
 
 function toPosix(filename) {
   return filename.replace(/\\/g, "/");
@@ -67,12 +45,17 @@ function isTestFile(posix) {
   );
 }
 
-function isEnforced(filename) {
+function isEnforced(filename, sourceCode) {
   const posix = toPosix(filename);
-  if (!ENFORCED_ROOTS.some((root) => posix.includes(root))) return false;
+  if (!posix.startsWith("src/") && !posix.includes("/src/")) return false;
   if (EXEMPT_FILES.some((f) => posix.includes(f))) return false;
   if (isTestFile(posix)) return false;
-  return true;
+  if (CLIENT_ROOTS.some((root) => posix.includes(root))) return true;
+  return sourceCode.ast.body.some(
+    (statement) =>
+      statement.type === "ExpressionStatement" &&
+      statement.directive === "use client",
+  );
 }
 
 /** @type {import("eslint").Rule.RuleModule} */
@@ -81,49 +64,40 @@ const apiFetchRequiredRule = {
     type: "problem",
     docs: {
       description:
-        "Same-origin /api/ calls must route through the apiFetch wrapper (src/lib/api/api-fetch.ts).",
+        "Client-side requests must route through the apiFetch wrapper family (src/lib/api/api-fetch.ts).",
     },
     schema: [],
     messages: {
       rawApiFetch:
-        'Raw fetch("/api/…") re-implements the envelope unwrap + error contract by hand. Import { apiFetch } (or a verb helper / apiFetchRaw) from "@/lib/api/api-fetch" and call it instead.',
+        "Raw fetch() bypasses the client request contract. Use an apiFetch envelope helper, or apiFetchRaw for deliberate Response-level/external requests.",
     },
   },
   create(context) {
     const filename = context.filename ?? context.getFilename?.();
-    if (!filename || !isEnforced(filename)) {
+    const sourceCode = context.sourceCode ?? context.getSourceCode();
+    if (!filename || !isEnforced(filename, sourceCode)) {
       return {};
     }
 
     function isFetchCallee(callee) {
       // Bare `fetch(...)`.
       if (callee.type === "Identifier" && callee.name === "fetch") return true;
-      // `globalThis.fetch(...)` / `window.fetch(...)` / `self.fetch(...)`.
+      // `globalThis.fetch(...)` / `window.fetch(...)` / `self.fetch(...)`,
+      // including their static computed forms (`window["fetch"](...)`).
       if (
         callee.type === "MemberExpression" &&
-        !callee.computed &&
-        callee.property.type === "Identifier" &&
-        callee.property.name === "fetch" &&
         callee.object.type === "Identifier" &&
         (callee.object.name === "globalThis" ||
           callee.object.name === "window" ||
           callee.object.name === "self")
       ) {
-        return true;
-      }
-      return false;
-    }
-
-    function isApiPath(arg) {
-      if (!arg) return false;
-      const isApiHead = (head) => head.startsWith("/api/");
-      // `fetch("/api/…")`
-      if (arg.type === "Literal" && typeof arg.value === "string") {
-        return isApiHead(arg.value);
-      }
-      // `fetch(`/api/${id}`)` — inspect the template's first cooked chunk.
-      if (arg.type === "TemplateLiteral" && arg.quasis.length > 0) {
-        return isApiHead(arg.quasis[0].value.cooked ?? "");
+        const propertyName =
+          !callee.computed && callee.property.type === "Identifier"
+            ? callee.property.name
+            : callee.computed && callee.property.type === "Literal"
+              ? callee.property.value
+              : null;
+        return propertyName === "fetch";
       }
       return false;
     }
@@ -131,7 +105,6 @@ const apiFetchRequiredRule = {
     return {
       CallExpression(node) {
         if (!isFetchCallee(node.callee)) return;
-        if (!isApiPath(node.arguments[0])) return;
         context.report({ node, messageId: "rawApiFetch" });
       },
     };

eslint-plugins/healthlog/queryKey-factory.js

@@ -1,96 +1,57 @@
 /**
  * @fileoverview ESLint rule — `queryKey` / `mutationKey` literal-array
- * factory enforcement.
+ * factory enforcement across the complete client tree.
  *
- * v1.4.41 W-PROCESS-DOCS — promoted from the test-guard substitute
- * (`src/lib/__tests__/query-keys.test.ts`, factory-bypass guard added
- * in v1.4.40 W-RSC) to a real ESLint rule. The test-guard substitute
- * stays in place as a belt-and-braces safety net for repo-walk
- * coverage of files the ESLint config might miss; this rule fires at
- * authoring time inside the IDE and at lint CI time.
+ * Every TanStack key must come from `src/lib/query-keys/`. The rule flags
+ * object-property `queryKey: [ … ]` and `mutationKey: [ … ]` values in
+ * components, hooks, client query modules, and any source module declaring
+ * top-level `"use client"`.
  *
- * The rule flags any object-property `queryKey: [ … ]` or
- * `mutationKey: [ … ]` whose value is a bare ArrayExpression — i.e.
- * the bypass shape that drove audit-H1 in `.planning/round-v1439-
- * arch-qa-frontend.md`. Acceptable shapes:
+ * Accepted call-site shapes include direct factory calls, identifiers already
+ * built from the factory, and conditionals selecting factory calls. Tests and
+ * the factory definition directory are exempt because they intentionally
+ * construct literal fixtures and tuples.
  *
- *   - `queryKey: queryKeys.something(arg)`                — factory call
- *   - `queryKey: someLocal`                               — indirect identifier
- *   - `queryKey: cond ? queryKeys.a() : queryKeys.b()`    — conditional via factory
- *
- * Files outside `WHITELISTED_FILES` are exempt entirely — the
- * test-guard substitute holds the "guarded surface" line until a
- * future wave extends both the guard and this whitelist together.
- *
- * @see src/lib/query-keys/         — factory home (do not lint as offender)
- * @see src/lib/__tests__/query-keys.test.ts — test-guard substitute
- * @see .planning/phase-W-PROCESS-DOCS-v1441-report.md
+ * @see src/lib/query-keys/
+ * @see src/lib/__tests__/query-keys.test.ts
  */
 
 "use strict";
 
-// Files that are ALLOWED to declare a literal-array queryKey. Mirrors
-// the test-guard substitute's `guardedRoots` allowlist inverted: every
-// file under those roots MUST use the factory, every file outside is
-// exempt for now. Path matches use `String#includes` semantics against
-// the absolute filename — keep entries as posix-style suffix paths.
-const FACTORY_HOME_FILES = [
-  // The factory's own unit-test file constructs literal keys to assert
-  // the factory output shape.
-  "src/lib/__tests__/query-keys.test.ts",
-];
-
-// The factory definition files are allowed to declare literal keys —
-// that's the whole point of the factory. The factory is split into
-// per-feature files under this directory (barrel at index.ts).
 const FACTORY_HOME_DIRECTORY = "src/lib/query-keys";
 
-// Directories under which any `queryKey: [ … ]` literal is an error.
-// Extend in lockstep with the test-guard substitute's `guardedRoots`.
-const GUARDED_DIRECTORIES = [
-  "src/components/charts",
-  "src/components/comparison",
-  // v1.4.41 W-FRONTEND-FACTORY — auth + notifications migrated to the
-  // factory. Mirror the test-guard's guardedRoots so IDE/lint CI fail
-  // at the same boundary the unit-test walker does.
-  "src/app/auth",
-  "src/app/notifications",
-  // v1.4.42 W3-QUERYKEY-LONGTAIL — the settings / medications /
-  // admin / hooks surface is now factory-only. Every long-tail
-  // bare-literal flagged by audit-H1 routes through `queryKeys.<entry>()`.
-  "src/components/settings",
-  "src/components/medications",
-  "src/components/admin",
-  "src/hooks",
-];
+// Components and hooks are client-facing by convention. Query modules are
+// client-transitive even if a future refactor moves the directive to a barrel.
+const CLIENT_ROOTS = ["src/components/", "src/hooks/", "src/lib/queries/"];
 
-// Individual guarded files outside the directories above.
-const GUARDED_FILES = [
-  "src/app/page.tsx",
-  "src/hooks/use-auth.ts",
-  // v1.4.41 W-FRONTEND-FACTORY — about-section migrated.
-  "src/components/settings/about-section.tsx",
-  // v1.4.42 W3-QUERYKEY-LONGTAIL — medications + targets pages now
-  // route every read through the factory.
-  "src/app/medications/page.tsx",
-  "src/app/medications/[id]/history/page.tsx",
-  "src/app/targets/page.tsx",
-];
+function toPosix(filename) {
+  return filename.replace(/\\/g, "/");
+}
 
-function isGuarded(filename) {
-  // Factory home is never an offender even if it shows up under a
-  // guarded directory by accident.
-  for (const home of FACTORY_HOME_FILES) {
-    if (filename.endsWith(home)) return false;
+function isTestFile(posix) {
+  return (
+    /\.(?:test|spec)\.[cm]?[jt]sx?$/.test(posix) ||
+    posix.includes("/__tests__/") ||
+    posix.includes("/__mocks__/")
+  );
+}
+
+function isGuarded(filename, sourceCode) {
+  const posix = toPosix(filename);
+  if (!posix.startsWith("src/") && !posix.includes("/src/")) return false;
+  if (
+    posix.startsWith(`${FACTORY_HOME_DIRECTORY}/`) ||
+    posix.includes(`/${FACTORY_HOME_DIRECTORY}/`)
+  ) {
+    return false;
   }
-  if (filename.includes(`/${FACTORY_HOME_DIRECTORY}/`)) return false;
-  for (const dir of GUARDED_DIRECTORIES) {
-    if (filename.includes(`/${dir}/`)) return true;
-  }
-  for (const file of GUARDED_FILES) {
-    if (filename.endsWith(file)) return true;
-  }
-  return false;
+  if (isTestFile(posix)) return false;
+  if (CLIENT_ROOTS.some((root) => posix.includes(root))) return true;
+  return sourceCode.ast.body.some(
+    (statement) =>
+      statement.type === "ExpressionStatement" &&
+      statement.directive === "use client",
+  );
 }
 
 /** @type {import('eslint').Rule.RuleModule} */
@@ -99,7 +60,7 @@ const queryKeyFactoryRule = {
     type: "problem",
     docs: {
       description:
-        "Disallow literal-array `queryKey` / `mutationKey` declarations in guarded files. Use `queryKeys.<entry>()` from `src/lib/query-keys/` instead.",
+        "Disallow literal-array `queryKey` / `mutationKey` declarations in client modules. Use `queryKeys.<entry>()` from `src/lib/query-keys/` instead.",
       recommended: false,
     },
     messages: {
@@ -110,7 +71,8 @@ const queryKeyFactoryRule = {
   },
   create(context) {
     const filename = context.filename ?? context.getFilename?.();
-    if (!filename || !isGuarded(filename)) {
+    const sourceCode = context.sourceCode ?? context.getSourceCode();
+    if (!filename || !isGuarded(filename, sourceCode)) {
       return {};
     }
 

eslint.config.mjs

@@ -13,22 +13,22 @@ const eslintConfig = defineConfig([
     "out/**",
     "build/**",
     "next-env.d.ts",
-    // v1.4.41 — ignore local tool worktrees so a worktree on an older
-    // commit can't poison `pnpm lint` locally.
-    // CI never sees this path; the rule is for the dev environment.
+    // v1.31.4 — ignore local tool worktrees so a worktree on another
+    // commit cannot poison `pnpm lint` locally.
+    // CI never sees these paths; the rules protect the dev environment.
     ".claude/**",
+    ".worktrees/**",
     // The project-local ESLint rule plugin is CommonJS (require/module
     // .exports) by ESLint convention; it is not application source and
     // is not linted by the app's TypeScript ruleset.
     "eslint-plugins/**",
+    "coverage/**",
+    "playwright-report/**",
+    "test-results/**",
   ]),
-  // v1.4.41 — custom rule that flags any bare-array
-  // `queryKey: [ … ]` / `mutationKey: [ … ]` declaration inside the
-  // files the queryKeys factory currently guards. Promotes the earlier
-  // v1.4.40 test-guard substitute to a real ESLint rule so IDE + CI
-  // both fail fast on a factory bypass. See
-  // `eslint-plugins/healthlog/queryKey-factory.js` for the
-  // whitelist + rationale.
+  // Factory enforcement for every client module: all components/hooks plus
+  // `"use client"` app/lib modules. Tests and `src/lib/query-keys/**` own
+  // literal fixtures/tuples and are exempt inside the rule.
   {
     plugins: { healthlog: healthlogPlugin },
     rules: {
@@ -38,11 +38,11 @@ const eslintConfig = defineConfig([
       // requirePublicHost connect-time pin). The wrapper internals and
       // test files are exempt; see the rule file for the allowlist.
       "healthlog/safe-fetch-required": "error",
-      // v1.16.4 — same-origin `/api/...` calls in the client surface
-      // (src/components + src/app) must route through the typed apiFetch
-      // wrapper (`src/lib/api/api-fetch.ts`): one `.ok` check, one
-      // envelope unwrap, one ApiError shape. Wrapper internals and test
-      // files are exempt; see the rule file for the allowlist.
+      // Every raw fetch in the complete client surface is rejected regardless
+      // of whether the endpoint is a literal, template, variable, or map
+      // lookup. Envelope JSON uses the verb helpers; deliberate Response-level
+      // work and non-API external calls use the explicit `apiFetchRaw` escape
+      // hatch. Server-only modules, wrapper internals, and tests are exempt.
       "healthlog/api-fetch-required": "error",
       // v1.26.0 — the design-consistency wave locked the app's colour
       // vocabulary onto semantic tokens. Raw Tailwind palette utilities
@@ -109,6 +109,8 @@ const eslintConfig = defineConfig([
       "src/components/medications/dose-strength-curve.tsx",
       "src/components/medications/drug-level-chart.tsx",
       "src/components/mental-health/assessment-history-chart.tsx",
+      "src/components/charts/workout-hr-chart.tsx",
+      "src/components/charts/workout-elevation-chart.tsx",
     ],
     rules: {
       "no-restricted-imports": [

lefthook.yml

@@ -16,6 +16,24 @@
 # Per project policy (`--no-verify` is banned), prefer fixing the
 # finding over bypassing the hook.
 
+# Commit-message guard: the project voice rule (CLAUDE.md, "Voice and
+# privacy") states that commits are authored by the maintainer's git
+# identity alone and carry no tooling co-author trailer or session link.
+# Editors and CLIs add those trailers by default, and a message that
+# picks one up is only removable from the object store by a history
+# rewrite — so the check belongs here, before the commit exists, not in
+# a review pass afterwards.
+commit-msg:
+  commands:
+    no-tooling-trailer:
+      run: |
+        if grep -qiE '^(Co-Authored-By:.*(claude|anthropic|copilot|gpt|gemini)|Claude-Session:|Generated with)' "{1}"; then
+          echo "ERROR: the commit message carries a tooling co-author trailer or session link." >&2
+          echo "Project policy: commits are authored by the maintainer's git identity alone." >&2
+          echo "Remove the offending line(s) from the message and commit again." >&2
+          exit 1
+        fi
+
 pre-commit:
   commands:
     gitleaks:

messages/de.json

@@ -42,7 +42,70 @@
     "hidePassword": "Passwort verbergen",
     "learnMore": "Mehr erfahren",
     "dismiss": "Schließen",
-    "moreInfo": "Mehr Informationen"
+    "moreInfo": "Mehr Informationen",
+    "durationHoursMinutes": "{hours} Std. {minutes} Min.",
+    "durationMinutes": "{minutes} Min."
+  },
+  "apiErrors": {
+    "measurement": {
+      "create": { "invalid": "Prüfe die Messdaten und versuche es erneut." },
+      "duplicate_timestamp": "Für diesen Zeitpunkt ist bereits eine Messung vorhanden."
+    },
+    "mood": {
+      "list": { "invalid": "Die Filter der Stimmungsliste sind ungültig." },
+      "create": {
+        "invalid": "Prüfe den Stimmungseintrag und versuche es erneut."
+      },
+      "update": {
+        "invalid": "Prüfe den Stimmungseintrag und versuche es erneut."
+      },
+      "duplicate_timestamp": "Für diesen Zeitpunkt ist bereits ein Stimmungseintrag vorhanden.",
+      "not_found": "Dieser Stimmungseintrag ist nicht mehr verfügbar.",
+      "ratedFactor": {
+        "out_of_range": "Eine Faktorbewertung liegt außerhalb des zulässigen Bereichs."
+      }
+    },
+    "labs": {
+      "create": { "invalid": "Prüfe den Laborwert und versuche es erneut." },
+      "result": { "notFound": "Dieser Laborwert ist nicht mehr verfügbar." },
+      "biomarker": {
+        "notFound": "Dieser Biomarker ist nicht mehr verfügbar.",
+        "duplicate": "Ein Biomarker mit diesem Namen ist bereits vorhanden.",
+        "create": {
+          "invalid": "Prüfe die Biomarker-Angaben und versuche es erneut."
+        },
+        "update": {
+          "invalid": "Prüfe die Biomarker-Angaben und versuche es erneut.",
+          "referenceRangeInvalid": "Der untere Referenzwert darf den oberen Wert nicht überschreiten."
+        }
+      },
+      "update": {
+        "invalid": "Prüfe den Laborwert und versuche es erneut.",
+        "linkedFieldsImmutable": "Bearbeite den Biomarker, um Name, Einheit, Panel oder Referenzbereich zu ändern.",
+        "qualitativeExpected": "Gib für diesen qualitativen Laborwert ein Textergebnis ein.",
+        "numericExpected": "Gib für diesen numerischen Laborwert eine Zahl ein.",
+        "referenceRangeInvalid": "Der untere Referenzwert darf den oberen Wert nicht überschreiten."
+      }
+    },
+    "onboarding": {
+      "disclaimer": {
+        "invalid": "Bestätige den medizinischen Hinweis bitte erneut."
+      },
+      "tour": {
+        "invalid": "Der Tour-Fortschritt konnte nicht gespeichert werden."
+      },
+      "complete": {
+        "invalid": "Prüfe die Profildaten und versuche es erneut."
+      },
+      "user": { "notFound": "Dein Konto wurde nicht gefunden." },
+      "step": {
+        "rateLimited": "Zu viele Versuche. Warte kurz und versuche es erneut.",
+        "invalid": "Dieser Onboarding-Schritt konnte nicht gespeichert werden.",
+        "completed": "Das Onboarding ist bereits abgeschlossen.",
+        "outOfOrder": "Dein Onboarding-Fortschritt hat sich geändert. Lade die Seite neu und fahre fort.",
+        "concurrent": "Dein Onboarding-Fortschritt hat sich geändert. Lade die Seite neu und fahre fort."
+      }
+    }
   },
   "doctorReport": {
     "title": "Gesundheitsbericht",
@@ -253,7 +316,9 @@
       "medication": "Medikament",
       "medicationDescription": "Eine Dosis als genommen markieren",
       "mood": "Stimmung",
-      "moodDescription": "Stimmung und Tags erfassen"
+      "moodDescription": "Stimmung und Tags erfassen",
+      "water": "Wasser",
+      "waterDescription": "Wasseraufnahme schnell hinzufügen"
     },
     "cycle": "Zyklus",
     "labs": "Laborwerte",
@@ -356,6 +421,7 @@
     "quickAddMeasurement": "Messung erfassen",
     "quickAddMood": "Stimmung erfassen",
     "quickAddMedicationIntake": "Einnahme erfassen",
+    "quickAddWater": "Wasser erfassen",
     "customizeDashboard": "Dashboard anpassen",
     "medicationIntakeQuickAdd": {
       "sheetTitle": "Medikamenteneinnahme erfassen",
@@ -400,8 +466,10 @@
     "staleHint": "Letzter Wert vor {count} T.",
     "staleHintWeeksOne": "Letzter Wert vor 1 Woche",
     "staleHintWeeksOther": "Letzter Wert vor {count} Wochen",
+    "staleHintWeeksFew": "Letzter Wert vor {count} Wochen",
     "staleHintMonthsOne": "Letzter Wert vor 1 Monat",
     "staleHintMonthsOther": "Letzter Wert vor {count} Monaten",
+    "staleHintMonthsFew": "Letzter Wert vor {count} Monaten",
     "recentWorkouts": {
       "title": "Letzte Workouts",
       "viewAll": "Alle anzeigen",
@@ -421,7 +489,9 @@
         "steps": "Schritte",
         "totalBodyWater": "Gesamtkörperwasser",
         "boneMass": "Knochenmasse",
-        "oxygenSaturation": "Sauerstoffsättigung"
+        "oxygenSaturation": "Sauerstoffsättigung",
+        "mood": "Stimmung",
+        "bmi": "BMI"
       },
       "unit": {
         "weight": "kg",
@@ -433,7 +503,9 @@
         "steps": "Schritte",
         "totalBodyWater": "kg",
         "boneMass": "kg",
-        "oxygenSaturation": "%"
+        "oxygenSaturation": "%",
+        "mood": "/5",
+        "bmi": "kg/m²"
       }
     }
   },
@@ -574,7 +646,7 @@
     "bulkDeleteSuccess": "{count} Messungen gelöscht",
     "bulkDeleteError": "Fehler beim Löschen der ausgewählten Messungen",
     "bulkDeleteConfirmTitle": "{count} Messungen löschen?",
-    "bulkDeleteConfirmBody": "Die {count} ausgewählten Messungen werden endgültig gelöscht.",
+    "bulkDeleteConfirmBody": "Die {count} ausgewählten Messungen werden gelöscht. Direkt danach kannst du das kurz rückgängig machen.",
     "typePhq9Score": "PHQ-9-Wert",
     "typeGad7Score": "GAD-7-Wert",
     "typeGripStrength": "Griffstärke",
@@ -592,6 +664,7 @@
     "statusPresent": "Erfasst",
     "statusAbsent": "Noch nicht erfasst",
     "statusModuleOff": "Aus",
+    "loadError": "Erfassungsstatus konnte nicht geladen werden.",
     "connectCta": "Quelle verbinden",
     "viewCta": "Ansehen",
     "ecg": {
@@ -599,7 +672,7 @@
     },
     "watchdog": {
       "title": "Automatische Überwachung",
-      "description": "HealthLog beobachtet außerdem still im Hintergrund — Benachrichtigungen zu unregelmäßigem Rhythmus und Atemstörungen von einer verbundenen Uhr, Warnungen bei Abweichungen von deiner Baseline sowie auffällige Veränderungen zwischen deinen letzten beiden Laborwerten — und zeigt eine Karte nur, wenn etwas auffällt. Keine Karte ist ein gutes Zeichen, kein fehlendes Feature."
+      "description": "HealthLog beobachtet außerdem still im Hintergrund — Benachrichtigungen zu unregelmäßigem Rhythmus und Atemstörungen von einer verbundenen Uhr, Warnungen bei Abweichungen von deiner Baseline sowie auffällige Veränderungen zwischen deinen letzten beiden Laborwerten — und zeigt eine Karte nur, wenn etwas auffällt. Ist mindestens eine dieser Quellen verbunden, ist keine Karte ein gutes Zeichen, kein fehlendes Feature; ist noch keine verbunden, wird schlicht noch nichts überwacht."
     }
   },
   "mood": {
@@ -721,7 +794,7 @@
     "bulkDeleteSuccess": "{count} Einträge gelöscht",
     "bulkDeleteError": "Fehler beim Löschen der ausgewählten Einträge",
     "bulkDeleteConfirmTitle": "{count} Einträge löschen?",
-    "bulkDeleteConfirmBody": "Die {count} ausgewählten Stimmungseinträge werden endgültig gelöscht.",
+    "bulkDeleteConfirmBody": "Die {count} ausgewählten Stimmungseinträge werden gelöscht. Direkt danach kannst du das kurz rückgängig machen.",
     "customize": "Stimmungs-Tags anpassen",
     "addTagInline": "Tag hinzufügen",
     "manage": {
@@ -1678,7 +1751,10 @@
         "packagingDefaultPackLabel": "Standard-Packungsgröße (Einheiten)",
         "packagingDefaultPackHelper": "Vorbefüllung beim Erfassen neuer Packungen (1–1000). Leer lassen, wenn keine üblich ist.",
         "packagingSuccess": "Packungsangaben gespeichert",
-        "packagingFailed": "Speichern fehlgeschlagen"
+        "packagingFailed": "Speichern fehlgeschlagen",
+        "addManufacturerLabel": "Hersteller",
+        "addDoseStrengthLabel": "Wirkstärke",
+        "addDoseStrengthHint": "Wie auf dem Behälter aufgedruckt, z. B. 5 mg/0,5 ml."
       },
       "erweitert": {
         "group": {
@@ -1978,6 +2054,61 @@
     "notAvailableForCompliance": "Vergleich für Therapietreue nicht verfügbar"
   },
   "insights": {
+    "correlation": {
+      "direction": {
+        "higher": "höher",
+        "lower": "niedriger"
+      },
+      "weekdayDirection": {
+        "above": "über",
+        "below": "unter"
+      },
+      "channelFactor": "die Bewertung von {factor}",
+      "channel": {
+        "WEIGHT": "das Gewicht",
+        "BLOOD_GLUCOSE": "der Blutzucker",
+        "BLOOD_PRESSURE_SYS": "der systolische Blutdruck",
+        "BLOOD_PRESSURE_DIA": "der diastolische Blutdruck",
+        "ACTIVITY_STEPS": "die tägliche Schrittzahl",
+        "SLEEP_DURATION": "die Schlafdauer",
+        "HEART_RATE_VARIABILITY": "die Herzratenvariabilität",
+        "RESTING_HEART_RATE": "die Ruheherzfrequenz",
+        "TIME_IN_DAYLIGHT": "die Zeit im Tageslicht",
+        "MOOD": "die Stimmung",
+        "PULSE": "der Ruhepuls",
+        "MEDICATION_COMPLIANCE": "die Medikamententreue",
+        "SYMPTOM_SEVERITY": "die Symptomstärke",
+        "ENV_TEMP_MEAN": "die Tagestemperatur",
+        "ENV_TEMP_MIN": "die nächtliche Tiefsttemperatur",
+        "ENV_SUNSHINE": "der Sonnenschein",
+        "ENV_DAYLIGHT": "das Tageslicht",
+        "ENV_PRECIP": "der Niederschlag",
+        "ENV_PRESSURE_MEAN": "der Luftdruck",
+        "ENV_PRESSURE_DELTA": "die Luftdruckschwankung am Tag"
+      },
+      "daily": {
+        "high": "Wenn {behaviour} höher liegt, fällt {outcome} am Folgetag in deinen Daten tendenziell {direction} aus — ein Muster, das Beachtung verdient, keine Ursache.",
+        "moderate": "Wenn {behaviour} höher liegt, scheint {outcome} am Folgetag nach bisheriger Datenlage eher {direction} auszufallen — ein Muster, das Beachtung verdient, keine Ursache.",
+        "faint": "Wenn {behaviour} höher liegt, gibt es in deinen Daten allenfalls einen schwachen Hinweis darauf, dass {outcome} am Folgetag {direction} ausfällt — zu gering, um sich darauf zu verlassen, niemals eine Ursache."
+      },
+      "lab": {
+        "default": "Höhere {lab}-Werte gehen in deinen Daten damit einher, dass {outcome} im selben Zeitraum {direction} ausfällt — ein Zusammenhang, den du ärztlich im Blick behalten solltest, niemals eine Ursache.",
+        "faint": "Höhere {lab}-Werte deuten in deinen Daten allenfalls schwach darauf hin, dass {outcome} im selben Zeitraum {direction} ausfällt — zu gering, um sich darauf zu verlassen, ein Zusammenhang, den du ärztlich abklären lassen solltest, niemals eine Ursache."
+      },
+      "hypothesis": {
+        "bpCompliance": {
+          "support": "Höhere Medikamententreue geht mit niedrigeren systolischen Werten einher — ein Muster, das Beachtung verdient.",
+          "surprising": "Medikamententreue und systolischer Wert bewegen sich in deinen Daten gemeinsam — überraschend; sprich mit deiner Ärztin oder deinem Arzt, bevor du etwas änderst.",
+          "none": "Medikamententreue und systolischer Wert bewegen sich in diesem Zeitraum nicht deutlich gemeinsam."
+        },
+        "moodPulse": {
+          "support": "Tage mit schlechterer Stimmung gehen mit höherem Ruhepuls einher — ein Muster, das Beachtung verdient.",
+          "surprising": "Tage mit besserer Stimmung gehen in deinen Daten mit höherem Ruhepuls einher — überraschend.",
+          "none": "Stimmung und Ruhepuls bewegen sich in diesem Zeitraum nicht deutlich gemeinsam."
+        },
+        "weightWeekday": "Das Gewicht am {weekday} liegt {delta} kg {direction} deinem Durchschnitt der übrigen Tage — ein Muster, das Beachtung verdient."
+      }
+    },
     "emptyTitle": "Noch nicht genug Daten",
     "emptyDescription": "Insights erscheinen, sobald du ein paar Messwerte erfasst hast. Beginne mit Gewicht oder Blutdruck.",
     "emptyAddMeasurement": "Messwert erfassen",
@@ -2264,6 +2395,13 @@
       "historyEmpty": "Deine Unterhaltungen erscheinen hier. Stell eine Frage, um zu starten.",
       "historyDeleteAria": "Unterhaltung löschen",
       "historyDeleted": "Unterhaltung gelöscht",
+      "rename": {
+        "action": "Unterhaltung umbenennen",
+        "input": "Titel der Unterhaltung",
+        "save": "Titel speichern",
+        "cancel": "Umbenennen abbrechen",
+        "error": "Der Titel der Unterhaltung konnte nicht gespeichert werden."
+      },
       "historySearchEmpty": "Keine Unterhaltungen entsprechen deiner Suche.",
       "historyLoadingMore": "Mehr wird geladen…",
       "sourcesTitle": "Worauf ich zugreife",
@@ -2402,10 +2540,6 @@
       "settingsClustersHint": "Wähle, welche Datencluster der Coach lesen darf. Mehr Daten bedeuten reichhaltigere Antworten und einen größeren Prompt.",
       "settingsClusterNoData": "Noch keine Daten",
       "sourcesMemberCount": "{count} Werte",
-      "dictate": "Diktieren",
-      "dictateStop": "Diktat beenden",
-      "voiceUnsupported": "Spracheingabe wird in diesem Browser nicht unterstützt",
-      "dictateError": "Spracheingabe konnte nicht gestartet werden. Prüfe die Mikrofonberechtigung und versuche es erneut.",
       "showConversations": "Unterhaltungen anzeigen",
       "hideConversations": "Unterhaltungen ausblenden",
       "heroGreeting": "Frage mich etwas zu deinen Daten",
@@ -2502,10 +2636,13 @@
     "relativeJustNow": "gerade eben",
     "relativeMinutesAgoOne": "vor {count} Minute",
     "relativeMinutesAgoOther": "vor {count} Minuten",
+    "relativeMinutesAgoFew": "vor {count} Minuten",
     "relativeHoursAgoOne": "vor {count} Stunde",
     "relativeHoursAgoOther": "vor {count} Stunden",
+    "relativeHoursAgoFew": "vor {count} Stunden",
     "relativeDaysAgoOne": "vor {count} Tag",
     "relativeDaysAgoOther": "vor {count} Tagen",
+    "relativeDaysAgoFew": "vor {count} Tagen",
     "navOverview": "Übersicht",
     "navCatalog": "Alle Messwerte",
     "navBloodPressure": "Blutdruck",
@@ -2665,11 +2802,11 @@
         "fatFreeMassTitle": "Fettfreie Masse",
         "fatFreeMassBody": "Die fettfreie Masse ist alles in deinem Körper, das kein Fett ist — Muskeln, Knochen, Organe und Wasser. Sie zu halten oder aufzubauen, während das Gewicht sinkt, deutet meist auf eine gesündere Körperzusammensetzung hin.",
         "fatMassTitle": "Fettmasse",
-        "fatMassBody": "Die Fettmasse ist das Gesamtgewicht des Körperfetts. Etwas Fett ist für Hormone und Energiespeicher unverzichtbar, doch zu viel — besonders am Bauch — erhöht das langfristige Gesundheitsrisiko.",
+        "fatMassBody": "Die Fettmasse ist das Gesamtgewicht des Körperfetts. Etwas Fett ist für Hormone und Energiespeicher unverzichtbar, doch zu viel — besonders am Bauch — erhöht das langfristige Gesundheitsrisiko (WHO 2024).",
         "muscleMassTitle": "Muskelmasse",
         "muscleMassBody": "Die Muskelmasse ist das geschätzte Gewicht der Muskeln in deinem Körper. Mehr Muskeln unterstützen Kraft, Stoffwechsel und Beweglichkeit und müssen mit zunehmendem Alter aktiv erhalten werden.",
         "visceralFatTitle": "Viszeralfett",
-        "visceralFatBody": "Viszeralfett ist das Fett, das tief im Bauchraum um die Organe gespeichert wird. Anders als das Unterhautfett ist ein hoher Wert eng mit Herzkrankheiten und Typ-2-Diabetes verbunden, daher ist niedriger meist besser.",
+        "visceralFatBody": "Viszeralfett ist das Fett, das tief im Bauchraum um die Organe gespeichert wird. Anders als das Unterhautfett ist ein hoher Wert eng mit Herzkrankheiten und Typ-2-Diabetes verbunden (AHA, Circulation 2021), daher ist niedriger meist besser. Die Skala zeigt einen einheitenlosen Wert (etwa 1–12 gilt als gesunder Bereich, ab 13 als erhöht); das ist eine andere Skala als die bildgebenden cm²-Schwellenwerte, die in der Klinik verwendet werden, und nicht mit ihnen austauschbar.",
         "leanBodyMassTitle": "Magermasse",
         "leanBodyMassBody": "Die Magermasse ist dein Gesamtgewicht abzüglich des Körperfetts — Muskeln, Knochen, Organe und Wasser zusammen. Sie neben dem Gewicht zu verfolgen zeigt, ob Veränderungen aus Muskeln oder aus Fett stammen.",
         "flightsClimbedTitle": "Etagen gestiegen",
@@ -2699,7 +2836,7 @@
         "audioEventsTitle": "Laute Geräuschereignisse",
         "audioEventsBody": "Laute Geräuschereignisse markieren Momente, in denen der Lärm um dich herum ein Niveau erreicht hat, das bei ausreichender Belastung das Gehör schädigen kann. Häufige Ereignisse sind ein Hinweis, eine ruhigere Umgebung oder Gehörschutz zu suchen.",
         "daylightTitle": "Zeit im Tageslicht",
-        "daylightBody": "Die Zeit im Tageslicht ist, wie lange du dich täglich im Freien im Licht aufhältst. Regelmäßiges Tageslicht unterstützt einen gesunden Schlaf-Wach-Rhythmus und die Stimmung, und Zeit im Freien ist mit der Augengesundheit verbunden.",
+        "daylightBody": "Die Zeit im Tageslicht ist, wie lange du dich täglich im Freien im Licht aufhältst. Regelmäßiges Tageslicht unterstützt einen gesunden Schlaf-Wach-Rhythmus und die Stimmung (CDC 2024), und Zeit im Freien ist mit der Augengesundheit verbunden.",
         "bloodGlucoseTitle": "Blutzucker",
         "bloodGlucoseBody": "Der Blutzucker ist die Zuckermenge in deinem Blut, die wichtigste Energiequelle des Körpers. Er steigt nach dem Essen und pendelt sich zwischen den Mahlzeiten ein; dauerhaft hohe Werte können auf Diabetes oder Prädiabetes hinweisen.",
         "skinTemperatureTitle": "Hauttemperatur",
@@ -2711,7 +2848,7 @@
         "wristTemperatureTitle": "Handgelenktemperatur",
         "wristTemperatureBody": "Die Handgelenktemperatur wird im Schlaf gemessen und als Abweichung von deinem persönlichen Ausgangswert angegeben, nicht als absoluter Wert. Ein gleichmäßiger Wert ist normal, ein anhaltender Anstieg kann auf Krankheit, intensives Training oder eine Zyklusveränderung hindeuten.",
         "fallsTitle": "Stürze",
-        "fallsBody": "Hier werden die von deinem Wearable erkannten schweren Stürze gezählt. Null ist das Ziel; eine steigende Zahl ist ein Hinweis auf ein erhöhtes Sturzrisiko, das du — besonders im höheren Alter — mit einer Ärztin oder einem Arzt besprechen solltest.",
+        "fallsBody": "Hier werden die von deinem Wearable erkannten schweren Stürze gezählt. Null ist das Ziel; eine steigende Zahl ist ein Hinweis auf ein erhöhtes Sturzrisiko, das du — besonders im höheren Alter — mit einer Ärztin oder einem Arzt besprechen solltest (CDC STEADI 2024).",
         "sixMinuteWalkTitle": "6-Minuten-Gehstrecke",
         "sixMinuteWalkBody": "Dies ist eine Schätzung, wie weit du in sechs Minuten gehen könntest — ein etablierter klinischer Test für Mobilität und kardiopulmonale Ausdauer. Der Wearable-Wert ist ein Näherungswert, nicht der überwachte klinische Test; aussagekräftig ist der gleichbleibende oder steigende Trend.",
         "stairAscentSpeedTitle": "Treppensteig-Tempo",
@@ -2759,7 +2896,8 @@
       },
       "valuesBack": "Zurück zu Insights",
       "valuesBackToMetric": "Zurück zu {metric}",
-      "scoresBack": "Zurück zu Insights"
+      "scoresBack": "Zurück zu Insights",
+      "ecgDescription": "Einkanal-EKG-Aufzeichnungen deines Geräts, jeweils mit dem Ergebnis des Geräts. HealthLog zeigt die Kurve und die Aufzeichnung – die Kurve wird nicht interpretiert."
     },
     "sleep": {
       "title": "Schlaf",
@@ -2798,9 +2936,9 @@
       "debt": {
         "title": "Schlafschuld",
         "value": "{hours} Std. {minutes} Min. zu wenig",
-        "caption": "Kumuliertes Defizit der letzten {nights} Nächte",
+        "caption": "Offene Bilanz der letzten {nights} Nächte",
         "clearValue": "Ausgeglichen",
-        "clearCaption": "Kein aufgelaufenes Defizit über die letzten {nights} Nächte",
+        "clearCaption": "Nichts offen über die letzten {nights} Nächte",
         "learning": "Dein Schlaf wird noch erfasst — {counted} Nächte bisher, noch {remaining} für eine verlässliche Bilanz.",
         "computedInfo": "Das ist HealthLogs eigene Schätzung: eine gleitende Bilanz aus Bedarf minus Schlaf über die letzten Nächte, die Aufholschlaf wieder abbaut. Sie kann vom nativen Schlafdefizit eines Wearables abweichen, das ein eigenes Bedarfsmodell nutzt."
       },
@@ -2904,6 +3042,8 @@
     "navRecovery": "Erholung",
     "workouts": {
       "title": "Workouts",
+      "askWhy": "Warum?",
+      "askWhyPrompt": "Warum ist diese Einheit so ausgefallen? Erkläre mir meine eigenen Werte dazu.",
       "description": "Letzte Läufe, Touren, Spaziergänge und Krafteinheiten — quellenübergreifend entdoppelt zwischen Apple Watch und Withings.",
       "emptyState": {
         "title": "Noch keine Workouts",
@@ -2932,7 +3072,24 @@
         "hrChartTitle": "Herzfrequenz",
         "hrChartUnavailable": "Sekundengenaue Herzfrequenz-Werte werden für dieses Workout nicht gespeichert.",
         "notFound": "Workout nicht gefunden.",
-        "loading": "Workout wird geladen…"
+        "loading": "Workout wird geladen…",
+        "hrFromPulse": "Aus deinen Herzfrequenzdaten rund um diese Einheit",
+        "hrAxisMinutes": "Min.",
+        "sportAverageLabel": "Dein aktueller Durchschnitt:",
+        "zonesTitle": "Belastungszonen",
+        "zonesCaption": "Wie sich deine Belastung auf die Herzfrequenzzonen verteilt hat.",
+        "zonesCaptionDevice": "Zeit pro Zone laut deinem Gerät.",
+        "exportGpx": "GPX exportieren",
+        "elevationTitle": "Höhe",
+        "splitsTitle": "Kilometerzeiten",
+        "splitsKm": "km",
+        "splitsTime": "Zeit",
+        "splitsPace": "Tempo",
+        "thatDayTitle": "An diesem Tag",
+        "dayPulse": "Puls",
+        "daySleep": "Schlaf",
+        "dayMood": "Stimmung",
+        "insightTitle": "Aktivitäts-Einblick"
       },
       "sport": {
         "walking": "Gehen",
@@ -2955,7 +3112,11 @@
         "crossTraining": "Cross-Training",
         "mixedCardio": "Mixed Cardio",
         "other": "Sonstiges"
-      }
+      },
+      "loadError": "Deine Workouts konnten nicht geladen werden",
+      "loadMore": "Weitere Workouts laden",
+      "loadingMore": "Weitere Workouts werden geladen",
+      "loadMoreError": "Weitere Workouts konnten nicht geladen werden"
     },
     "bloodGlucose": {
       "title": "Blutzucker",
@@ -3898,7 +4059,10 @@
         "recordingsMany": "{count} Aufzeichnungen vorhanden.",
         "latestResult": "Letztes Geräte-Ergebnis: {result}.",
         "cta": "Aufzeichnungen ansehen"
-      }
+      },
+      "emptyTitle": "Noch keine EKG-Aufzeichnungen",
+      "emptyDescription": "EKG-Aufzeichnungen werden von einem kompatiblen Einkanal-Gerät synchronisiert. Sobald dein Gerät eine Aufzeichnung überträgt, erscheint sie hier.",
+      "emptyCta": "Gerät verbinden"
     },
     "intradayPulse": {
       "title": "Der Verlauf deines Tages",
@@ -3917,7 +4081,8 @@
         "evening": "Eine anhaltend erhöhte Ruhephase heute Abend — möglicherweise etwas Anspannung.",
         "night": "Eine anhaltend erhöhte Ruhephase in der Nacht — möglicherweise etwas Anspannung."
       }
-    }
+    },
+    "navEcg": "EKG"
   },
   "thresholds": {
     "defaultLabel": "Default",
@@ -4397,7 +4562,7 @@
           "fullBackup": {
             "title": "Voll-Backup",
             "description": "Alle deine Daten in einer JSON-Datei — Messwerte, Medikamente, Stimmung, Zyklus, Laborwerte, Krankheitsepisoden, Allergien, Familienanamnese und Workouts. Gleiches Format wie das wöchentliche Auto-Backup.",
-            "scopeNote": "Die Originaldateien der Dokumente sowie GPS-Routen und Einzelmesswerte von Workouts sind nicht enthalten — lade diese separat aus dem Dokumententresor bzw. dem Workout-Export herunter.",
+            "scopeNote": "Dokumentmetadaten und die KI-Zusammenfassung, falls vorhanden, sind als Klartext enthalten; die Originaldateien der Dokumente sowie GPS-Routen und Einzelmesswerte von Workouts sind es nicht — lade diese separat aus dem Dokumententresor bzw. dem Workout-Export herunter.",
             "encryptToggle": "Mit einer Passphrase verschlüsseln",
             "passphrasePlaceholder": "Passphrase (mind. 12 Zeichen)",
             "passphraseHelp": "Leitet den Archivschlüssel per Argon2id ab und versiegelt ihn mit AES-256-GCM. Speichere die Datei mit der Endung .hlx.",
@@ -4428,6 +4593,7 @@
             "failed": "Der Import ist fehlgeschlagen.",
             "rowsImported": "Bisher {count} Einträge importiert",
             "doneSummary": "Fertig — {imported} von {read} Datensätzen importiert, {skipped} klinische Datensätze übersprungen.",
+            "estimateWarning": "Kumulative Summen für {count} Tag(e) wurden anhand der größten Exportquelle geschätzt. Native Apple-Health-Statistiken bleiben maßgeblich.",
             "phase": {
               "queued": "In Warteschlange…",
               "unpacking": "Archiv wird entpackt…",
@@ -4586,7 +4752,9 @@
           "description": "Füge einen Ort und einen Zeitraum hinzu – eine Reise oder einen früheren Abschnitt deiner Verlaufsdaten. Der Zeitraum überschreibt für seine Tage deinen Wohnort, damit das Wetter zu deinem tatsächlichen Aufenthalt passt. So korrigierst du die Vergangenheit.",
           "none": "Noch keine Ortszeiträume.",
           "add": "{label} hinzufügen",
-          "remove": "Ortszeitraum entfernen"
+          "remove": "Ortszeitraum entfernen",
+          "removeConfirmTitle": "Diese Reise entfernen?",
+          "removeConfirmBody": "Messwerte aus diesem Zeitraum bleiben erhalten; nur der Reise-Eintrag verschwindet."
         },
         "backfill": {
           "title": "Vergangene Tage nacherfassen",
@@ -4867,7 +5035,10 @@
           "surfaced": "Angezeigt",
           "done": "Erledigt",
           "dismissed": "Verworfen"
-        }
+        },
+        "deleteConfirmTitle": "Diese Erinnerung löschen?",
+        "deleteConfirmBody": "Sie wird nicht mehr ausgelöst. An bereits erfassten Daten ändert sich nichts.",
+        "deleteConfirmAction": "Löschen"
       },
       "aboutMe": {
         "title": "Über mich",
@@ -4913,6 +5084,16 @@
         "honesty": "Der gemeinsame Zugang ist ein einzelnes angemeldetes KI-Konto, das der Betreiber für alle auf diesem Server verbunden hat — nicht dein eigener Schlüssel. Anfragen darüber werden vom Anbieter standardmäßig zum Training genutzt und von keiner Auftragsverarbeitungsvereinbarung gedeckt, die Stunden- und Wochenlimits des Kontos teilst du dir mit allen anderen, die zugestimmt haben, und deine eigenen Anbieter werden weiterhin zuerst versucht. Aktiviere es nur, wenn du diesen Kompromiss akzeptierst.",
         "confirm": "Verstanden — gemeinsame Verbindung nutzen",
         "cancel": "Abbrechen"
+      },
+      "consent": {
+        "title": "KI-Einwilligung",
+        "activeSince": "Erteilt am {date}. Deine Gesundheitsdaten dürfen für die KI-Funktionen an den eingestellten Anbieter gesendet werden.",
+        "withdrawn": "Widerrufen. Es werden keine Gesundheitsdaten an einen KI-Anbieter gesendet; die KI-Funktionen bleiben aus.",
+        "withdraw": "Einwilligung widerrufen",
+        "confirmBody": "Die KI-Funktionen sind sofort abgeschaltet. Bereits erfasste Daten werden nicht gelöscht — dafür gibt es Daten & Privatsphäre.",
+        "confirmWithdraw": "Widerrufen",
+        "regrantHint": "Um die KI-Funktionen wieder zu nutzen, schalte das automatische Lesen von Dokumenten ein oder erteile die Einwilligung in der App.",
+        "error": "Der Widerruf konnte nicht gespeichert werden. Bitte versuche es erneut."
       }
     },
     "dashboard": {
@@ -5099,7 +5280,8 @@
       "resumeError": "Wieder verbinden fehlgeschlagen"
     },
     "apiTokens": "API-Tokens",
-    "apiTokensDescription": "Erstelle API-Tokens für die externe Medikamenten-Einnahme (z.B. Shortcuts, Automationen).",
+    "apiTokensDescription": "API-Tokens für die externe Medikamenten-Einnahme prüfen und widerrufen. Tokens werden pro Medikament über dessen API-Endpoint-Schalter ausgestellt.",
+    "tokenMintMovedDescription": "Tokens werden pro Medikament ausgestellt. Öffne ein Medikament und aktiviere dessen API-Endpoint, um ein Token zu erhalten, das nur für dieses Medikament gilt.",
     "tokenNamePlaceholder": "Token-Name (z.B. iPhone Shortcut)",
     "tokenCreated": "Token erstellt — kopiere ihn jetzt! Er wird nicht erneut angezeigt.",
     "tokenCopy": "Token kopieren",
@@ -5531,8 +5713,16 @@
         "revokeAllDone": "{count} vertrauenswürdige(s) Gerät(e) entfernt.",
         "unnamed": "Unbekanntes Gerät",
         "current": "Dieses Gerät",
-        "expires": "Vertraut bis {date}"
-      }
+        "expires": "Vertraut bis {date}",
+        "revokeConfirmTitle": "Diesem Gerät nicht mehr vertrauen?",
+        "revokeConfirmBody": "Es fragt beim nächsten Anmelden wieder nach deinem zweiten Faktor.",
+        "revokeAllConfirmTitle": "Keinem Gerät mehr vertrauen?",
+        "revokeAllConfirmBody": "Jedes Gerät fragt beim nächsten Anmelden wieder nach deinem zweiten Faktor, auch dieses."
+      },
+      "revokeSessionConfirmTitle": "Dieses Gerät abmelden?",
+      "revokeSessionConfirmBody": "{device} muss sich neu anmelden. An den dort erfassten Daten ändert sich nichts.",
+      "signOutEverywhereConfirmTitle": "Alle anderen Geräte abmelden?",
+      "signOutEverywhereConfirmBody": "Jedes Gerät außer diesem muss sich neu anmelden. Dieses Gerät bleibt angemeldet. An deinen erfassten Daten ändert sich nichts."
     },
     "privacy": {
       "intro": {
@@ -5632,10 +5822,34 @@
       "rate_limited": "Zu viele Verbindungsversuche. Warte einen Moment und versuche es erneut.",
       "generic": "Unbekannter Fehler bei der Verbindung. Bitte starte die Verbindung erneut."
     },
+    "appleHealth": {
+      "title": "Apple Health",
+      "description": "Die Live-Synchronisierung erfolgt über die HealthLog-iOS-App – nicht über eine Web- oder OAuth-Verbindung.",
+      "status": {
+        "checking": "Apple-Health-Daten werden geprüft…",
+        "dataReceived": "Apple-Health-Daten empfangen",
+        "setup": "In der iOS-App einrichten",
+        "unavailable": "Apple-Health-Status nicht verfügbar"
+      },
+      "lastDataLabel": "Letzte Apple-Health-Daten:",
+      "setupTitle": "Live-Synchronisierung aktivieren",
+      "permissionStep": "Öffne in der HealthLog-iOS-App Einstellungen → Apple Health und erlaube die Gesundheitskategorien, die du teilen möchtest.",
+      "backgroundStep": "Lass die Hintergrundaktualisierung aktiviert. Die App synchronisiert neue Daten automatisch im Vordergrund und wenn iOS Hintergrundzeit gewährt.",
+      "importNote": "Du brauchst ältere Daten oder kannst die iOS-App nicht nutzen? Der Apple-Health-XML/ZIP-Upload ist ein einmaliger Ersatzweg und aktiviert keine Live-Synchronisierung.",
+      "importAction": "Einmaligen Import öffnen"
+    },
     "garminInfo": {
       "title": "Garmin",
       "body": "Garmin hat hier keine direkte Verbindung. Verbinde über Apple Health (iOS) oder Google Health Connect (Android). Garmins proprietäre Werte — Body Battery, Training Load, HRV-Status, VO₂max — werden von Garmin an keine der beiden Plattformen weitergegeben.",
       "docsLink": "Zur Anleitung"
+    },
+    "glucoseReference": {
+      "title": "Glukose-Referenzband",
+      "description": "Gegen welches Band deine Blutzuckerwerte bewertet werden.",
+      "enable": "Diabetes-Zielband verwenden",
+      "explainer": "Aus werden Werte gegen das allgemeine nicht-diabetische Referenzband bewertet. An werden sie gegen das engere glykämische Zielband der ADA Standards of Care bewertet, und der Coach begründet seine Glukose-Aussagen auf diesem Band. Deine eigenen Zielwert-Überschreibungen unten haben weiterhin Vorrang.",
+      "disclaimer": "Das wählt ein Referenzband aus. Es ist keine Diagnose, wird nie aus einem Messwert abgeleitet, und die App handelt klinisch nicht danach. Welche Zielwerte für dich gelten, klärst du mit deiner Ärztin oder deinem Arzt.",
+      "error": "Die Einstellung konnte nicht gespeichert werden."
     }
   },
   "admin": {
@@ -6116,7 +6330,7 @@
         "restore": "Wiederherstellen",
         "restoreAria": "Backup für {username} wiederherstellen",
         "restoreTitle": "Aus Backup wiederherstellen",
-        "restoreDescription": "Dies ersetzt ALLE aktuellen Daten von {username} mit dem Snapshot von {when}. Vorhandene Messungen, Medikamente, Einnahmen, Stimmungseinträge, Benachrichtigungs-Kanäle, Push-Abos und Telegram-Lösch-Aufträge werden entfernt.",
+        "restoreDescription": "Dies ersetzt ALLE aktuellen Daten von {username} mit dem Snapshot von {when}. Vorhandene Messungen, Medikamente, Einnahmen, Stimmungseinträge, Benachrichtigungs-Kanäle, Push-Abos und Telegram-Lösch-Aufträge werden entfernt. Falls im Snapshot enthalten, überschreiben instanzweite Einstellungen die Konfiguration der gesamten Installation.",
         "restorePromptLabel": "Tippe RESTORE zum Fortfahren",
         "restoreConfirm": "Jetzt wiederherstellen",
         "restoreInProgress": "Wiederherstellung läuft…",
@@ -7374,7 +7588,7 @@
     "referenceLabel": "Referenz",
     "readingsCount": "{count} Messungen",
     "deleteConfirmTitle": "Laborwert löschen?",
-    "deleteConfirmDescription": "Dieser Laborwert wird dauerhaft gelöscht.",
+    "deleteConfirmDescription": "Dieser Laborwert wird gelöscht. Direkt danach kannst du das kurz rückgängig machen.",
     "deletedToast": "Wert gelöscht",
     "deleteError": "Wert konnte nicht gelöscht werden",
     "loadError": "Laborwerte konnten nicht geladen werden",
@@ -7853,7 +8067,7 @@
     },
     "deleteConfirm": {
       "title": "Diese Episode löschen?",
-      "body": "„{label}“ und alle zugehörigen Tageseinträge werden entfernt. Dies kann nicht rückgängig gemacht werden."
+      "body": "„{label}“ und alle zugehörigen Tageseinträge werden entfernt. Direkt danach kannst du das kurz rückgängig machen."
     },
     "vital": {
       "RESTING_HEART_RATE": "Ruheherzfrequenz",
@@ -7936,6 +8150,11 @@
         "review_due": "Check-in fällig",
         "reviewed": "Ausgewertet"
       }
+    },
+    "refusal": {
+      "outOfScope": "Ich kann nur bei den Gesundheitsdaten in deinem Log helfen — Messwerte, Medikamente, Stimmung, Trends. Fragen außerhalb dieses Themas beantworte ich nicht.",
+      "promptInjection": "In deiner Nachricht stehen Anweisungen, die meine Vorgaben überschreiben sollen. Ich bin der HealthLog-Coach und fasse ausschließlich deine eigenen Gesundheitsdaten zusammen — formuliere deine Frage bitte in diesem Rahmen neu.",
+      "conversationPoisoned": "Eine frühere Nachricht in dieser Unterhaltung enthält Anweisungen, die meine Vorgaben überschreiben sollen. Beginne bitte eine neue Unterhaltung."
     }
   },
   "safety": {
@@ -8188,7 +8407,9 @@
         "finally": "Finally …"
       }
     },
-    "openDetail": "Details anzeigen"
+    "openDetail": "Details anzeigen",
+    "historyLoadError": "Dein Testverlauf konnte nicht geladen werden",
+    "historyLoadErrorHint": "Das heißt nicht, dass keine Ergebnisse vorliegen — die Liste konnte nicht abgerufen werden. Versuche es erneut."
   },
   "records": {
     "disclaimer": "Das sind deine eigenen Angaben, keine ärztliche Diagnose. HealthLog stellt keine Diagnose, behandelt nicht und deutet nichts.",
@@ -8397,7 +8618,13 @@
       "title": "Dokumentdetails",
       "summary": {
         "title": "Zusammenfassung",
-        "pending": "Die Zusammenfassung wird erstellt."
+        "pending": "Die Zusammenfassung wird erstellt.",
+        "none": "Für dieses Dokument wurde noch keine Zusammenfassung erstellt.",
+        "withheld": "Eine Zusammenfassung wurde erstellt, hat die Sicherheitsprüfung aber nicht bestanden und wird deshalb nicht angezeigt. Du kannst es erneut versuchen oder das Dokument selbst lesen.",
+        "unavailable": "Für dieses Dokument konnte keine Zusammenfassung erstellt werden.",
+        "generate": "Zusammenfassung erstellen",
+        "regenerate": "Neu erstellen",
+        "generating": "Wird erstellt…"
       },
       "loadError": "Dieses Dokument konnte nicht geladen werden.",
       "saveError": "Die Änderung konnte nicht gespeichert werden.",
@@ -8479,7 +8706,6 @@
       "close": "Ausblenden"
     },
     "ai": {
-      "statusAiRead": "Von KI gelesen",
       "readDone": "Die KI hat dein Dokument gelesen.",
       "read": "Mit KI auslesen",
       "reread": "Erneut lesen",
@@ -8635,6 +8861,7 @@
       "quickAddCustomPlaceholder": "250",
       "quickAddSubmit": "Hinzufügen",
       "quickAddError": "Konnte nicht gespeichert werden — versuch's noch mal.",
+      "quickAddSuccess": "{amount} ml Wasser hinzugefügt.",
       "editTotal": "Heutige Summe bearbeiten"
     },
     "caffeine": {
@@ -8645,7 +8872,8 @@
       "rowMeta": "{days} von {window} Tagen · Richtwert {value} {unit} (EFSA)",
       "rowMetaNoRef": "{days} von {window} Tagen",
       "footer": "{tracked} von {total} erfassten Mikronährstoffen haben Daten in diesem Zeitraum.",
-      "emptyTitle": "Noch keine Mikronährstoffdaten synchronisiert"
+      "emptyTitle": "Noch keine Mikronährstoffdaten synchronisiert",
+      "loadError": "Deine Nährstoffdaten konnten nicht geladen werden"
     },
     "sparseNote": "Ein niedriger Wert bedeutet hier meist lückenhafte Erfassung, keinen Mangel — die Tagessummen aus Apple Health spiegeln wider, was deine Apps erfasst haben, nicht die gesamte Nahrungsaufnahme."
   },
@@ -8661,8 +8889,11 @@
     "item": {
       "doseWindow": {
         "title": "Medikament fällig",
-        "body": "Heute ist eine Dosis fällig.",
-        "bodyNamed": "{name} ist heute fällig."
+        "body": "Eine Dosis ist bald fällig.",
+        "bodyNamed": "{name} ist bald fällig.",
+        "overdueTitle": "Medikament überfällig",
+        "overdueBody": "Eine Dosis ist überfällig.",
+        "overdueBodyNamed": "{name} ist überfällig."
       },
       "preventiveCare": {
         "title": "Vorsorge fällig",
@@ -8716,7 +8947,8 @@
       "deltaVsBaseline": "{delta} ggü. deinem Ausgangswert",
       "deltaFlat": "Im Bereich deines Ausgangswerts",
       "sleepPending": "Der Schlaf von letzter Nacht fehlt noch – der heutige Wert ist vorläufig.",
-      "readFullBriefing": "Vollständiges Briefing lesen",
+      "justIn": "Gerade eingetroffen",
+      "justInAt": "Gerade eingetroffen · {time}",
       "worthALook": "Einen Blick wert",
       "allClear": "Heute braucht nichts deine Aufmerksamkeit.",
       "ringLink": "{metric}-Details öffnen"

messages/en.json

@@ -42,7 +42,60 @@
     "hidePassword": "Hide password",
     "learnMore": "Learn more",
     "dismiss": "Dismiss",
-    "moreInfo": "More information"
+    "moreInfo": "More information",
+    "durationHoursMinutes": "{hours}h {minutes}m",
+    "durationMinutes": "{minutes}m"
+  },
+  "apiErrors": {
+    "measurement": {
+      "create": { "invalid": "Check the measurement details and try again." },
+      "duplicate_timestamp": "A measurement already exists for this time."
+    },
+    "mood": {
+      "list": { "invalid": "The mood list filters are invalid." },
+      "create": { "invalid": "Check the mood entry and try again." },
+      "update": { "invalid": "Check the mood entry and try again." },
+      "duplicate_timestamp": "A mood entry already exists for this time.",
+      "not_found": "This mood entry is no longer available.",
+      "ratedFactor": {
+        "out_of_range": "A factor rating is outside its allowed range."
+      }
+    },
+    "labs": {
+      "create": { "invalid": "Check the lab result and try again." },
+      "result": { "notFound": "This lab result is no longer available." },
+      "biomarker": {
+        "notFound": "This biomarker is no longer available.",
+        "duplicate": "A biomarker with this name already exists.",
+        "create": { "invalid": "Check the biomarker details and try again." },
+        "update": {
+          "invalid": "Check the biomarker details and try again.",
+          "referenceRangeInvalid": "The lower reference value must not exceed the upper value."
+        }
+      },
+      "update": {
+        "invalid": "Check the lab result and try again.",
+        "linkedFieldsImmutable": "Edit the biomarker to change its name, unit, panel, or reference range.",
+        "qualitativeExpected": "Enter a text result for this qualitative reading.",
+        "numericExpected": "Enter a number for this numeric reading.",
+        "referenceRangeInvalid": "The lower reference value must not exceed the upper value."
+      }
+    },
+    "onboarding": {
+      "disclaimer": {
+        "invalid": "Please confirm the medical disclaimer again."
+      },
+      "tour": { "invalid": "The tour progress could not be saved." },
+      "complete": { "invalid": "Check the profile details and try again." },
+      "user": { "notFound": "Your account could not be found." },
+      "step": {
+        "rateLimited": "Too many attempts. Please wait and try again.",
+        "invalid": "This onboarding step could not be saved.",
+        "completed": "Onboarding is already complete.",
+        "outOfOrder": "Your onboarding progress changed. Refresh and continue.",
+        "concurrent": "Your onboarding progress changed. Refresh and continue."
+      }
+    }
   },
   "doctorReport": {
     "title": "Health Report",
@@ -253,7 +306,9 @@
       "medication": "Medication",
       "medicationDescription": "Mark a dose as taken",
       "mood": "Mood",
-      "moodDescription": "Log your mood and tags"
+      "moodDescription": "Log your mood and tags",
+      "water": "Water",
+      "waterDescription": "Quickly add your water intake"
     },
     "cycle": "Cycle",
     "labs": "Labs",
@@ -356,6 +411,7 @@
     "quickAddMeasurement": "Log measurement",
     "quickAddMood": "Log mood",
     "quickAddMedicationIntake": "Log medication intake",
+    "quickAddWater": "Log water",
     "customizeDashboard": "Customize dashboard",
     "medicationIntakeQuickAdd": {
       "sheetTitle": "Log medication intake",
@@ -400,8 +456,10 @@
     "staleHint": "Last reading {count} d ago",
     "staleHintWeeksOne": "Last reading 1 week ago",
     "staleHintWeeksOther": "Last reading {count} weeks ago",
+    "staleHintWeeksFew": "Last reading {count} weeks ago",
     "staleHintMonthsOne": "Last reading 1 month ago",
     "staleHintMonthsOther": "Last reading {count} months ago",
+    "staleHintMonthsFew": "Last reading {count} months ago",
     "recentWorkouts": {
       "title": "Recent workouts",
       "viewAll": "View all",
@@ -421,7 +479,9 @@
         "steps": "Steps",
         "totalBodyWater": "Total Body Water",
         "boneMass": "Bone Mass",
-        "oxygenSaturation": "Oxygen Saturation"
+        "oxygenSaturation": "Oxygen Saturation",
+        "mood": "Mood",
+        "bmi": "BMI"
       },
       "unit": {
         "weight": "kg",
@@ -433,7 +493,9 @@
         "steps": "steps",
         "totalBodyWater": "kg",
         "boneMass": "kg",
-        "oxygenSaturation": "%"
+        "oxygenSaturation": "%",
+        "mood": "/5",
+        "bmi": "kg/m²"
       }
     }
   },
@@ -574,7 +636,7 @@
     "bulkDeleteSuccess": "{count} measurements deleted",
     "bulkDeleteError": "Error deleting the selected measurements",
     "bulkDeleteConfirmTitle": "Delete {count} measurements?",
-    "bulkDeleteConfirmBody": "The {count} selected measurements will be permanently deleted.",
+    "bulkDeleteConfirmBody": "The {count} selected measurements will be deleted. You can undo this for a short moment afterwards.",
     "typePhq9Score": "PHQ-9 score",
     "typeGad7Score": "GAD-7 score",
     "typeGripStrength": "Grip strength",
@@ -592,6 +654,7 @@
     "statusPresent": "Tracked",
     "statusAbsent": "Not tracked yet",
     "statusModuleOff": "Off",
+    "loadError": "Could not load your tracking status.",
     "connectCta": "Connect a source",
     "viewCta": "View",
     "ecg": {
@@ -599,7 +662,7 @@
     },
     "watchdog": {
       "title": "Automatic screening",
-      "description": "HealthLog also watches quietly in the background — irregular-rhythm and breathing-disturbance notifications from a connected watch, baseline-drift health-status alerts, and notable shifts between your two most recent lab panels — and surfaces a card only when something stands out. No card showing is a good sign, not a missing feature."
+      "description": "HealthLog also watches quietly in the background — irregular-rhythm and breathing-disturbance notifications from a connected watch, baseline-drift health-status alerts, and notable shifts between your two most recent lab panels — and surfaces a card only when something stands out. With at least one of those sources connected, no card showing is a good sign, not a missing feature; with none connected yet, there's simply nothing being watched."
     }
   },
   "mood": {
@@ -721,7 +784,7 @@
     "bulkDeleteSuccess": "{count} entries deleted",
     "bulkDeleteError": "Error deleting the selected entries",
     "bulkDeleteConfirmTitle": "Delete {count} entries?",
-    "bulkDeleteConfirmBody": "The {count} selected mood entries will be permanently deleted.",
+    "bulkDeleteConfirmBody": "The {count} selected mood entries will be deleted. You can undo this for a short moment afterwards.",
     "customize": "Customize mood tags",
     "addTagInline": "Add tag",
     "manage": {
@@ -1678,7 +1741,10 @@
         "packagingDefaultPackLabel": "Default pack size (units)",
         "packagingDefaultPackHelper": "Prefills the quantity when registering new packs (1–1000). Leave empty if none applies.",
         "packagingSuccess": "Packaging details saved",
-        "packagingFailed": "Saving failed"
+        "packagingFailed": "Saving failed",
+        "addManufacturerLabel": "Manufacturer",
+        "addDoseStrengthLabel": "Strength",
+        "addDoseStrengthHint": "As printed on the container, e.g. 5 mg/0.5 ml."
       },
       "erweitert": {
         "group": {
@@ -1978,6 +2044,61 @@
     "notAvailableForCompliance": "Comparison N/A for adherence"
   },
   "insights": {
+    "correlation": {
+      "direction": {
+        "higher": "higher",
+        "lower": "lower"
+      },
+      "weekdayDirection": {
+        "above": "above",
+        "below": "below"
+      },
+      "channelFactor": "rated {factor}",
+      "channel": {
+        "WEIGHT": "weight",
+        "BLOOD_GLUCOSE": "blood glucose",
+        "BLOOD_PRESSURE_SYS": "systolic blood pressure",
+        "BLOOD_PRESSURE_DIA": "diastolic blood pressure",
+        "ACTIVITY_STEPS": "daily steps",
+        "SLEEP_DURATION": "sleep duration",
+        "HEART_RATE_VARIABILITY": "heart-rate variability",
+        "RESTING_HEART_RATE": "resting heart rate",
+        "TIME_IN_DAYLIGHT": "time in daylight",
+        "MOOD": "mood",
+        "PULSE": "resting pulse",
+        "MEDICATION_COMPLIANCE": "medication compliance",
+        "SYMPTOM_SEVERITY": "symptom severity",
+        "ENV_TEMP_MEAN": "daily temperature",
+        "ENV_TEMP_MIN": "overnight low temperature",
+        "ENV_SUNSHINE": "sunshine",
+        "ENV_DAYLIGHT": "daylight",
+        "ENV_PRECIP": "precipitation",
+        "ENV_PRESSURE_MEAN": "barometric pressure",
+        "ENV_PRESSURE_DELTA": "intraday pressure swing"
+      },
+      "daily": {
+        "high": "Higher {behaviour} tends to go with {direction} next-day {outcome} in your data — a pattern worth watching, not a cause.",
+        "moderate": "Higher {behaviour} looks like it goes with {direction} next-day {outcome} in your data, on the evidence so far — a pattern worth watching, not a cause.",
+        "faint": "Higher {behaviour} shows a faint hint, if anything, of {direction} next-day {outcome} in your data — too small to lean on, never a cause."
+      },
+      "lab": {
+        "default": "Higher {lab} readings line up with {direction} {outcome} over the same periods in your data — an association worth watching with your clinician, never a cause.",
+        "faint": "Higher {lab} readings show a faint hint, if anything, of {direction} {outcome} over the same periods in your data — too small to lean on, an association to raise with your clinician, never a cause."
+      },
+      "hypothesis": {
+        "bpCompliance": {
+          "support": "Higher medication compliance lines up with lower systolic readings — a pattern worth watching.",
+          "surprising": "Compliance and systolic move together in your data — surprising; talk to your doctor before adjusting anything.",
+          "none": "Compliance and systolic do not move together strongly in this window."
+        },
+        "moodPulse": {
+          "support": "Lower-mood days line up with higher resting pulse — a pattern worth watching.",
+          "surprising": "Higher-mood days line up with higher resting pulse in your data — surprising.",
+          "none": "Mood and resting pulse do not move together strongly in this window."
+        },
+        "weightWeekday": "{weekday} weights run {delta} kg {direction} your other-day average — a pattern worth watching."
+      }
+    },
     "noAnalysisYet": "No assessment yet.",
     "assessmentPreparing": "Preparing your assessment…",
     "emptyTitle": "Not enough data yet",
@@ -2264,6 +2385,13 @@
       "historyEmpty": "Your conversations will appear here. Ask anything to start.",
       "historyDeleteAria": "Delete conversation",
       "historyDeleted": "Conversation deleted",
+      "rename": {
+        "action": "Rename conversation",
+        "input": "Conversation title",
+        "save": "Save title",
+        "cancel": "Cancel rename",
+        "error": "Conversation title could not be saved."
+      },
       "historySearchEmpty": "No conversations match your search.",
       "historyLoadingMore": "Loading more…",
       "sourcesTitle": "What I can see",
@@ -2402,10 +2530,6 @@
       "settingsClustersHint": "Pick which clusters of your data the Coach can read. More data means richer answers and a larger prompt.",
       "settingsClusterNoData": "No data yet",
       "sourcesMemberCount": "{count} metrics",
-      "dictate": "Dictate",
-      "dictateStop": "Stop dictation",
-      "voiceUnsupported": "Voice input is not supported in this browser",
-      "dictateError": "Could not start voice input. Check microphone permission and try again.",
       "showConversations": "Show conversations",
       "hideConversations": "Hide conversations",
       "heroGreeting": "Ask me anything about your data",
@@ -2502,10 +2626,13 @@
     "relativeJustNow": "just now",
     "relativeMinutesAgoOne": "{count} minute ago",
     "relativeMinutesAgoOther": "{count} minutes ago",
+    "relativeMinutesAgoFew": "{count} minutes ago",
     "relativeHoursAgoOne": "{count} hour ago",
     "relativeHoursAgoOther": "{count} hours ago",
+    "relativeHoursAgoFew": "{count} hours ago",
     "relativeDaysAgoOne": "{count} day ago",
     "relativeDaysAgoOther": "{count} days ago",
+    "relativeDaysAgoFew": "{count} days ago",
     "navOverview": "Overview",
     "navCatalog": "All metrics",
     "navBloodPressure": "Blood Pressure",
@@ -2759,7 +2886,8 @@
       },
       "valuesBack": "Back to insights",
       "valuesBackToMetric": "Back to {metric}",
-      "scoresBack": "Back to insights"
+      "scoresBack": "Back to insights",
+      "ecgDescription": "Single-lead ECG recordings from your device, each with the device's own result. HealthLog shows the trace and the recording — it does not interpret the waveform."
     },
     "sleep": {
       "title": "Sleep",
@@ -2798,9 +2926,9 @@
       "debt": {
         "title": "Sleep debt",
         "value": "{hours}h {minutes}m short",
-        "caption": "Cumulative shortfall over the last {nights} nights",
+        "caption": "Outstanding balance over the last {nights} nights",
         "clearValue": "All caught up",
-        "clearCaption": "No accumulated shortfall over the last {nights} nights",
+        "clearCaption": "Nothing outstanding over the last {nights} nights",
         "learning": "Still learning your sleep — {counted} nights so far, {remaining} more to read a reliable balance.",
         "computedInfo": "This is HealthLog's own estimate: a rolling balance of need minus sleep over recent nights, with catch-up sleep paying it down. It can differ from a wearable's native sleep-debt figure, which uses its own need model."
       },
@@ -2904,6 +3032,8 @@
     "navRecovery": "Recovery",
     "workouts": {
       "title": "Workouts",
+      "askWhy": "Ask why",
+      "askWhyPrompt": "Why did this session read the way it did? Walk me through my own numbers from it.",
       "description": "Recent runs, rides, walks and strength sessions, deduped across Apple Watch and Withings sources.",
       "emptyState": {
         "title": "No workouts yet",
@@ -2932,7 +3062,24 @@
         "hrChartTitle": "Heart rate",
         "hrChartUnavailable": "Per-second heart-rate samples are not stored for this workout.",
         "notFound": "Workout not found.",
-        "loading": "Loading workout…"
+        "loading": "Loading workout…",
+        "hrFromPulse": "From your heart-rate data around this session",
+        "hrAxisMinutes": "min",
+        "sportAverageLabel": "Your recent average:",
+        "zonesTitle": "Effort zones",
+        "zonesCaption": "How your effort was distributed across heart-rate zones.",
+        "zonesCaptionDevice": "Time in zone as reported by your device.",
+        "exportGpx": "Export GPX",
+        "elevationTitle": "Elevation",
+        "splitsTitle": "Splits",
+        "splitsKm": "km",
+        "splitsTime": "Time",
+        "splitsPace": "Pace",
+        "thatDayTitle": "That day",
+        "dayPulse": "Pulse",
+        "daySleep": "Sleep",
+        "dayMood": "Mood",
+        "insightTitle": "Activity insight"
       },
       "sport": {
         "walking": "Walking",
@@ -2955,7 +3102,11 @@
         "crossTraining": "Cross training",
         "mixedCardio": "Mixed cardio",
         "other": "Other"
-      }
+      },
+      "loadError": "Your workouts could not be loaded",
+      "loadMore": "Load more workouts",
+      "loadingMore": "Loading more workouts",
+      "loadMoreError": "More workouts could not be loaded"
     },
     "bloodGlucose": {
       "title": "Blood Glucose",
@@ -3898,7 +4049,10 @@
         "recordingsMany": "{count} recordings on file.",
         "latestResult": "Latest device result: {result}.",
         "cta": "View recordings"
-      }
+      },
+      "emptyTitle": "No ECG recordings yet",
+      "emptyDescription": "ECG recordings sync from a compatible single-lead device. Once your device uploads a recording, it appears here.",
+      "emptyCta": "Connect a device"
     },
     "intradayPulse": {
       "title": "Your day's shape",
@@ -3917,7 +4071,8 @@
         "evening": "A sustained elevated-at-rest stretch this evening — possibly some tension.",
         "night": "A sustained elevated-at-rest stretch overnight — possibly some tension."
       }
-    }
+    },
+    "navEcg": "ECG"
   },
   "thresholds": {
     "defaultLabel": "Default",
@@ -4397,7 +4552,7 @@
           "fullBackup": {
             "title": "Full backup",
             "description": "Every record you own in one JSON file — measurements, medications, mood, cycle, labs, illness episodes, allergies, family history, and workouts. Same shape as the weekly auto-backup.",
-            "scopeNote": "Original document files and workout GPS/sample data are not included — download those separately from the vault or the workout export.",
+            "scopeNote": "Document metadata and the AI-generated summary, if one exists, are included as plain text; original document files and workout GPS/sample data are not — download those separately from the vault or the workout export.",
             "encryptToggle": "Encrypt with a passphrase",
             "passphrasePlaceholder": "Passphrase (min. 12 characters)",
             "passphraseHelp": "Derives the archive key with Argon2id and seals it with AES-256-GCM. Save the file with a .hlx extension.",
@@ -4428,6 +4583,7 @@
             "failed": "The import failed.",
             "rowsImported": "{count} rows imported so far",
             "doneSummary": "Done — {imported} of {read} records imported, {skipped} clinical records skipped.",
+            "estimateWarning": "Cumulative totals for {count} day(s) were estimated from the largest export source. Native Apple Health statistics remain authoritative.",
             "phase": {
               "queued": "Queued…",
               "unpacking": "Unpacking the archive…",
@@ -4586,7 +4742,9 @@
           "description": "Add a place and a date range — a trip, or a stretch of earlier history. The period overrides your home for the days it covers, so weather matches where you actually were. This is how you correct the past.",
           "none": "No location periods yet.",
           "add": "Add {label}",
-          "remove": "Remove location period"
+          "remove": "Remove location period",
+          "removeConfirmTitle": "Remove this trip?",
+          "removeConfirmBody": "Readings taken during it stay in your record; only the trip entry goes."
         },
         "backfill": {
           "title": "Backfill past days",
@@ -4867,7 +5025,10 @@
           "surfaced": "Surfaced",
           "done": "Done",
           "dismissed": "Dismissed"
-        }
+        },
+        "deleteConfirmTitle": "Delete this reminder?",
+        "deleteConfirmBody": "It stops being raised. Anything you have already recorded is untouched.",
+        "deleteConfirmAction": "Delete"
       },
       "aboutMe": {
         "title": "About me",
@@ -4913,6 +5074,16 @@
         "honesty": "The shared access is a single signed-in AI account the operator connected for everyone on this server — not your own key. Requests you make on it are trained on by the provider by default and no data-processing agreement covers them, the account's hourly and weekly limits are shared with every other user who opted in, and your own configured providers are still tried first. Turn it on only if you accept this trade.",
         "confirm": "I understand — use the shared connection",
         "cancel": "Cancel"
+      },
+      "consent": {
+        "title": "AI consent",
+        "activeSince": "Given on {date}. Your health data may be sent to the configured provider for the AI features.",
+        "withdrawn": "Withdrawn. No health data is sent to an AI provider; the AI features stay switched off.",
+        "withdraw": "Withdraw consent",
+        "confirmBody": "The AI features stop working straight away. Nothing already recorded is deleted — use Data & privacy to export or erase your record.",
+        "confirmWithdraw": "Withdraw",
+        "regrantHint": "To use the AI features again, switch on automatic document reading or grant consent from the app.",
+        "error": "The withdrawal could not be saved. Please try again."
       }
     },
     "dashboard": {
@@ -5099,7 +5270,8 @@
       "resumeError": "Reconnect failed"
     },
     "apiTokens": "API Tokens",
-    "apiTokensDescription": "Create API tokens for external medication intake (e.g., Shortcuts, automations).",
+    "apiTokensDescription": "Review and revoke API tokens for external medication intake. Tokens are issued per medication from the medication's API endpoint toggle.",
+    "tokenMintMovedDescription": "Tokens are issued per medication. Open a medication and enable its API endpoint to get a token scoped to that medication alone.",
     "tokenNamePlaceholder": "Token name (e.g., iPhone Shortcut)",
     "tokenCreated": "Token created — copy it now! It won't be shown again.",
     "tokenCopy": "Copy token",
@@ -5531,8 +5703,16 @@
         "revokeAllDone": "Forgot {count} trusted device(s).",
         "unnamed": "Unknown device",
         "current": "This device",
-        "expires": "Trusted until {date}"
-      }
+        "expires": "Trusted until {date}",
+        "revokeConfirmTitle": "Stop trusting this device?",
+        "revokeConfirmBody": "It will ask for your second factor again the next time you sign in from it.",
+        "revokeAllConfirmTitle": "Stop trusting every device?",
+        "revokeAllConfirmBody": "Every device will ask for your second factor again the next time you sign in from it, including this one."
+      },
+      "revokeSessionConfirmTitle": "Sign this device out?",
+      "revokeSessionConfirmBody": "{device} will need to sign in again. Nothing recorded on it is affected.",
+      "signOutEverywhereConfirmTitle": "Sign out every other device?",
+      "signOutEverywhereConfirmBody": "Every device except this one will need to sign in again. This device stays signed in. Nothing you have recorded is affected."
     },
     "privacy": {
       "intro": {
@@ -5632,10 +5812,34 @@
       "rate_limited": "Too many connection attempts. Wait a moment and try again.",
       "generic": "Unknown error while connecting. Please start the connection again."
     },
+    "appleHealth": {
+      "title": "Apple Health",
+      "description": "Live sync comes from the HealthLog iOS app. It is not a web or OAuth connection.",
+      "status": {
+        "checking": "Checking Apple Health data…",
+        "dataReceived": "Apple Health data received",
+        "setup": "Set up in iOS app",
+        "unavailable": "Apple Health status unavailable"
+      },
+      "lastDataLabel": "Last Apple Health data:",
+      "setupTitle": "Turn on live sync",
+      "permissionStep": "In the HealthLog iOS app, open Settings → Apple Health and allow the health categories you want to share.",
+      "backgroundStep": "Keep Background App Refresh enabled. The app syncs new data automatically in the foreground and when iOS grants background time.",
+      "importNote": "Need older history or cannot use the iOS app? The Apple Health XML/ZIP upload is a one-shot fallback and does not enable live sync.",
+      "importAction": "Open one-shot import"
+    },
     "garminInfo": {
       "title": "Garmin",
       "body": "Garmin has no direct connection here. Connect via Apple Health (iOS) or Google Health Connect (Android). Garmin's proprietary scores — Body Battery, Training Load, HRV Status, VO₂ max — are not shared by Garmin to either platform.",
       "docsLink": "Read the guide"
+    },
+    "glucoseReference": {
+      "title": "Glucose reference band",
+      "description": "Which band your blood-glucose readings are judged against.",
+      "enable": "Use the diabetes goal band",
+      "explainer": "Off, readings are judged against the general non-diabetic reference band. On, they are judged against the tighter glycaemic goal band from the ADA Standards of Care, and the Coach grounds its glucose remarks on that band instead. Your own target overrides below still take precedence.",
+      "disclaimer": "This selects a reference band. It is not a diagnosis, it is never inferred from a reading, and the app takes no clinical action on it. Which targets apply to you is a question for your clinician.",
+      "error": "Could not save the setting."
     }
   },
   "admin": {
@@ -6116,7 +6320,7 @@
         "restore": "Restore",
         "restoreAria": "Restore from backup for {username}",
         "restoreTitle": "Restore from backup",
-        "restoreDescription": "This will replace ALL current data for {username} with the snapshot from {when}. Existing measurements, medications, intake events, mood entries, notification channels, push subscriptions and queued Telegram deletions will be deleted.",
+        "restoreDescription": "This will replace ALL current data for {username} with the snapshot from {when}. Existing measurements, medications, intake events, mood entries, notification channels, push subscriptions and queued Telegram deletions will be deleted. If included in the snapshot, instance-wide settings overwrite the configuration for the entire installation.",
         "restorePromptLabel": "Type RESTORE to continue",
         "restoreConfirm": "Restore now",
         "restoreInProgress": "Restoring…",
@@ -7374,7 +7578,7 @@
     "referenceLabel": "Reference",
     "readingsCount": "{count} readings",
     "deleteConfirmTitle": "Delete lab result?",
-    "deleteConfirmDescription": "This lab result will be permanently deleted.",
+    "deleteConfirmDescription": "This lab result will be deleted. You can undo this for a short moment afterwards.",
     "deletedToast": "Result deleted",
     "deleteError": "Could not delete the result",
     "loadError": "Could not load lab results",
@@ -7853,7 +8057,7 @@
     },
     "deleteConfirm": {
       "title": "Delete this episode?",
-      "body": "“{label}” and all its day-logs will be removed. This cannot be undone."
+      "body": "“{label}” and all its day-logs will be removed. You can undo this for a short moment afterwards."
     },
     "vital": {
       "RESTING_HEART_RATE": "Resting heart rate",
@@ -7936,6 +8140,11 @@
         "review_due": "Check-in due",
         "reviewed": "Reviewed"
       }
+    },
+    "refusal": {
+      "outOfScope": "I can only help with the health metrics in your log — measurements, medications, mood, trends. I cannot answer questions outside that scope.",
+      "promptInjection": "I noticed wording that tries to override my instructions. I am the HealthLog Coach and only summarise your own health data — please rephrase your question in those terms.",
+      "conversationPoisoned": "An earlier message in this conversation contains wording that overrides my instructions. Please start a new conversation."
     }
   },
   "safety": {
@@ -8188,7 +8397,9 @@
         "finally": "Finally …"
       }
     },
-    "openDetail": "Show details"
+    "openDetail": "Show details",
+    "historyLoadError": "Your assessment history could not be loaded",
+    "historyLoadErrorHint": "This does not mean you have no results — the list could not be fetched. Try again."
   },
   "records": {
     "disclaimer": "These are your own records, not a medical diagnosis. HealthLog does not diagnose, treat, or interpret them.",
@@ -8397,7 +8608,13 @@
       "title": "Document details",
       "summary": {
         "title": "Summary",
-        "pending": "The summary is being prepared."
+        "pending": "The summary is being prepared.",
+        "none": "No summary has been generated for this document yet.",
+        "withheld": "A summary was generated but did not pass the safety check, so it is not shown. You can try again, or read the document itself.",
+        "unavailable": "No summary could be generated for this document.",
+        "generate": "Generate summary",
+        "regenerate": "Generate again",
+        "generating": "Generating…"
       },
       "loadError": "Couldn't load this document.",
       "saveError": "Couldn't save the change.",
@@ -8479,7 +8696,6 @@
       "close": "Hide"
     },
     "ai": {
-      "statusAiRead": "Read by AI",
       "readDone": "The AI read your document.",
       "read": "Read with AI",
       "reread": "Read again",
@@ -8635,6 +8851,7 @@
       "quickAddCustomPlaceholder": "250",
       "quickAddSubmit": "Add",
       "quickAddError": "Couldn't save that — try again.",
+      "quickAddSuccess": "{amount} mL water added.",
       "editTotal": "Edit today's total"
     },
     "caffeine": {
@@ -8645,7 +8862,8 @@
       "rowMeta": "{days} of {window} days · ref {value} {unit} (EFSA)",
       "rowMetaNoRef": "{days} of {window} days",
       "footer": "{tracked} of {total} tracked micronutrients have data in this window.",
-      "emptyTitle": "No micronutrient data synced yet"
+      "emptyTitle": "No micronutrient data synced yet",
+      "loadError": "Your nutrient data could not be loaded"
     },
     "sparseNote": "A low number here usually means sparse logging, not a deficiency — Apple Health day totals reflect what your apps logged, not total dietary intake."
   },
@@ -8661,8 +8879,11 @@
     "item": {
       "doseWindow": {
         "title": "Medication due",
-        "body": "A dose is due today.",
-        "bodyNamed": "{name} is due today."
+        "body": "A dose is due soon.",
+        "bodyNamed": "{name} is due soon.",
+        "overdueTitle": "Medication overdue",
+        "overdueBody": "A dose is past due.",
+        "overdueBodyNamed": "{name} is past due."
       },
       "preventiveCare": {
         "title": "Check-up due",
@@ -8716,7 +8937,8 @@
       "deltaVsBaseline": "{delta} vs your baseline",
       "deltaFlat": "In line with your baseline",
       "sleepPending": "Last night's sleep isn't in yet — today's read is provisional.",
-      "readFullBriefing": "Read the full briefing",
+      "justIn": "Just in",
+      "justInAt": "Just in · {time}",
       "worthALook": "Worth a look",
       "allClear": "Nothing needs your attention today.",
       "ringLink": "Open {metric} details"

messages/es.json

@@ -42,7 +42,72 @@
     "hidePassword": "Ocultar contraseña",
     "learnMore": "Más información",
     "dismiss": "Descartar",
-    "moreInfo": "Más información"
+    "moreInfo": "Más información",
+    "durationHoursMinutes": "{hours} h {minutes} min",
+    "durationMinutes": "{minutes} min"
+  },
+  "apiErrors": {
+    "measurement": {
+      "create": {
+        "invalid": "Comprueba los datos de la medición e inténtalo de nuevo."
+      },
+      "duplicate_timestamp": "Ya existe una medición para esta hora."
+    },
+    "mood": {
+      "list": { "invalid": "Los filtros de la lista de ánimo no son válidos." },
+      "create": {
+        "invalid": "Comprueba la entrada de ánimo e inténtalo de nuevo."
+      },
+      "update": {
+        "invalid": "Comprueba la entrada de ánimo e inténtalo de nuevo."
+      },
+      "duplicate_timestamp": "Ya existe una entrada de ánimo para esta hora.",
+      "not_found": "Esta entrada de ánimo ya no está disponible.",
+      "ratedFactor": {
+        "out_of_range": "Una valoración está fuera del intervalo permitido."
+      }
+    },
+    "labs": {
+      "create": {
+        "invalid": "Comprueba el resultado de laboratorio e inténtalo de nuevo."
+      },
+      "result": {
+        "notFound": "Este resultado de laboratorio ya no está disponible."
+      },
+      "biomarker": {
+        "notFound": "Este biomarcador ya no está disponible.",
+        "duplicate": "Ya existe un biomarcador con este nombre.",
+        "create": {
+          "invalid": "Comprueba los datos del biomarcador e inténtalo de nuevo."
+        },
+        "update": {
+          "invalid": "Comprueba los datos del biomarcador e inténtalo de nuevo.",
+          "referenceRangeInvalid": "El valor de referencia inferior no puede superar al superior."
+        }
+      },
+      "update": {
+        "invalid": "Comprueba el resultado de laboratorio e inténtalo de nuevo.",
+        "linkedFieldsImmutable": "Edita el biomarcador para cambiar su nombre, unidad, panel o intervalo de referencia.",
+        "qualitativeExpected": "Introduce un resultado de texto para esta lectura cualitativa.",
+        "numericExpected": "Introduce un número para esta lectura numérica.",
+        "referenceRangeInvalid": "El valor de referencia inferior no puede superar al superior."
+      }
+    },
+    "onboarding": {
+      "disclaimer": { "invalid": "Confirma de nuevo el aviso médico." },
+      "tour": { "invalid": "No se pudo guardar el progreso del recorrido." },
+      "complete": {
+        "invalid": "Comprueba los datos del perfil e inténtalo de nuevo."
+      },
+      "user": { "notFound": "No se pudo encontrar tu cuenta." },
+      "step": {
+        "rateLimited": "Demasiados intentos. Espera e inténtalo de nuevo.",
+        "invalid": "No se pudo guardar este paso de la introducción.",
+        "completed": "La introducción ya está completada.",
+        "outOfOrder": "Tu progreso ha cambiado. Actualiza la página y continúa.",
+        "concurrent": "Tu progreso ha cambiado. Actualiza la página y continúa."
+      }
+    }
   },
   "doctorReport": {
     "title": "Informe de salud",
@@ -253,7 +318,9 @@
       "medication": "Medicamento",
       "medicationDescription": "Marcar una dosis como tomada",
       "mood": "Estado de ánimo",
-      "moodDescription": "Registrar estado de ánimo y etiquetas"
+      "moodDescription": "Registra tu estado de ánimo y etiquetas",
+      "water": "Agua",
+      "waterDescription": "Añade rápidamente tu consumo de agua"
     },
     "cycle": "Ciclo",
     "labs": "Análisis",
@@ -356,6 +423,7 @@
     "quickAddMeasurement": "Registrar medición",
     "quickAddMood": "Registrar estado de ánimo",
     "quickAddMedicationIntake": "Registrar toma",
+    "quickAddWater": "Registrar agua",
     "customizeDashboard": "Personalizar panel",
     "medicationIntakeQuickAdd": {
       "sheetTitle": "Registrar toma de medicación",
@@ -400,8 +468,10 @@
     "staleHint": "Último valor hace {count} d",
     "staleHintWeeksOne": "Último valor hace 1 semana",
     "staleHintWeeksOther": "Último valor hace {count} semanas",
+    "staleHintWeeksFew": "Último valor hace {count} semanas",
     "staleHintMonthsOne": "Último valor hace 1 mes",
     "staleHintMonthsOther": "Último valor hace {count} meses",
+    "staleHintMonthsFew": "Último valor hace {count} meses",
     "recentWorkouts": {
       "title": "Entrenamientos recientes",
       "viewAll": "Ver todos",
@@ -421,7 +491,9 @@
         "steps": "Pasos",
         "totalBodyWater": "Agua corporal total",
         "boneMass": "Masa ósea",
-        "oxygenSaturation": "Saturación de oxígeno"
+        "oxygenSaturation": "Saturación de oxígeno",
+        "mood": "Estado de ánimo",
+        "bmi": "IMC"
       },
       "unit": {
         "weight": "kg",
@@ -433,7 +505,9 @@
         "steps": "pasos",
         "totalBodyWater": "kg",
         "boneMass": "kg",
-        "oxygenSaturation": "%"
+        "oxygenSaturation": "%",
+        "mood": "/5",
+        "bmi": "kg/m²"
       }
     }
   },
@@ -574,7 +648,7 @@
     "bulkDeleteSuccess": "{count} mediciones eliminadas",
     "bulkDeleteError": "Error al eliminar las mediciones seleccionadas",
     "bulkDeleteConfirmTitle": "¿Eliminar {count} mediciones?",
-    "bulkDeleteConfirmBody": "Las {count} mediciones seleccionadas se eliminarán de forma permanente.",
+    "bulkDeleteConfirmBody": "Las {count} mediciones seleccionadas se eliminarán. Justo después podrás deshacerlo durante un breve momento.",
     "typePhq9Score": "Puntuación PHQ-9",
     "typeGad7Score": "Puntuación GAD-7",
     "typeGripStrength": "Fuerza de agarre",
@@ -592,6 +666,7 @@
     "statusPresent": "Registrado",
     "statusAbsent": "Aún sin registrar",
     "statusModuleOff": "Desactivado",
+    "loadError": "No se pudo cargar el estado de seguimiento.",
     "connectCta": "Conectar una fuente",
     "viewCta": "Ver",
     "ecg": {
@@ -599,7 +674,7 @@
     },
     "watchdog": {
       "title": "Supervisión automática",
-      "description": "HealthLog también vigila en segundo plano — notificaciones de ritmo irregular y alteraciones respiratorias de un reloj conectado, alertas de desviación de tu valor de referencia, y cambios destacables entre tus dos últimos paneles de laboratorio — y solo muestra una tarjeta cuando algo destaca. Que no aparezca ninguna tarjeta es una buena señal, no una función ausente."
+      "description": "HealthLog también vigila en segundo plano — notificaciones de ritmo irregular y alteraciones respiratorias de un reloj conectado, alertas de desviación de tu valor de referencia, y cambios destacables entre tus dos últimos paneles de laboratorio — y solo muestra una tarjeta cuando algo destaca. Si al menos una de esas fuentes está conectada, que no aparezca ninguna tarjeta es una buena señal, no una función ausente; si todavía no hay ninguna conectada, sencillamente no se está vigilando nada."
     }
   },
   "mood": {
@@ -721,7 +796,7 @@
     "bulkDeleteSuccess": "{count} entradas eliminadas",
     "bulkDeleteError": "Error al eliminar las entradas seleccionadas",
     "bulkDeleteConfirmTitle": "¿Eliminar {count} entradas?",
-    "bulkDeleteConfirmBody": "Las {count} entradas de estado de ánimo seleccionadas se eliminarán de forma permanente.",
+    "bulkDeleteConfirmBody": "Las {count} entradas de estado de ánimo seleccionadas se eliminarán. Justo después podrás deshacerlo durante un breve momento.",
     "customize": "Personalizar etiquetas de ánimo",
     "addTagInline": "Añadir etiqueta",
     "manage": {
@@ -1678,7 +1753,10 @@
         "packagingDefaultPackLabel": "Tamaño de envase predeterminado (unidades)",
         "packagingDefaultPackHelper": "Rellena la cantidad al registrar envases nuevos (1–1000). Déjalo vacío si no aplica.",
         "packagingSuccess": "Datos del envase guardados",
-        "packagingFailed": "Error al guardar"
+        "packagingFailed": "Error al guardar",
+        "addManufacturerLabel": "Fabricante",
+        "addDoseStrengthLabel": "Concentración",
+        "addDoseStrengthHint": "Tal como aparece impreso en el envase, p. ej. 5 mg/0,5 ml."
       },
       "erweitert": {
         "group": {
@@ -1978,6 +2056,61 @@
     "notAvailableForCompliance": "Comparación no disponible para el cumplimiento"
   },
   "insights": {
+    "correlation": {
+      "direction": {
+        "higher": "subir",
+        "lower": "bajar"
+      },
+      "weekdayDirection": {
+        "above": "por encima de",
+        "below": "por debajo de"
+      },
+      "channelFactor": "la valoración de {factor}",
+      "channel": {
+        "WEIGHT": "el peso",
+        "BLOOD_GLUCOSE": "la glucosa en sangre",
+        "BLOOD_PRESSURE_SYS": "la presión sistólica",
+        "BLOOD_PRESSURE_DIA": "la presión diastólica",
+        "ACTIVITY_STEPS": "los pasos diarios",
+        "SLEEP_DURATION": "la duración del sueño",
+        "HEART_RATE_VARIABILITY": "la variabilidad de la frecuencia cardíaca",
+        "RESTING_HEART_RATE": "la frecuencia cardíaca en reposo",
+        "TIME_IN_DAYLIGHT": "el tiempo con luz natural",
+        "MOOD": "el estado de ánimo",
+        "PULSE": "el pulso en reposo",
+        "MEDICATION_COMPLIANCE": "la adherencia a la medicación",
+        "SYMPTOM_SEVERITY": "la intensidad de los síntomas",
+        "ENV_TEMP_MEAN": "la temperatura diaria",
+        "ENV_TEMP_MIN": "la temperatura mínima nocturna",
+        "ENV_SUNSHINE": "las horas de sol",
+        "ENV_DAYLIGHT": "la luz natural",
+        "ENV_PRECIP": "las precipitaciones",
+        "ENV_PRESSURE_MEAN": "la presión atmosférica",
+        "ENV_PRESSURE_DELTA": "la variación de presión del día"
+      },
+      "daily": {
+        "high": "Cuando {behaviour} es mayor, {outcome} del día siguiente tiende a {direction} en tus datos — un patrón que conviene observar, no una causa.",
+        "moderate": "Cuando {behaviour} es mayor, {outcome} del día siguiente parece tender a {direction}, según los datos disponibles — un patrón que conviene observar, no una causa.",
+        "faint": "Cuando {behaviour} es mayor, apenas se insinúa —si acaso— que {outcome} del día siguiente tienda a {direction} en tus datos — demasiado leve para fiarse, nunca una causa."
+      },
+      "lab": {
+        "default": "Unos valores de {lab} más altos coinciden con que {outcome} tienda a {direction} en los mismos periodos de tus datos — una asociación que conviene vigilar con tu médico, nunca una causa.",
+        "faint": "Unos valores de {lab} más altos apenas insinúan —si acaso— que {outcome} tienda a {direction} en los mismos periodos de tus datos — demasiado leve para fiarse, una asociación que conviene comentar con tu médico, nunca una causa."
+      },
+      "hypothesis": {
+        "bpCompliance": {
+          "support": "Una mayor adherencia a la medicación coincide con valores sistólicos más bajos — un patrón que conviene observar.",
+          "surprising": "La adherencia y la sistólica se mueven juntas en tus datos — sorprendente; consulta con tu médico antes de cambiar nada.",
+          "none": "La adherencia y la sistólica no se mueven juntas de forma marcada en este periodo."
+        },
+        "moodPulse": {
+          "support": "Los días de peor ánimo coinciden con un pulso en reposo más alto — un patrón que conviene observar.",
+          "surprising": "Los días de mejor ánimo coinciden con un pulso en reposo más alto en tus datos — sorprendente.",
+          "none": "El ánimo y el pulso en reposo no se mueven juntos de forma marcada en este periodo."
+        },
+        "weightWeekday": "El peso de los {weekday} está {delta} kg {direction} tu media de los demás días — un patrón que conviene observar."
+      }
+    },
     "noAnalysisYet": "Aún no hay valoración.",
     "assessmentPreparing": "Preparando tu valoración…",
     "emptyTitle": "Aún no hay datos suficientes",
@@ -2264,6 +2397,13 @@
       "historyEmpty": "Tus conversaciones aparecen aquí. Lanza una pregunta para empezar.",
       "historyDeleteAria": "Eliminar conversación",
       "historyDeleted": "Conversación eliminada",
+      "rename": {
+        "action": "Renombrar conversación",
+        "input": "Título de la conversación",
+        "save": "Guardar título",
+        "cancel": "Cancelar cambio de nombre",
+        "error": "No se pudo guardar el título de la conversación."
+      },
       "historySearchEmpty": "Ninguna conversación coincide con tu búsqueda.",
       "historyLoadingMore": "Cargando más…",
       "sourcesTitle": "A qué accedo",
@@ -2402,10 +2542,6 @@
       "settingsClustersHint": "Elige qué grupos de datos puede leer el Coach. Más datos significan respuestas más ricas y un prompt mayor.",
       "settingsClusterNoData": "Aún no hay datos",
       "sourcesMemberCount": "{count} métricas",
-      "dictate": "Dictar",
-      "dictateStop": "Detener el dictado",
-      "voiceUnsupported": "La entrada de voz no es compatible con este navegador",
-      "dictateError": "No se pudo iniciar la entrada de voz. Comprueba el permiso del micrófono e inténtalo de nuevo.",
       "showConversations": "Mostrar conversaciones",
       "hideConversations": "Ocultar conversaciones",
       "heroGreeting": "Pregúntame lo que quieras sobre tus datos",
@@ -2502,10 +2638,13 @@
     "relativeJustNow": "ahora mismo",
     "relativeMinutesAgoOne": "hace {count} minuto",
     "relativeMinutesAgoOther": "hace {count} minutos",
+    "relativeMinutesAgoFew": "hace {count} minutos",
     "relativeHoursAgoOne": "hace {count} hora",
     "relativeHoursAgoOther": "hace {count} horas",
+    "relativeHoursAgoFew": "hace {count} horas",
     "relativeDaysAgoOne": "hace {count} día",
     "relativeDaysAgoOther": "hace {count} días",
+    "relativeDaysAgoFew": "hace {count} días",
     "navOverview": "Resumen",
     "navCatalog": "Todas las métricas",
     "navBloodPressure": "Presión arterial",
@@ -2665,11 +2804,11 @@
         "fatFreeMassTitle": "Masa libre de grasa",
         "fatFreeMassBody": "La masa libre de grasa es todo lo que en tu cuerpo no es grasa: músculo, hueso, órganos y agua. Mantenerla o aumentarla mientras pierdes peso suele indicar una composición corporal más sana.",
         "fatMassTitle": "Masa grasa",
-        "fatMassBody": "La masa grasa es el peso total de la grasa de tu cuerpo. Algo de grasa es esencial para las hormonas y la reserva de energía, pero un exceso —sobre todo en el abdomen— eleva el riesgo para la salud a largo plazo.",
+        "fatMassBody": "La masa grasa es el peso total de la grasa de tu cuerpo. Algo de grasa es esencial para las hormonas y la reserva de energía, pero un exceso —sobre todo en el abdomen— eleva el riesgo para la salud a largo plazo (WHO 2024).",
         "muscleMassTitle": "Masa muscular",
         "muscleMassBody": "La masa muscular es el peso estimado del músculo de tu cuerpo. Más músculo favorece la fuerza, el metabolismo y la movilidad, y suele requerir esfuerzo activo para conservarse con la edad.",
         "visceralFatTitle": "Grasa visceral",
-        "visceralFatBody": "La grasa visceral es la grasa almacenada en lo profundo del abdomen, alrededor de los órganos. A diferencia de la grasa bajo la piel, un nivel alto se asocia estrechamente con enfermedad cardíaca y diabetes tipo 2, por lo que cuanto más baja, mejor.",
+        "visceralFatBody": "La grasa visceral es la grasa almacenada en lo profundo del abdomen, alrededor de los órganos. A diferencia de la grasa bajo la piel, un nivel alto se asocia estrechamente con enfermedad cardíaca y diabetes tipo 2 (AHA, Circulation 2021), por lo que cuanto más baja, mejor. La escala muestra una puntuación sin unidades (aproximadamente 1–12 es el rango saludable, 13 o más se considera elevado); es una escala distinta de los umbrales en cm² por imagen que usan los profesionales clínicos y no es intercambiable con ellos.",
         "leanBodyMassTitle": "Masa magra corporal",
         "leanBodyMassBody": "La masa magra corporal es tu peso total menos la grasa: músculo, hueso, órganos y agua en conjunto. Seguirla junto al peso muestra si los cambios vienen del músculo o de la grasa.",
         "flightsClimbedTitle": "Pisos subidos",
@@ -2699,7 +2838,7 @@
         "audioEventsTitle": "Eventos de sonido fuerte",
         "audioEventsBody": "Los eventos de sonido fuerte señalan momentos en que el ruido a tu alrededor alcanzó un nivel que puede dañar la audición con suficiente exposición. Los eventos frecuentes son una señal para buscar un entorno más silencioso o protección auditiva.",
         "daylightTitle": "Tiempo a la luz del día",
-        "daylightBody": "El tiempo a la luz del día es cuánto pasas bajo luz exterior cada día. La luz diurna regular favorece un ritmo sueño-vigilia y un estado de ánimo saludables, y el tiempo al aire libre se asocia con la salud ocular.",
+        "daylightBody": "El tiempo a la luz del día es cuánto pasas bajo luz exterior cada día. La luz diurna regular favorece un ritmo sueño-vigilia y un estado de ánimo saludables (CDC 2024), y el tiempo al aire libre se asocia con la salud ocular.",
         "bloodGlucoseTitle": "Glucosa en sangre",
         "bloodGlucoseBody": "La glucosa en sangre es la cantidad de azúcar en tu sangre, la principal fuente de energía del cuerpo. Sube tras comer y se estabiliza entre comidas; valores que se mantienen altos con el tiempo pueden indicar diabetes o prediabetes.",
         "skinTemperatureTitle": "Temperatura de la piel",
@@ -2711,7 +2850,7 @@
         "wristTemperatureTitle": "Temperatura de muñeca",
         "wristTemperatureBody": "La temperatura de muñeca se mide mientras duermes y se indica como la diferencia respecto a tu valor de referencia, no como un valor absoluto. Un valor estable es normal, mientras que una subida sostenida puede indicar enfermedad, entrenamiento intenso o un cambio del ciclo.",
         "fallsTitle": "Caídas",
-        "fallsBody": "Esto cuenta las caídas fuertes que detecta tu wearable. El objetivo es cero; un número creciente es una señal de riesgo de movilidad que conviene comentar con un profesional, sobre todo en personas mayores.",
+        "fallsBody": "Esto cuenta las caídas fuertes que detecta tu wearable. El objetivo es cero; un número creciente es una señal de riesgo de movilidad que conviene comentar con un profesional, sobre todo en personas mayores (CDC STEADI 2024).",
         "sixMinuteWalkTitle": "Distancia en marcha de 6 minutos",
         "sixMinuteWalkBody": "Es una estimación de cuánto podrías caminar en seis minutos, una prueba clínica clásica de movilidad y resistencia cardiopulmonar. El valor del wearable es una aproximación, no la prueba clínica supervisada; lo útil es la tendencia estable o en aumento.",
         "stairAscentSpeedTitle": "Velocidad subiendo escaleras",
@@ -2759,7 +2898,8 @@
       },
       "valuesBack": "Volver a Insights",
       "valuesBackToMetric": "Volver a {metric}",
-      "scoresBack": "Volver a Insights"
+      "scoresBack": "Volver a Insights",
+      "ecgDescription": "Registros de ECG de una derivación de tu dispositivo, cada uno con el resultado del propio dispositivo. HealthLog muestra el trazado y el registro, pero no interpreta la onda."
     },
     "sleep": {
       "title": "Sueño",
@@ -2798,9 +2938,9 @@
       "debt": {
         "title": "Deuda de sueño",
         "value": "{hours} h {minutes} min de déficit",
-        "caption": "Déficit acumulado de las últimas {nights} noches",
+        "caption": "Balance pendiente de las últimas {nights} noches",
         "clearValue": "Al día",
-        "clearCaption": "Sin déficit acumulado en las últimas {nights} noches",
+        "clearCaption": "Nada pendiente en las últimas {nights} noches",
         "learning": "Aún estamos midiendo tu sueño — {counted} noches hasta ahora, faltan {remaining} para un balance fiable.",
         "computedInfo": "Esta es la estimación propia de HealthLog: un balance móvil de la necesidad menos el sueño de las últimas noches, que el sueño de recuperación va reduciendo. Puede diferir de la cifra de deuda de sueño nativa de un wearable, que usa su propio modelo de necesidad."
       },
@@ -2904,6 +3044,8 @@
     "navRecovery": "Recuperación",
     "workouts": {
       "title": "Entrenamientos",
+      "askWhy": "Por qué",
+      "askWhyPrompt": "¿Por qué salió así esta sesión? Explícame mis propios datos de ella.",
       "description": "Carreras, salidas en bici, paseos y sesiones de fuerza recientes, deduplicados entre Apple Watch y Withings.",
       "emptyState": {
         "title": "Aún no hay entrenamientos",
@@ -2932,7 +3074,24 @@
         "hrChartTitle": "Frecuencia cardíaca",
         "hrChartUnavailable": "Las muestras de frecuencia cardíaca por segundo no se almacenan para este entrenamiento.",
         "notFound": "Entrenamiento no encontrado.",
-        "loading": "Cargando entrenamiento…"
+        "loading": "Cargando entrenamiento…",
+        "hrFromPulse": "A partir de tus datos de frecuencia cardíaca en torno a esta sesión",
+        "hrAxisMinutes": "min",
+        "sportAverageLabel": "Tu promedio reciente:",
+        "zonesTitle": "Zonas de esfuerzo",
+        "zonesCaption": "Cómo se distribuyó tu esfuerzo entre las zonas de frecuencia cardíaca.",
+        "zonesCaptionDevice": "Tiempo por zona según tu dispositivo.",
+        "exportGpx": "Exportar GPX",
+        "elevationTitle": "Altitud",
+        "splitsTitle": "Parciales",
+        "splitsKm": "km",
+        "splitsTime": "Tiempo",
+        "splitsPace": "Ritmo",
+        "thatDayTitle": "Ese día",
+        "dayPulse": "Pulso",
+        "daySleep": "Sueño",
+        "dayMood": "Ánimo",
+        "insightTitle": "Análisis de la actividad"
       },
       "sport": {
         "walking": "Caminar",
@@ -2955,7 +3114,11 @@
         "crossTraining": "Entreno cruzado",
         "mixedCardio": "Cardio mixto",
         "other": "Otro"
-      }
+      },
+      "loadError": "No se pudieron cargar tus entrenamientos",
+      "loadMore": "Cargar más entrenamientos",
+      "loadingMore": "Cargando más entrenamientos",
+      "loadMoreError": "No se pudieron cargar más entrenamientos"
     },
     "bloodGlucose": {
       "title": "Glucosa en sangre",
@@ -3898,7 +4061,10 @@
         "recordingsMany": "{count} registros guardados.",
         "latestResult": "Último resultado del dispositivo: {result}.",
         "cta": "Ver registros"
-      }
+      },
+      "emptyTitle": "Aún no hay registros de ECG",
+      "emptyDescription": "Los registros de ECG se sincronizan desde un dispositivo de una derivación compatible. En cuanto tu dispositivo suba un registro, aparecerá aquí.",
+      "emptyCta": "Conectar un dispositivo"
     },
     "intradayPulse": {
       "title": "La forma de tu día",
@@ -3917,7 +4083,8 @@
         "evening": "Un tramo elevado en reposo al anochecer; posiblemente algo de tensión.",
         "night": "Un tramo elevado en reposo por la noche; posiblemente algo de tensión."
       }
-    }
+    },
+    "navEcg": "ECG"
   },
   "thresholds": {
     "defaultLabel": "Por defecto",
@@ -4397,7 +4564,7 @@
           "fullBackup": {
             "title": "Copia completa",
             "description": "Todos tus datos en un único archivo JSON: mediciones, medicamentos, estado de ánimo, ciclo, analíticas, episodios de enfermedad, alergias, antecedentes familiares y entrenamientos. Mismo formato que la copia automática semanal.",
-            "scopeNote": "Los archivos originales de los documentos y los datos de rutas GPS/muestras de los entrenamientos no están incluidos — descárgalos por separado desde el archivo de documentos o la exportación de entrenamientos.",
+            "scopeNote": "Los metadatos de los documentos y el resumen de IA, si existe, se incluyen en texto plano; los archivos originales de los documentos y los datos de rutas GPS/muestras de los entrenamientos no están incluidos — descárgalos por separado desde el archivo de documentos o la exportación de entrenamientos.",
             "encryptToggle": "Cifrar con una contraseña",
             "passphrasePlaceholder": "Contraseña (mín. 12 caracteres)",
             "passphraseHelp": "Deriva la clave del archivo con Argon2id y lo sella con AES-256-GCM. Guarda el archivo con la extensión .hlx.",
@@ -4428,6 +4595,7 @@
             "failed": "La importación falló.",
             "rowsImported": "{count} filas importadas hasta ahora",
             "doneSummary": "Listo: {imported} de {read} registros importados, {skipped} registros clínicos omitidos.",
+            "estimateWarning": "Los totales acumulados de {count} día(s) se estimaron a partir de la mayor fuente de la exportación. Las estadísticas nativas de Apple Health siguen siendo la referencia.",
             "phase": {
               "queued": "En cola…",
               "unpacking": "Descomprimiendo el archivo…",
@@ -4586,7 +4754,9 @@
           "description": "Añade un lugar y un rango de fechas: un viaje o un tramo de tu historial anterior. El periodo anula tu hogar en los días que cubre, para que el tiempo coincida con donde estuviste realmente. Así corriges el pasado.",
           "none": "Aún no hay periodos de ubicación.",
           "add": "Añadir {label}",
-          "remove": "Eliminar periodo de ubicación"
+          "remove": "Eliminar periodo de ubicación",
+          "removeConfirmTitle": "¿Quitar este viaje?",
+          "removeConfirmBody": "Las mediciones de ese periodo permanecen; solo desaparece la entrada del viaje."
         },
         "backfill": {
           "title": "Rellenar días pasados",
@@ -4867,7 +5037,10 @@
           "surfaced": "Mostrado",
           "done": "Hecho",
           "dismissed": "Descartado"
-        }
+        },
+        "deleteConfirmTitle": "¿Eliminar este recordatorio?",
+        "deleteConfirmBody": "Deja de aparecer. Lo que ya has registrado no cambia.",
+        "deleteConfirmAction": "Eliminar"
       },
       "aboutMe": {
         "title": "Sobre mí",
@@ -4913,6 +5086,16 @@
         "honesty": "El acceso compartido es una única cuenta de IA con sesión iniciada que el operador conectó para todos en este servidor, no tu propia clave. Las solicitudes que hagas se usan de forma predeterminada para entrenar los modelos del proveedor y ningún acuerdo de tratamiento de datos las cubre, los límites por hora y semanales de la cuenta se comparten con todos los demás que se han unido, y tus propios proveedores se prueban primero. Actívalo solo si aceptas este compromiso.",
         "confirm": "Entendido: usar la conexión compartida",
         "cancel": "Cancelar"
+      },
+      "consent": {
+        "title": "Consentimiento de IA",
+        "activeSince": "Otorgado el {date}. Tus datos de salud pueden enviarse al proveedor configurado para las funciones de IA.",
+        "withdrawn": "Retirado. No se envían datos de salud a ningún proveedor de IA; las funciones de IA permanecen desactivadas.",
+        "withdraw": "Retirar el consentimiento",
+        "confirmBody": "Las funciones de IA dejan de funcionar de inmediato. No se borra nada de lo ya registrado: usa Datos y privacidad para exportar o eliminar tu historial.",
+        "confirmWithdraw": "Retirar",
+        "regrantHint": "Para volver a usar las funciones de IA, activa la lectura automática de documentos u otorga el consentimiento desde la aplicación.",
+        "error": "No se pudo guardar la retirada. Inténtalo de nuevo."
       }
     },
     "dashboard": {
@@ -5099,7 +5282,8 @@
       "resumeError": "Reconexión fallida"
     },
     "apiTokens": "Tokens de API",
-    "apiTokensDescription": "Crea tokens de API para registrar tomas de medicación externas (p. ej., Atajos, automatizaciones).",
+    "apiTokensDescription": "Revisa y revoca tokens de API para el registro externo de tomas de medicación. Los tokens se emiten por medicamento desde su interruptor de endpoint de API.",
+    "tokenMintMovedDescription": "Los tokens se emiten por medicamento. Abre un medicamento y activa su endpoint de API para obtener un token limitado únicamente a ese medicamento.",
     "tokenNamePlaceholder": "Nombre del token (p. ej., Atajo de iPhone)",
     "tokenCreated": "Token creado — ¡cópialo ahora! No se mostrará de nuevo.",
     "tokenCopy": "Copiar token",
@@ -5531,8 +5715,16 @@
         "revokeAllDone": "Se olvidaron {count} dispositivo(s) de confianza.",
         "unnamed": "Dispositivo desconocido",
         "current": "Este dispositivo",
-        "expires": "De confianza hasta el {date}"
-      }
+        "expires": "De confianza hasta el {date}",
+        "revokeConfirmTitle": "¿Dejar de confiar en este dispositivo?",
+        "revokeConfirmBody": "Volverá a pedir tu segundo factor la próxima vez que inicies sesión desde él.",
+        "revokeAllConfirmTitle": "¿Dejar de confiar en todos los dispositivos?",
+        "revokeAllConfirmBody": "Todos los dispositivos volverán a pedir tu segundo factor la próxima vez que inicies sesión, incluido este."
+      },
+      "revokeSessionConfirmTitle": "¿Cerrar la sesión de este dispositivo?",
+      "revokeSessionConfirmBody": "{device} tendrá que iniciar sesión de nuevo. Lo registrado en él no se ve afectado.",
+      "signOutEverywhereConfirmTitle": "¿Cerrar la sesión en los demás dispositivos?",
+      "signOutEverywhereConfirmBody": "Todos los dispositivos salvo este tendrán que iniciar sesión de nuevo. Este seguirá con la sesión abierta. Nada de lo que has registrado se ve afectado."
     },
     "privacy": {
       "intro": {
@@ -5632,10 +5824,34 @@
       "rate_limited": "Demasiados intentos de conexión. Espera un momento e inténtalo de nuevo.",
       "generic": "Error desconocido al conectar. Inicia la conexión de nuevo."
     },
+    "appleHealth": {
+      "title": "Apple Health",
+      "description": "La sincronización en vivo se realiza desde la app HealthLog para iOS, no mediante una conexión web ni OAuth.",
+      "status": {
+        "checking": "Comprobando datos de Apple Health…",
+        "dataReceived": "Datos de Apple Health recibidos",
+        "setup": "Configurar en la app de iOS",
+        "unavailable": "Estado de Apple Health no disponible"
+      },
+      "lastDataLabel": "Últimos datos de Apple Health:",
+      "setupTitle": "Activar la sincronización en vivo",
+      "permissionStep": "En la app HealthLog para iOS, abre Ajustes → Apple Health y permite las categorías de salud que quieras compartir.",
+      "backgroundStep": "Mantén activada la actualización en segundo plano. La app sincroniza datos nuevos automáticamente en primer plano y cuando iOS le concede tiempo en segundo plano.",
+      "importNote": "¿Necesitas un historial anterior o no puedes usar la app de iOS? La carga XML/ZIP de Apple Health es una alternativa puntual y no activa la sincronización en vivo.",
+      "importAction": "Abrir importación puntual"
+    },
     "garminInfo": {
       "title": "Garmin",
       "body": "Garmin no tiene conexión directa aquí. Conéctalo a través de Apple Health (iOS) o Google Health Connect (Android). Las métricas propias de Garmin — Body Battery, Training Load, estado de HRV, VO₂ máx.— no las comparte Garmin con ninguna de las dos plataformas.",
       "docsLink": "Leer la guía"
+    },
+    "glucoseReference": {
+      "title": "Banda de referencia de glucosa",
+      "description": "Con qué banda se evalúan tus valores de glucosa en sangre.",
+      "enable": "Usar la banda objetivo para diabetes",
+      "explainer": "Desactivado, los valores se evalúan con la banda de referencia general no diabética. Activado, se evalúan con la banda objetivo glucémica más estrecha de los ADA Standards of Care, y el Coach fundamenta sus comentarios sobre glucosa en esa banda. Tus propios valores objetivo personalizados de abajo siguen teniendo prioridad.",
+      "disclaimer": "Esto selecciona una banda de referencia. No es un diagnóstico, nunca se deduce de una medición y la aplicación no actúa clínicamente en consecuencia. Qué objetivos se aplican a ti es una pregunta para tu profesional sanitario.",
+      "error": "No se pudo guardar el ajuste."
     }
   },
   "admin": {
@@ -7374,7 +7590,7 @@
     "referenceLabel": "Referencia",
     "readingsCount": "{count} mediciones",
     "deleteConfirmTitle": "¿Eliminar resultado de laboratorio?",
-    "deleteConfirmDescription": "Este resultado de laboratorio se eliminará de forma permanente.",
+    "deleteConfirmDescription": "Este resultado de laboratorio se eliminará. Justo después podrás deshacerlo durante un breve momento.",
     "deletedToast": "Resultado eliminado",
     "deleteError": "No se pudo eliminar el resultado",
     "loadError": "No se pudieron cargar los resultados",
@@ -7853,7 +8069,7 @@
     },
     "deleteConfirm": {
       "title": "¿Eliminar este episodio?",
-      "body": "«{label}» y todos sus registros diarios se eliminarán. Esta acción no se puede deshacer."
+      "body": "«{label}» y todos sus registros diarios se eliminarán. Justo después podrás deshacerlo durante un breve momento."
     },
     "vital": {
       "RESTING_HEART_RATE": "Frecuencia cardíaca en reposo",
@@ -7936,6 +8152,11 @@
         "review_due": "Revisión pendiente",
         "reviewed": "Revisado"
       }
+    },
+    "refusal": {
+      "outOfScope": "Solo puedo ayudarte con los datos de salud de tu registro: mediciones, medicamentos, estado de ánimo, tendencias. No puedo responder preguntas fuera de ese ámbito.",
+      "promptInjection": "He detectado instrucciones que intentan anular mis directrices. Soy el Coach de HealthLog y solo resumo tus propios datos de salud; reformula tu pregunta en esos términos, por favor.",
+      "conversationPoisoned": "Un mensaje anterior de esta conversación contiene instrucciones que intentan anular mis directrices. Empieza una conversación nueva, por favor."
     }
   },
   "safety": {
@@ -8188,7 +8409,9 @@
         "finally": "Finally …"
       }
     },
-    "openDetail": "Ver detalles"
+    "openDetail": "Ver detalles",
+    "historyLoadError": "No se pudo cargar tu historial de evaluaciones",
+    "historyLoadErrorHint": "Esto no significa que no tengas resultados: no se pudo obtener la lista. Vuelve a intentarlo."
   },
   "records": {
     "disclaimer": "Son tus propios registros, no un diagnóstico médico. HealthLog no diagnostica, no trata ni los interpreta.",
@@ -8397,7 +8620,13 @@
       "title": "Detalles del documento",
       "summary": {
         "title": "Resumen",
-        "pending": "Se está preparando el resumen."
+        "pending": "Se está preparando el resumen.",
+        "none": "Todavía no se ha generado ningún resumen para este documento.",
+        "withheld": "Se generó un resumen, pero no superó la comprobación de seguridad, así que no se muestra. Puedes intentarlo de nuevo o leer el documento.",
+        "unavailable": "No se pudo generar ningún resumen para este documento.",
+        "generate": "Generar resumen",
+        "regenerate": "Volver a generar",
+        "generating": "Generando…"
       },
       "loadError": "No se pudo cargar este documento.",
       "saveError": "No se pudo guardar el cambio.",
@@ -8479,7 +8708,6 @@
       "close": "Ocultar"
     },
     "ai": {
-      "statusAiRead": "Leído por IA",
       "readDone": "La IA leyó tu documento.",
       "read": "Leer con IA",
       "reread": "Leer de nuevo",
@@ -8635,6 +8863,7 @@
       "quickAddCustomPlaceholder": "250",
       "quickAddSubmit": "Añadir",
       "quickAddError": "No se pudo guardar. Inténtalo de nuevo.",
+      "quickAddSuccess": "Se añadieron {amount} mL de agua.",
       "editTotal": "Editar el total de hoy"
     },
     "caffeine": {
@@ -8645,7 +8874,8 @@
       "rowMeta": "{days} de {window} días · ref. {value} {unit} (EFSA)",
       "rowMetaNoRef": "{days} de {window} días",
       "footer": "{tracked} de {total} micronutrientes registrados tienen datos en este periodo.",
-      "emptyTitle": "Aún no hay datos de micronutrientes sincronizados"
+      "emptyTitle": "Aún no hay datos de micronutrientes sincronizados",
+      "loadError": "No se pudieron cargar tus datos de nutrientes"
     },
     "sparseNote": "Un valor bajo aquí suele significar un registro escaso, no una deficiencia: los totales diarios de Apple Health reflejan lo que registraron tus apps, no la ingesta dietética total."
   },
@@ -8661,8 +8891,11 @@
     "item": {
       "doseWindow": {
         "title": "Medicación pendiente",
-        "body": "Hoy toca una dosis.",
-        "bodyNamed": "{name} toca hoy."
+        "body": "Pronto toca una dosis.",
+        "bodyNamed": "Pronto toca {name}.",
+        "overdueTitle": "Medicación atrasada",
+        "overdueBody": "Una dosis está atrasada.",
+        "overdueBodyNamed": "{name} está atrasado."
       },
       "preventiveCare": {
         "title": "Revisión pendiente",
@@ -8716,7 +8949,8 @@
       "deltaVsBaseline": "{delta} frente a tu valor de referencia",
       "deltaFlat": "En línea con tu valor de referencia",
       "sleepPending": "El sueño de anoche aún no ha llegado; la lectura de hoy es provisional.",
-      "readFullBriefing": "Leer el informe completo",
+      "justIn": "Recién llegado",
+      "justInAt": "Recién llegado · {time}",
       "worthALook": "Merece un vistazo",
       "allClear": "Hoy nada necesita tu atención.",
       "ringLink": "Abrir detalles de {metric}"

messages/fr.json

@@ -42,7 +42,74 @@
     "hidePassword": "Masquer le mot de passe",
     "learnMore": "En savoir plus",
     "dismiss": "Ignorer",
-    "moreInfo": "Plus d'informations"
+    "moreInfo": "Plus d'informations",
+    "durationHoursMinutes": "{hours} h {minutes} min",
+    "durationMinutes": "{minutes} min"
+  },
+  "apiErrors": {
+    "measurement": {
+      "create": {
+        "invalid": "Vérifiez les données de la mesure et réessayez."
+      },
+      "duplicate_timestamp": "Une mesure existe déjà pour cette heure."
+    },
+    "mood": {
+      "list": {
+        "invalid": "Les filtres de la liste d’humeur ne sont pas valides."
+      },
+      "create": { "invalid": "Vérifiez l’entrée d’humeur et réessayez." },
+      "update": { "invalid": "Vérifiez l’entrée d’humeur et réessayez." },
+      "duplicate_timestamp": "Une entrée d’humeur existe déjà pour cette heure.",
+      "not_found": "Cette entrée d’humeur n’est plus disponible.",
+      "ratedFactor": {
+        "out_of_range": "Une évaluation est hors de la plage autorisée."
+      }
+    },
+    "labs": {
+      "create": {
+        "invalid": "Vérifiez le résultat de laboratoire et réessayez."
+      },
+      "result": {
+        "notFound": "Ce résultat de laboratoire n’est plus disponible."
+      },
+      "biomarker": {
+        "notFound": "Ce biomarqueur n’est plus disponible.",
+        "duplicate": "Un biomarqueur portant ce nom existe déjà.",
+        "create": {
+          "invalid": "Vérifiez les informations du biomarqueur et réessayez."
+        },
+        "update": {
+          "invalid": "Vérifiez les informations du biomarqueur et réessayez.",
+          "referenceRangeInvalid": "La valeur de référence basse ne doit pas dépasser la valeur haute."
+        }
+      },
+      "update": {
+        "invalid": "Vérifiez le résultat de laboratoire et réessayez.",
+        "linkedFieldsImmutable": "Modifiez le biomarqueur pour changer son nom, son unité, son panel ou sa plage de référence.",
+        "qualitativeExpected": "Saisissez un résultat textuel pour cette mesure qualitative.",
+        "numericExpected": "Saisissez un nombre pour cette mesure numérique.",
+        "referenceRangeInvalid": "La valeur de référence basse ne doit pas dépasser la valeur haute."
+      }
+    },
+    "onboarding": {
+      "disclaimer": {
+        "invalid": "Veuillez confirmer à nouveau l’avertissement médical."
+      },
+      "tour": {
+        "invalid": "La progression de la visite n’a pas pu être enregistrée."
+      },
+      "complete": {
+        "invalid": "Vérifiez les informations du profil et réessayez."
+      },
+      "user": { "notFound": "Votre compte est introuvable." },
+      "step": {
+        "rateLimited": "Trop de tentatives. Patientez puis réessayez.",
+        "invalid": "Cette étape d’accueil n’a pas pu être enregistrée.",
+        "completed": "L’accueil est déjà terminé.",
+        "outOfOrder": "Votre progression a changé. Actualisez la page et continuez.",
+        "concurrent": "Votre progression a changé. Actualisez la page et continuez."
+      }
+    }
   },
   "doctorReport": {
     "title": "Rapport de santé",
@@ -253,7 +320,9 @@
       "medication": "Médicament",
       "medicationDescription": "Marquer une dose comme prise",
       "mood": "Humeur",
-      "moodDescription": "Enregistrer l'humeur et les tags"
+      "moodDescription": "Enregistrez votre humeur et des étiquettes",
+      "water": "Eau",
+      "waterDescription": "Ajoutez rapidement votre consommation d’eau"
     },
     "cycle": "Cycle",
     "labs": "Analyses",
@@ -356,6 +425,7 @@
     "quickAddMeasurement": "Saisir une mesure",
     "quickAddMood": "Saisir une humeur",
     "quickAddMedicationIntake": "Saisir une prise",
+    "quickAddWater": "Saisir de l’eau",
     "customizeDashboard": "Personnaliser le tableau de bord",
     "medicationIntakeQuickAdd": {
       "sheetTitle": "Saisir une prise de médicament",
@@ -400,8 +470,10 @@
     "staleHint": "Dernière valeur il y a {count} j",
     "staleHintWeeksOne": "Dernière valeur il y a 1 semaine",
     "staleHintWeeksOther": "Dernière valeur il y a {count} semaines",
+    "staleHintWeeksFew": "Dernière valeur il y a {count} semaines",
     "staleHintMonthsOne": "Dernière valeur il y a 1 mois",
     "staleHintMonthsOther": "Dernière valeur il y a {count} mois",
+    "staleHintMonthsFew": "Dernière valeur il y a {count} mois",
     "recentWorkouts": {
       "title": "Entraînements récents",
       "viewAll": "Tout voir",
@@ -421,7 +493,9 @@
         "steps": "Pas",
         "totalBodyWater": "Eau corporelle totale",
         "boneMass": "Masse osseuse",
-        "oxygenSaturation": "Saturation en oxygène"
+        "oxygenSaturation": "Saturation en oxygène",
+        "mood": "Humeur",
+        "bmi": "IMC"
       },
       "unit": {
         "weight": "kg",
@@ -433,7 +507,9 @@
         "steps": "pas",
         "totalBodyWater": "kg",
         "boneMass": "kg",
-        "oxygenSaturation": "%"
+        "oxygenSaturation": "%",
+        "mood": "/5",
+        "bmi": "kg/m²"
       }
     }
   },
@@ -574,7 +650,7 @@
     "bulkDeleteSuccess": "{count} mesures supprimées",
     "bulkDeleteError": "Erreur lors de la suppression des mesures sélectionnées",
     "bulkDeleteConfirmTitle": "Supprimer {count} mesures ?",
-    "bulkDeleteConfirmBody": "Les {count} mesures sélectionnées seront définitivement supprimées.",
+    "bulkDeleteConfirmBody": "Les {count} mesures sélectionnées seront supprimées. Vous pourrez annuler cette action pendant un court instant juste après.",
     "typePhq9Score": "Score PHQ-9",
     "typeGad7Score": "Score GAD-7",
     "typeGripStrength": "Force de préhension",
@@ -592,6 +668,7 @@
     "statusPresent": "Suivi",
     "statusAbsent": "Pas encore suivi",
     "statusModuleOff": "Désactivé",
+    "loadError": "Impossible de charger l'état de suivi.",
     "connectCta": "Connecter une source",
     "viewCta": "Voir",
     "ecg": {
@@ -599,7 +676,7 @@
     },
     "watchdog": {
       "title": "Surveillance automatique",
-      "description": "HealthLog surveille aussi discrètement en arrière-plan — notifications de rythme irrégulier et de perturbations respiratoires envoyées par une montre connectée, alertes d'écart par rapport à ta valeur de référence, ainsi que des changements notables entre tes deux derniers bilans de laboratoire — et n'affiche une carte que si quelque chose se démarque. L'absence de carte est bon signe, pas une fonctionnalité manquante."
+      "description": "HealthLog surveille aussi discrètement en arrière-plan — notifications de rythme irrégulier et de perturbations respiratoires envoyées par une montre connectée, alertes d'écart par rapport à ta valeur de référence, ainsi que des changements notables entre tes deux derniers bilans de laboratoire — et n'affiche une carte que si quelque chose se démarque. Si au moins une de ces sources est connectée, l'absence de carte est bon signe, pas une fonctionnalité manquante ; si aucune ne l'est encore, c'est simplement qu'il n'y a rien à surveiller."
     }
   },
   "mood": {
@@ -721,7 +798,7 @@
     "bulkDeleteSuccess": "{count} entrées supprimées",
     "bulkDeleteError": "Erreur lors de la suppression des entrées sélectionnées",
     "bulkDeleteConfirmTitle": "Supprimer {count} entrées ?",
-    "bulkDeleteConfirmBody": "Les {count} entrées d'humeur sélectionnées seront définitivement supprimées.",
+    "bulkDeleteConfirmBody": "Les {count} entrées d'humeur sélectionnées seront supprimées. Vous pourrez annuler cette action pendant un court instant juste après.",
     "customize": "Personnaliser les étiquettes d’humeur",
     "addTagInline": "Ajouter une étiquette",
     "manage": {
@@ -1678,7 +1755,10 @@
         "packagingDefaultPackLabel": "Taille de boîte par défaut (unités)",
         "packagingDefaultPackHelper": "Préremplit la quantité lors de l’enregistrement de nouvelles boîtes (1–1000). Laisse vide si aucune ne s’applique.",
         "packagingSuccess": "Conditionnement enregistré",
-        "packagingFailed": "Échec de l’enregistrement"
+        "packagingFailed": "Échec de l’enregistrement",
+        "addManufacturerLabel": "Fabricant",
+        "addDoseStrengthLabel": "Dosage",
+        "addDoseStrengthHint": "Tel qu'imprimé sur le contenant, par ex. 5 mg/0,5 ml."
       },
       "erweitert": {
         "group": {
@@ -1978,6 +2058,61 @@
     "notAvailableForCompliance": "Comparaison indisponible pour l’observance"
   },
   "insights": {
+    "correlation": {
+      "direction": {
+        "higher": "augmenter",
+        "lower": "diminuer"
+      },
+      "weekdayDirection": {
+        "above": "au-dessus de",
+        "below": "en dessous de"
+      },
+      "channelFactor": "l'évaluation de {factor}",
+      "channel": {
+        "WEIGHT": "le poids",
+        "BLOOD_GLUCOSE": "la glycémie",
+        "BLOOD_PRESSURE_SYS": "la pression systolique",
+        "BLOOD_PRESSURE_DIA": "la pression diastolique",
+        "ACTIVITY_STEPS": "le nombre de pas quotidien",
+        "SLEEP_DURATION": "la durée de sommeil",
+        "HEART_RATE_VARIABILITY": "la variabilité de la fréquence cardiaque",
+        "RESTING_HEART_RATE": "la fréquence cardiaque au repos",
+        "TIME_IN_DAYLIGHT": "le temps passé à la lumière du jour",
+        "MOOD": "l'humeur",
+        "PULSE": "le pouls au repos",
+        "MEDICATION_COMPLIANCE": "l'observance des médicaments",
+        "SYMPTOM_SEVERITY": "la sévérité des symptômes",
+        "ENV_TEMP_MEAN": "la température quotidienne",
+        "ENV_TEMP_MIN": "la température minimale nocturne",
+        "ENV_SUNSHINE": "l'ensoleillement",
+        "ENV_DAYLIGHT": "la lumière du jour",
+        "ENV_PRECIP": "les précipitations",
+        "ENV_PRESSURE_MEAN": "la pression atmosphérique",
+        "ENV_PRESSURE_DELTA": "la variation de pression sur la journée"
+      },
+      "daily": {
+        "high": "Quand {behaviour} monte, {outcome} du lendemain tend à {direction} dans tes données — une tendance à surveiller, pas une cause.",
+        "moderate": "Quand {behaviour} monte, {outcome} du lendemain semble avoir tendance à {direction}, au vu des données actuelles — une tendance à surveiller, pas une cause.",
+        "faint": "Quand {behaviour} monte, tout au plus se dessine un faible indice que {outcome} du lendemain tende à {direction} dans tes données — trop ténu pour s'y fier, jamais une cause."
+      },
+      "lab": {
+        "default": "Des valeurs de {lab} plus élevées vont de pair avec {outcome} qui tend à {direction} sur les mêmes périodes dans tes données — une association à surveiller avec ton médecin, jamais une cause.",
+        "faint": "Des valeurs de {lab} plus élevées laissent tout au plus entrevoir que {outcome} tende à {direction} sur les mêmes périodes dans tes données — trop ténu pour s'y fier, une association à évoquer avec ton médecin, jamais une cause."
+      },
+      "hypothesis": {
+        "bpCompliance": {
+          "support": "Une meilleure observance des médicaments va de pair avec des valeurs systoliques plus basses — une tendance à surveiller.",
+          "surprising": "L'observance et la systolique évoluent ensemble dans tes données — surprenant ; parles-en à ton médecin avant de changer quoi que ce soit.",
+          "none": "L'observance et la systolique n'évoluent pas nettement ensemble sur cette période."
+        },
+        "moodPulse": {
+          "support": "Les jours de moral plus bas vont de pair avec un pouls au repos plus élevé — une tendance à surveiller.",
+          "surprising": "Les jours de meilleur moral vont de pair avec un pouls au repos plus élevé dans tes données — surprenant.",
+          "none": "L'humeur et le pouls au repos n'évoluent pas nettement ensemble sur cette période."
+        },
+        "weightWeekday": "Le poids du {weekday} est {delta} kg {direction} ta moyenne des autres jours — une tendance à surveiller."
+      }
+    },
     "noAnalysisYet": "Pas encore d’évaluation.",
     "assessmentPreparing": "Préparation de votre évaluation…",
     "emptyTitle": "Pas encore assez de données",
@@ -2264,6 +2399,13 @@
       "historyEmpty": "Tes conversations s’affichent ici. Lance une question pour commencer.",
       "historyDeleteAria": "Supprimer la conversation",
       "historyDeleted": "Conversation supprimée",
+      "rename": {
+        "action": "Renommer la conversation",
+        "input": "Titre de la conversation",
+        "save": "Enregistrer le titre",
+        "cancel": "Annuler le renommage",
+        "error": "Impossible d’enregistrer le titre de la conversation."
+      },
       "historySearchEmpty": "Aucune conversation ne correspond à ta recherche.",
       "historyLoadingMore": "Chargement…",
       "sourcesTitle": "Ce à quoi j’accède",
@@ -2402,10 +2544,6 @@
       "settingsClustersHint": "Choisissez les groupes de données que le Coach peut lire. Plus de données, des réponses plus riches et un prompt plus grand.",
       "settingsClusterNoData": "Pas encore de données",
       "sourcesMemberCount": "{count} mesures",
-      "dictate": "Dicter",
-      "dictateStop": "Arrêter la dictée",
-      "voiceUnsupported": "La saisie vocale n'est pas prise en charge par ce navigateur",
-      "dictateError": "Impossible de démarrer la saisie vocale. Vérifiez l'autorisation du microphone et réessayez.",
       "showConversations": "Afficher les conversations",
       "hideConversations": "Masquer les conversations",
       "heroGreeting": "Pose-moi une question sur tes données",
@@ -2502,10 +2640,13 @@
     "relativeJustNow": "à l’instant",
     "relativeMinutesAgoOne": "il y a {count} minute",
     "relativeMinutesAgoOther": "il y a {count} minutes",
+    "relativeMinutesAgoFew": "il y a {count} minutes",
     "relativeHoursAgoOne": "il y a {count} heure",
     "relativeHoursAgoOther": "il y a {count} heures",
+    "relativeHoursAgoFew": "il y a {count} heures",
     "relativeDaysAgoOne": "il y a {count} jour",
     "relativeDaysAgoOther": "il y a {count} jours",
+    "relativeDaysAgoFew": "il y a {count} jours",
     "navOverview": "Vue d'ensemble",
     "navCatalog": "Toutes les mesures",
     "navBloodPressure": "Tension artérielle",
@@ -2665,11 +2806,11 @@
         "fatFreeMassTitle": "Masse non grasse",
         "fatFreeMassBody": "La masse non grasse est tout ce qui, dans votre corps, n'est pas de la graisse : muscle, os, organes et eau. La maintenir ou la développer tout en perdant du poids signale en général une composition corporelle plus saine.",
         "fatMassTitle": "Masse grasse",
-        "fatMassBody": "La masse grasse est le poids total de la graisse de votre corps. Une part de graisse est indispensable aux hormones et au stockage d'énergie, mais un excès — surtout au niveau de l'abdomen — augmente le risque pour la santé à long terme.",
+        "fatMassBody": "La masse grasse est le poids total de la graisse de votre corps. Une part de graisse est indispensable aux hormones et au stockage d'énergie, mais un excès — surtout au niveau de l'abdomen — augmente le risque pour la santé à long terme (WHO 2024).",
         "muscleMassTitle": "Masse musculaire",
         "muscleMassBody": "La masse musculaire est le poids estimé des muscles de votre corps. Plus de muscle soutient la force, le métabolisme et la mobilité, et demande généralement un effort actif pour être préservé avec l'âge.",
         "visceralFatTitle": "Graisse viscérale",
-        "visceralFatBody": "La graisse viscérale est la graisse stockée au plus profond de l'abdomen, autour des organes. Contrairement à la graisse sous la peau, un niveau élevé est étroitement lié aux maladies cardiaques et au diabète de type 2 : plus elle est basse, mieux c'est.",
+        "visceralFatBody": "La graisse viscérale est la graisse stockée au plus profond de l'abdomen, autour des organes. Contrairement à la graisse sous la peau, un niveau élevé est étroitement lié aux maladies cardiaques et au diabète de type 2 (AHA, Circulation 2021) : plus elle est basse, mieux c'est. L'échelle indique une valeur sans unité (environ 1 à 12 correspond à la plage saine, 13 et plus étant élevé) ; il s'agit d'une échelle distincte des seuils en cm² obtenus par imagerie qu'utilisent les cliniciens, et elle n'est pas interchangeable avec eux.",
         "leanBodyMassTitle": "Masse maigre",
         "leanBodyMassBody": "La masse maigre est votre poids total moins la graisse corporelle : muscle, os, organes et eau réunis. La suivre en parallèle du poids montre si les variations viennent du muscle ou de la graisse.",
         "flightsClimbedTitle": "Étages montés",
@@ -2699,7 +2840,7 @@
         "audioEventsTitle": "Événements sonores forts",
         "audioEventsBody": "Les événements sonores forts signalent les moments où le bruit autour de vous a atteint un niveau pouvant nuire à l'audition en cas d'exposition suffisante. Des événements fréquents invitent à rechercher un environnement plus calme ou une protection auditive.",
         "daylightTitle": "Temps à la lumière du jour",
-        "daylightBody": "Le temps à la lumière du jour correspond à la durée passée en lumière extérieure chaque jour. Une lumière naturelle régulière soutient un rythme veille-sommeil et une humeur sains, et le temps passé dehors est lié à la santé oculaire.",
+        "daylightBody": "Le temps à la lumière du jour correspond à la durée passée en lumière extérieure chaque jour. Une lumière naturelle régulière soutient un rythme veille-sommeil et une humeur sains (CDC 2024), et le temps passé dehors est lié à la santé oculaire.",
         "bloodGlucoseTitle": "Glycémie",
         "bloodGlucoseBody": "La glycémie est la quantité de sucre dans votre sang, principale source d'énergie de l'organisme. Elle augmente après les repas et se stabilise entre eux ; des valeurs durablement élevées peuvent signaler un diabète ou un prédiabète.",
         "skinTemperatureTitle": "Température cutanée",
@@ -2711,7 +2852,7 @@
         "wristTemperatureTitle": "Température du poignet",
         "wristTemperatureBody": "La température du poignet est mesurée pendant votre sommeil et indiquée comme l'écart par rapport à votre valeur de référence, et non comme une valeur absolue. Une valeur stable est normale, tandis qu'une hausse durable peut signaler une maladie, un entraînement intense ou un changement de cycle.",
         "fallsTitle": "Chutes",
-        "fallsBody": "Ceci compte les chutes lourdes détectées par votre wearable. L'objectif est zéro ; un nombre en hausse est un signal de risque de mobilité à évoquer avec un professionnel, surtout pour les personnes âgées.",
+        "fallsBody": "Ceci compte les chutes lourdes détectées par votre wearable. L'objectif est zéro ; un nombre en hausse est un signal de risque de mobilité à évoquer avec un professionnel, surtout pour les personnes âgées (CDC STEADI 2024).",
         "sixMinuteWalkTitle": "Distance de marche de 6 minutes",
         "sixMinuteWalkBody": "C'est une estimation de la distance que vous pourriez parcourir en six minutes, un test clinique classique de mobilité et d'endurance cardiopulmonaire. La valeur du wearable est une approximation, pas le test clinique encadré ; c'est la tendance stable ou en hausse qui compte.",
         "stairAscentSpeedTitle": "Vitesse en montée d'escaliers",
@@ -2759,7 +2900,8 @@
       },
       "valuesBack": "Retour aux Insights",
       "valuesBackToMetric": "Retour à {metric}",
-      "scoresBack": "Retour aux Insights"
+      "scoresBack": "Retour aux Insights",
+      "ecgDescription": "Enregistrements ECG à dérivation unique de votre appareil, chacun accompagné du résultat de l'appareil. HealthLog affiche le tracé et l'enregistrement, mais n'interprète pas la courbe."
     },
     "sleep": {
       "title": "Sommeil",
@@ -2798,9 +2940,9 @@
       "debt": {
         "title": "Dette de sommeil",
         "value": "{hours} h {minutes} min de déficit",
-        "caption": "Déficit cumulé sur les {nights} dernières nuits",
+        "caption": "Solde restant sur les {nights} dernières nuits",
         "clearValue": "À jour",
-        "clearCaption": "Aucun déficit cumulé sur les {nights} dernières nuits",
+        "clearCaption": "Rien en attente sur les {nights} dernières nuits",
         "learning": "Votre sommeil est encore en cours d'analyse — {counted} nuits jusqu'ici, encore {remaining} pour un bilan fiable.",
         "computedInfo": "Il s'agit de l'estimation propre à HealthLog : un solde glissant entre le besoin et le sommeil des dernières nuits, que le sommeil de récupération réduit. Elle peut différer de la dette de sommeil native d'un wearable, qui utilise son propre modèle de besoin."
       },
@@ -2904,6 +3046,8 @@
     "navRecovery": "Récupération",
     "workouts": {
       "title": "Entraînements",
+      "askWhy": "Pourquoi",
+      "askWhyPrompt": "Pourquoi cette séance s'est-elle passée ainsi ? Explique-moi mes propres chiffres.",
       "description": "Courses, sorties à vélo, marches et séances de musculation récentes, dédupliquées entre Apple Watch et Withings.",
       "emptyState": {
         "title": "Aucun entraînement",
@@ -2932,7 +3076,24 @@
         "hrChartTitle": "Fréquence cardiaque",
         "hrChartUnavailable": "Les échantillons de fréquence cardiaque à la seconde ne sont pas stockés pour cet entraînement.",
         "notFound": "Entraînement introuvable.",
-        "loading": "Chargement de l'entraînement…"
+        "loading": "Chargement de l'entraînement…",
+        "hrFromPulse": "À partir de vos données de fréquence cardiaque autour de cette séance",
+        "hrAxisMinutes": "min",
+        "sportAverageLabel": "Votre moyenne récente :",
+        "zonesTitle": "Zones d'effort",
+        "zonesCaption": "Répartition de votre effort entre les zones de fréquence cardiaque.",
+        "zonesCaptionDevice": "Temps par zone indiqué par votre appareil.",
+        "exportGpx": "Exporter le GPX",
+        "elevationTitle": "Dénivelé",
+        "splitsTitle": "Temps par kilomètre",
+        "splitsKm": "km",
+        "splitsTime": "Temps",
+        "splitsPace": "Allure",
+        "thatDayTitle": "Ce jour-là",
+        "dayPulse": "Pouls",
+        "daySleep": "Sommeil",
+        "dayMood": "Humeur",
+        "insightTitle": "Analyse de l'activité"
       },
       "sport": {
         "walking": "Marche",
@@ -2955,7 +3116,11 @@
         "crossTraining": "Cross-training",
         "mixedCardio": "Cardio mixte",
         "other": "Autre"
-      }
+      },
+      "loadError": "Tes séances n'ont pas pu être chargées",
+      "loadMore": "Charger plus de séances",
+      "loadingMore": "Chargement de séances supplémentaires",
+      "loadMoreError": "Les séances supplémentaires n'ont pas pu être chargées"
     },
     "bloodGlucose": {
       "title": "Glycémie",
@@ -3898,7 +4063,10 @@
         "recordingsMany": "{count} enregistrements disponibles.",
         "latestResult": "Dernier résultat de l’appareil : {result}.",
         "cta": "Voir les enregistrements"
-      }
+      },
+      "emptyTitle": "Aucun enregistrement ECG pour l'instant",
+      "emptyDescription": "Les enregistrements ECG se synchronisent depuis un appareil à dérivation unique compatible. Dès que votre appareil transfère un enregistrement, il apparaît ici.",
+      "emptyCta": "Connecter un appareil"
     },
     "intradayPulse": {
       "title": "Le rythme de votre journée",
@@ -3917,7 +4085,8 @@
         "evening": "Une période élevée au repos ce soir — peut-être un peu de tension.",
         "night": "Une période élevée au repos cette nuit — peut-être un peu de tension."
       }
-    }
+    },
+    "navEcg": "ECG"
   },
   "thresholds": {
     "defaultLabel": "Par défaut",
@@ -4397,7 +4566,7 @@
           "fullBackup": {
             "title": "Sauvegarde complète",
             "description": "Toutes vos données dans un seul fichier JSON : mesures, médicaments, humeur, cycle, analyses de laboratoire, épisodes de maladie, allergies, antécédents familiaux et entraînements. Même format que la sauvegarde automatique hebdomadaire.",
-            "scopeNote": "Les fichiers originaux des documents ainsi que les tracés GPS/données d'échantillons des entraînements ne sont pas inclus — téléchargez-les séparément depuis le coffre de documents ou l'export des entraînements.",
+            "scopeNote": "Les métadonnées des documents et le résumé IA, s'il existe, sont inclus en texte clair ; les fichiers originaux des documents ainsi que les tracés GPS/données d'échantillons des entraînements ne le sont pas — téléchargez-les séparément depuis le coffre de documents ou l'export des entraînements.",
             "encryptToggle": "Chiffrer avec une phrase secrète",
             "passphrasePlaceholder": "Phrase secrète (12 caractères min.)",
             "passphraseHelp": "Dérive la clé de l'archive avec Argon2id et la scelle avec AES-256-GCM. Enregistrez le fichier avec l'extension .hlx.",
@@ -4428,6 +4597,7 @@
             "failed": "L'import a échoué.",
             "rowsImported": "{count} lignes importées jusqu'ici",
             "doneSummary": "Terminé — {imported} enregistrements sur {read} importés, {skipped} enregistrements cliniques ignorés.",
+            "estimateWarning": "Les totaux cumulés de {count} jour(s) ont été estimés à partir de la source d’export la plus élevée. Les statistiques Apple Santé natives restent la référence.",
             "phase": {
               "queued": "En file d'attente…",
               "unpacking": "Décompression de l'archive…",
@@ -4586,7 +4756,9 @@
           "description": "Ajoutez un lieu et une plage de dates : un voyage ou une portion de votre historique passé. La période remplace votre domicile pour les jours qu'elle couvre, afin que la météo corresponde à l'endroit où vous étiez réellement. C'est ainsi que vous corrigez le passé.",
           "none": "Aucune période de localisation pour l'instant.",
           "add": "Ajouter {label}",
-          "remove": "Supprimer la période de localisation"
+          "remove": "Supprimer la période de localisation",
+          "removeConfirmTitle": "Retirer ce voyage ?",
+          "removeConfirmBody": "Les mesures de cette période restent dans ton dossier ; seule l'entrée du voyage disparaît."
         },
         "backfill": {
           "title": "Récupérer les jours passés",
@@ -4867,7 +5039,10 @@
           "surfaced": "Affiché",
           "done": "Terminé",
           "dismissed": "Ignoré"
-        }
+        },
+        "deleteConfirmTitle": "Supprimer ce rappel ?",
+        "deleteConfirmBody": "Il ne se déclenchera plus. Ce que tu as déjà enregistré reste intact.",
+        "deleteConfirmAction": "Supprimer"
       },
       "aboutMe": {
         "title": "À propos de moi",
@@ -4913,6 +5088,16 @@
         "honesty": "L'accès partagé est un unique compte IA connecté que l'opérateur a relié pour tout le monde sur ce serveur, et non votre propre clé. Les requêtes que vous y faites servent par défaut à entraîner les modèles du fournisseur et aucun accord de traitement des données ne les couvre, les limites horaires et hebdomadaires du compte sont partagées avec tous les autres qui ont accepté, et vos propres fournisseurs sont essayés en premier. Ne l'activez que si vous acceptez ce compromis.",
         "confirm": "J'ai compris — utiliser la connexion partagée",
         "cancel": "Annuler"
+      },
+      "consent": {
+        "title": "Consentement IA",
+        "activeSince": "Donné le {date}. Tes données de santé peuvent être transmises au fournisseur configuré pour les fonctions IA.",
+        "withdrawn": "Retiré. Aucune donnée de santé n'est transmise à un fournisseur IA ; les fonctions IA restent désactivées.",
+        "withdraw": "Retirer le consentement",
+        "confirmBody": "Les fonctions IA s'arrêtent immédiatement. Rien de ce qui est déjà enregistré n'est supprimé — utilise Données et confidentialité pour exporter ou effacer ton dossier.",
+        "confirmWithdraw": "Retirer",
+        "regrantHint": "Pour réutiliser les fonctions IA, active la lecture automatique des documents ou donne ton consentement depuis l'application.",
+        "error": "Le retrait n'a pas pu être enregistré. Réessaie."
       }
     },
     "dashboard": {
@@ -5099,7 +5284,8 @@
       "resumeError": "Échec de la reconnexion"
     },
     "apiTokens": "Jetons API",
-    "apiTokensDescription": "Créez des jetons API pour enregistrer des prises de médicaments externes (par exemple Raccourcis, automatisations).",
+    "apiTokensDescription": "Consultez et révoquez les jetons API pour l’enregistrement externe des prises de médicaments. Les jetons sont émis par médicament depuis son interrupteur de point de terminaison API.",
+    "tokenMintMovedDescription": "Les jetons sont émis par médicament. Ouvrez un médicament et activez son point de terminaison API pour obtenir un jeton limité à ce seul médicament.",
     "tokenNamePlaceholder": "Nom du jeton (par exemple Raccourci iPhone)",
     "tokenCreated": "Jeton créé — copiez-le maintenant ! Il ne sera plus affiché.",
     "tokenCopy": "Copier le jeton",
@@ -5531,8 +5717,16 @@
         "revokeAllDone": "{count} appareil(s) de confiance oublié(s).",
         "unnamed": "Appareil inconnu",
         "current": "Cet appareil",
-        "expires": "De confiance jusqu'au {date}"
-      }
+        "expires": "De confiance jusqu'au {date}",
+        "revokeConfirmTitle": "Ne plus faire confiance à cet appareil ?",
+        "revokeConfirmBody": "Il redemandera ton deuxième facteur à la prochaine connexion depuis cet appareil.",
+        "revokeAllConfirmTitle": "Ne plus faire confiance à aucun appareil ?",
+        "revokeAllConfirmBody": "Chaque appareil redemandera ton deuxième facteur à la prochaine connexion, celui-ci compris."
+      },
+      "revokeSessionConfirmTitle": "Déconnecter cet appareil ?",
+      "revokeSessionConfirmBody": "{device} devra se reconnecter. Ce qui y est enregistré n'est pas affecté.",
+      "signOutEverywhereConfirmTitle": "Déconnecter tous les autres appareils ?",
+      "signOutEverywhereConfirmBody": "Chaque appareil sauf celui-ci devra se reconnecter. Celui-ci reste connecté. Rien de ce que tu as enregistré n'est affecté."
     },
     "privacy": {
       "intro": {
@@ -5632,10 +5826,34 @@
       "rate_limited": "Trop de tentatives de connexion. Attends un instant et réessaie.",
       "generic": "Erreur inconnue lors de la connexion. Relance la connexion."
     },
+    "appleHealth": {
+      "title": "Apple Health",
+      "description": "La synchronisation en direct passe par l’app HealthLog pour iOS, et non par une connexion web ou OAuth.",
+      "status": {
+        "checking": "Vérification des données Apple Health…",
+        "dataReceived": "Données Apple Health reçues",
+        "setup": "Configurer dans l’app iOS",
+        "unavailable": "Statut Apple Health indisponible"
+      },
+      "lastDataLabel": "Dernières données Apple Health :",
+      "setupTitle": "Activer la synchronisation en direct",
+      "permissionStep": "Dans l’app HealthLog pour iOS, ouvre Réglages → Apple Health et autorise les catégories de santé que tu souhaites partager.",
+      "backgroundStep": "Laisse l’actualisation en arrière-plan activée. L’app synchronise automatiquement les nouvelles données au premier plan et lorsque iOS lui accorde du temps en arrière-plan.",
+      "importNote": "Besoin d’un ancien historique ou impossible d’utiliser l’app iOS ? L’envoi XML/ZIP Apple Health est une solution ponctuelle et n’active pas la synchronisation en direct.",
+      "importAction": "Ouvrir l’import ponctuel"
+    },
     "garminInfo": {
       "title": "Garmin",
       "body": "Garmin n'a pas de connexion directe ici. Connecte-le via Apple Health (iOS) ou Google Health Connect (Android). Les scores propriétaires de Garmin — Body Battery, Training Load, statut VFC, VO₂ max — ne sont partagés par Garmin avec aucune des deux plateformes.",
       "docsLink": "Lire le guide"
+    },
+    "glucoseReference": {
+      "title": "Plage de référence du glucose",
+      "description": "La plage à laquelle vos glycémies sont comparées.",
+      "enable": "Utiliser la plage cible diabète",
+      "explainer": "Désactivé, les valeurs sont comparées à la plage de référence générale non diabétique. Activé, elles sont comparées à la plage cible glycémique plus stricte des ADA Standards of Care, et le Coach fonde ses remarques sur le glucose sur cette plage. Vos propres valeurs cibles personnalisées ci-dessous restent prioritaires.",
+      "disclaimer": "Ceci sélectionne une plage de référence. Ce n'est pas un diagnostic, ce n'est jamais déduit d'une mesure, et l'application n'en tire aucune conséquence clinique. Les cibles qui s'appliquent à vous relèvent de votre médecin.",
+      "error": "Le réglage n'a pas pu être enregistré."
     }
   },
   "admin": {
@@ -7374,7 +7592,7 @@
     "referenceLabel": "Référence",
     "readingsCount": "{count} mesures",
     "deleteConfirmTitle": "Supprimer le résultat d'analyse ?",
-    "deleteConfirmDescription": "Ce résultat d'analyse sera définitivement supprimé.",
+    "deleteConfirmDescription": "Ce résultat d'analyse sera supprimé. Vous pourrez annuler cette action pendant un court instant juste après.",
     "deletedToast": "Résultat supprimé",
     "deleteError": "Impossible de supprimer le résultat",
     "loadError": "Impossible de charger les résultats",
@@ -7853,7 +8071,7 @@
     },
     "deleteConfirm": {
       "title": "Supprimer cet épisode ?",
-      "body": "« {label} » et tous ses relevés quotidiens seront supprimés. Cette action est irréversible."
+      "body": "« {label} » et tous ses relevés quotidiens seront supprimés. Vous pourrez annuler cette action pendant un court instant juste après."
     },
     "vital": {
       "RESTING_HEART_RATE": "Fréquence cardiaque au repos",
@@ -7936,6 +8154,11 @@
         "review_due": "Point d'étape dû",
         "reviewed": "Évalué"
       }
+    },
+    "refusal": {
+      "outOfScope": "Je peux uniquement t'aider avec les données de santé de ton journal : mesures, médicaments, humeur, tendances. Je ne réponds pas aux questions en dehors de ce cadre.",
+      "promptInjection": "J'ai repéré des instructions qui cherchent à contourner mes consignes. Je suis le Coach HealthLog et je résume uniquement tes propres données de santé — reformule ta question dans ce cadre, s'il te plaît.",
+      "conversationPoisoned": "Un message précédent de cette conversation contient des instructions qui cherchent à contourner mes consignes. Démarre une nouvelle conversation, s'il te plaît."
     }
   },
   "safety": {
@@ -8188,7 +8411,9 @@
         "finally": "Finally …"
       }
     },
-    "openDetail": "Voir les détails"
+    "openDetail": "Voir les détails",
+    "historyLoadError": "Ton historique d'évaluations n'a pas pu être chargé",
+    "historyLoadErrorHint": "Cela ne veut pas dire que tu n'as aucun résultat : la liste n'a pas pu être récupérée. Réessaie."
   },
   "records": {
     "disclaimer": "Ce sont vos propres informations, pas un diagnostic médical. HealthLog ne diagnostique pas, ne traite pas et ne les interprète pas.",
@@ -8397,7 +8622,13 @@
       "title": "Détails du document",
       "summary": {
         "title": "Résumé",
-        "pending": "Le résumé est en cours de préparation."
+        "pending": "Le résumé est en cours de préparation.",
+        "none": "Aucun résumé n’a encore été généré pour ce document.",
+        "withheld": "Un résumé a été généré mais n’a pas passé le contrôle de sécurité, il n’est donc pas affiché. Vous pouvez réessayer ou lire le document lui-même.",
+        "unavailable": "Aucun résumé n’a pu être généré pour ce document.",
+        "generate": "Générer le résumé",
+        "regenerate": "Regénérer",
+        "generating": "Génération…"
       },
       "loadError": "Impossible de charger ce document.",
       "saveError": "Impossible d'enregistrer la modification.",
@@ -8479,7 +8710,6 @@
       "close": "Masquer"
     },
     "ai": {
-      "statusAiRead": "Lu par l’IA",
       "readDone": "L’IA a lu votre document.",
       "read": "Lire avec l’IA",
       "reread": "Relire",
@@ -8635,6 +8865,7 @@
       "quickAddCustomPlaceholder": "250",
       "quickAddSubmit": "Ajouter",
       "quickAddError": "Échec de l'enregistrement — réessayez.",
+      "quickAddSuccess": "{amount} mL d’eau ajoutés.",
       "editTotal": "Modifier le total du jour"
     },
     "caffeine": {
@@ -8645,7 +8876,8 @@
       "rowMeta": "{days} sur {window} jours · réf. {value} {unit} (EFSA)",
       "rowMetaNoRef": "{days} sur {window} jours",
       "footer": "{tracked} des {total} micronutriments suivis ont des données sur cette période.",
-      "emptyTitle": "Aucune donnée de micronutriments synchronisée pour l'instant"
+      "emptyTitle": "Aucune donnée de micronutriments synchronisée pour l'instant",
+      "loadError": "Tes données de nutriments n'ont pas pu être chargées"
     },
     "sparseNote": "Une valeur basse ici signifie généralement un suivi partiel, pas une carence — les totaux journaliers Apple Health reflètent ce que vos applis ont enregistré, pas l'apport alimentaire total."
   },
@@ -8661,8 +8893,11 @@
     "item": {
       "doseWindow": {
         "title": "Médicament à prendre",
-        "body": "Une dose est prévue aujourd'hui.",
-        "bodyNamed": "{name} est prévu aujourd'hui."
+        "body": "Une dose est bientôt à prendre.",
+        "bodyNamed": "{name} est bientôt à prendre.",
+        "overdueTitle": "Médicament en retard",
+        "overdueBody": "Une dose est en retard.",
+        "overdueBodyNamed": "{name} est en retard."
       },
       "preventiveCare": {
         "title": "Examen à faire",
@@ -8716,7 +8951,8 @@
       "deltaVsBaseline": "{delta} par rapport à ta référence",
       "deltaFlat": "Conforme à ta référence",
       "sleepPending": "Le sommeil de la nuit dernière n'est pas encore arrivé — la lecture du jour est provisoire.",
-      "readFullBriefing": "Lire le briefing complet",
+      "justIn": "Vient d'arriver",
+      "justInAt": "Vient d'arriver · {time}",
       "worthALook": "À regarder",
       "allClear": "Rien ne requiert ton attention aujourd'hui.",
       "ringLink": "Ouvrir les détails de {metric}"

messages/it.json

@@ -42,7 +42,64 @@
     "hidePassword": "Nascondi password",
     "learnMore": "Scopri di più",
     "dismiss": "Ignora",
-    "moreInfo": "Maggiori informazioni"
+    "moreInfo": "Maggiori informazioni",
+    "durationHoursMinutes": "{hours} h {minutes} min",
+    "durationMinutes": "{minutes} min"
+  },
+  "apiErrors": {
+    "measurement": {
+      "create": { "invalid": "Controlla i dati della misurazione e riprova." },
+      "duplicate_timestamp": "Esiste già una misurazione per questo orario."
+    },
+    "mood": {
+      "list": { "invalid": "I filtri dell’elenco dell’umore non sono validi." },
+      "create": { "invalid": "Controlla la voce dell’umore e riprova." },
+      "update": { "invalid": "Controlla la voce dell’umore e riprova." },
+      "duplicate_timestamp": "Esiste già una voce dell’umore per questo orario.",
+      "not_found": "Questa voce dell’umore non è più disponibile.",
+      "ratedFactor": {
+        "out_of_range": "Una valutazione non rientra nell’intervallo consentito."
+      }
+    },
+    "labs": {
+      "create": {
+        "invalid": "Controlla il risultato di laboratorio e riprova."
+      },
+      "result": {
+        "notFound": "Questo risultato di laboratorio non è più disponibile."
+      },
+      "biomarker": {
+        "notFound": "Questo biomarcatore non è più disponibile.",
+        "duplicate": "Esiste già un biomarcatore con questo nome.",
+        "create": { "invalid": "Controlla i dati del biomarcatore e riprova." },
+        "update": {
+          "invalid": "Controlla i dati del biomarcatore e riprova.",
+          "referenceRangeInvalid": "Il valore di riferimento inferiore non può superare quello superiore."
+        }
+      },
+      "update": {
+        "invalid": "Controlla il risultato di laboratorio e riprova.",
+        "linkedFieldsImmutable": "Modifica il biomarcatore per cambiare nome, unità, pannello o intervallo di riferimento.",
+        "qualitativeExpected": "Inserisci un risultato testuale per questa lettura qualitativa.",
+        "numericExpected": "Inserisci un numero per questa lettura numerica.",
+        "referenceRangeInvalid": "Il valore di riferimento inferiore non può superare quello superiore."
+      }
+    },
+    "onboarding": {
+      "disclaimer": { "invalid": "Conferma nuovamente l’avviso medico." },
+      "tour": {
+        "invalid": "Non è stato possibile salvare l’avanzamento del tour."
+      },
+      "complete": { "invalid": "Controlla i dati del profilo e riprova." },
+      "user": { "notFound": "Impossibile trovare il tuo account." },
+      "step": {
+        "rateLimited": "Troppi tentativi. Attendi e riprova.",
+        "invalid": "Non è stato possibile salvare questo passaggio introduttivo.",
+        "completed": "La procedura introduttiva è già completata.",
+        "outOfOrder": "I tuoi progressi sono cambiati. Aggiorna la pagina e continua.",
+        "concurrent": "I tuoi progressi sono cambiati. Aggiorna la pagina e continua."
+      }
+    }
   },
   "doctorReport": {
     "title": "Rapporto sanitario",
@@ -253,7 +310,9 @@
       "medication": "Farmaco",
       "medicationDescription": "Segna una dose come assunta",
       "mood": "Umore",
-      "moodDescription": "Registra umore e tag"
+      "moodDescription": "Registra umore e tag",
+      "water": "Acqua",
+      "waterDescription": "Aggiungi rapidamente l’acqua bevuta"
     },
     "cycle": "Ciclo",
     "labs": "Esami",
@@ -356,6 +415,7 @@
     "quickAddMeasurement": "Registra misurazione",
     "quickAddMood": "Registra umore",
     "quickAddMedicationIntake": "Registra assunzione",
+    "quickAddWater": "Registra acqua",
     "customizeDashboard": "Personalizza dashboard",
     "medicationIntakeQuickAdd": {
       "sheetTitle": "Registra assunzione del farmaco",
@@ -400,8 +460,10 @@
     "staleHint": "Ultimo valore {count} g fa",
     "staleHintWeeksOne": "Ultimo valore 1 settimana fa",
     "staleHintWeeksOther": "Ultimo valore {count} settimane fa",
+    "staleHintWeeksFew": "Ultimo valore {count} settimane fa",
     "staleHintMonthsOne": "Ultimo valore 1 mese fa",
     "staleHintMonthsOther": "Ultimo valore {count} mesi fa",
+    "staleHintMonthsFew": "Ultimo valore {count} mesi fa",
     "recentWorkouts": {
       "title": "Allenamenti recenti",
       "viewAll": "Vedi tutti",
@@ -421,7 +483,9 @@
         "steps": "Passi",
         "totalBodyWater": "Acqua corporea totale",
         "boneMass": "Massa ossea",
-        "oxygenSaturation": "Saturazione di ossigeno"
+        "oxygenSaturation": "Saturazione di ossigeno",
+        "mood": "Umore",
+        "bmi": "IMC"
       },
       "unit": {
         "weight": "kg",
@@ -433,7 +497,9 @@
         "steps": "passi",
         "totalBodyWater": "kg",
         "boneMass": "kg",
-        "oxygenSaturation": "%"
+        "oxygenSaturation": "%",
+        "mood": "/5",
+        "bmi": "kg/m²"
       }
     }
   },
@@ -574,7 +640,7 @@
     "bulkDeleteSuccess": "{count} misurazioni eliminate",
     "bulkDeleteError": "Errore durante l'eliminazione delle misurazioni selezionate",
     "bulkDeleteConfirmTitle": "Eliminare {count} misurazioni?",
-    "bulkDeleteConfirmBody": "Le {count} misurazioni selezionate verranno eliminate definitivamente.",
+    "bulkDeleteConfirmBody": "Le {count} misurazioni selezionate verranno eliminate. Subito dopo potrai annullare l’operazione per un breve momento.",
     "typePhq9Score": "Punteggio PHQ-9",
     "typeGad7Score": "Punteggio GAD-7",
     "typeGripStrength": "Forza di presa",
@@ -592,6 +658,7 @@
     "statusPresent": "Monitorato",
     "statusAbsent": "Non ancora monitorato",
     "statusModuleOff": "Disattivato",
+    "loadError": "Impossibile caricare lo stato di monitoraggio.",
     "connectCta": "Collega una fonte",
     "viewCta": "Visualizza",
     "ecg": {
@@ -599,7 +666,7 @@
     },
     "watchdog": {
       "title": "Monitoraggio automatico",
-      "description": "HealthLog osserva anche silenziosamente in background — notifiche di ritmo irregolare e disturbi respiratori da un orologio connesso, avvisi di scostamento dalla tua base di riferimento, e variazioni degne di nota tra i tuoi due ultimi pannelli di laboratorio — mostrando una scheda solo quando qualcosa emerge. Nessuna scheda visibile è un buon segno, non una funzione mancante."
+      "description": "HealthLog osserva anche silenziosamente in background — notifiche di ritmo irregolare e disturbi respiratori da un orologio connesso, avvisi di scostamento dalla tua base di riferimento, e variazioni degne di nota tra i tuoi due ultimi pannelli di laboratorio — mostrando una scheda solo quando qualcosa emerge. Se almeno una di queste fonti è collegata, nessuna scheda visibile è un buon segno, non una funzione mancante; se non ne è ancora collegata nessuna, semplicemente non c'è ancora nulla sotto controllo."
     }
   },
   "mood": {
@@ -721,7 +788,7 @@
     "bulkDeleteSuccess": "{count} voci eliminate",
     "bulkDeleteError": "Errore durante l'eliminazione delle voci selezionate",
     "bulkDeleteConfirmTitle": "Eliminare {count} voci?",
-    "bulkDeleteConfirmBody": "Le {count} voci dell'umore selezionate verranno eliminate definitivamente.",
+    "bulkDeleteConfirmBody": "Le {count} voci dell'umore selezionate verranno eliminate. Subito dopo potrai annullare l’operazione per un breve momento.",
     "customize": "Personalizza i tag dell’umore",
     "addTagInline": "Aggiungi tag",
     "manage": {
@@ -1678,7 +1745,10 @@
         "packagingDefaultPackLabel": "Dimensione confezione predefinita (unità)",
         "packagingDefaultPackHelper": "Precompila la quantità quando registri nuove confezioni (1–1000). Lascia vuoto se non applicabile.",
         "packagingSuccess": "Dati confezione salvati",
-        "packagingFailed": "Salvataggio non riuscito"
+        "packagingFailed": "Salvataggio non riuscito",
+        "addManufacturerLabel": "Produttore",
+        "addDoseStrengthLabel": "Dosaggio",
+        "addDoseStrengthHint": "Come stampato sul contenitore, ad es. 5 mg/0,5 ml."
       },
       "erweitert": {
         "group": {
@@ -1978,6 +2048,61 @@
     "notAvailableForCompliance": "Confronto non disponibile per l’aderenza"
   },
   "insights": {
+    "correlation": {
+      "direction": {
+        "higher": "salire",
+        "lower": "scendere"
+      },
+      "weekdayDirection": {
+        "above": "sopra",
+        "below": "sotto"
+      },
+      "channelFactor": "la valutazione di {factor}",
+      "channel": {
+        "WEIGHT": "il peso",
+        "BLOOD_GLUCOSE": "la glicemia",
+        "BLOOD_PRESSURE_SYS": "la pressione sistolica",
+        "BLOOD_PRESSURE_DIA": "la pressione diastolica",
+        "ACTIVITY_STEPS": "i passi giornalieri",
+        "SLEEP_DURATION": "la durata del sonno",
+        "HEART_RATE_VARIABILITY": "la variabilità della frequenza cardiaca",
+        "RESTING_HEART_RATE": "la frequenza cardiaca a riposo",
+        "TIME_IN_DAYLIGHT": "il tempo alla luce del giorno",
+        "MOOD": "l'umore",
+        "PULSE": "il polso a riposo",
+        "MEDICATION_COMPLIANCE": "l'aderenza ai farmaci",
+        "SYMPTOM_SEVERITY": "la gravità dei sintomi",
+        "ENV_TEMP_MEAN": "la temperatura giornaliera",
+        "ENV_TEMP_MIN": "la temperatura minima notturna",
+        "ENV_SUNSHINE": "il soleggiamento",
+        "ENV_DAYLIGHT": "la luce del giorno",
+        "ENV_PRECIP": "le precipitazioni",
+        "ENV_PRESSURE_MEAN": "la pressione atmosferica",
+        "ENV_PRESSURE_DELTA": "l'oscillazione di pressione nella giornata"
+      },
+      "daily": {
+        "high": "Quando {behaviour} sale, {outcome} del giorno dopo tende a {direction} nei tuoi dati — un andamento da osservare, non una causa.",
+        "moderate": "Quando {behaviour} sale, {outcome} del giorno dopo sembra tendere a {direction}, per quanto emerge finora — un andamento da osservare, non una causa.",
+        "faint": "Quando {behaviour} sale, al più si intravede un debole indizio che {outcome} del giorno dopo tenda a {direction} nei tuoi dati — troppo lieve per farci affidamento, mai una causa."
+      },
+      "lab": {
+        "default": "Valori di {lab} più alti si accompagnano al fatto che {outcome} tende a {direction} negli stessi periodi dei tuoi dati — un'associazione da tenere d'occhio con il tuo medico, mai una causa.",
+        "faint": "Valori di {lab} più alti lasciano al più intravedere che {outcome} tenda a {direction} negli stessi periodi dei tuoi dati — troppo lieve per farci affidamento, un'associazione da discutere con il tuo medico, mai una causa."
+      },
+      "hypothesis": {
+        "bpCompliance": {
+          "support": "Una maggiore aderenza ai farmaci si accompagna a valori sistolici più bassi — un andamento da osservare.",
+          "surprising": "L'aderenza e la sistolica si muovono insieme nei tuoi dati — sorprendente; parlane con il tuo medico prima di modificare qualcosa.",
+          "none": "L'aderenza e la sistolica non si muovono insieme in modo marcato in questo periodo."
+        },
+        "moodPulse": {
+          "support": "I giorni di umore più basso si accompagnano a un polso a riposo più alto — un andamento da osservare.",
+          "surprising": "I giorni di umore migliore si accompagnano a un polso a riposo più alto nei tuoi dati — sorprendente.",
+          "none": "L'umore e il polso a riposo non si muovono insieme in modo marcato in questo periodo."
+        },
+        "weightWeekday": "Il peso del {weekday} è {delta} kg {direction} la tua media degli altri giorni — un andamento da osservare."
+      }
+    },
     "noAnalysisYet": "Ancora nessuna valutazione.",
     "assessmentPreparing": "Preparazione della valutazione…",
     "emptyTitle": "Dati ancora insufficienti",
@@ -2264,6 +2389,13 @@
       "historyEmpty": "Le tue conversazioni compaiono qui. Fai una domanda per iniziare.",
       "historyDeleteAria": "Elimina conversazione",
       "historyDeleted": "Conversazione eliminata",
+      "rename": {
+        "action": "Rinomina conversazione",
+        "input": "Titolo della conversazione",
+        "save": "Salva titolo",
+        "cancel": "Annulla rinomina",
+        "error": "Impossibile salvare il titolo della conversazione."
+      },
       "historySearchEmpty": "Nessuna conversazione corrisponde alla tua ricerca.",
       "historyLoadingMore": "Caricamento…",
       "sourcesTitle": "A cosa accedo",
@@ -2402,10 +2534,6 @@
       "settingsClustersHint": "Scegli quali gruppi di dati il Coach può leggere. Più dati significano risposte più ricche e un prompt più grande.",
       "settingsClusterNoData": "Ancora nessun dato",
       "sourcesMemberCount": "{count} metriche",
-      "dictate": "Detta",
-      "dictateStop": "Interrompi dettatura",
-      "voiceUnsupported": "L'inserimento vocale non è supportato in questo browser",
-      "dictateError": "Impossibile avviare l'inserimento vocale. Controlla l'autorizzazione del microfono e riprova.",
       "showConversations": "Mostra conversazioni",
       "hideConversations": "Nascondi conversazioni",
       "heroGreeting": "Chiedimi qualcosa sui tuoi dati",
@@ -2502,10 +2630,13 @@
     "relativeJustNow": "proprio ora",
     "relativeMinutesAgoOne": "{count} minuto fa",
     "relativeMinutesAgoOther": "{count} minuti fa",
+    "relativeMinutesAgoFew": "{count} minuti fa",
     "relativeHoursAgoOne": "{count} ora fa",
     "relativeHoursAgoOther": "{count} ore fa",
+    "relativeHoursAgoFew": "{count} ore fa",
     "relativeDaysAgoOne": "{count} giorno fa",
     "relativeDaysAgoOther": "{count} giorni fa",
+    "relativeDaysAgoFew": "{count} giorni fa",
     "navOverview": "Panoramica",
     "navCatalog": "Tutte le metriche",
     "navBloodPressure": "Pressione arteriosa",
@@ -2665,11 +2796,11 @@
         "fatFreeMassTitle": "Massa magra",
         "fatFreeMassBody": "La massa magra è tutto ciò che nel corpo non è grasso: muscoli, ossa, organi e acqua. Mantenerla o aumentarla mentre si perde peso indica di solito una composizione corporea più sana.",
         "fatMassTitle": "Massa grassa",
-        "fatMassBody": "La massa grassa è il peso totale del grasso nel corpo. Un po' di grasso è essenziale per gli ormoni e le riserve di energia, ma un eccesso — soprattutto sull'addome — aumenta il rischio per la salute a lungo termine.",
+        "fatMassBody": "La massa grassa è il peso totale del grasso nel corpo. Un po' di grasso è essenziale per gli ormoni e le riserve di energia, ma un eccesso — soprattutto sull'addome — aumenta il rischio per la salute a lungo termine (WHO 2024).",
         "muscleMassTitle": "Massa muscolare",
         "muscleMassBody": "La massa muscolare è il peso stimato dei muscoli del corpo. Più muscolo sostiene forza, metabolismo e mobilità, e di solito richiede impegno attivo per essere mantenuto con l'età.",
         "visceralFatTitle": "Grasso viscerale",
-        "visceralFatBody": "Il grasso viscerale è il grasso depositato in profondità nell'addome, intorno agli organi. A differenza del grasso sottocutaneo, un livello elevato è strettamente legato a malattie cardiache e diabete di tipo 2, quindi più basso è in genere meglio.",
+        "visceralFatBody": "Il grasso viscerale è il grasso depositato in profondità nell'addome, intorno agli organi. A differenza del grasso sottocutaneo, un livello elevato è strettamente legato a malattie cardiache e diabete di tipo 2 (AHA, Circulation 2021), quindi più basso è in genere meglio. La scala mostra un valore senza unità di misura (circa 1–12 è l'intervallo salutare, 13 e oltre è elevato); si tratta di una scala distinta dalle soglie in cm² ottenute per immagini che i clinici utilizzano, e non è intercambiabile con esse.",
         "leanBodyMassTitle": "Massa magra corporea",
         "leanBodyMassBody": "La massa magra corporea è il peso totale meno il grasso: muscoli, ossa, organi e acqua insieme. Seguirla accanto al peso mostra se i cambiamenti derivano dal muscolo o dal grasso.",
         "flightsClimbedTitle": "Piani saliti",
@@ -2699,7 +2830,7 @@
         "audioEventsTitle": "Eventi sonori intensi",
         "audioEventsBody": "Gli eventi sonori intensi segnalano i momenti in cui il rumore intorno a te ha raggiunto un livello che può danneggiare l'udito con esposizione sufficiente. Eventi frequenti sono un invito a cercare un ambiente più silenzioso o protezioni acustiche.",
         "daylightTitle": "Tempo alla luce del giorno",
-        "daylightBody": "Il tempo alla luce del giorno è quanto trascorri sotto la luce esterna ogni giorno. La luce diurna regolare sostiene un sano ritmo sonno-veglia e l'umore, e il tempo all'aperto è collegato alla salute degli occhi.",
+        "daylightBody": "Il tempo alla luce del giorno è quanto trascorri sotto la luce esterna ogni giorno. La luce diurna regolare sostiene un sano ritmo sonno-veglia e l'umore (CDC 2024), e il tempo all'aperto è collegato alla salute degli occhi.",
         "bloodGlucoseTitle": "Glicemia",
         "bloodGlucoseBody": "La glicemia è la quantità di zucchero nel sangue, la principale fonte di energia del corpo. Sale dopo i pasti e si stabilizza tra un pasto e l'altro; valori che restano alti nel tempo possono indicare diabete o prediabete.",
         "skinTemperatureTitle": "Temperatura cutanea",
@@ -2711,7 +2842,7 @@
         "wristTemperatureTitle": "Temperatura del polso",
         "wristTemperatureBody": "La temperatura del polso viene misurata mentre dormi ed è indicata come differenza dal tuo valore di riferimento, non come valore assoluto. Un valore stabile è normale, mentre un aumento prolungato può indicare malattia, allenamento intenso o un cambiamento del ciclo.",
         "fallsTitle": "Cadute",
-        "fallsBody": "Qui vengono contate le cadute forti rilevate dal tuo wearable. L'obiettivo è zero; un numero in aumento è un segnale di rischio di mobilità da segnalare a un medico, soprattutto per le persone anziane.",
+        "fallsBody": "Qui vengono contate le cadute forti rilevate dal tuo wearable. L'obiettivo è zero; un numero in aumento è un segnale di rischio di mobilità da segnalare a un medico, soprattutto per le persone anziane (CDC STEADI 2024).",
         "sixMinuteWalkTitle": "Distanza nel cammino di 6 minuti",
         "sixMinuteWalkBody": "È una stima di quanto potresti camminare in sei minuti, un classico test clinico di mobilità e resistenza cardiopolmonare. Il valore del wearable è un'approssimazione, non il test clinico supervisionato; ciò che conta è la tendenza stabile o in aumento.",
         "stairAscentSpeedTitle": "Velocità in salita scale",
@@ -2759,7 +2890,8 @@
       },
       "valuesBack": "Torna a Insights",
       "valuesBackToMetric": "Torna a {metric}",
-      "scoresBack": "Torna a Insights"
+      "scoresBack": "Torna a Insights",
+      "ecgDescription": "Registrazioni ECG a singola derivazione dal tuo dispositivo, ciascuna con il risultato del dispositivo. HealthLog mostra il tracciato e la registrazione, ma non interpreta l'onda."
     },
     "sleep": {
       "title": "Sonno",
@@ -2798,9 +2930,9 @@
       "debt": {
         "title": "Debito di sonno",
         "value": "{hours} h {minutes} min in meno",
-        "caption": "Deficit cumulato nelle ultime {nights} notti",
+        "caption": "Bilancio in sospeso nelle ultime {nights} notti",
         "clearValue": "In pari",
-        "clearCaption": "Nessun deficit accumulato nelle ultime {nights} notti",
+        "clearCaption": "Niente in sospeso nelle ultime {nights} notti",
         "learning": "Stiamo ancora misurando il tuo sonno — {counted} notti finora, ne mancano {remaining} per un bilancio affidabile.",
         "computedInfo": "Questa è la stima propria di HealthLog: un bilancio mobile tra fabbisogno e sonno delle ultime notti, che il sonno di recupero riduce. Può differire dal dato di debito di sonno nativo di un dispositivo indossabile, che usa un proprio modello di fabbisogno."
       },
@@ -2904,6 +3036,8 @@
     "navRecovery": "Recupero",
     "workouts": {
       "title": "Allenamenti",
+      "askWhy": "Perché",
+      "askWhyPrompt": "Perché questa sessione è andata così? Spiegami i miei dati di questa sessione.",
       "description": "Corse, uscite in bici, camminate e sessioni di forza recenti, deduplicati tra Apple Watch e Withings.",
       "emptyState": {
         "title": "Nessun allenamento",
@@ -2932,7 +3066,24 @@
         "hrChartTitle": "Frequenza cardiaca",
         "hrChartUnavailable": "I campioni di frequenza cardiaca al secondo non vengono salvati per questo allenamento.",
         "notFound": "Allenamento non trovato.",
-        "loading": "Caricamento allenamento…"
+        "loading": "Caricamento allenamento…",
+        "hrFromPulse": "Dai tuoi dati di frequenza cardiaca intorno a questa sessione",
+        "hrAxisMinutes": "min",
+        "sportAverageLabel": "La tua media recente:",
+        "zonesTitle": "Zone di sforzo",
+        "zonesCaption": "Come si è distribuito il tuo sforzo tra le zone di frequenza cardiaca.",
+        "zonesCaptionDevice": "Tempo per zona riportato dal tuo dispositivo.",
+        "exportGpx": "Esporta GPX",
+        "elevationTitle": "Dislivello",
+        "splitsTitle": "Parziali",
+        "splitsKm": "km",
+        "splitsTime": "Tempo",
+        "splitsPace": "Ritmo",
+        "thatDayTitle": "Quel giorno",
+        "dayPulse": "Battito",
+        "daySleep": "Sonno",
+        "dayMood": "Umore",
+        "insightTitle": "Analisi dell'attività"
       },
       "sport": {
         "walking": "Camminata",
@@ -2955,7 +3106,11 @@
         "crossTraining": "Cross-training",
         "mixedCardio": "Cardio misto",
         "other": "Altro"
-      }
+      },
+      "loadError": "Non è stato possibile caricare i tuoi allenamenti",
+      "loadMore": "Carica altri allenamenti",
+      "loadingMore": "Caricamento di altri allenamenti",
+      "loadMoreError": "Non è stato possibile caricare altri allenamenti"
     },
     "bloodGlucose": {
       "title": "Glicemia",
@@ -3898,7 +4053,10 @@
         "recordingsMany": "{count} registrazioni disponibili.",
         "latestResult": "Ultimo risultato del dispositivo: {result}.",
         "cta": "Vedi registrazioni"
-      }
+      },
+      "emptyTitle": "Ancora nessuna registrazione ECG",
+      "emptyDescription": "Le registrazioni ECG si sincronizzano da un dispositivo a singola derivazione compatibile. Non appena il dispositivo carica una registrazione, comparirà qui.",
+      "emptyCta": "Collega un dispositivo"
     },
     "intradayPulse": {
       "title": "L'andamento della tua giornata",
@@ -3917,7 +4075,8 @@
         "evening": "Un tratto elevato a riposo stasera — forse un po' di tensione.",
         "night": "Un tratto elevato a riposo durante la notte — forse un po' di tensione."
       }
-    }
+    },
+    "navEcg": "ECG"
   },
   "thresholds": {
     "defaultLabel": "Predefinito",
@@ -4397,7 +4556,7 @@
           "fullBackup": {
             "title": "Backup completo",
             "description": "Tutti i tuoi dati in un unico file JSON: misurazioni, farmaci, umore, ciclo, esami di laboratorio, episodi di malattia, allergie, anamnesi familiare e allenamenti. Stesso formato del backup automatico settimanale.",
-            "scopeNote": "I file originali dei documenti e i dati di percorso GPS/campionamento degli allenamenti non sono inclusi — scaricali separatamente dall'archivio documenti o dall'esportazione degli allenamenti.",
+            "scopeNote": "I metadati dei documenti e il riepilogo IA, se presente, sono inclusi in chiaro; i file originali dei documenti e i dati di percorso GPS/campionamento degli allenamenti non lo sono — scaricali separatamente dall'archivio documenti o dall'esportazione degli allenamenti.",
             "encryptToggle": "Cifra con una passphrase",
             "passphrasePlaceholder": "Passphrase (min. 12 caratteri)",
             "passphraseHelp": "Deriva la chiave dell'archivio con Argon2id e lo sigilla con AES-256-GCM. Salva il file con estensione .hlx.",
@@ -4428,6 +4587,7 @@
             "failed": "L'importazione non è riuscita.",
             "rowsImported": "{count} righe importate finora",
             "doneSummary": "Fatto: {imported} di {read} record importati, {skipped} record clinici saltati.",
+            "estimateWarning": "I totali cumulativi di {count} giorno/i sono stati stimati dalla fonte di esportazione più alta. Le statistiche native di Apple Salute restano autorevoli.",
             "phase": {
               "queued": "In coda…",
               "unpacking": "Estrazione dell'archivio…",
@@ -4586,7 +4746,9 @@
           "description": "Aggiungi un luogo e un intervallo di date: un viaggio o un tratto della tua cronologia passata. Il periodo prevale sulla tua residenza nei giorni che copre, così il meteo corrisponde a dove ti trovavi davvero. È così che correggi il passato.",
           "none": "Nessun periodo di posizione.",
           "add": "Aggiungi {label}",
-          "remove": "Rimuovi periodo di posizione"
+          "remove": "Rimuovi periodo di posizione",
+          "removeConfirmTitle": "Rimuovere questo viaggio?",
+          "removeConfirmBody": "Le misurazioni di quel periodo restano nel tuo archivio; sparisce solo la voce del viaggio."
         },
         "backfill": {
           "title": "Recupera i giorni passati",
@@ -4867,7 +5029,10 @@
           "surfaced": "Mostrato",
           "done": "Fatto",
           "dismissed": "Ignorato"
-        }
+        },
+        "deleteConfirmTitle": "Eliminare questo promemoria?",
+        "deleteConfirmBody": "Non verrà più mostrato. Quanto hai già registrato resta invariato.",
+        "deleteConfirmAction": "Elimina"
       },
       "aboutMe": {
         "title": "Su di me",
@@ -4913,6 +5078,16 @@
         "honesty": "L'accesso condiviso è un unico account IA con accesso eseguito che l'operatore ha collegato per tutti su questo server, non la tua chiave. Le richieste che vi effettui vengono usate per impostazione predefinita per addestrare i modelli del provider e nessun accordo sul trattamento dei dati le copre, i limiti orari e settimanali dell'account sono condivisi con tutti gli altri che hanno aderito, e i tuoi provider vengono comunque provati per primi. Attivalo solo se accetti questo compromesso.",
         "confirm": "Ho capito — usa la connessione condivisa",
         "cancel": "Annulla"
+      },
+      "consent": {
+        "title": "Consenso IA",
+        "activeSince": "Concesso il {date}. I tuoi dati sanitari possono essere inviati al provider configurato per le funzioni IA.",
+        "withdrawn": "Revocato. Nessun dato sanitario viene inviato a un provider IA; le funzioni IA restano disattivate.",
+        "withdraw": "Revoca il consenso",
+        "confirmBody": "Le funzioni IA si fermano subito. Nulla di quanto già registrato viene eliminato — usa Dati e privacy per esportare o cancellare il tuo archivio.",
+        "confirmWithdraw": "Revoca",
+        "regrantHint": "Per usare di nuovo le funzioni IA, attiva la lettura automatica dei documenti o concedi il consenso dall'app.",
+        "error": "Non è stato possibile salvare la revoca. Riprova."
       }
     },
     "dashboard": {
@@ -5099,7 +5274,8 @@
       "resumeError": "Riconnessione fallita"
     },
     "apiTokens": "Token API",
-    "apiTokensDescription": "Crea token API per registrare assunzioni di farmaci esterne (ad es. Comandi rapidi, automazioni).",
+    "apiTokensDescription": "Rivedi e revoca i token API per la registrazione esterna delle assunzioni di farmaci. I token vengono emessi per singolo farmaco dal relativo interruttore dell’endpoint API.",
+    "tokenMintMovedDescription": "I token vengono emessi per singolo farmaco. Apri un farmaco e attiva il suo endpoint API per ottenere un token valido solo per quel farmaco.",
     "tokenNamePlaceholder": "Nome del token (ad es. Comando rapido iPhone)",
     "tokenCreated": "Token creato — copialo ora! Non verrà mostrato di nuovo.",
     "tokenCopy": "Copia token",
@@ -5531,8 +5707,16 @@
         "revokeAllDone": "Dimenticati {count} dispositivo/i attendibile/i.",
         "unnamed": "Dispositivo sconosciuto",
         "current": "Questo dispositivo",
-        "expires": "Attendibile fino al {date}"
-      }
+        "expires": "Attendibile fino al {date}",
+        "revokeConfirmTitle": "Non fidarsi più di questo dispositivo?",
+        "revokeConfirmBody": "Al prossimo accesso da questo dispositivo chiederà di nuovo il secondo fattore.",
+        "revokeAllConfirmTitle": "Non fidarsi più di alcun dispositivo?",
+        "revokeAllConfirmBody": "Ogni dispositivo chiederà di nuovo il secondo fattore al prossimo accesso, questo compreso."
+      },
+      "revokeSessionConfirmTitle": "Disconnettere questo dispositivo?",
+      "revokeSessionConfirmBody": "{device} dovrà accedere di nuovo. Quanto registrato su di esso non viene toccato.",
+      "signOutEverywhereConfirmTitle": "Disconnettere tutti gli altri dispositivi?",
+      "signOutEverywhereConfirmBody": "Ogni dispositivo tranne questo dovrà accedere di nuovo. Questo resta connesso. Nulla di ciò che hai registrato viene toccato."
     },
     "privacy": {
       "intro": {
@@ -5632,10 +5816,34 @@
       "rate_limited": "Troppi tentativi di connessione. Attendi un momento e riprova.",
       "generic": "Errore sconosciuto durante la connessione. Riavvia la connessione."
     },
+    "appleHealth": {
+      "title": "Apple Health",
+      "description": "La sincronizzazione in tempo reale avviene tramite l’app HealthLog per iOS, non tramite una connessione web o OAuth.",
+      "status": {
+        "checking": "Controllo dei dati Apple Health…",
+        "dataReceived": "Dati Apple Health ricevuti",
+        "setup": "Configura nell’app iOS",
+        "unavailable": "Stato di Apple Health non disponibile"
+      },
+      "lastDataLabel": "Ultimi dati Apple Health:",
+      "setupTitle": "Attiva la sincronizzazione in tempo reale",
+      "permissionStep": "Nell’app HealthLog per iOS, apri Impostazioni → Apple Health e autorizza le categorie di salute che vuoi condividere.",
+      "backgroundStep": "Mantieni attivo l’aggiornamento in background. L’app sincronizza automaticamente i nuovi dati in primo piano e quando iOS concede tempo in background.",
+      "importNote": "Ti serve lo storico precedente o non puoi usare l’app iOS? Il caricamento XML/ZIP di Apple Health è un’alternativa una tantum e non attiva la sincronizzazione in tempo reale.",
+      "importAction": "Apri importazione una tantum"
+    },
     "garminInfo": {
       "title": "Garmin",
       "body": "Garmin non ha una connessione diretta qui. Collegalo tramite Apple Health (iOS) o Google Health Connect (Android). I punteggi proprietari di Garmin — Body Battery, Training Load, stato HRV, VO₂ max — non vengono condivisi da Garmin con nessuna delle due piattaforme.",
       "docsLink": "Leggi la guida"
+    },
+    "glucoseReference": {
+      "title": "Banda di riferimento della glicemia",
+      "description": "La banda con cui vengono valutati i tuoi valori glicemici.",
+      "enable": "Usa la banda obiettivo per il diabete",
+      "explainer": "Disattivato, i valori vengono valutati con la banda di riferimento generale non diabetica. Attivato, vengono valutati con la banda obiettivo glicemica più stretta degli ADA Standards of Care, e il Coach fonda su quella banda le sue osservazioni sulla glicemia. I tuoi valori obiettivo personalizzati qui sotto hanno comunque la precedenza.",
+      "disclaimer": "Questo seleziona una banda di riferimento. Non è una diagnosi, non viene mai dedotto da una misurazione e l'app non agisce clinicamente di conseguenza. Quali obiettivi valgano per te è una domanda per il tuo medico.",
+      "error": "Non è stato possibile salvare l'impostazione."
     }
   },
   "admin": {
@@ -7374,7 +7582,7 @@
     "referenceLabel": "Riferimento",
     "readingsCount": "{count} misurazioni",
     "deleteConfirmTitle": "Eliminare il risultato di laboratorio?",
-    "deleteConfirmDescription": "Questo risultato di laboratorio verrà eliminato definitivamente.",
+    "deleteConfirmDescription": "Questo risultato di laboratorio verrà eliminato. Subito dopo potrai annullare l’operazione per un breve momento.",
     "deletedToast": "Risultato eliminato",
     "deleteError": "Impossibile eliminare il risultato",
     "loadError": "Impossibile caricare i risultati",
@@ -7853,7 +8061,7 @@
     },
     "deleteConfirm": {
       "title": "Eliminare questo episodio?",
-      "body": "«{label}» e tutti i relativi registri giornalieri verranno rimossi. L'operazione non può essere annullata."
+      "body": "«{label}» e tutti i relativi registri giornalieri verranno rimossi. Subito dopo potrai annullare l’operazione per un breve momento."
     },
     "vital": {
       "RESTING_HEART_RATE": "Frequenza cardiaca a riposo",
@@ -7936,6 +8144,11 @@
         "review_due": "Verifica in scadenza",
         "reviewed": "Valutato"
       }
+    },
+    "refusal": {
+      "outOfScope": "Posso aiutarti solo con i dati di salute del tuo registro: misurazioni, farmaci, umore, tendenze. Non rispondo a domande al di fuori di questo ambito.",
+      "promptInjection": "Ho notato istruzioni che cercano di aggirare le mie direttive. Sono il Coach di HealthLog e riassumo soltanto i tuoi dati di salute — riformula la domanda in questi termini, per favore.",
+      "conversationPoisoned": "Un messaggio precedente di questa conversazione contiene istruzioni che cercano di aggirare le mie direttive. Inizia una nuova conversazione, per favore."
     }
   },
   "safety": {
@@ -8188,7 +8401,9 @@
         "finally": "Finally …"
       }
     },
-    "openDetail": "Mostra dettagli"
+    "openDetail": "Mostra dettagli",
+    "historyLoadError": "Non è stato possibile caricare la cronologia dei test",
+    "historyLoadErrorHint": "Questo non significa che non ci siano risultati: non è stato possibile recuperare l'elenco. Riprova."
   },
   "records": {
     "disclaimer": "Sono i tuoi dati, non una diagnosi medica. HealthLog non diagnostica, non cura e non li interpreta.",
@@ -8397,7 +8612,13 @@
       "title": "Dettagli del documento",
       "summary": {
         "title": "Riepilogo",
-        "pending": "Il riepilogo è in preparazione."
+        "pending": "Il riepilogo è in preparazione.",
+        "none": "Non è ancora stato generato alcun riepilogo per questo documento.",
+        "withheld": "Un riepilogo è stato generato ma non ha superato il controllo di sicurezza, quindi non viene mostrato. Puoi riprovare o leggere il documento stesso.",
+        "unavailable": "Non è stato possibile generare un riepilogo per questo documento.",
+        "generate": "Genera riepilogo",
+        "regenerate": "Genera di nuovo",
+        "generating": "Generazione…"
       },
       "loadError": "Impossibile caricare questo documento.",
       "saveError": "Impossibile salvare la modifica.",
@@ -8479,7 +8700,6 @@
       "close": "Nascondi"
     },
     "ai": {
-      "statusAiRead": "Letto dall’IA",
       "readDone": "L’IA ha letto il tuo documento.",
       "read": "Leggi con l’IA",
       "reread": "Leggi di nuovo",
@@ -8635,6 +8855,7 @@
       "quickAddCustomPlaceholder": "250",
       "quickAddSubmit": "Aggiungi",
       "quickAddError": "Salvataggio non riuscito. Riprova.",
+      "quickAddSuccess": "Aggiunti {amount} mL di acqua.",
       "editTotal": "Modifica il totale di oggi"
     },
     "caffeine": {
@@ -8645,7 +8866,8 @@
       "rowMeta": "{days} di {window} giorni · rif. {value} {unit} (EFSA)",
       "rowMetaNoRef": "{days} di {window} giorni",
       "footer": "{tracked} di {total} micronutrienti monitorati hanno dati in questo periodo.",
-      "emptyTitle": "Nessun dato sui micronutrienti ancora sincronizzato"
+      "emptyTitle": "Nessun dato sui micronutrienti ancora sincronizzato",
+      "loadError": "Non è stato possibile caricare i tuoi dati sui nutrienti"
     },
     "sparseNote": "Un valore basso qui di solito indica una registrazione poco frequente, non una carenza — i totali giornalieri di Apple Health riflettono ciò che le tue app hanno registrato, non l'apporto alimentare totale."
   },
@@ -8661,8 +8883,11 @@
     "item": {
       "doseWindow": {
         "title": "Farmaco da assumere",
-        "body": "Oggi è prevista una dose.",
-        "bodyNamed": "{name} è previsto oggi."
+        "body": "Una dose è prevista a breve.",
+        "bodyNamed": "{name} è previsto a breve.",
+        "overdueTitle": "Farmaco in ritardo",
+        "overdueBody": "Una dose è in ritardo.",
+        "overdueBodyNamed": "{name} è in ritardo."
       },
       "preventiveCare": {
         "title": "Controllo da fare",
@@ -8716,7 +8941,8 @@
       "deltaVsBaseline": "{delta} rispetto al tuo valore di riferimento",
       "deltaFlat": "In linea con il tuo valore di riferimento",
       "sleepPending": "Il sonno di stanotte non è ancora arrivato: la lettura di oggi è provvisoria.",
-      "readFullBriefing": "Leggi il briefing completo",
+      "justIn": "Appena arrivato",
+      "justInAt": "Appena arrivato · {time}",
       "worthALook": "Da tenere d'occhio",
       "allClear": "Oggi nulla richiede la tua attenzione.",
       "ringLink": "Apri i dettagli di {metric}"

messages/pl.json

@@ -42,7 +42,58 @@
     "hidePassword": "Ukryj hasło",
     "learnMore": "Dowiedz się więcej",
     "dismiss": "Odrzuć",
-    "moreInfo": "Więcej informacji"
+    "moreInfo": "Więcej informacji",
+    "durationHoursMinutes": "{hours} godz. {minutes} min",
+    "durationMinutes": "{minutes} min"
+  },
+  "apiErrors": {
+    "measurement": {
+      "create": { "invalid": "Sprawdź dane pomiaru i spróbuj ponownie." },
+      "duplicate_timestamp": "Pomiar dla tego czasu już istnieje."
+    },
+    "mood": {
+      "list": { "invalid": "Filtry listy nastroju są nieprawidłowe." },
+      "create": { "invalid": "Sprawdź wpis nastroju i spróbuj ponownie." },
+      "update": { "invalid": "Sprawdź wpis nastroju i spróbuj ponownie." },
+      "duplicate_timestamp": "Wpis nastroju dla tego czasu już istnieje.",
+      "not_found": "Ten wpis nastroju nie jest już dostępny.",
+      "ratedFactor": {
+        "out_of_range": "Ocena czynnika jest poza dozwolonym zakresem."
+      }
+    },
+    "labs": {
+      "create": { "invalid": "Sprawdź wynik badania i spróbuj ponownie." },
+      "result": { "notFound": "Ten wynik badania nie jest już dostępny." },
+      "biomarker": {
+        "notFound": "Ten biomarker nie jest już dostępny.",
+        "duplicate": "Biomarker o tej nazwie już istnieje.",
+        "create": { "invalid": "Sprawdź dane biomarkera i spróbuj ponownie." },
+        "update": {
+          "invalid": "Sprawdź dane biomarkera i spróbuj ponownie.",
+          "referenceRangeInvalid": "Dolna wartość referencyjna nie może przekraczać górnej."
+        }
+      },
+      "update": {
+        "invalid": "Sprawdź wynik badania i spróbuj ponownie.",
+        "linkedFieldsImmutable": "Edytuj biomarker, aby zmienić nazwę, jednostkę, panel lub zakres referencyjny.",
+        "qualitativeExpected": "Wprowadź wynik tekstowy dla tego odczytu jakościowego.",
+        "numericExpected": "Wprowadź liczbę dla tego odczytu ilościowego.",
+        "referenceRangeInvalid": "Dolna wartość referencyjna nie może przekraczać górnej."
+      }
+    },
+    "onboarding": {
+      "disclaimer": { "invalid": "Potwierdź ponownie informację medyczną." },
+      "tour": { "invalid": "Nie udało się zapisać postępu prezentacji." },
+      "complete": { "invalid": "Sprawdź dane profilu i spróbuj ponownie." },
+      "user": { "notFound": "Nie znaleziono Twojego konta." },
+      "step": {
+        "rateLimited": "Zbyt wiele prób. Zaczekaj i spróbuj ponownie.",
+        "invalid": "Nie udało się zapisać tego kroku wprowadzenia.",
+        "completed": "Wprowadzenie zostało już ukończone.",
+        "outOfOrder": "Twój postęp się zmienił. Odśwież stronę i kontynuuj.",
+        "concurrent": "Twój postęp się zmienił. Odśwież stronę i kontynuuj."
+      }
+    }
   },
   "doctorReport": {
     "title": "Raport zdrowotny",
@@ -253,7 +304,9 @@
       "medication": "Lek",
       "medicationDescription": "Oznacz dawkę jako przyjętą",
       "mood": "Nastrój",
-      "moodDescription": "Zapisz nastrój i tagi"
+      "moodDescription": "Zapisz nastrój i tagi",
+      "water": "Woda",
+      "waterDescription": "Szybko dodaj ilość wypitej wody"
     },
     "cycle": "Cykl",
     "labs": "Wyniki badań",
@@ -356,6 +409,7 @@
     "quickAddMeasurement": "Zarejestruj pomiar",
     "quickAddMood": "Zarejestruj nastrój",
     "quickAddMedicationIntake": "Zarejestruj przyjęcie",
+    "quickAddWater": "Zapisz wodę",
     "customizeDashboard": "Dostosuj pulpit",
     "medicationIntakeQuickAdd": {
       "sheetTitle": "Zarejestruj przyjęcie leku",
@@ -400,8 +454,10 @@
     "staleHint": "Ostatni odczyt {count} d temu",
     "staleHintWeeksOne": "Ostatni odczyt 1 tydzień temu",
     "staleHintWeeksOther": "Ostatni odczyt {count} tygodni temu",
+    "staleHintWeeksFew": "Ostatni odczyt {count} tygodnie temu",
     "staleHintMonthsOne": "Ostatni odczyt 1 miesiąc temu",
     "staleHintMonthsOther": "Ostatni odczyt {count} miesięcy temu",
+    "staleHintMonthsFew": "Ostatni odczyt {count} miesiące temu",
     "recentWorkouts": {
       "title": "Ostatnie treningi",
       "viewAll": "Zobacz wszystkie",
@@ -421,7 +477,9 @@
         "steps": "Kroki",
         "totalBodyWater": "Całkowita woda w organizmie",
         "boneMass": "Masa kostna",
-        "oxygenSaturation": "Saturacja tlenem"
+        "oxygenSaturation": "Saturacja tlenem",
+        "mood": "Nastrój",
+        "bmi": "BMI"
       },
       "unit": {
         "weight": "kg",
@@ -433,7 +491,9 @@
         "steps": "kroki",
         "totalBodyWater": "kg",
         "boneMass": "kg",
-        "oxygenSaturation": "%"
+        "oxygenSaturation": "%",
+        "mood": "/5",
+        "bmi": "kg/m²"
       }
     }
   },
@@ -574,7 +634,7 @@
     "bulkDeleteSuccess": "Usunięto pomiary: {count}",
     "bulkDeleteError": "Błąd podczas usuwania wybranych pomiarów",
     "bulkDeleteConfirmTitle": "Usunąć pomiary ({count})?",
-    "bulkDeleteConfirmBody": "Wybrane pomiary ({count}) zostaną trwale usunięte.",
+    "bulkDeleteConfirmBody": "Wybrane pomiary ({count}) zostaną usunięte. Zaraz po usunięciu możesz to przez chwilę cofnąć.",
     "typePhq9Score": "Wynik PHQ-9",
     "typeGad7Score": "Wynik GAD-7",
     "typeGripStrength": "Siła chwytu",
@@ -592,6 +652,7 @@
     "statusPresent": "Śledzone",
     "statusAbsent": "Jeszcze nieśledzone",
     "statusModuleOff": "Wyłączone",
+    "loadError": "Nie udało się załadować statusu śledzenia.",
     "connectCta": "Połącz źródło",
     "viewCta": "Zobacz",
     "ecg": {
@@ -599,7 +660,7 @@
     },
     "watchdog": {
       "title": "Automatyczny nadzór",
-      "description": "HealthLog dyskretnie obserwuje też dane w tle — powiadomienia o nieregularnym rytmie i zaburzeniach oddychania z podłączonego zegarka, alerty o odchyleniu od Twojej wartości bazowej oraz zauważalne zmiany między dwoma ostatnimi panelami badań laboratoryjnych — i pokazuje kartę tylko wtedy, gdy coś zwraca uwagę. Brak karty to dobry znak, a nie brakująca funkcja."
+      "description": "HealthLog dyskretnie obserwuje też dane w tle — powiadomienia o nieregularnym rytmie i zaburzeniach oddychania z podłączonego zegarka, alerty o odchyleniu od Twojej wartości bazowej oraz zauważalne zmiany między dwoma ostatnimi panelami badań laboratoryjnych — i pokazuje kartę tylko wtedy, gdy coś zwraca uwagę. Jeśli podłączone jest co najmniej jedno z tych źródeł, brak karty to dobry znak, a nie brakująca funkcja; jeśli żadne nie jest jeszcze podłączone, po prostu nic nie jest jeszcze monitorowane."
     }
   },
   "mood": {
@@ -721,7 +782,7 @@
     "bulkDeleteSuccess": "Usunięto wpisy: {count}",
     "bulkDeleteError": "Błąd podczas usuwania wybranych wpisów",
     "bulkDeleteConfirmTitle": "Usunąć wpisy ({count})?",
-    "bulkDeleteConfirmBody": "Wybrane wpisy nastroju ({count}) zostaną trwale usunięte.",
+    "bulkDeleteConfirmBody": "Wybrane wpisy nastroju ({count}) zostaną usunięte. Zaraz po usunięciu możesz to przez chwilę cofnąć.",
     "customize": "Dostosuj tagi nastroju",
     "addTagInline": "Dodaj tag",
     "manage": {
@@ -1678,7 +1739,10 @@
         "packagingDefaultPackLabel": "Domyślny rozmiar opakowania (jednostki)",
         "packagingDefaultPackHelper": "Wstępnie wypełnia ilość przy dodawaniu nowych opakowań (1–1000). Zostaw puste, jeśli nie dotyczy.",
         "packagingSuccess": "Zapisano dane opakowania",
-        "packagingFailed": "Zapis nie powiódł się"
+        "packagingFailed": "Zapis nie powiódł się",
+        "addManufacturerLabel": "Producent",
+        "addDoseStrengthLabel": "Moc",
+        "addDoseStrengthHint": "Zgodnie z nadrukiem na opakowaniu, np. 5 mg/0,5 ml."
       },
       "erweitert": {
         "group": {
@@ -1978,6 +2042,61 @@
     "notAvailableForCompliance": "Porównanie niedostępne dla przestrzegania"
   },
   "insights": {
+    "correlation": {
+      "direction": {
+        "higher": "wzrostu",
+        "lower": "spadku"
+      },
+      "weekdayDirection": {
+        "above": "powyżej",
+        "below": "poniżej"
+      },
+      "channelFactor": "ocena czynnika {factor}",
+      "channel": {
+        "WEIGHT": "waga",
+        "BLOOD_GLUCOSE": "poziom cukru we krwi",
+        "BLOOD_PRESSURE_SYS": "ciśnienie skurczowe",
+        "BLOOD_PRESSURE_DIA": "ciśnienie rozkurczowe",
+        "ACTIVITY_STEPS": "dzienna liczba kroków",
+        "SLEEP_DURATION": "długość snu",
+        "HEART_RATE_VARIABILITY": "zmienność rytmu serca",
+        "RESTING_HEART_RATE": "spoczynkowe tętno",
+        "TIME_IN_DAYLIGHT": "czas w świetle dziennym",
+        "MOOD": "nastrój",
+        "PULSE": "tętno spoczynkowe",
+        "MEDICATION_COMPLIANCE": "przyjmowanie leków",
+        "SYMPTOM_SEVERITY": "nasilenie objawów",
+        "ENV_TEMP_MEAN": "temperatura dobowa",
+        "ENV_TEMP_MIN": "nocna temperatura minimalna",
+        "ENV_SUNSHINE": "nasłonecznienie",
+        "ENV_DAYLIGHT": "światło dzienne",
+        "ENV_PRECIP": "opady",
+        "ENV_PRESSURE_MEAN": "ciśnienie atmosferyczne",
+        "ENV_PRESSURE_DELTA": "dobowa zmiana ciśnienia"
+      },
+      "daily": {
+        "high": "Gdy {behaviour} rośnie, {outcome} następnego dnia zwykle wykazuje tendencję do {direction} w Twoich danych — wzorzec wart obserwacji, nie przyczyna.",
+        "moderate": "Gdy {behaviour} rośnie, {outcome} następnego dnia wydaje się wykazywać tendencję do {direction}, na podstawie dostępnych danych — wzorzec wart obserwacji, nie przyczyna.",
+        "faint": "Gdy {behaviour} rośnie, w Twoich danych pojawia się co najwyżej słaba wskazówka, że {outcome} następnego dnia wykazuje tendencję do {direction} — zbyt słaba, by na niej polegać, nigdy przyczyna."
+      },
+      "lab": {
+        "default": "Wyższe wartości {lab} idą w parze z tym, że {outcome} wykazuje tendencję do {direction} w tych samych okresach w Twoich danych — zależność, którą warto obserwować z lekarzem, nigdy przyczyna.",
+        "faint": "Wyższe wartości {lab} co najwyżej słabo sugerują, że {outcome} wykazuje tendencję do {direction} w tych samych okresach w Twoich danych — zbyt słabo, by na tym polegać, zależność do omówienia z lekarzem, nigdy przyczyna."
+      },
+      "hypothesis": {
+        "bpCompliance": {
+          "support": "Lepsze przyjmowanie leków idzie w parze z niższymi wartościami skurczowymi — wzorzec wart obserwacji.",
+          "surprising": "Przyjmowanie leków i ciśnienie skurczowe zmieniają się razem w Twoich danych — zaskakujące; skonsultuj się z lekarzem, zanim coś zmienisz.",
+          "none": "Przyjmowanie leków i ciśnienie skurczowe nie zmieniają się wyraźnie razem w tym okresie."
+        },
+        "moodPulse": {
+          "support": "Dni z gorszym nastrojem idą w parze z wyższym tętnem spoczynkowym — wzorzec wart obserwacji.",
+          "surprising": "Dni z lepszym nastrojem idą w parze z wyższym tętnem spoczynkowym w Twoich danych — zaskakujące.",
+          "none": "Nastrój i tętno spoczynkowe nie zmieniają się wyraźnie razem w tym okresie."
+        },
+        "weightWeekday": "Waga w {weekday} jest {delta} kg {direction} Twojej średniej z pozostałych dni — wzorzec wart obserwacji."
+      }
+    },
     "noAnalysisYet": "Brak oceny.",
     "assessmentPreparing": "Przygotowywanie oceny…",
     "emptyTitle": "Jeszcze za mało danych",
@@ -2264,6 +2383,13 @@
       "historyEmpty": "Twoje rozmowy pojawią się tutaj. Zadaj pytanie, aby zacząć.",
       "historyDeleteAria": "Usuń rozmowę",
       "historyDeleted": "Rozmowa usunięta",
+      "rename": {
+        "action": "Zmień nazwę rozmowy",
+        "input": "Tytuł rozmowy",
+        "save": "Zapisz tytuł",
+        "cancel": "Anuluj zmianę nazwy",
+        "error": "Nie udało się zapisać tytułu rozmowy."
+      },
       "historySearchEmpty": "Żadna rozmowa nie pasuje do wyszukiwania.",
       "historyLoadingMore": "Wczytywanie…",
       "sourcesTitle": "Do czego mam dostęp",
@@ -2402,10 +2528,6 @@
       "settingsClustersHint": "Wybierz, które grupy danych Coach może czytać. Więcej danych to bogatsze odpowiedzi i większy prompt.",
       "settingsClusterNoData": "Brak danych",
       "sourcesMemberCount": "{count} wskaźników",
-      "dictate": "Dyktuj",
-      "dictateStop": "Zatrzymaj dyktowanie",
-      "voiceUnsupported": "Wprowadzanie głosowe nie jest obsługiwane w tej przeglądarce",
-      "dictateError": "Nie udało się uruchomić wprowadzania głosowego. Sprawdź uprawnienia mikrofonu i spróbuj ponownie.",
       "showConversations": "Pokaż rozmowy",
       "hideConversations": "Ukryj rozmowy",
       "heroGreeting": "Zapytaj mnie o cokolwiek na temat twoich danych",
@@ -2502,10 +2624,13 @@
     "relativeJustNow": "przed chwilą",
     "relativeMinutesAgoOne": "{count} minutę temu",
     "relativeMinutesAgoOther": "{count} minut temu",
+    "relativeMinutesAgoFew": "{count} minuty temu",
     "relativeHoursAgoOne": "{count} godzinę temu",
     "relativeHoursAgoOther": "{count} godzin temu",
+    "relativeHoursAgoFew": "{count} godziny temu",
     "relativeDaysAgoOne": "{count} dzień temu",
     "relativeDaysAgoOther": "{count} dni temu",
+    "relativeDaysAgoFew": "{count} dni temu",
     "navOverview": "Przegląd",
     "navCatalog": "Wszystkie metryki",
     "navBloodPressure": "Ciśnienie krwi",
@@ -2665,11 +2790,11 @@
         "fatFreeMassTitle": "Masa beztłuszczowa",
         "fatFreeMassBody": "Masa beztłuszczowa to wszystko w ciele, co nie jest tłuszczem — mięśnie, kości, narządy i woda. Utrzymanie lub jej budowanie przy spadku wagi zwykle wskazuje na zdrowszy skład ciała.",
         "fatMassTitle": "Masa tłuszczowa",
-        "fatMassBody": "Masa tłuszczowa to łączna waga tłuszczu w ciele. Pewna ilość tłuszczu jest niezbędna dla hormonów i magazynowania energii, ale jego nadmiar — zwłaszcza w okolicy brzucha — zwiększa długoterminowe ryzyko zdrowotne.",
+        "fatMassBody": "Masa tłuszczowa to łączna waga tłuszczu w ciele. Pewna ilość tłuszczu jest niezbędna dla hormonów i magazynowania energii, ale jego nadmiar — zwłaszcza w okolicy brzucha — zwiększa długoterminowe ryzyko zdrowotne (WHO 2024).",
         "muscleMassTitle": "Masa mięśniowa",
         "muscleMassBody": "Masa mięśniowa to szacowana waga mięśni w ciele. Więcej mięśni wspiera siłę, metabolizm i sprawność, a ich utrzymanie z wiekiem zwykle wymaga aktywnego wysiłku.",
         "visceralFatTitle": "Tłuszcz trzewny",
-        "visceralFatBody": "Tłuszcz trzewny to tłuszcz gromadzony głęboko w jamie brzusznej wokół narządów. W odróżnieniu od tłuszczu podskórnego jego wysoki poziom jest ściśle powiązany z chorobami serca i cukrzycą typu 2, więc im niżej, tym lepiej.",
+        "visceralFatBody": "Tłuszcz trzewny to tłuszcz gromadzony głęboko w jamie brzusznej wokół narządów. W odróżnieniu od tłuszczu podskórnego jego wysoki poziom jest ściśle powiązany z chorobami serca i cukrzycą typu 2 (AHA, Circulation 2021), więc im niżej, tym lepiej. Skala pokazuje wartość bezjednostkową (mniej więcej 1–12 to zakres zdrowy, 13 i więcej to wartość podwyższona); to inna skala niż progi w cm² z badań obrazowych stosowane przez klinicystów i nie należy jej traktować z nimi zamiennie.",
         "leanBodyMassTitle": "Beztłuszczowa masa ciała",
         "leanBodyMassBody": "Beztłuszczowa masa ciała to całkowita waga pomniejszona o tłuszcz — mięśnie, kości, narządy i woda razem. Śledzenie jej obok wagi pokazuje, czy zmiany wynikają z mięśni, czy z tłuszczu.",
         "flightsClimbedTitle": "Pokonane piętra",
@@ -2699,7 +2824,7 @@
         "audioEventsTitle": "Zdarzenia głośnego dźwięku",
         "audioEventsBody": "Zdarzenia głośnego dźwięku oznaczają momenty, gdy hałas wokół ciebie osiągnął poziom mogący przy wystarczającej ekspozycji uszkodzić słuch. Częste zdarzenia to sygnał, by poszukać cichszego otoczenia lub ochrony słuchu.",
         "daylightTitle": "Czas w świetle dziennym",
-        "daylightBody": "Czas w świetle dziennym to ilość czasu spędzanego w świetle na zewnątrz każdego dnia. Regularne światło dzienne wspiera zdrowy rytm snu i czuwania oraz nastrój, a czas na świeżym powietrzu wiąże się ze zdrowiem oczu.",
+        "daylightBody": "Czas w świetle dziennym to ilość czasu spędzanego w świetle na zewnątrz każdego dnia. Regularne światło dzienne wspiera zdrowy rytm snu i czuwania oraz nastrój (CDC 2024), a czas na świeżym powietrzu wiąże się ze zdrowiem oczu.",
         "bloodGlucoseTitle": "Poziom glukozy we krwi",
         "bloodGlucoseBody": "Poziom glukozy we krwi to ilość cukru we krwi, głównego źródła energii organizmu. Rośnie po jedzeniu i ustala się między posiłkami; wartości utrzymujące się wysoko mogą sygnalizować cukrzycę lub stan przedcukrzycowy.",
         "skinTemperatureTitle": "Temperatura skóry",
@@ -2711,7 +2836,7 @@
         "wristTemperatureTitle": "Temperatura nadgarstka",
         "wristTemperatureBody": "Temperatura nadgarstka jest mierzona podczas snu i podawana jako różnica względem Twojej wartości bazowej, a nie jako wartość bezwzględna. Stabilny odczyt jest normalny, a utrzymujący się wzrost może wskazywać na chorobę, intensywny trening lub zmianę cyklu.",
         "fallsTitle": "Upadki",
-        "fallsBody": "Tutaj liczone są poważne upadki wykryte przez urządzenie noszone. Celem jest zero; rosnąca liczba to sygnał ryzyka związanego z mobilnością, który warto omówić z lekarzem, zwłaszcza u osób starszych.",
+        "fallsBody": "Tutaj liczone są poważne upadki wykryte przez urządzenie noszone. Celem jest zero; rosnąca liczba to sygnał ryzyka związanego z mobilnością, który warto omówić z lekarzem, zwłaszcza u osób starszych (CDC STEADI 2024).",
         "sixMinuteWalkTitle": "Dystans marszu 6-minutowego",
         "sixMinuteWalkBody": "To szacunek, jak daleko mógłbyś przejść w sześć minut — klasyczny test kliniczny mobilności i wydolności krążeniowo-oddechowej. Wartość z urządzenia noszonego to przybliżenie, a nie nadzorowany test kliniczny; liczy się stały lub rosnący trend.",
         "stairAscentSpeedTitle": "Prędkość wchodzenia po schodach",
@@ -2759,7 +2884,8 @@
       },
       "valuesBack": "Powrót do Insights",
       "valuesBackToMetric": "Powrót do {metric}",
-      "scoresBack": "Powrót do Insights"
+      "scoresBack": "Powrót do Insights",
+      "ecgDescription": "Zapisy EKG jednoodprowadzeniowe z Twojego urządzenia, każdy z wynikiem samego urządzenia. HealthLog pokazuje przebieg i zapis — nie interpretuje krzywej."
     },
     "sleep": {
       "title": "Sen",
@@ -2798,9 +2924,9 @@
       "debt": {
         "title": "Dług snu",
         "value": "{hours} godz. {minutes} min niedoboru",
-        "caption": "Skumulowany niedobór z ostatnich {nights} nocy",
+        "caption": "Pozostały bilans z ostatnich {nights} nocy",
         "clearValue": "Na bieżąco",
-        "clearCaption": "Brak skumulowanego niedoboru w ostatnich {nights} nocach",
+        "clearCaption": "Nic do nadrobienia w ostatnich {nights} nocach",
         "learning": "Wciąż analizujemy Twój sen — {counted} nocy do tej pory, jeszcze {remaining}, aby uzyskać wiarygodny bilans.",
         "computedInfo": "To własne oszacowanie HealthLog: ruchomy bilans potrzeby snu minus sen z ostatnich nocy, który sen nadrabiający zmniejsza. Może różnić się od natywnego wskaźnika długu snu z urządzenia, które korzysta z własnego modelu zapotrzebowania."
       },
@@ -2904,6 +3030,8 @@
     "navRecovery": "Regeneracja",
     "workouts": {
       "title": "Treningi",
+      "askWhy": "Dlaczego",
+      "askWhyPrompt": "Dlaczego ta sesja wypadła w ten sposób? Wyjaśnij mi moje własne wyniki.",
       "description": "Ostatnie biegi, jazdy, marsze i treningi siłowe — zdeduplikowane między Apple Watch a Withings.",
       "emptyState": {
         "title": "Brak treningów",
@@ -2932,7 +3060,24 @@
         "hrChartTitle": "Tętno",
         "hrChartUnavailable": "Próbki tętna co sekundę nie są zapisywane dla tego treningu.",
         "notFound": "Nie znaleziono treningu.",
-        "loading": "Wczytywanie treningu…"
+        "loading": "Wczytywanie treningu…",
+        "hrFromPulse": "Na podstawie Twoich danych tętna z okolic tej sesji",
+        "hrAxisMinutes": "min",
+        "sportAverageLabel": "Twoja ostatnia średnia:",
+        "zonesTitle": "Strefy wysiłku",
+        "zonesCaption": "Jak Twój wysiłek rozłożył się na strefy tętna.",
+        "zonesCaptionDevice": "Czas w strefach według Twojego urządzenia.",
+        "exportGpx": "Eksportuj GPX",
+        "elevationTitle": "Wznios",
+        "splitsTitle": "Międzyczasy",
+        "splitsKm": "km",
+        "splitsTime": "Czas",
+        "splitsPace": "Tempo",
+        "thatDayTitle": "Tego dnia",
+        "dayPulse": "Tętno",
+        "daySleep": "Sen",
+        "dayMood": "Nastrój",
+        "insightTitle": "Analiza aktywności"
       },
       "sport": {
         "walking": "Marsz",
@@ -2955,7 +3100,11 @@
         "crossTraining": "Cross-trening",
         "mixedCardio": "Cardio mieszane",
         "other": "Inne"
-      }
+      },
+      "loadError": "Nie udało się wczytać treningów",
+      "loadMore": "Wczytaj więcej treningów",
+      "loadingMore": "Wczytywanie kolejnych treningów",
+      "loadMoreError": "Nie udało się wczytać kolejnych treningów"
     },
     "bloodGlucose": {
       "title": "Poziom glukozy",
@@ -3898,7 +4047,10 @@
         "recordingsMany": "Zapisy w kartotece: {count}.",
         "latestResult": "Ostatni wynik urządzenia: {result}.",
         "cta": "Zobacz zapisy"
-      }
+      },
+      "emptyTitle": "Brak zapisów EKG",
+      "emptyDescription": "Zapisy EKG synchronizują się z kompatybilnego urządzenia jednoodprowadzeniowego. Gdy urządzenie prześle zapis, pojawi się tutaj.",
+      "emptyCta": "Połącz urządzenie"
     },
     "intradayPulse": {
       "title": "Przebieg Twojego dnia",
@@ -3917,7 +4069,8 @@
         "evening": "Utrzymujący się podwyższony spoczynek wieczorem — możliwe napięcie.",
         "night": "Utrzymujący się podwyższony spoczynek w nocy — możliwe napięcie."
       }
-    }
+    },
+    "navEcg": "EKG"
   },
   "thresholds": {
     "defaultLabel": "Domyślne",
@@ -4397,7 +4550,7 @@
           "fullBackup": {
             "title": "Pełna kopia zapasowa",
             "description": "Wszystkie Twoje dane w jednym pliku JSON — pomiary, leki, nastrój, cykl, wyniki badań laboratoryjnych, epizody chorobowe, alergie, wywiad rodzinny i treningi. Taki sam format jak cotygodniowa automatyczna kopia.",
-            "scopeNote": "Oryginalne pliki dokumentów oraz dane tras GPS/próbek treningów nie są uwzględnione — pobierz je osobno z archiwum dokumentów lub eksportu treningów.",
+            "scopeNote": "Metadane dokumentów oraz podsumowanie AI, jeśli istnieje, są uwzględnione jako czysty tekst; oryginalne pliki dokumentów oraz dane tras GPS/próbek treningów nie są uwzględnione — pobierz je osobno z archiwum dokumentów lub eksportu treningów.",
             "encryptToggle": "Zaszyfruj hasłem-frazą",
             "passphrasePlaceholder": "Hasło-fraza (min. 12 znaków)",
             "passphraseHelp": "Wyprowadza klucz archiwum za pomocą Argon2id i pieczętuje je AES-256-GCM. Zapisz plik z rozszerzeniem .hlx.",
@@ -4428,6 +4581,7 @@
             "failed": "Import nie powiódł się.",
             "rowsImported": "Zaimportowano dotąd {count} wierszy",
             "doneSummary": "Gotowe — zaimportowano {imported} z {read} rekordów, pominięto {skipped} rekordów klinicznych.",
+            "estimateWarning": "Łączne wartości dla {count} dni oszacowano na podstawie największego źródła w eksporcie. Natywne statystyki Apple Health pozostają nadrzędne.",
             "phase": {
               "queued": "W kolejce…",
               "unpacking": "Rozpakowywanie archiwum…",
@@ -4586,7 +4740,9 @@
           "description": "Dodaj miejsce i zakres dat: podróż lub fragment wcześniejszej historii. Okres zastępuje Twój dom w dniach, które obejmuje, aby pogoda odpowiadała miejscu, w którym naprawdę byłeś. W ten sposób korygujesz przeszłość.",
           "none": "Brak okresów lokalizacji.",
           "add": "Dodaj {label}",
-          "remove": "Usuń okres lokalizacji"
+          "remove": "Usuń okres lokalizacji",
+          "removeConfirmTitle": "Usunąć tę podróż?",
+          "removeConfirmBody": "Pomiary z tego okresu pozostają w historii; znika tylko wpis podróży."
         },
         "backfill": {
           "title": "Uzupełnij minione dni",
@@ -4867,7 +5023,10 @@
           "surfaced": "Wyświetlone",
           "done": "Gotowe",
           "dismissed": "Odrzucone"
-        }
+        },
+        "deleteConfirmTitle": "Usunąć to przypomnienie?",
+        "deleteConfirmBody": "Przestanie się pojawiać. Zapisane wcześniej dane pozostają bez zmian.",
+        "deleteConfirmAction": "Usuń"
       },
       "aboutMe": {
         "title": "O mnie",
@@ -4913,6 +5072,16 @@
         "honesty": "Wspólny dostęp to jedno zalogowane konto AI, które operator podłączył dla wszystkich na tym serwerze — nie Twój własny klucz. Zapytania, które przez nie wysyłasz, są domyślnie wykorzystywane do trenowania modeli dostawcy i nie obejmuje ich żadna umowa powierzenia przetwarzania danych, godzinowe i tygodniowe limity konta dzielisz z wszystkimi innymi, którzy się zgodzili, a Twoi właśni dostawcy są próbowani jako pierwsi. Włącz to tylko, jeśli akceptujesz ten kompromis.",
         "confirm": "Rozumiem — użyj wspólnego połączenia",
         "cancel": "Anuluj"
+      },
+      "consent": {
+        "title": "Zgoda na AI",
+        "activeSince": "Udzielona {date}. Twoje dane zdrowotne mogą być wysyłane do skonfigurowanego dostawcy na potrzeby funkcji AI.",
+        "withdrawn": "Wycofana. Żadne dane zdrowotne nie są wysyłane do dostawcy AI; funkcje AI pozostają wyłączone.",
+        "withdraw": "Wycofaj zgodę",
+        "confirmBody": "Funkcje AI przestają działać natychmiast. Nic z już zapisanych danych nie zostaje usunięte — użyj sekcji Dane i prywatność, aby wyeksportować lub usunąć swoją historię.",
+        "confirmWithdraw": "Wycofaj",
+        "regrantHint": "Aby ponownie korzystać z funkcji AI, włącz automatyczne czytanie dokumentów lub udziel zgody w aplikacji.",
+        "error": "Nie udało się zapisać wycofania. Spróbuj ponownie."
       }
     },
     "dashboard": {
@@ -5099,7 +5268,8 @@
       "resumeError": "Ponowne połączenie nieudane"
     },
     "apiTokens": "Tokeny API",
-    "apiTokensDescription": "Twórz tokeny API do zewnętrznego rejestrowania przyjęć leków (np. Skróty, automatyzacje).",
+    "apiTokensDescription": "Przeglądaj i unieważniaj tokeny API do zewnętrznego rejestrowania przyjęć leków. Tokeny są wydawane dla pojedynczego leku z jego przełącznika punktu końcowego API.",
+    "tokenMintMovedDescription": "Tokeny są wydawane dla pojedynczego leku. Otwórz lek i włącz jego punkt końcowy API, aby otrzymać token obejmujący wyłącznie ten lek.",
     "tokenNamePlaceholder": "Nazwa tokena (np. Skrót iPhone)",
     "tokenCreated": "Token utworzony — skopiuj go teraz! Nie zostanie pokazany ponownie.",
     "tokenCopy": "Kopiuj token",
@@ -5531,8 +5701,16 @@
         "revokeAllDone": "Zapomniano {count} zaufane urządzenie/a.",
         "unnamed": "Nieznane urządzenie",
         "current": "To urządzenie",
-        "expires": "Zaufane do {date}"
-      }
+        "expires": "Zaufane do {date}",
+        "revokeConfirmTitle": "Przestać ufać temu urządzeniu?",
+        "revokeConfirmBody": "Przy następnym logowaniu z tego urządzenia ponownie poprosi o drugi składnik.",
+        "revokeAllConfirmTitle": "Przestać ufać wszystkim urządzeniom?",
+        "revokeAllConfirmBody": "Każde urządzenie przy następnym logowaniu ponownie poprosi o drugi składnik, łącznie z tym."
+      },
+      "revokeSessionConfirmTitle": "Wylogować to urządzenie?",
+      "revokeSessionConfirmBody": "{device} będzie musiało zalogować się ponownie. Zapisane na nim dane pozostają bez zmian.",
+      "signOutEverywhereConfirmTitle": "Wylogować wszystkie pozostałe urządzenia?",
+      "signOutEverywhereConfirmBody": "Każde urządzenie poza tym będzie musiało zalogować się ponownie. To urządzenie pozostaje zalogowane. Zapisane dane pozostają bez zmian."
     },
     "privacy": {
       "intro": {
@@ -5632,10 +5810,34 @@
       "rate_limited": "Zbyt wiele prób połączenia. Poczekaj chwilę i spróbuj ponownie.",
       "generic": "Nieznany błąd podczas łączenia. Rozpocznij połączenie ponownie."
     },
+    "appleHealth": {
+      "title": "Apple Health",
+      "description": "Synchronizacja na żywo odbywa się przez aplikację HealthLog na iOS, a nie przez połączenie internetowe ani OAuth.",
+      "status": {
+        "checking": "Sprawdzanie danych Apple Health…",
+        "dataReceived": "Odebrano dane Apple Health",
+        "setup": "Skonfiguruj w aplikacji iOS",
+        "unavailable": "Stan Apple Health jest niedostępny"
+      },
+      "lastDataLabel": "Najnowsze dane Apple Health:",
+      "setupTitle": "Włącz synchronizację na żywo",
+      "permissionStep": "W aplikacji HealthLog na iOS otwórz Ustawienia → Apple Health i zezwól na udostępnianie wybranych kategorii zdrowotnych.",
+      "backgroundStep": "Pozostaw włączone odświeżanie aplikacji w tle. Aplikacja synchronizuje nowe dane automatycznie na pierwszym planie oraz gdy iOS przydzieli jej czas w tle.",
+      "importNote": "Potrzebujesz starszej historii lub nie możesz użyć aplikacji iOS? Przesłanie pliku XML/ZIP z Apple Health jest jednorazową alternatywą i nie włącza synchronizacji na żywo.",
+      "importAction": "Otwórz jednorazowy import"
+    },
     "garminInfo": {
       "title": "Garmin",
       "body": "Garmin nie ma tutaj bezpośredniego połączenia. Połącz przez Apple Health (iOS) lub Google Health Connect (Android). Zastrzeżone wskaźniki Garmina — Body Battery, Training Load, status HRV, VO₂ max — nie są udostępniane przez Garmina żadnej z tych platform.",
       "docsLink": "Przeczytaj przewodnik"
+    },
+    "glucoseReference": {
+      "title": "Zakres referencyjny glukozy",
+      "description": "Do jakiego zakresu porównywane są twoje wyniki glukozy we krwi.",
+      "enable": "Użyj zakresu docelowego dla cukrzycy",
+      "explainer": "Wyłączone — wyniki są oceniane względem ogólnego zakresu referencyjnego dla osób bez cukrzycy. Włączone — są oceniane względem węższego zakresu docelowego glikemii z ADA Standards of Care, a Coach opiera na nim swoje uwagi o glukozie. Twoje własne wartości docelowe poniżej nadal mają pierwszeństwo.",
+      "disclaimer": "To wybiera zakres referencyjny. Nie jest to diagnoza, nigdy nie jest wywnioskowane z pomiaru, a aplikacja nie podejmuje na tej podstawie działań klinicznych. O to, jakie cele dotyczą ciebie, zapytaj swojego lekarza.",
+      "error": "Nie udało się zapisać ustawienia."
     }
   },
   "admin": {
@@ -7374,7 +7576,7 @@
     "referenceLabel": "Norma",
     "readingsCount": "{count} pomiarów",
     "deleteConfirmTitle": "Usunąć wynik laboratoryjny?",
-    "deleteConfirmDescription": "Ten wynik laboratoryjny zostanie trwale usunięty.",
+    "deleteConfirmDescription": "Ten wynik laboratoryjny zostanie usunięty. Zaraz po usunięciu możesz to przez chwilę cofnąć.",
     "deletedToast": "Wynik usunięty",
     "deleteError": "Nie udało się usunąć wyniku",
     "loadError": "Nie udało się wczytać wyników",
@@ -7853,7 +8055,7 @@
     },
     "deleteConfirm": {
       "title": "Usunąć ten epizod?",
-      "body": "„{label}” oraz wszystkie powiązane wpisy dzienne zostaną usunięte. Tej operacji nie można cofnąć."
+      "body": "„{label}” oraz wszystkie powiązane wpisy dzienne zostaną usunięte. Zaraz po usunięciu możesz to przez chwilę cofnąć."
     },
     "vital": {
       "RESTING_HEART_RATE": "Spoczynkowe tętno",
@@ -7936,6 +8138,11 @@
         "review_due": "Przegląd do zrobienia",
         "reviewed": "Oceniony"
       }
+    },
+    "refusal": {
+      "outOfScope": "Mogę pomóc wyłącznie z danymi zdrowotnymi z Twojego dziennika: pomiarami, lekami, nastrojem, trendami. Na pytania spoza tego zakresu nie odpowiadam.",
+      "promptInjection": "Zauważyłem polecenia, które próbują obejść moje wytyczne. Jestem Coachem HealthLog i podsumowuję wyłącznie Twoje własne dane zdrowotne — sformułuj pytanie w tych ramach.",
+      "conversationPoisoned": "Wcześniejsza wiadomość w tej rozmowie zawiera polecenia, które próbują obejść moje wytyczne. Rozpocznij nową rozmowę."
     }
   },
   "safety": {
@@ -8188,7 +8395,9 @@
         "finally": "Finally …"
       }
     },
-    "openDetail": "Pokaż szczegóły"
+    "openDetail": "Pokaż szczegóły",
+    "historyLoadError": "Nie udało się wczytać historii testów",
+    "historyLoadErrorHint": "To nie znaczy, że nie masz wyników — nie udało się pobrać listy. Spróbuj ponownie."
   },
   "records": {
     "disclaimer": "To Twoje własne wpisy, a nie diagnoza lekarska. HealthLog nie diagnozuje, nie leczy i ich nie interpretuje.",
@@ -8397,7 +8606,13 @@
       "title": "Szczegóły dokumentu",
       "summary": {
         "title": "Podsumowanie",
-        "pending": "Podsumowanie jest przygotowywane."
+        "pending": "Podsumowanie jest przygotowywane.",
+        "none": "Dla tego dokumentu nie wygenerowano jeszcze podsumowania.",
+        "withheld": "Podsumowanie zostało wygenerowane, ale nie przeszło kontroli bezpieczeństwa, więc nie jest wyświetlane. Możesz spróbować ponownie lub przeczytać sam dokument.",
+        "unavailable": "Nie udało się wygenerować podsumowania dla tego dokumentu.",
+        "generate": "Wygeneruj podsumowanie",
+        "regenerate": "Wygeneruj ponownie",
+        "generating": "Generowanie…"
       },
       "loadError": "Nie udało się wczytać tego dokumentu.",
       "saveError": "Nie udało się zapisać zmiany.",
@@ -8479,7 +8694,6 @@
       "close": "Ukryj"
     },
     "ai": {
-      "statusAiRead": "Odczytane przez AI",
       "readDone": "AI odczytało Twój dokument.",
       "read": "Odczytaj z AI",
       "reread": "Odczytaj ponownie",
@@ -8635,6 +8849,7 @@
       "quickAddCustomPlaceholder": "250",
       "quickAddSubmit": "Dodaj",
       "quickAddError": "Nie udało się zapisać — spróbuj ponownie.",
+      "quickAddSuccess": "Dodano {amount} mL wody.",
       "editTotal": "Edytuj dzisiejszą sumę"
     },
     "caffeine": {
@@ -8645,7 +8860,8 @@
       "rowMeta": "{days} z {window} dni · zalecane {value} {unit} (EFSA)",
       "rowMetaNoRef": "{days} z {window} dni",
       "footer": "{tracked} z {total} śledzonych mikroskładników ma dane w tym okresie.",
-      "emptyTitle": "Brak jeszcze zsynchronizowanych danych o mikroskładnikach"
+      "emptyTitle": "Brak jeszcze zsynchronizowanych danych o mikroskładnikach",
+      "loadError": "Nie udało się wczytać danych o składnikach odżywczych"
     },
     "sparseNote": "Niska wartość zwykle oznacza tu rzadkie zapisywanie, a nie niedobór — dzienne sumy z Apple Health odzwierciedlają to, co zapisały twoje aplikacje, a nie całkowite spożycie w diecie."
   },
@@ -8661,8 +8877,11 @@
     "item": {
       "doseWindow": {
         "title": "Lek do przyjęcia",
-        "body": "Dziś przypada dawka.",
-        "bodyNamed": "{name} przypada dziś."
+        "body": "Dawka wkrótce do przyjęcia.",
+        "bodyNamed": "{name} wkrótce do przyjęcia.",
+        "overdueTitle": "Lek zaległy",
+        "overdueBody": "Dawka jest zaległa.",
+        "overdueBodyNamed": "{name} jest zaległy."
       },
       "preventiveCare": {
         "title": "Badanie do wykonania",
@@ -8716,7 +8935,8 @@
       "deltaVsBaseline": "{delta} wzgl. Twojej wartości bazowej",
       "deltaFlat": "Zgodnie z Twoją wartością bazową",
       "sleepPending": "Sen z ostatniej nocy jeszcze nie dotarł — dzisiejszy odczyt jest wstępny.",
-      "readFullBriefing": "Przeczytaj pełny briefing",
+      "justIn": "Właśnie dotarło",
+      "justInAt": "Właśnie dotarło · {time}",
       "worthALook": "Warto sprawdzić",
       "allClear": "Dziś nic nie wymaga Twojej uwagi.",
       "ringLink": "Otwórz szczegóły: {metric}"

next.config.ts

@@ -231,7 +231,6 @@ const nextConfig: NextConfig = {
   serverExternalPackages: [
     "@prisma/client",
     "pg-boss",
-    "@prisma/adapter-pg",
     "pg",
     // Document PDF handling MUST run the real, un-bundled modules. When
     // Turbopack bundles pdfjs-dist into the server chunks, its runtime

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.30.2",
+  "version": "1.32.2",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",
@@ -22,9 +22,9 @@
     "passkey"
   ],
   "private": true,
-  "packageManager": "pnpm@10.31.0",
+  "packageManager": "pnpm@11.15.1",
   "scripts": {
-    "prepare": "lefthook install || echo 'lefthook install skipped (no git repo or binary unavailable)'",
+    "prepare": "node scripts/prepare.mjs",
     "dev": "next dev",
     "predev": "node scripts/generate-i18n-boot.mjs",
     "prebuild": "node scripts/generate-sw-version.mjs && node scripts/generate-i18n-boot.mjs",
@@ -59,7 +59,7 @@
     "@dnd-kit/utilities": "^3.2.2",
     "@hookform/resolvers": "^5.4.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@napi-rs/canvas": "0.1.80",
+    "@napi-rs/canvas": "1.0.2",
     "@node-rs/argon2": "^2.0.2",
     "@parse/node-apn": "^8.1.0",
     "@prisma/adapter-pg": "^7.8.0",
@@ -79,7 +79,7 @@
     "jspdf-autotable": "^5.0.8",
     "lucide-react": "^1.18.0",
     "mmdb-lib": "^3.0.2",
-    "next": "16.2.10",
+    "next": "16.2.11",
     "next-themes": "^0.4.6",
     "nodemailer": "9.0.3",
     "otpauth": "^9.5.1",
@@ -87,7 +87,7 @@
     "pg-boss": "^12.26.0",
     "prisma": "^7.8.0",
     "qrcode": "^1.5.4",
-    "radix-ui": "^1.6.0",
+    "radix-ui": "^1.6.2",
     "react": "19.2.7",
     "react-day-picker": "^10.0.1",
     "react-dom": "19.2.7",
@@ -125,25 +125,15 @@
     "knip": "^6.16.1",
     "lefthook": "^2.1.10",
     "pdf-parse": "^2.4.5",
-    "pdfjs-dist": "5.4.296",
+    "pdfjs-dist": "6.1.200",
     "pg": "^8.22.0",
     "prettier": "^3.9.1",
-    "prettier-plugin-tailwindcss": "^0.8.0",
+    "prettier-plugin-tailwindcss": "^0.8.1",
     "shadcn": "^4.13.0",
     "tailwindcss": "^4",
     "testcontainers": "^12.0.3",
     "tw-animate-css": "^1.4.0",
     "typescript": "^6",
     "vitest": "^4.1.5"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "prisma",
-      "@prisma/engines"
-    ],
-    "overrides": {
-      "hono@<4.12.25": "^4.12.25",
-      "picomatch@<4.0.4": "^4.0.4"
-    }
   }
 }

playwright.config.ts

@@ -22,13 +22,13 @@ export default defineConfig({
   expect: { timeout: 10_000 },
   fullyParallel: true,
   forbidOnly: !!process.env.CI,
+  failOnFlakyTests: !!process.env.CI,
   // Two retries on CI: under a loaded shared runner, DOM-settle-gated
   // assertions (wizard step transitions, list refetch → card provenance,
   // disclosure toggles) intermittently sample a mid-transition frame. A
-  // rotating single test failed each run while 211 passed; a second retry
-  // absorbs that transient contention without masking a real failure (a true
-  // break fails all three attempts). The default expect timeout is also
-  // lifted from 5s → 10s for the same settle headroom.
+  // retry distinguishes transient contention from a persistent break, while
+  // failOnFlakyTests keeps either outcome visible to CI. The default expect
+  // timeout is lifted from 5s → 10s for the same settle headroom.
   retries: process.env.CI ? 2 : 0,
   workers: process.env.CI ? 2 : undefined,
   reporter: process.env.CI
@@ -95,7 +95,7 @@ export default defineConfig({
   webServer: process.env.E2E_SKIP_WEB_SERVER
     ? undefined
     : {
-        command: "pnpm exec next start --port 3000",
+        command: `mkdir -p .next/standalone/.next/static .next/standalone/public && cp -R .next/static/. .next/standalone/.next/static && cp -R public/. .next/standalone/public && PORT=3000 HOSTNAME=127.0.0.1 ${JSON.stringify(process.execPath)} .next/standalone/server.js`,
         url: "http://localhost:3000/api/version",
         timeout: 60_000,
         reuseExistingServer: !process.env.CI,
@@ -103,6 +103,10 @@ export default defineConfig({
         stderr: "pipe",
         env: {
           ...process.env,
+          // Native document rendering is fail-soft and outside the browser
+          // suite. Disable it here so queued local thumbnail jobs cannot
+          // crash the shared server inside Skia during unrelated scenarios.
+          NATIVE_CANVAS: "off",
           // The dashboard RSC wrapper server-prefetches the snapshot into
           // the first HTML (HydrationBoundary). Playwright's route mocks
           // only see CLIENT fetches, so an SSR-embedded snapshot would

pnpm-workspace.yaml

@@ -1,3 +1,23 @@
-ignoredBuiltDependencies:
-  - sharp
-  - unrs-resolver
+overrides:
+  "dompurify@<=3.4.10": "^3.4.11"
+  "postcss@<8.5.10": "^8.5.10"
+  "@hono/node-server@<1.19.13": "^1.19.13"
+  "hono@<4.12.25": "^4.12.25"
+  "picomatch@<4.0.4": "^4.0.4"
+  "body-parser@<2.3.0": "^2.3.0"
+  "fast-uri@<3.1.3": "^3.1.3"
+  "sharp@<0.35.0": "^0.35.3"
+
+allowBuilds:
+  "@prisma/engines": true
+  prisma: true
+  core-js: false
+  cpu-features: false
+  esbuild: false
+  lefthook: false
+  msw: false
+  protobufjs: false
+  sharp: false
+  ssh2: false
+  tesseract.js: false
+  unrs-resolver: false

prisma/migrations/0252_oidc_native_handoff/migration.sql

@@ -0,0 +1,48 @@
+-- Native OIDC SSO session handoff (iOS#49).
+--
+-- One-time handoff codes bridging the browser-context OIDC callback to the
+-- cookie-less native token exchange. The web OIDC flow ends in a session
+-- cookie a Bearer-transport native client can never consume; this table lets
+-- the callback mint an opaque, PKCE-locked, single-use code that the app
+-- exchanges for the standard native token bundle at
+-- POST /api/auth/oidc/native/token.
+--
+-- The raw code (`hlh_<…>`) rides ONLY the custom-scheme redirect; only its
+-- HMAC-SHA256 hash is stored, mirroring the refresh-token / MFA-challenge
+-- hash-at-rest posture. `issued_refresh_token_hash` records the pair minted at
+-- exchange so a replay (a second presentation after consumption) can revoke
+-- exactly that family member — refresh-token reuse-detection reach-back.
+
+-- CreateTable
+CREATE TABLE "oidc_native_handoffs" (
+  "id" TEXT NOT NULL,
+  "user_id" TEXT NOT NULL,
+  "code_hash" TEXT NOT NULL,
+  "code_challenge" TEXT NOT NULL,
+  "expires_at" TIMESTAMP(3) NOT NULL,
+  "consumed_at" TIMESTAMP(3),
+  "issued_refresh_token_hash" TEXT,
+  "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "ip_address" TEXT,
+  "user_agent" TEXT,
+  CONSTRAINT "oidc_native_handoffs_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex — the exchange loads a row by the code's hash; unique so a hash
+-- collision can never resolve to two live codes.
+CREATE UNIQUE INDEX "oidc_native_handoffs_code_hash_key"
+  ON "oidc_native_handoffs" ("code_hash");
+
+-- CreateIndex — per-user audit scans + the FK-cascade delete path.
+CREATE INDEX "oidc_native_handoffs_user_id_idx"
+  ON "oidc_native_handoffs" ("user_id");
+
+-- CreateIndex — the daily cleanup sweep filters on `expires_at`.
+CREATE INDEX "oidc_native_handoffs_expires_at_idx"
+  ON "oidc_native_handoffs" ("expires_at");
+
+-- AddForeignKey — deleting a user cascades their handoff rows away.
+ALTER TABLE "oidc_native_handoffs"
+  ADD CONSTRAINT "oidc_native_handoffs_user_id_fkey"
+  FOREIGN KEY ("user_id") REFERENCES "users" ("id")
+  ON DELETE CASCADE ON UPDATE CASCADE;

prisma/migrations/0253_perf_medication_intake_indexes/migration.sql

@@ -0,0 +1,11 @@
+-- v1.30.12 perf — index the two medication-intake read shapes the dashboard
+-- "meds today" builder fires that could not index-seek before: the sibling
+-- reads filtering (user_id, scheduled_for) without medication_id, and the
+-- per-medication last-taken group-by that scanned the whole intake history.
+-- Additive; no data change.
+
+-- CreateIndex
+CREATE INDEX "medication_intake_events_user_id_scheduled_for_idx" ON "medication_intake_events"("user_id", "scheduled_for");
+
+-- CreateIndex
+CREATE INDEX "medication_intake_events_user_id_medication_id_taken_at_idx" ON "medication_intake_events"("user_id", "medication_id", "taken_at");

prisma/migrations/0254_document_summary_state/migration.sql

@@ -0,0 +1,26 @@
+-- Record what happened to a document's summary.
+--
+-- `summary_encrypted` alone cannot tell four outcomes apart: a document nobody
+-- ever enqueued, one whose provider is missing, one the safety screen withheld,
+-- and one still in flight all leave it NULL. The detail view read that NULL as
+-- "still generating" and said so forever.
+--
+-- Additive and backfill-free: NONE is the default and is the truthful value for
+-- every pre-existing row, because none of them were ever attempted. Rows that
+-- already carry a summary are moved to READY below.
+
+CREATE TYPE "document_summary_state" AS ENUM (
+  'NONE',
+  'PENDING',
+  'READY',
+  'WITHHELD',
+  'UNAVAILABLE'
+);
+
+ALTER TABLE "inbound_documents"
+  ADD COLUMN "summary_state" "document_summary_state" NOT NULL DEFAULT 'NONE';
+
+-- A document that already holds a summary is READY, not NONE.
+UPDATE "inbound_documents"
+  SET "summary_state" = 'READY'
+  WHERE "summary_encrypted" IS NOT NULL;

prisma/migrations/0255_session_token_hash/migration.sql

@@ -0,0 +1,21 @@
+-- Session cookies carry a purpose-generated secret rather than the row's cuid
+-- primary key.
+--
+-- A cuid is built for collision-resistant identity, not for unguessability: it
+-- embeds a timestamp and a monotonic counter and does not come from a CSPRNG.
+-- A session cookie is a bearer credential and must. The cookie now carries a
+-- 32-byte random token (`hls_<hex>`) and only its HMAC-SHA256 hash is stored,
+-- matching how api_tokens and refresh_tokens already hold their secrets.
+--
+-- Additive and nullable ON PURPOSE: every session row that exists at deploy
+-- time keeps NULL here and stays resolvable by its id, so the release signs
+-- nobody out. Those rows cannot have their sliding expiry extended, so the
+-- id-as-credential path drains itself within the 30-day session lifetime with
+-- no operator action. Postgres permits many NULLs under a unique index, so the
+-- constraint below does not conflict with the backfill-free transition.
+
+-- AlterTable
+ALTER TABLE "sessions" ADD COLUMN "token_hash" TEXT;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "sessions_token_hash_key" ON "sessions"("token_hash");

prisma/migrations/0256_medication_inventory_pen_labelling/migration.sql

@@ -0,0 +1,14 @@
+-- Carton labelling for an inventory container: manufacturer + printed strength.
+--
+-- The native client's pen list uses these two as its headline and subhead, so
+-- a container created on the web could not be shown there without fabricating
+-- an empty card. Nothing on the server held them, so the client kept its own
+-- copy locally and no back-fill was possible.
+--
+-- Both are additive and nullable. Every pre-existing row is truthfully NULL:
+-- the values were never collected, and a plain supply row (a blister pack, a
+-- bottle) has no use for either. No backfill, no default, no rewrite of the
+-- table's existing contents.
+ALTER TABLE "medication_inventory_items"
+  ADD COLUMN "manufacturer" TEXT,
+  ADD COLUMN "dose_strength" TEXT;

prisma/migrations/0257_arrival_reactions/migration.sql

@@ -0,0 +1,53 @@
+-- The data-arrival spine's durable reaction marker.
+--
+-- One row per (user, arrival kind, local day), written by the `data-arrival`
+-- worker after a SALIENT ingest. A backfill never reaches here: the seam
+-- classifier drops historical and future-dated samples before anything is
+-- enqueued, so a ten-year import writes nothing to this table.
+--
+-- The unique index is the point of the table, not decoration. It carries three
+-- separate contracts at once:
+--   1. the "just in" marker every reaction surface reads,
+--   2. the at-most-one-generated-line per kind per day claim — the worker
+--      inserts with ON CONFLICT DO NOTHING, so a lost race simply means
+--      another worker already owns today's line,
+--   3. the audit trail of what the spine actually reacted to.
+--
+-- `line_encrypted` is AES-256-GCM at rest, following the
+-- `insight_narratives.encrypted_content` precedent. It is NULLABLE on purpose:
+-- the marker is the feature and the sentence is garnish, so a provider-less
+-- install fills the table normally and simply never sets this column.
+--
+-- Rows are pruned after 14 days by the daily `arrival-reaction-cleanup` job.
+
+CREATE TABLE "arrival_reactions" (
+  "id" TEXT NOT NULL,
+  "user_id" TEXT NOT NULL,
+  "kind" TEXT NOT NULL,
+  "local_date" TEXT NOT NULL,
+  "occurred_at" TIMESTAMP(3) NOT NULL,
+  "ref_id" TEXT,
+  "line_encrypted" BYTEA,
+  "generated_at" TIMESTAMP(3),
+  "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+  CONSTRAINT "arrival_reactions_pkey" PRIMARY KEY ("id")
+);
+
+-- The once-per-kind-per-local-day claim. Do NOT widen this to include
+-- `ref_id`: the day scope IS the throttle.
+CREATE UNIQUE INDEX "arrival_reactions_user_id_kind_local_date_key"
+  ON "arrival_reactions" ("user_id", "kind", "local_date");
+
+-- The reaction surfaces read "today's rows for this user".
+CREATE INDEX "arrival_reactions_user_id_local_date_idx"
+  ON "arrival_reactions" ("user_id", "local_date");
+
+-- The nightly retention sweep deletes by age.
+CREATE INDEX "arrival_reactions_created_at_idx"
+  ON "arrival_reactions" ("created_at");
+
+ALTER TABLE "arrival_reactions"
+  ADD CONSTRAINT "arrival_reactions_user_id_fkey"
+  FOREIGN KEY ("user_id") REFERENCES "users"("id")
+  ON DELETE CASCADE ON UPDATE CASCADE;

prisma/migrations/0259_workout_insights/migration.sql

@@ -0,0 +1,52 @@
+-- The per-workout Activity Insight paragraph.
+--
+-- Its own table rather than a column on `workouts` because a workout delete is
+-- a HARD delete: the FK below cascades, so the paragraph can never outlive the
+-- session it describes. Keeping it out of `workouts` also keeps the generation
+-- provenance off the row every list read selects from.
+--
+-- Rows are written ONLY by the `workout-insight-generate` worker, dispatched by
+-- the data-arrival spine when a workout genuinely lands. No read path creates
+-- one, so every workout that predates this migration stays without a row — and
+-- renders no card — forever, at zero provider cost.
+--
+-- `paragraph_encrypted` is AES-256-GCM at rest, following the
+-- `insight_narratives.encrypted_content` precedent, and is registered in
+-- `src/lib/crypto/encrypted-columns.ts` so key rotation covers it.
+--
+-- `input_hash` fingerprints the deterministic evidence the paragraph was built
+-- from together with the prompt version: a device re-post of the same session
+-- hashes identically and is refused before any provider is resolved.
+
+CREATE TABLE "workout_insights" (
+  "id" TEXT NOT NULL,
+  "user_id" TEXT NOT NULL,
+  "workout_id" TEXT NOT NULL,
+  "paragraph_encrypted" BYTEA NOT NULL,
+  "input_hash" TEXT NOT NULL,
+  "prompt_version" TEXT NOT NULL,
+  "provider_type" TEXT,
+  "locale" TEXT NOT NULL,
+  "generated_at" TIMESTAMP(3) NOT NULL,
+  "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+  CONSTRAINT "workout_insights_pkey" PRIMARY KEY ("id")
+);
+
+-- One paragraph per workout. This is also the second half of the
+-- double-post defence: the singleton queue key collapses a burst, and this
+-- constraint makes the claim durable even if two workers do run.
+CREATE UNIQUE INDEX "workout_insights_workout_id_key"
+  ON "workout_insights"("workout_id");
+
+-- The daily-cap count: rows for one user inside a generated_at window.
+CREATE INDEX "workout_insights_user_id_generated_at_idx"
+  ON "workout_insights"("user_id", "generated_at");
+
+ALTER TABLE "workout_insights"
+  ADD CONSTRAINT "workout_insights_user_id_fkey"
+  FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "workout_insights"
+  ADD CONSTRAINT "workout_insights_workout_id_fkey"
+  FOREIGN KEY ("workout_id") REFERENCES "workouts"("id") ON DELETE CASCADE ON UPDATE CASCADE;

prisma/migrations/0260_ai_generation_claims/migration.sql

@@ -0,0 +1,9 @@
+-- Durable arrival freshness plus ownership and spend linkage for
+-- arrival-reaction provider attempts.
+ALTER TABLE "arrival_reactions"
+  ADD COLUMN "arrived_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  ADD COLUMN "generation_claim_id" TEXT,
+  ADD COLUMN "generation_claimed_at" TIMESTAMP(3),
+  ADD COLUMN "generation_reserved_tokens" INTEGER,
+  ADD COLUMN "generation_budget_date_key" TEXT,
+  ADD COLUMN "generation_provider_invoked_at" TIMESTAMP(3);

prisma/migrations/0261_arrival_reaction_arrival_backfill/migration.sql

@@ -0,0 +1,6 @@
+-- Preserve the original landing time for markers that predate `arrived_at`.
+-- Migration 0260 must add the NOT NULL column with a default; this follow-up
+-- restores historical rows to their actual first-arrival timestamp before the
+-- application starts serving the release.
+UPDATE "arrival_reactions"
+SET "arrived_at" = "created_at";

prisma/migrations/0262_workout_insight_generation_claims/migration.sql

@@ -0,0 +1,34 @@
+-- Durable single-spend ownership and local-day capacity reservations for
+-- per-workout Activity Insight generation. Existing insight rows remain valid
+-- and are counted by the worker until a claim row exists for their workout.
+CREATE TABLE "workout_insight_generation_claims" (
+  "id" TEXT NOT NULL,
+  "user_id" TEXT NOT NULL,
+  "workout_id" TEXT NOT NULL,
+  "local_date" TEXT NOT NULL,
+  "claim_id" TEXT,
+  "claimed_at" TIMESTAMP(3),
+  "provider_invoked_at" TIMESTAMP(3),
+  "completed_at" TIMESTAMP(3),
+  "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updated_at" TIMESTAMP(3) NOT NULL,
+
+  CONSTRAINT "workout_insight_generation_claims_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "workout_insight_generation_claims_workout_id_key"
+  ON "workout_insight_generation_claims"("workout_id");
+
+CREATE UNIQUE INDEX "workout_insight_generation_claims_claim_id_key"
+  ON "workout_insight_generation_claims"("claim_id");
+
+CREATE INDEX "workout_insight_generation_claims_user_id_local_date_idx"
+  ON "workout_insight_generation_claims"("user_id", "local_date");
+
+ALTER TABLE "workout_insight_generation_claims"
+  ADD CONSTRAINT "workout_insight_generation_claims_user_id_fkey"
+  FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "workout_insight_generation_claims"
+  ADD CONSTRAINT "workout_insight_generation_claims_workout_id_fkey"
+  FOREIGN KEY ("workout_id") REFERENCES "workouts"("id") ON DELETE CASCADE ON UPDATE CASCADE;

prisma/migrations/0263_apple_health_aggregate_authority/migration.sql

@@ -0,0 +1,27 @@
+-- Aggregate provenance makes the shared Apple Health `stats:*` identity
+-- authority-aware. Existing rows cannot be classified safely from their stored
+-- shape, so they remain repairable but are never promoted heuristically.
+CREATE TYPE "measurement_aggregation_provenance" AS ENUM (
+  'HEALTHKIT_STATISTICS',
+  'EXPORT_XML_SOURCE_MAX',
+  'LEGACY_UNKNOWN'
+);
+
+ALTER TABLE "measurements"
+  ADD COLUMN "aggregation_provenance" "measurement_aggregation_provenance",
+  ADD COLUMN "aggregation_contributor_count" INTEGER,
+  ADD COLUMN "aggregation_selected_source_hash" TEXT;
+
+UPDATE "measurements"
+SET "aggregation_provenance" = 'LEGACY_UNKNOWN'
+WHERE "source" = 'APPLE_HEALTH'
+  AND "external_id" LIKE 'stats:%';
+
+-- Revision 1 denotes rows created under the pre-authority parser. New binaries
+-- write revision 2 explicitly; the default stays legacy-safe during rollouts.
+ALTER TABLE "import_jobs"
+  ADD COLUMN "parser_revision" INTEGER NOT NULL DEFAULT 1;
+
+UPDATE "import_jobs"
+SET "parser_revision" = 1;
+

prisma/migrations/0264_whoop_owner_identity/migration.sql

@@ -0,0 +1,26 @@
+-- WHOOP provider identities are globally owned by one local account.
+-- Existing duplicate identities keep the earliest connection; ties are broken
+-- by the primary key so every database chooses the same winner.
+ALTER TABLE "whoop_connections"
+    ALTER COLUMN "whoop_user_id" DROP NOT NULL;
+
+WITH ranked_connections AS (
+    SELECT
+        "id",
+        ROW_NUMBER() OVER (
+            PARTITION BY "whoop_user_id"
+            ORDER BY "created_at" ASC, "id" ASC
+        ) AS owner_rank
+    FROM "whoop_connections"
+    WHERE "whoop_user_id" IS NOT NULL
+)
+UPDATE "whoop_connections" AS connection
+SET
+    "whoop_user_id" = NULL,
+    "updated_at" = CURRENT_TIMESTAMP
+FROM ranked_connections AS ranked
+WHERE connection."id" = ranked."id"
+  AND ranked.owner_rank > 1;
+
+CREATE UNIQUE INDEX "whoop_connections_whoop_user_id_key"
+    ON "whoop_connections"("whoop_user_id");

prisma/migrations/0265_withings_subscription_state/migration.sql

@@ -0,0 +1,11 @@
+ALTER TABLE "withings_connections"
+  ADD COLUMN "webhook_subscription_state" JSONB,
+  ADD COLUMN "webhook_subscription_retry_at" TIMESTAMP(3);
+
+-- Existing connections have no durable outcome yet. Mark them due so the
+-- hourly repair reconciles each category; status 294 is idempotent success.
+UPDATE "withings_connections"
+SET "webhook_subscription_retry_at" = CURRENT_TIMESTAMP;
+
+CREATE INDEX "withings_connections_webhook_subscription_retry_at_idx"
+  ON "withings_connections"("webhook_subscription_retry_at");

prisma/migrations/0266_medication_intake_import_jobs/migration.sql

@@ -0,0 +1,36 @@
+-- Durable medication-intake imports keep the validated payload and monotonic
+-- progress in Postgres so queue retries and process restarts cannot duplicate
+-- intake or inventory side effects. This is additive and preserves all rows.
+CREATE TABLE "medication_intake_import_jobs" (
+  "id" TEXT NOT NULL,
+  "user_id" TEXT NOT NULL,
+  "medication_id" TEXT NOT NULL,
+  "pg_boss_job_id" TEXT,
+  "status" TEXT NOT NULL DEFAULT 'queued',
+  "payload" JSONB NOT NULL,
+  "progress" JSONB NOT NULL DEFAULT '{}',
+  "result" JSONB,
+  "failure_reason" TEXT,
+  "heartbeat_at" TIMESTAMP(3),
+  "started_at" TIMESTAMP(3),
+  "completed_at" TIMESTAMP(3),
+  "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+  CONSTRAINT "medication_intake_import_jobs_pkey" PRIMARY KEY ("id"),
+  CONSTRAINT "medication_intake_import_jobs_status_check"
+    CHECK ("status" IN ('queued', 'running', 'done', 'failed')),
+  CONSTRAINT "medication_intake_import_jobs_user_id_fkey"
+    FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT "medication_intake_import_jobs_medication_id_fkey"
+    FOREIGN KEY ("medication_id") REFERENCES "medications"("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+CREATE UNIQUE INDEX "medication_intake_import_jobs_pg_boss_job_id_key"
+  ON "medication_intake_import_jobs"("pg_boss_job_id");
+CREATE INDEX "medication_intake_import_jobs_user_id_created_at_idx"
+  ON "medication_intake_import_jobs"("user_id", "created_at");
+CREATE INDEX "medication_intake_import_jobs_medication_id_created_at_idx"
+  ON "medication_intake_import_jobs"("medication_id", "created_at");
+CREATE INDEX "medication_intake_import_jobs_status_heartbeat_at_idx"
+  ON "medication_intake_import_jobs"("status", "heartbeat_at");

prisma/schema.prisma

@@ -667,6 +667,9 @@ model User {
   // authorization for an MCP client, audience-bound to health:read/health:write.
   mcpOAuthConnections         McpOAuthConnection[]
   refreshTokens               RefreshToken[]
+  // v1.30.x — one-time native OIDC SSO handoff codes. Each row bridges the
+  // browser-context OIDC callback to the cookie-less native token exchange.
+  oidcNativeHandoffs          OidcNativeHandoff[]
   auditLogs                   AuditLog[]
   withingsConnection          WithingsConnection?
   // v1.4.47 W6 — short-lived `(nonce → userId)` ledger backing the
@@ -734,6 +737,7 @@ model User {
   // pg-boss job state so the polling endpoint can read live per-
   // phase progress without round-tripping through pg-boss internals.
   importJobs                  ImportJob[]
+  medicationIntakeImportJobs MedicationIntakeImportJob[]
   // v1.5.0 — persistent measurement rollup table. Carries the
   // count/min/max/mean/sd/slope/r2 stats per (type, granularity,
   // bucketStart) so the analytics + comprehensive read paths bypass
@@ -789,6 +793,12 @@ model User {
   // v1.11.0 W3 — one durable period-narrative row per (period, locale).
   // Delete/regenerate-clean; the generated prose is AES-256-GCM at rest.
   insightNarratives           InsightNarrative[]
+  // v1.31.0 — the data-arrival spine's durable per-day reaction marker. One
+  // row per (kind, local day); the unique index IS the once-per-kind-per-day
+  // claim every reaction surface reads. Retained 14 days.
+  arrivalReactions            ArrivalReaction[]
+  workoutInsights             WorkoutInsight[]
+  workoutInsightGenerationClaims WorkoutInsightGenerationClaim[]
   // v1.17.1 — preventive-care / measurement (Vorsorge) reminders. One row
   // per user-created reminder ("BP every 7 days", "annual blood panel").
   // Server computes the canonical `nextDueAt`; the cron fires through the
@@ -1020,6 +1030,16 @@ model Passkey {
 model Session {
   id            String    @id @default(cuid())
   userId        String    @map("user_id")
+  // v1.30.32 — HMAC-SHA256 of the session cookie's secret. The cookie carries
+  // a 32-byte CSPRNG token (`hls_<hex>`), never this row's cuid: a cuid is
+  // collision-resistant, not unguessable (embedded timestamp + counter), and a
+  // session identifier is a bearer credential. Hash-at-rest mirrors the
+  // ApiToken / RefreshToken posture — a database read yields no usable cookie.
+  //
+  // Nullable for the transition only: rows minted before this column existed
+  // carry NULL and are still resolvable by id until they expire. See the
+  // resolution comment in `src/lib/auth/session.ts`.
+  tokenHash     String?   @unique @map("token_hash")
   expiresAt     DateTime  @map("expires_at")
   createdAt     DateTime  @default(now()) @map("created_at")
   ipAddress     String?   @map("ip_address")
@@ -1573,6 +1593,14 @@ enum SleepStage {
   @@map("sleep_stage")
 }
 
+enum MeasurementAggregationProvenance {
+  HEALTHKIT_STATISTICS
+  EXPORT_XML_SOURCE_MAX
+  LEGACY_UNKNOWN
+
+  @@map("measurement_aggregation_provenance")
+}
+
 model Measurement {
   id                    String                @id @default(cuid())
   userId                String                @map("user_id")
@@ -1606,6 +1634,18 @@ model Measurement {
   // sample's `metadata.HKWasUserEntered`, Withings model code, …).
   // Stored as a string so the ingest path can replay it back unchanged.
   externalSourceVersion String?               @map("external_source_version")
+  // Authority of an aggregate stored under a `stats:*` identity. NULL for
+  // ordinary point/sample rows. Native HealthKit statistics outrank the
+  // source-day estimate derived from export.xml; migrated ambiguous rows are
+  // explicitly LEGACY_UNKNOWN until a native sync or archive reprocess repairs
+  // them.
+  aggregationProvenance         MeasurementAggregationProvenance? @map("aggregation_provenance")
+  // Distinct source identities contributing to an export.xml source-day
+  // estimate. Source labels themselves are never persisted.
+  aggregationContributorCount   Int?                             @map("aggregation_contributor_count")
+  // SHA-256 of the deterministically selected source identity. Non-identifying
+  // provenance for repeatability without retaining device/source labels.
+  aggregationSelectedSourceHash String?                          @map("aggregation_selected_source_hash")
   // Only set for BLOOD_GLUCOSE measurements. NULL for all others.
   glucoseContext        GlucoseContext?       @map("glucose_context")
   // v1.4.23 — per-stage sleep label. NULL for non-sleep rows; non-NULL
@@ -1922,6 +1962,8 @@ model Workout {
   user    User            @relation(fields: [userId], references: [id], onDelete: Cascade)
   route   WorkoutRoute?
   samples WorkoutSamples?
+  insight WorkoutInsight?
+  insightGenerationClaim WorkoutInsightGenerationClaim?
 
   /// Ingest dedup. NULL externalId is distinct so two manual
   /// entries on the same day never collide here.
@@ -2012,6 +2054,75 @@ model WorkoutSamples {
   @@map("workout_samples")
 }
 
+// ─── Per-workout Activity Insight (v1.31.0) ─────────────────
+//
+// The grounded paragraph the workout-detail seam renders. Its OWN model
+// rather than a column on `Workout` for one concrete reason: workout deletes
+// are HARD deletes (see the note on the `Workout` unique above), so the row
+// has to disappear with its workout. A column would go with it too, but a
+// separate model also keeps the generation provenance (`inputHash`,
+// `promptVersion`, `providerType`) off the hot workout row that every list
+// read selects from, and gives the daily-cap count an index of its own.
+//
+// Written ONLY by the `workout-insight-generate` worker, which the arrival
+// spine dispatches when a workout genuinely LANDS. Nothing on a read path
+// ever creates one: a workout with no row renders no card, and that includes
+// every workout that predates this model.
+model WorkoutInsight {
+
+  id                 String   @id @default(cuid())
+  userId             String   @map("user_id")
+  workoutId          String   @unique @map("workout_id")
+  /// AES-256-GCM ciphertext of the generated paragraph. Follows the
+  /// `InsightNarrative.encryptedContent` precedent, NOT the plaintext pattern
+  /// the status cards use. Registered in `src/lib/crypto/encrypted-columns.ts`
+  /// and rotated by `scripts/rotate-encryption-key.ts`.
+  paragraphEncrypted Bytes    @map("paragraph_encrypted")
+  /// Fingerprint of the deterministic evidence the paragraph was generated
+  /// from, plus the prompt version. A re-sync of the same session hashes
+  /// identically and costs nothing.
+  inputHash          String   @map("input_hash")
+  promptVersion      String   @map("prompt_version")
+  providerType       String?  @map("provider_type")
+  /// The UI locale the paragraph was WRITTEN in. Provenance only: a later
+  /// language switch does not regenerate, because a read path may never
+  /// trigger a provider call. Stored so that is visible rather than guessed.
+  locale             String
+  generatedAt        DateTime @map("generated_at")
+  createdAt          DateTime @default(now()) @map("created_at")
+
+  user    User    @relation(fields: [userId], references: [id], onDelete: Cascade)
+  workout Workout @relation(fields: [workoutId], references: [id], onDelete: Cascade)
+
+  /// The per-day cap count reads this: rows for one user in a generatedAt
+  /// window.
+  @@index([userId, generatedAt])
+  @@map("workout_insights")
+}
+
+// Durable ownership and local-day capacity reservation for workout insight
+// generation. The row is created before expensive evidence work. A live
+// `claimId` owns the pre-provider lease; `providerInvokedAt` is the terminal
+// boundary after which retries must never spend again.
+model WorkoutInsightGenerationClaim {
+  id                String    @id @default(cuid())
+  userId            String    @map("user_id")
+  workoutId         String    @unique @map("workout_id")
+  localDate         String    @map("local_date")
+  claimId           String?   @unique @map("claim_id")
+  claimedAt         DateTime? @map("claimed_at")
+  providerInvokedAt DateTime? @map("provider_invoked_at")
+  completedAt       DateTime? @map("completed_at")
+  createdAt         DateTime  @default(now()) @map("created_at")
+  updatedAt         DateTime  @updatedAt @map("updated_at")
+
+  user    User    @relation(fields: [userId], references: [id], onDelete: Cascade)
+  workout Workout @relation(fields: [workoutId], references: [id], onDelete: Cascade)
+
+  @@index([userId, localDate])
+  @@map("workout_insight_generation_claims")
+}
+
 // ─── Strain personal anchor cache (v1.10.3) ─────────────────
 //
 // Server-internal per-(user, day) cache that lets the nightly Strain
@@ -2309,6 +2420,7 @@ model Medication {
 
   schedules         MedicationSchedule[]
   intakeEvents      MedicationIntakeEvent[]
+  intakeImportJobs MedicationIntakeImportJob[]
   phaseConfig       ReminderPhaseConfig?
   telegramMessages  TelegramReminderMessage[]
   doseChanges       MedicationDoseChange[]
@@ -2730,6 +2842,12 @@ model MedicationIntakeEvent {
   // v1.7.0 sync — keyset support for the `/api/sync/changes` intake feed
   // (`where userId` ordered by `(updatedAt asc, id asc)`).
   @@index([userId, updatedAt, id])
+  // v1.30.12 perf — the dashboard "meds today" read fires sibling queries that
+  // filter `(userId, scheduledFor)` WITHOUT `medicationId` (the composite above
+  // cannot range-seek those) and a per-medication `_max(takenAt)` group-by that
+  // scanned the whole intake history. These two let both index-seek instead.
+  @@index([userId, scheduledFor])
+  @@index([userId, medicationId, takenAt])
   @@map("medication_intake_events")
 }
 
@@ -2852,6 +2970,18 @@ model MedicationInventoryItem {
   /// The carton-printed expiry date the user enters at creation.
   printedExpiry  DateTime?                @map("printed_expiry")
   purchasedAt    DateTime?                @map("purchased_at")
+  /// Marketing-authorisation holder / maker printed on the carton. Free
+  /// text: the field is a label the user reads back, not a lookup key, and
+  /// there is no authority list a self-hoster could be held to. Nullable
+  /// because every pre-existing row predates it and plain supply rows
+  /// (blisters, bottles) have no use for it.
+  manufacturer   String?
+  /// Strength as printed on the container, e.g. "5 mg/0.5 ml". Free text
+  /// and deliberately NOT parsed into a number + unit: pens state strength
+  /// per dose, per ml, or per cartridge depending on the product, and a
+  /// forced numeric split would lose which of the three it was. Nullable
+  /// for the same reason as `manufacturer`.
+  doseStrength   String?                  @map("dose_strength")
   /// Free-text note, application-layer max 200 chars.
   notes          String?
   /// v1.25 — AES-256-GCM ciphertext for `notes`. The plaintext column
@@ -3214,6 +3344,37 @@ model RefreshToken {
   @@map("refresh_tokens")
 }
 
+// v1.30.x — one-time native OIDC handoff code. Bridges the browser-context
+// OIDC callback to the cookie-less native token exchange. The raw value
+// `hlh_<…>` rides ONLY the custom-scheme redirect (healthlog://oidc-callback);
+// only its HMAC-SHA256 hash (hashToken, keyed by API_TOKEN_HMAC_KEY) is stored,
+// so a database dump reconstructs nothing. Single-use via the guarded consume
+// (`WHERE consumed_at IS NULL`); a second presentation after consumption revokes
+// the token pair the first exchange issued (refresh-token reuse-detection
+// posture). 90-second TTL enforced at read; a daily sweep prunes stale rows.
+model OidcNativeHandoff {
+  id                     String    @id @default(cuid())
+  userId                 String    @map("user_id")
+  codeHash               String    @unique @map("code_hash") // hashToken(hlh_<…>)
+  /// The app's S256 PKCE challenge, bound at mint; the exchange verifies
+  /// s256(code_verifier) against it (constant-time) before consuming.
+  codeChallenge          String    @map("code_challenge")
+  expiresAt              DateTime  @map("expires_at")
+  consumedAt             DateTime? @map("consumed_at")
+  /// hashToken of the refresh token issued at exchange — replay containment
+  /// revokes exactly this family member (+ its paired access token).
+  issuedRefreshTokenHash String?   @map("issued_refresh_token_hash")
+  createdAt              DateTime  @default(now()) @map("created_at")
+  ipAddress              String?   @map("ip_address")
+  userAgent              String?   @map("user_agent")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
+  @@index([expiresAt])
+  @@map("oidc_native_handoffs")
+}
+
 // ─── Withings ──────────────────────────────────────────────
 
 model WithingsConnection {
@@ -3239,11 +3400,17 @@ model WithingsConnection {
   /// and re-syncs with the corrected END stamp, then sets this so the discovery
   /// query drops the connection. Null = backfill not yet run.
   sleepTimelineBackfillAt DateTime? @map("sleep_timeline_backfill_at")
+  /// v1.32 — durable per-category webhook subscription outcomes. The JSON
+  /// payload is versioned and validated before use; the timestamp mirrors the
+  /// earliest transient/pending category retry for indexed hourly discovery.
+  webhookSubscriptionState   Json?     @map("webhook_subscription_state")
+  webhookSubscriptionRetryAt DateTime? @map("webhook_subscription_retry_at")
   createdAt               DateTime  @default(now()) @map("created_at")
   updatedAt               DateTime  @updatedAt @map("updated_at")
 
   user User @relation(fields: [userId], references: [id], onDelete: Cascade)
 
+  @@index([webhookSubscriptionRetryAt])
   @@map("withings_connections")
 }
 
@@ -3293,7 +3460,7 @@ model WithingsOAuthState {
 model WhoopConnection {
   id                      String    @id @default(cuid())
   userId                  String    @unique @map("user_id")
-  whoopUserId             String    @map("whoop_user_id")
+  whoopUserId             String?   @unique @map("whoop_user_id")
   accessToken             String    @map("access_token") // encrypted at app level
   refreshToken            String    @map("refresh_token") // encrypted at app level
   tokenExpiresAt          DateTime  @map("token_expires_at")
@@ -4145,6 +4312,9 @@ model ImportJob {
   /// kick-off endpoint short-circuit a re-upload of the exact same
   /// file back to the existing job id without re-queueing.
   uploadSha256       String?   @map("upload_sha256")
+  /// Parser semantics revision. Existing archives migrated at revision 1 can
+  /// be deliberately reprocessed when the current parser revision advances.
+  parserRevision     Int       @default(1) @map("parser_revision")
   /// Apple's `ExportDate` attribute string-formatted, parsed during
   /// the unpack phase. NULL until the parser sees it.
   exportedAt         DateTime? @map("exported_at")
@@ -4171,6 +4341,33 @@ model ImportJob {
   @@map("import_jobs")
 }
 
+// Durable medication-intake CSV imports. The validated, normalized payload
+// stays in Postgres so retries never depend on request-process memory.
+model MedicationIntakeImportJob {
+  id            String    @id @default(cuid())
+  userId        String    @map("user_id")
+  medicationId  String    @map("medication_id")
+  pgBossJobId   String?   @unique @map("pg_boss_job_id")
+  status        String    @default("queued")
+  payload       Json
+  progress      Json      @default("{}")
+  result        Json?
+  failureReason String?   @map("failure_reason")
+  heartbeatAt   DateTime? @map("heartbeat_at")
+  startedAt     DateTime? @map("started_at")
+  completedAt   DateTime? @map("completed_at")
+  createdAt     DateTime  @default(now()) @map("created_at")
+  updatedAt     DateTime  @updatedAt @map("updated_at")
+
+  user       User       @relation(fields: [userId], references: [id], onDelete: Cascade)
+  medication Medication @relation(fields: [medicationId], references: [id], onDelete: Cascade)
+
+  @@index([userId, createdAt])
+  @@index([medicationId, createdAt])
+  @@index([status, heartbeatAt])
+  @@map("medication_intake_import_jobs")
+}
+
 // ─── Rate Limiting ──────────────────────────────────────────
 
 model RateLimit {
@@ -5186,7 +5383,8 @@ model InsightNarrative {
   userId           String   @map("user_id")
   /// "week" | "month".
   period           String
-  /// Resolved UI locale of the prose ("de" | "en").
+  /// Resolved UI locale of the prose — any shipped UI locale, not just de/en:
+  /// the prose is generated per locale, so the row is keyed by it.
   locale           String
   /// UTC YYYY-MM-DD boundary the narrative was generated for.
   dateKey          String   @map("date_key")
@@ -5207,6 +5405,62 @@ model InsightNarrative {
   @@map("insight_narratives")
 }
 
+// ─── Data-arrival spine (v1.31.0) ─────────────────────────────
+//
+// One row per (user, arrival kind, local day). The row is written by the
+// `data-arrival` worker after a SALIENT ingest — never by a backfill, which
+// the seam classifier drops before anything is enqueued.
+//
+// The unique index is load-bearing twice over: it is the "just in" marker the
+// reaction surfaces read and the durable identity whose newest same-day
+// revision owns generation. A strictly newer arrival atomically invalidates
+// stale generation state; equal or older deliveries are deduplicated.
+model ArrivalReaction {
+  id            String    @id @default(cuid())
+  userId        String    @map("user_id")
+  /// One of `ARRIVAL_KINDS` (`@/lib/arrivals/types`).
+  kind          String
+  /// The user's PROFILE-timezone YYYY-MM-DD this reaction is filed under.
+  localDate     String    @map("local_date")
+  /// Timestamp of the newest sample that triggered it.
+  occurredAt    DateTime  @map("occurred_at")
+  /// When the newest sample actually reached HealthLog. Unlike `createdAt`,
+  /// this advances when a later same-kind arrival refreshes the daily marker.
+  arrivedAt      DateTime  @default(now()) @map("arrived_at")
+  /// Kind-scoped referent: the workout id for `workout`, the panel day for labs.
+  refId         String?   @map("ref_id")
+  /// AES-256-GCM ciphertext of the generated reaction line. Null until — and
+  /// unless — a line is generated: the marker is the feature, the sentence is
+  /// garnish, and a provider-less install never fills this in. Follows the
+  /// `InsightNarrative.encryptedContent` precedent, NOT the plaintext pattern
+  /// the status cards use. Registered in `scripts/rotate-encryption-key.ts`.
+  lineEncrypted Bytes?    @map("line_encrypted")
+  generatedAt   DateTime? @map("generated_at")
+  /// Opaque owner token and lease for pre-provider setup. A stale worker may
+  /// reclaim only while `generationProviderInvokedAt` is null.
+  generationClaimId              String?   @map("generation_claim_id")
+  generationClaimedAt            DateTime? @map("generation_claimed_at")
+  /// The token reservation is written in the same transaction as the
+  /// `coach_usage` increment. A reclaimed pre-provider attempt reuses it.
+  generationReservedTokens       Int?      @map("generation_reserved_tokens")
+  generationBudgetDateKey        String?   @map("generation_budget_date_key")
+  /// Durable provider boundary. Once set, this marker is terminal unless the
+  /// encrypted line is committed; no retry may invoke a provider again.
+  generationProviderInvokedAt    DateTime? @map("generation_provider_invoked_at")
+  createdAt     DateTime  @default(now()) @map("created_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  // One mutable marker per kind and local day. Do not include `refId`: newer
+  // same-day referents replace this row atomically.
+  @@unique([userId, kind, localDate])
+  // The reaction surfaces read "today's rows for this user".
+  @@index([userId, localDate])
+  // The nightly retention sweep deletes by age.
+  @@index([createdAt])
+  @@map("arrival_reactions")
+}
+
 // ─── Cycle Tracking (v1.15.0) ─────────────────────────────────
 //
 // Self-hosted reproductive-health tracking: period + flow, symptom
@@ -6039,6 +6293,31 @@ enum InboundDocumentStatus {
   @@map("inbound_document_status")
 }
 
+/// Outcome of a document's plain-language summary. Recorded so the detail view
+/// states what happened rather than claiming generation is in progress for a
+/// job that was never enqueued.
+///
+/// WITHHELD deserves a note: the outbound safety screen tripped, so the model's
+/// prose is discarded and NEVER shown. Only the fact of the refusal is kept, and
+/// it is deliberately not terminal — the user can ask again, which is the whole
+/// reason this is a state and not a stored refusal string.
+enum DocumentSummaryState {
+  /// Never attempted — the opt-in was off at upload, or the document predates
+  /// the feature. The default, so every existing row is correct.
+  NONE
+  /// Enqueued or running.
+  PENDING
+  /// A summary was produced and is stored in `summaryEncrypted`.
+  READY
+  /// Produced, then blocked by the outbound safety screen. Text discarded.
+  WITHHELD
+  /// Attempted and could not produce one — no vision provider, spent budget,
+  /// withdrawn consent, an unreadable file, or a provider error.
+  UNAVAILABLE
+
+  @@map("document_summary_state")
+}
+
 /// The FHIR resource an extracted fact maps to (STATED status only): a
 /// diagnosis → Condition, a measured value → Observation, a medication the
 /// patient is/was taking → MedicationStatement.
@@ -6125,6 +6404,13 @@ model InboundDocument {
   /// When the background summary was generated (null until it runs). Surfaced
   /// as meta beside the summary in the document detail view.
   summaryGeneratedAt DateTime?             @map("summary_generated_at")
+  /// What actually happened to this document's summary, so the detail view can
+  /// tell the four outcomes apart instead of reading a null column as "still
+  /// generating". `summaryEncrypted` alone cannot: a document nobody ever
+  /// enqueued, one whose provider is missing, one the safety screen withheld,
+  /// and one mid-flight all leave it null. NONE is the default, which keeps
+  /// every pre-existing row correct — none of them were ever attempted.
+  summaryState       DocumentSummaryState  @default(NONE) @map("summary_state")
 
   facts           ExtractedFact[]
   conditionLinks  DocumentConditionLink[]
@@ -6251,14 +6537,14 @@ model DocumentConditionLink {
 /// versioned key (no schema column), and key rotation re-tokenises from the
 /// decrypted `textEncrypted`.
 model DocumentContentIndex {
-  id               String   @id @default(cuid())
-  documentId       String   @unique @map("document_id")
-  userId           String   @map("user_id")
+  id                    String   @id @default(cuid())
+  documentId            String   @unique @map("document_id")
+  userId                String   @map("user_id")
   /// AES-256-GCM ciphertext of the normalised extracted text (capped, first
   /// ~64 KiB), stored as the `encrypt()`-string-as-UTF-8 Bytes shape shared
   /// with the Coach columns. The plaintext is recoverable server-side so
   /// rotation can re-tokenise; the list query never selects it.
-  textEncrypted    Bytes    @map("text_encrypted")
+  textEncrypted         Bytes    @map("text_encrypted")
   /// v1.27.33 (Document vault P4 — chat about a document) — AES-256-GCM
   /// ciphertext of the VERBATIM extracted text (byte-capped, NOT lowercased or
   /// de-accented), stored additionally alongside `textEncrypted` so a document
@@ -6267,22 +6553,22 @@ model DocumentContentIndex {
   /// UTF-8 Bytes shape as every other PHI column. Nullable: rows indexed before
   /// P4 carry NULL until re-indexed, and the chat route falls back to the
   /// normalised `textEncrypted` when it is absent. The list query never selects it.
-  verbatimTextEncrypted Bytes? @map("verbatim_text_encrypted")
+  verbatimTextEncrypted Bytes?   @map("verbatim_text_encrypted")
   /// Deduped HMAC-SHA256 (truncated hex) of the normalised tokens — the blind
   /// index. One-way: opaque without the server-held index subkey. GIN-indexed
   /// (raw SQL in the migration; Prisma cannot express a GIN index).
-  searchTokens     String[] @default([]) @map("search_tokens")
+  searchTokens          String[] @default([]) @map("search_tokens")
   /// Provenance of the indexed text: "vision" (provider transcription of the
   /// stored original), "text-ocr" (browser-OCR text posted by the client),
   /// "local-pdf" (server-side text-layer extraction, no provider) or "local-ocr"
   /// (server-side OCR of a scanned document — deferred follow-up). Free String;
   /// adding a source value needs no migration.
-  source           String
+  source                String
   /// Provider type that produced the text (diagnostic only), or null on the
   /// text-ocr path.
-  providerType     String?  @map("provider_type")
+  providerType          String?  @map("provider_type")
   /// Tokeniser algorithm version — bump to force a re-index on a scheme change.
-  tokenizerVersion String   @map("tokenizer_version")
+  tokenizerVersion      String   @map("tokenizer_version")
 
   createdAt DateTime @default(now()) @map("created_at")
   updatedAt DateTime @updatedAt @map("updated_at")
@@ -6303,23 +6589,23 @@ model DocumentContentIndex {
 /// source, so the preview is metadata-free by construction. Owner-scoped
 /// serve route only; cascades on delete.
 model DocumentThumbnail {
-  id                 String   @id @default(cuid())
-  documentId         String   @unique @map("document_id")
-  userId             String   @map("user_id")
+  id                 String @id @default(cuid())
+  documentId         String @unique @map("document_id")
+  userId             String @map("user_id")
   /// AES-256-GCM ciphertext of the JPEG preview, stored as the
   /// `encrypt()`-string-as-UTF-8 Bytes shape (base64 of the JPEG), the same
   /// codec `DocumentContentIndex.textEncrypted` uses so the standard
   /// key-rotation walk covers it. A scanned medical preview is PHI — never
   /// stored in the clear or logged. The list query never selects it.
-  thumbnailEncrypted Bytes    @map("thumbnail_encrypted")
+  thumbnailEncrypted Bytes  @map("thumbnail_encrypted")
   /// Decoded thumbnail dimensions (px) — diagnostic + lets a future consumer
   /// size the tile without decoding the blob.
   width              Int
   height             Int
   /// Plaintext byte length of the JPEG (pre-encryption), for `Content-Length`.
-  byteSize           Int      @map("byte_size")
+  byteSize           Int    @map("byte_size")
   /// Source MIME the preview was rendered from (diagnostic only).
-  sourceMime         String   @map("source_mime")
+  sourceMime         String @map("source_mime")
 
   createdAt DateTime @default(now()) @map("created_at")
   updatedAt DateTime @updatedAt @map("updated_at")

public/sw.js

@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.30.2";
+  /* @sw-version-fallback */ "v1.32.2";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`
@@ -202,9 +202,12 @@ async function cacheFirst(request, cacheName) {
 
   const response = await fetch(request);
   if (response.ok) {
-    const cache = await caches.open(cacheName);
-    cache.put(request, response.clone());
-    trimCache(cacheName, MAX_STATIC_ENTRIES);
+    await bestEffortCacheWrite(
+      cacheName,
+      request,
+      response.clone(),
+      MAX_STATIC_ENTRIES,
+    );
   }
   return response;
 }
@@ -225,7 +228,6 @@ async function cacheFirst(request, cacheName) {
  * refusal discipline the idempotency cache uses.
  */
 async function networkFirstApi(request) {
-  const cache = await caches.open(DATA_CACHE);
 
   try {
     const response = await fetch(request);
@@ -236,17 +238,21 @@ async function networkFirstApi(request) {
       .text()
       .catch(() => undefined);
     if (isCacheableApiResponse(response, bodyText)) {
-      const toStore = new Response(bodyText, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: response.headers,
-      });
-      await cache.put(request, toStore);
-      trimCache(DATA_CACHE, MAX_DATA_ENTRIES);
+      await bestEffortCacheWrite(
+        DATA_CACHE,
+        request,
+        new Response(bodyText, {
+          status: response.status,
+          statusText: response.statusText,
+          headers: response.headers,
+        }),
+        MAX_DATA_ENTRIES,
+      );
     }
     return response;
   } catch {
     // Network failed (offline) — serve the last cached copy if we have one.
+    const cache = await caches.open(DATA_CACHE);
     const cached = await cache.match(request);
     if (cached) return cached;
 
@@ -303,9 +309,14 @@ async function networkFirst(event, cacheName) {
       (event.preloadResponse ? await event.preloadResponse : null) ||
       (await fetch(request));
     if (response.ok && isCacheableNavigation(request, response)) {
-      const cache = await caches.open(cacheName);
-      cache.put(request, response.clone());
-      trimCache(cacheName, MAX_PAGE_ENTRIES);
+      event.waitUntil(
+        bestEffortCacheWrite(
+          cacheName,
+          request,
+          response.clone(),
+          MAX_PAGE_ENTRIES,
+        ),
+      );
     }
     return response;
   } catch {
@@ -336,6 +347,27 @@ async function networkFirst(event, cacheName) {
   }
 }
 
+/**
+ * Cache a successful network response without making CacheStorage
+ * availability part of the fetch contract. Quota, eviction, or trim failures
+ * are intentionally swallowed: caching may improve a later request, but it
+ * must never replace this request's already-successful network response.
+ */
+async function bestEffortCacheWrite(
+  cacheName,
+  request,
+  response,
+  maxEntries,
+) {
+  try {
+    const cache = await caches.open(cacheName);
+    await cache.put(request, response);
+    await trimCache(cacheName, maxEntries);
+  } catch {
+    // CacheStorage is an optional optimization.
+  }
+}
+
 /**
  * Trim cache to maxEntries by removing oldest entries. `keys()` returns
  * insertion order, so one read + a single pass over the excess prefix

scripts/README.md

@@ -4,11 +4,17 @@ One-shot operator and build scripts. These are not part of the running applicati
 
 ## How to run them
 
+From a source checkout:
+
 ```bash
 pnpm dlx tsx scripts/<file>.ts
 ```
 
-Use `pnpm dlx tsx`, not bare `pnpm tsx`. The production standalone image strips `tsx`, so the bare invocation fails inside the container. `scripts/` is excluded from the project typecheck.
+The production image intentionally removes npm, pnpm, and Corepack. Only
+container-safe scripts named by an operator runbook use its pinned
+`healthlog-tsx` launcher; scripts that import the full application dependency
+graph must run from a source checkout. `scripts/` is excluded from the project
+typecheck.
 
 ## What lives here
 

scripts/__tests__/check-env.test.ts

@@ -7,6 +7,8 @@
  * exit-code behaviour is best left to a smoke test in CI (deferred to
  * v1.4.43).
  */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import { describe, expect, it } from "vitest";
 import { checkEnv, parseEnvFile } from "../check-env";
 
@@ -252,3 +254,39 @@ describe("checkEnv — optional groups (informational)", () => {
     expect(apnsKeyId.required).toBe(false);
   });
 });
+
+describe("environment inventory", () => {
+  it("lists every optional AI runtime variable in compose, both examples, and the manifest", () => {
+    const repositoryRoot = join(__dirname, "../..");
+    const variableNames = [
+      "ALLOW_LOCAL_AI_PRIVATE_HOSTS",
+      "INSIGHTS_MAX_TOKENS",
+    ];
+    const compose = readFileSync(
+      join(repositoryRoot, "docker-compose.yml"),
+      "utf8",
+    );
+    const exampleEnvironments = [
+      readFileSync(join(repositoryRoot, ".env.example"), "utf8"),
+      readFileSync(join(repositoryRoot, ".env.production.example"), "utf8"),
+    ];
+    const manifest = JSON.parse(
+      readFileSync(join(repositoryRoot, "scripts/env-manifest.json"), "utf8"),
+    ) as {
+      groups: Array<{ variables: Array<{ name: string }> }>;
+    };
+    const manifestNames = manifest.groups.flatMap((group) =>
+      group.variables.map((variable) => variable.name),
+    );
+
+    for (const variableName of variableNames) {
+      expect(compose).toMatch(new RegExp(`^\\s*${variableName}:`, "m"));
+      for (const exampleEnvironment of exampleEnvironments) {
+        expect(exampleEnvironment).toMatch(
+          new RegExp(`^# ${variableName}=`, "m"),
+        );
+      }
+      expect(manifestNames).toContain(variableName);
+    }
+  });
+});

scripts/__tests__/ci-determinism.test.ts

@@ -0,0 +1,143 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { parse } from "yaml";
+
+import integrationConfig from "../../vitest.integration.config.mts";
+import unitConfig from "../../vitest.config.mts";
+
+function repositoryRoot(): string {
+  const testPath = expect.getState().testPath;
+  if (!testPath) throw new Error("Vitest did not expose the current test path");
+  return join(dirname(testPath), "../..");
+}
+
+function readRepoFile(path: string): string {
+  return readFileSync(join(repositoryRoot(), path), "utf8");
+}
+
+type WorkflowStep = {
+  if?: string;
+  uses?: string;
+  with?: Record<string, string | number>;
+};
+
+type WorkflowJob = {
+  env?: Record<string, string>;
+  steps?: WorkflowStep[];
+};
+
+type Workflow = {
+  jobs: Record<string, WorkflowJob>;
+};
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+  vi.resetModules();
+});
+
+describe("Playwright CI determinism", () => {
+  it("fails CI when a retry resolves a flaky test", async () => {
+    vi.stubEnv("CI", "true");
+    // Re-import after stubbing CI so config conditionals are evaluated as CI.
+    const { default: config } = await import("../../playwright.config");
+
+    expect(config.retries).toBe(2);
+    expect(config.failOnFlakyTests).toBe(true);
+    expect(config.reporter).toEqual([["github"], ["html", { open: "never" }]]);
+    expect(config.webServer).toMatchObject({
+      command: expect.stringContaining(
+        `${JSON.stringify(process.execPath)} .next/standalone/server.js`,
+      ),
+      env: expect.objectContaining({
+        NATIVE_CANVAS: "off",
+      }),
+    });
+  });
+
+  it("retains the Playwright report after every workflow outcome", () => {
+    const workflow = parse(
+      readRepoFile(".github/workflows/e2e.yml"),
+    ) as Workflow;
+    const upload = workflow.jobs.e2e?.steps?.find((step) =>
+      step.uses?.startsWith("actions/upload-artifact@"),
+    );
+
+    expect(upload).toBeDefined();
+    expect(upload?.if).toBe("always()");
+    expect(upload?.with).toMatchObject({
+      name: "playwright-report",
+      path: "playwright-report/",
+      "retention-days": 7,
+      "if-no-files-found": "ignore",
+    });
+  });
+
+  it("uses production-valid secrets and plain-HTTP cookies", () => {
+    const workflow = parse(
+      readRepoFile(".github/workflows/e2e.yml"),
+    ) as Workflow;
+    const env = workflow.jobs.e2e?.env;
+
+    expect(env?.API_TOKEN_HMAC_KEY).toMatch(/^[0-9a-f]{64}$/);
+    expect(env?.SESSION_COOKIE_SECURE).toBe("false");
+  });
+});
+
+describe("local worktree isolation", () => {
+  it("keeps nested worktree suites out of the root unit run", () => {
+    expect(unitConfig.test?.exclude ?? []).toContain(".worktrees/**");
+  });
+});
+
+describe("integration environment isolation", () => {
+  it("registers a worker setup bridge and authoritative test secrets", () => {
+    const test = integrationConfig.test;
+
+    expect(test?.setupFiles ?? []).toContain(
+      "./tests/integration/environment-setup.ts",
+    );
+    expect(test?.env).toMatchObject({
+      TZ: "UTC",
+      ENCRYPTION_KEY:
+        "0000000000000000000000000000000000000000000000000000000000000000",
+      ENCRYPTION_KEYS: "",
+      ENCRYPTION_ACTIVE_KEY_ID: "",
+      API_TOKEN_HMAC_KEY:
+        "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+      SESSION_SECRET: "integration-test-session-secret-32-bytes",
+    });
+    expect(
+      existsSync(
+        join(repositoryRoot(), "tests/integration/environment-setup.ts"),
+      ),
+    ).toBe(true);
+  });
+});
+
+describe("container dependency installation", () => {
+  it("copies the prepare helper before the Git-free frozen install", () => {
+    const dockerfile = readRepoFile("Dockerfile");
+
+    expect(dockerfile).toContain(
+      "COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./\n" +
+        "COPY scripts/prepare.mjs scripts/prepare.mjs\n" +
+        "RUN pnpm install --frozen-lockfile --prod=false",
+    );
+  });
+});
+
+describe("production dependency advisory floors", () => {
+  it("pins vulnerable transitive ranges to compatible patched versions", () => {
+    const workspace = parse(readRepoFile("pnpm-workspace.yaml")) as {
+      overrides?: Record<string, string>;
+    };
+
+    expect(workspace.overrides).toMatchObject({
+      "dompurify@<=3.4.10": "^3.4.11",
+      "postcss@<8.5.10": "^8.5.10",
+      "@hono/node-server@<1.19.13": "^1.19.13",
+      "hono@<4.12.25": "^4.12.25",
+    });
+  });
+});

scripts/__tests__/prepare.test.ts

@@ -0,0 +1,135 @@
+import { spawnSync, type SpawnSyncReturns } from "node:child_process";
+import {
+  chmodSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+
+const temporaryDirectories: string[] = [];
+
+afterEach(() => {
+  for (const path of temporaryDirectories.splice(0)) {
+    rmSync(path, { recursive: true, force: true });
+  }
+});
+
+type GitMarker = "absent" | "directory" | "file";
+
+type PrepareResult = {
+  invocationLog: string | null;
+  result: SpawnSyncReturns<string>;
+};
+
+function runPrepareFixture(
+  gitMarker: GitMarker,
+  lefthookStatus = 0,
+): PrepareResult {
+  const testPath = expect.getState().testPath;
+  if (!testPath) throw new Error("Vitest did not expose the current test path");
+  const root = join(dirname(testPath), "../..");
+  const directory = mkdtempSync(join(tmpdir(), "healthlog-prepare-"));
+  temporaryDirectories.push(directory);
+
+  const packageJson = JSON.parse(
+    readFileSync(join(root, "package.json"), "utf8"),
+  ) as {
+    scripts: { prepare: string };
+  };
+  const prepareHelper = join(root, "scripts/prepare.mjs");
+  if (existsSync(prepareHelper)) {
+    mkdirSync(join(directory, "scripts"));
+    cpSync(prepareHelper, join(directory, "scripts/prepare.mjs"));
+  }
+
+  if (gitMarker === "directory") {
+    mkdirSync(join(directory, ".git"));
+  } else if (gitMarker === "file") {
+    writeFileSync(
+      join(directory, ".git"),
+      "gitdir: ../shared/.git/worktrees/fixture\n",
+    );
+  }
+
+  const binDirectory = join(directory, "bin");
+  const invocationLog = join(directory, "lefthook.log");
+  mkdirSync(binDirectory);
+  const lefthook = join(
+    binDirectory,
+    process.platform === "win32" ? "lefthook.cmd" : "lefthook",
+  );
+  writeFileSync(
+    lefthook,
+    process.platform === "win32"
+      ? '@echo off\r\necho %*>>"%FIXTURE_LEFTHOOK_LOG%"\r\nexit /b %FIXTURE_LEFTHOOK_STATUS%\r\n'
+      : '#!/bin/sh\nprintf \'%s\\n\' "$*" >> "$FIXTURE_LEFTHOOK_LOG"\nexit "$FIXTURE_LEFTHOOK_STATUS"\n',
+  );
+  if (process.platform !== "win32") chmodSync(lefthook, 0o755);
+
+  const result = spawnSync(packageJson.scripts.prepare, {
+    cwd: directory,
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      PATH: `${binDirectory}:${process.env.PATH ?? ""}`,
+      FIXTURE_LEFTHOOK_LOG: invocationLog,
+      FIXTURE_LEFTHOOK_STATUS: String(lefthookStatus),
+    },
+    shell: true,
+  });
+
+  return {
+    result,
+    invocationLog: existsSync(invocationLog)
+      ? readFileSync(invocationLog, "utf8").replaceAll("\r\n", "\n")
+      : null,
+  };
+}
+
+describe("package prepare hook installation", () => {
+  it("enables command-shim execution on Windows only", () => {
+    const testPath = expect.getState().testPath;
+    if (!testPath)
+      throw new Error("Vitest did not expose the current test path");
+    const source = readFileSync(
+      join(dirname(testPath), "../prepare.mjs"),
+      "utf8",
+    );
+
+    expect(source).toContain('shell: process.platform === "win32"');
+  });
+
+  it("skips hook installation only when Git metadata is absent", () => {
+    const { invocationLog, result } = runPrepareFixture("absent");
+
+    expect(result.status, result.stderr).toBe(0);
+    expect(invocationLog).toBeNull();
+  });
+
+  it.each(["directory", "file"] as const)(
+    "installs hooks when .git is a %s",
+    (gitMarker) => {
+      const { invocationLog, result } = runPrepareFixture(gitMarker);
+
+      expect(result.status, result.stderr).toBe(0);
+      expect(invocationLog).toBe("install --force\n");
+    },
+  );
+
+  it.each(["directory", "file"] as const)(
+    "propagates Lefthook failure when .git is a %s",
+    (gitMarker) => {
+      const { invocationLog, result } = runPrepareFixture(gitMarker, 42);
+
+      expect(invocationLog).toBe("install --force\n");
+      expect(result.status).toBe(42);
+    },
+  );
+});

scripts/__tests__/release-workflows.test.ts

@@ -0,0 +1,473 @@
+import { spawnSync, type SpawnSyncReturns } from "node:child_process";
+import {
+  chmodSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { parse } from "yaml";
+
+function readRepoFile(path: string): string {
+  const testPath = expect.getState().testPath;
+  if (!testPath) throw new Error("Vitest did not expose the current test path");
+  return readFileSync(join(dirname(testPath), "../..", path), "utf8");
+}
+type WorkflowStep = {
+  name?: string;
+  run?: string;
+  "continue-on-error"?: boolean;
+};
+type WorkflowJob = {
+  needs?: string | string[];
+  outputs?: Record<string, string>;
+  steps?: WorkflowStep[];
+  uses?: string;
+  with?: Record<string, string>;
+};
+type Workflow = {
+  on?: {
+    workflow_call?: { inputs?: Record<string, { required?: boolean }> };
+  };
+  jobs: Record<string, WorkflowJob>;
+};
+
+const temporaryDirectories: string[] = [];
+
+afterEach(() => {
+  for (const path of temporaryDirectories.splice(0)) {
+    rmSync(path, { recursive: true, force: true });
+  }
+});
+
+function loadWorkflow(name: string): Workflow {
+  return parse(readRepoFile(join(".github/workflows", name))) as Workflow;
+}
+
+function stepScript(
+  workflow: Workflow,
+  jobName: string,
+  stepName: string,
+): string {
+  const step = workflow.jobs[jobName]?.steps?.find(
+    (candidate) => candidate.name === stepName,
+  );
+  if (!step?.run) {
+    throw new Error(`Missing ${jobName}/${stepName} run step`);
+  }
+  return step.run;
+}
+
+function runReleasePolicy(
+  overrides: Record<string, string> = {},
+): SpawnSyncReturns<string> {
+  const directory = mkdtempSync(join(tmpdir(), "healthlog-release-policy-"));
+  temporaryDirectories.push(directory);
+  const binDirectory = join(directory, "bin");
+  mkdirSync(binDirectory);
+  writeFileSync(
+    join(directory, "package.json"),
+    JSON.stringify({ version: overrides.FIXTURE_PACKAGE_VERSION ?? "1.31.4" }),
+  );
+
+  const gitPath = join(binDirectory, "git");
+  writeFileSync(
+    gitPath,
+    `#!/bin/sh
+if [ "$1" = "fetch" ]; then exit 0; fi
+if [ "$1" = "merge-base" ] && [ "$FIXTURE_MAIN_ANCESTRY" = "yes" ]; then exit 0; fi
+exit 1
+`,
+  );
+  chmodSync(gitPath, 0o755);
+
+  const ghPath = join(binDirectory, "gh");
+  writeFileSync(
+    ghPath,
+    `#!/bin/sh
+if [ "$FIXTURE_PRIOR_CI" = "yes" ]; then printf '1\\n'; else printf '0\\n'; fi
+`,
+  );
+  chmodSync(ghPath, 0o755);
+
+  const workflow = loadWorkflow("docker-publish.yml");
+  return spawnSync(
+    "bash",
+    [
+      "-euo",
+      "pipefail",
+      "-c",
+      stepScript(workflow, "release-policy", "Validate release policy"),
+    ],
+    {
+      cwd: directory,
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        PATH: `${binDirectory}:${process.env.PATH ?? ""}`,
+        GITHUB_EVENT_NAME: "push",
+        GITHUB_REF_TYPE: "tag",
+        GITHUB_REF_NAME: "v1.31.4",
+        GITHUB_SHA: "0123456789abcdef0123456789abcdef01234567",
+        GITHUB_REPOSITORY: "MBombeck/HealthLog",
+        GH_TOKEN: "fixture-token",
+        FIXTURE_MAIN_ANCESTRY: "yes",
+        FIXTURE_PRIOR_CI: "yes",
+        ...overrides,
+      },
+    },
+  );
+}
+
+function runExactPull(resolvedDigest: string): {
+  result: SpawnSyncReturns<string>;
+  commands: string;
+} {
+  const directory = mkdtempSync(join(tmpdir(), "healthlog-image-pull-"));
+  temporaryDirectories.push(directory);
+  const dockerPath = join(directory, "docker");
+  const commandLog = join(directory, "commands.log");
+  writeFileSync(
+    dockerPath,
+    `#!/bin/sh
+printf '%s\\n' "$*" >> "$FIXTURE_COMMAND_LOG"
+if [ "$1" = "pull" ]; then exit 0; fi
+if [ "$1" = "buildx" ] && [ "$2" = "imagetools" ] && [ "$3" = "inspect" ]; then
+  printf '\"%s\"\\n' "$FIXTURE_RESOLVED_DIGEST"
+  exit 0
+fi
+exit 1
+`,
+  );
+  chmodSync(dockerPath, 0o755);
+
+  const workflow = loadWorkflow("post-publish-verify.yml");
+  const result = spawnSync(
+    "bash",
+    [
+      "-euo",
+      "pipefail",
+      "-c",
+      stepScript(workflow, "verify", "Pull exact image"),
+    ],
+    {
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        PATH: `${directory}:${process.env.PATH ?? ""}`,
+        IMAGE_REF: "ghcr.io/mbombeck/healthlog",
+        IMAGE_TAG: "v1.31.4",
+        IMAGE_DIGEST:
+          "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        FIXTURE_COMMAND_LOG: commandLog,
+        FIXTURE_RESOLVED_DIGEST: resolvedDigest,
+      },
+    },
+  );
+  return {
+    result,
+    commands: readFileSync(commandLog, "utf8"),
+  };
+}
+
+function runPromotion(
+  overrides: Record<string, string> = {},
+): SpawnSyncReturns<string> {
+  const directory = mkdtempSync(join(tmpdir(), "healthlog-promotion-"));
+  temporaryDirectories.push(directory);
+  const sleepPath = join(directory, "sleep");
+  writeFileSync(sleepPath, "#!/bin/sh\nexit 0\n");
+  chmodSync(sleepPath, 0o755);
+  const curlPath = join(directory, "curl");
+  writeFileSync(
+    curlPath,
+    `#!/bin/sh
+printf '{\"deployment_uuid\":\"fixture\"}\\n__HTTP_STATUS__:%s' "$FIXTURE_HTTP_STATUS"
+`,
+  );
+  chmodSync(curlPath, 0o755);
+
+  const workflow = loadWorkflow("docker-publish.yml");
+  return spawnSync(
+    "bash",
+    [
+      "-euo",
+      "pipefail",
+      "-c",
+      stepScript(workflow, "promote", "Trigger Coolify deploy"),
+    ],
+    {
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        PATH: `${directory}:${process.env.PATH ?? ""}`,
+        COOLIFY_AUTO_DEPLOY: "on",
+        COOLIFY_WEBHOOK: "https://coolify.example/deploy?uuid=fixture",
+        COOLIFY_TOKEN: "fixture-token",
+        IMAGE_TAG: "v1.31.4",
+        IMAGE_DIGEST:
+          "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        BUILD_SHA: "0123456789ab",
+        FIXTURE_HTTP_STATUS: "200",
+        ...overrides,
+      },
+    },
+  );
+}
+
+describe("release container inputs", () => {
+  it("pins every Node stage to one reviewed multi-arch digest", () => {
+    const dockerfile = readRepoFile("Dockerfile");
+    const fromLines = dockerfile.match(/^FROM node:[^\n]+$/gm) ?? [];
+
+    expect(fromLines).toHaveLength(3);
+    expect(new Set(fromLines.map((line) => line.split(" AS ")[0]))).toEqual(
+      new Set([
+        "FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2",
+      ]),
+    );
+  });
+
+  it("pins pnpm for builds and removes package managers from runtime", () => {
+    const dockerfile = readRepoFile("Dockerfile");
+    const packageJson = JSON.parse(readRepoFile("package.json")) as {
+      packageManager: string;
+    };
+    expect(packageJson.packageManager).toBe("pnpm@11.15.1");
+    expect(dockerfile).not.toContain("pnpm@latest");
+    expect(
+      dockerfile.match(/corepack prepare pnpm@11\.15\.1 --activate/g),
+    ).toHaveLength(2);
+    expect(dockerfile).toContain(
+      "rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack /root/.cache/node/corepack",
+    );
+    expect(dockerfile).toContain("tsx@4.23.1");
+    expect(dockerfile).toContain(
+      "ln -sfn /opt/prisma-cli/node_modules/.bin/tsx /usr/local/bin/healthlog-tsx",
+    );
+    expect(dockerfile).toContain("dotenv@17.4.2");
+    expect(dockerfile).toContain(
+      "ln -sfn /opt/prisma-cli/node_modules/dotenv /app/node_modules/dotenv",
+    );
+    expect(dockerfile).toContain(
+      "ln -sfn /opt/prisma-cli/node_modules/prisma /app/node_modules/prisma",
+    );
+  });
+
+  it("keeps linked worktrees out of the Docker build context", () => {
+    const dockerignore = readRepoFile(".dockerignore");
+    expect(dockerignore.split(/\r?\n/)).toContain(".worktrees");
+  });
+
+  it("bundles Prisma's adapter and verifies only runtime externals", () => {
+    const dockerfile = readRepoFile("Dockerfile");
+    const nextConfig = readRepoFile("next.config.ts");
+    expect(dockerfile).not.toContain("/opt/pg-boss");
+    expect(dockerfile).not.toContain('NODE_PATH="/opt/pg-boss/node_modules"');
+    expect(dockerfile).toMatch(
+      /require\.resolve\(['"]pg-boss['"]\)[\s\S]*require\.resolve\(['"]pg['"]\)/,
+    );
+    expect(dockerfile).not.toContain("require.resolve('@prisma/adapter-pg')");
+    expect(dockerfile).not.toContain("require.resolve('@prisma/client')");
+    expect(nextConfig).not.toMatch(
+      /serverExternalPackages:\s*\[[\s\S]*["']@prisma\/adapter-pg["']/,
+    );
+  });
+});
+
+describe("release pre-build policy", () => {
+  it("accepts a strict SemVer tag that matches package.json on main with prior CI", () => {
+    const result = runReleasePolicy();
+
+    expect(result.status, result.stderr).toBe(0);
+    expect(result.stdout).toContain("Release policy passed");
+  });
+
+  it.each(["v1.2", "v01.2.3", "v1.2.3-rc.1", "1.2.3"])(
+    "rejects non-strict release tag %s",
+    (tag) => {
+      const result = runReleasePolicy({ GITHUB_REF_NAME: tag });
+
+      expect(result.status).not.toBe(0);
+      expect(result.stderr).toContain("strict SemVer");
+    },
+  );
+
+  it("rejects a tag that does not match package.json", () => {
+    const result = runReleasePolicy({ FIXTURE_PACKAGE_VERSION: "1.31.3" });
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain("package.json version");
+  });
+
+  it("rejects a release commit outside main ancestry", () => {
+    const result = runReleasePolicy({ FIXTURE_MAIN_ANCESTRY: "no" });
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain("ancestor of origin/main");
+  });
+
+  it("rejects a release commit without successful prior quality CI", () => {
+    const result = runReleasePolicy({ FIXTURE_PRIOR_CI: "no" });
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain("successful prior Security & Quality");
+  });
+
+  it("gates every image build on the release policy", () => {
+    const workflow = loadWorkflow("docker-publish.yml");
+    const needs = workflow.jobs.build?.needs;
+
+    expect(Array.isArray(needs) ? needs : [needs]).toContain("release-policy");
+  });
+});
+
+describe("exact post-publish verification", () => {
+  it("passes the published ref, tag, and digest into the blocking verifier", () => {
+    const workflow = loadWorkflow("docker-publish.yml");
+    const merge = workflow.jobs.merge;
+    const verify = workflow.jobs["verify-published-image"];
+
+    expect(merge?.outputs).toEqual({
+      image_ref: "${{ steps.published.outputs.image_ref }}",
+      image_tag: "${{ steps.published.outputs.image_tag }}",
+      image_digest: "${{ steps.published.outputs.image_digest }}",
+      build_sha: "${{ steps.published.outputs.build_sha }}",
+    });
+    expect(verify?.uses).toBe("./.github/workflows/post-publish-verify.yml");
+    expect(verify?.needs).toBe("merge");
+    expect(verify?.with).toEqual({
+      image_ref: "${{ needs.merge.outputs.image_ref }}",
+      image_tag: "${{ needs.merge.outputs.image_tag }}",
+      image_digest: "${{ needs.merge.outputs.image_digest }}",
+      build_sha: "${{ needs.merge.outputs.build_sha }}",
+    });
+  });
+
+  it("requires exact image identity inputs for every invocation", () => {
+    const workflow = loadWorkflow("post-publish-verify.yml");
+    const inputs = workflow.on?.workflow_call?.inputs;
+
+    expect(inputs?.image_ref?.required).toBe(true);
+    expect(inputs?.image_tag?.required).toBe(true);
+    expect(inputs?.image_digest?.required).toBe(true);
+    expect(inputs?.build_sha?.required).toBe(true);
+  });
+
+  it("pulls the exact tag and digest when the registry resolves correctly", () => {
+    const digest =
+      "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+    const { result, commands } = runExactPull(digest);
+
+    expect(result.status, result.stderr).toBe(0);
+    expect(commands).toContain("pull ghcr.io/mbombeck/healthlog:v1.31.4");
+    expect(commands).toContain(
+      "pull ghcr.io/mbombeck/healthlog@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    );
+  });
+
+  it("fails closed when the published tag resolves to another digest", () => {
+    const { result } = runExactPull(
+      "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+    );
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain("digest mismatch");
+  });
+
+  it("keeps pull, migration, start, version, and health checks blocking", () => {
+    const workflow = loadWorkflow("post-publish-verify.yml");
+    const steps = workflow.jobs.verify?.steps ?? [];
+    const requiredSteps = [
+      "Pull exact image",
+      "Run migrations",
+      "Start exact image",
+      "Verify exact version",
+      "Verify health",
+    ];
+
+    for (const name of requiredSteps) {
+      const step = steps.find((candidate) => candidate.name === name);
+      expect(step, `missing ${name}`).toBeDefined();
+      expect(step?.["continue-on-error"], name).not.toBe(true);
+    }
+
+    expect(stepScript(workflow, "verify", "Run migrations")).toContain(
+      "${IMAGE_REF}@${IMAGE_DIGEST}",
+    );
+    const startScript = stepScript(workflow, "verify", "Start exact image");
+    expect(startScript).toContain("${IMAGE_REF}@${IMAGE_DIGEST}");
+    expect(startScript).toMatch(/API_TOKEN_HMAC_KEY=[0-9a-f]{64}(?:\s|\\)/);
+    const versionScript = stepScript(
+      workflow,
+      "verify",
+      "Verify exact version",
+    );
+    expect(versionScript).toContain('EXPECTED_VERSION="${IMAGE_TAG#v}"');
+    expect(versionScript).toContain('jq -e --arg expected "$EXPECTED_VERSION"');
+    expect(stepScript(workflow, "verify", "Verify health")).toContain(
+      "jq -e '.status == \"ok\"'",
+    );
+  });
+});
+
+describe("Coolify promotion policy", () => {
+  it("waits for exact-image verification and keeps enabled promotion blocking", () => {
+    const workflow = loadWorkflow("docker-publish.yml");
+    const promotion = workflow.jobs.promote;
+    const needs = promotion?.needs;
+    const trigger = promotion?.steps?.find(
+      (step) => step.name === "Trigger Coolify deploy",
+    );
+
+    expect(Array.isArray(needs) ? needs : [needs]).toEqual(
+      expect.arrayContaining(["merge", "verify-published-image"]),
+    );
+    expect(trigger).toBeDefined();
+    expect(trigger?.["continue-on-error"]).not.toBe(true);
+    expect(
+      workflow.jobs.merge?.steps?.some(
+        (step) => step.name === "Trigger Coolify deploy",
+      ),
+    ).toBe(false);
+  });
+
+  it("accepts an enabled promotion only after a successful webhook response", () => {
+    const result = runPromotion();
+
+    expect(result.status, result.stderr).toBe(0);
+    expect(result.stdout).toContain("Coolify deploy queued");
+  });
+
+  it.each([
+    ["webhook", { COOLIFY_WEBHOOK: "" }],
+    ["token", { COOLIFY_TOKEN: "" }],
+  ])("rejects enabled promotion with missing %s credentials", (_name, env) => {
+    const result = runPromotion(env);
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain("COOLIFY_AUTO_DEPLOY=on");
+  });
+
+  it("fails enabled promotion when Coolify rejects the webhook", () => {
+    const result = runPromotion({ FIXTURE_HTTP_STATUS: "503" });
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain("returned HTTP 503");
+  });
+
+  it("allows explicit disabled promotion without credentials", () => {
+    const result = runPromotion({
+      COOLIFY_AUTO_DEPLOY: "off",
+      COOLIFY_WEBHOOK: "",
+      COOLIFY_TOKEN: "",
+    });
+
+    expect(result.status, result.stderr).toBe(0);
+    expect(result.stdout).toContain("COOLIFY_AUTO_DEPLOY=off");
+  });
+});

scripts/env-manifest.json

@@ -31,7 +31,7 @@
         },
         {
           "name": "API_TOKEN_HMAC_KEY",
-          "purpose": "HMAC-SHA256 key for hashing external Bearer tokens. 64 hex chars."
+          "purpose": "HMAC-SHA256 key for hashing external Bearer tokens AND web session cookies. 64 hex chars. Rotating it signs every browser session out on top of invalidating every issued token."
         }
       ]
     },
@@ -117,6 +117,21 @@
         }
       ]
     },
+    {
+      "name": "AI Provider",
+      "description": "Optional runtime policy and output tuning for user-configured AI providers. Each variable stands alone and has a safe default when unset.",
+      "required": false,
+      "variables": [
+        {
+          "name": "ALLOW_LOCAL_AI_PRIVATE_HOSTS",
+          "purpose": "Local-AI SSRF opt-in. Unset rejects private/internal hosts; set an exact comma-separated host allowlist or \"true\" to allow any private host."
+        },
+        {
+          "name": "INSIGHTS_MAX_TOKENS",
+          "purpose": "Daily-briefing output-token ceiling. Default 2500, clamped to 500-8000."
+        }
+      ]
+    },
     {
       "name": "APNs (iOS push)",
       "description": "All four core APNS_* vars together. Missing any disables APNs silently — the v1.4.40 AP-2 gap that motivated this manifest. allOrNone trips the synthetic <all-or-none> required row whenever 1-3 of the 4 are set.",

scripts/prepare.mjs

@@ -0,0 +1,17 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+
+if (!existsSync(".git")) {
+  console.log("Skipping Lefthook install: Git metadata is absent");
+} else {
+  const result = spawnSync("lefthook", ["install", "--force"], {
+    stdio: "inherit",
+    shell: process.platform === "win32",
+  });
+  if (result.error) {
+    console.error(`Failed to run Lefthook: ${result.error.message}`);
+    process.exitCode = 1;
+  } else {
+    process.exitCode = result.status ?? 1;
+  }
+}

scripts/repair-intake-anomalies.ts

@@ -64,32 +64,25 @@
  *
  * SELF-CONTAINED by design (v1.16.0)
  * ----------------------------------
- * The production standalone image ships neither the project
- * `node_modules` tree nor the `@/` path alias, so the previous
- * `dotenv/config` + `@/lib/db` import chain died with "Cannot find
- * module" inside the container. This script therefore depends on
- * exactly ONE package — `pg` — and reads `DATABASE_URL` straight from
- * the environment (no dotenv). Inside the production image `pg` resolves
- * via `NODE_PATH=/opt/pg-boss/node_modules` (Dockerfile installs
- * `pg@8.x` there); in a repo checkout it resolves from the project
- * `node_modules`. The `pnpm dlx` invocation below supplies `tsx` (the
- * standalone image strips it) and pins `pg` for any environment where
- * neither resolution path exists.
+ * The production standalone image does not expose the project package
+ * manager. It provides a pinned `healthlog-tsx` maintenance launcher, while
+ * `pg` resolves from the standalone runtime tree. In a repo checkout, run the
+ * same script through `pnpm dlx --package pg --package tsx tsx ...`.
  *
- * Usage
- * -----
+ * Usage inside the production container
+ * -------------------------------------
  *   # dry-run (DATABASE_URL must point at the target database)
- *   pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts
+ *   healthlog-tsx scripts/repair-intake-anomalies.ts
  *
  *   # scoped dry-run
- *   pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts --user <id>
+ *   healthlog-tsx scripts/repair-intake-anomalies.ts --user <id>
  *
  *   # apply
- *   pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts --fix
- *   pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts --fix --tombstone-implausible
+ *   healthlog-tsx scripts/repair-intake-anomalies.ts --fix
+ *   healthlog-tsx scripts/repair-intake-anomalies.ts --fix --tombstone-implausible
  *
  *   # create the proposed schedule revisions + startsOn fixes (defect 5)
- *   pnpm dlx --package pg --package tsx tsx scripts/repair-intake-anomalies.ts --backfill-eras
+ *   healthlog-tsx scripts/repair-intake-anomalies.ts --backfill-eras
  */
 import { Client, types } from "pg";
 
@@ -425,7 +418,7 @@ async function main(): Promise<void> {
   if (!process.env.DATABASE_URL) {
     console.error(
       `${TAG} DATABASE_URL must be set (no dotenv — export it or prefix ` +
-        `the command: DATABASE_URL='postgresql://…' pnpm dlx …)`,
+        `the command: DATABASE_URL='postgresql://…' healthlog-tsx …)`,
     );
     process.exit(1);
   }

scripts/restore-backup.ts

@@ -14,9 +14,8 @@
  *   BACKUP_S3_SECRET_KEY=...      \
  *   BACKUP_S3_REGION=auto         \
  *   BACKUP_ENCRYPTION_KEY=<hex64> \
- *   pnpm tsx scripts/restore-backup.ts 2026-05-08/user-clx123.json.enc /tmp/restored.json
+ *   pnpm dlx tsx scripts/restore-backup.ts 2026-05-08/user-clx123.json.enc /tmp/restored.json
  */
-import "dotenv/config";
 import { writeFileSync } from "node:fs";
 import {
   loadOffhostConfig,
@@ -82,7 +81,7 @@ async function main() {
     ?.slice("--user-id=".length);
   if (!key) {
     console.error(
-      "Usage: pnpm tsx scripts/restore-backup.ts <s3-key> [output-file] [--user-id=<id>]",
+      "Usage: pnpm dlx tsx scripts/restore-backup.ts <s3-key> [output-file] [--user-id=<id>]",
     );
     process.exit(1);
   }

scripts/rotate-encryption-key.ts

@@ -392,6 +392,30 @@ async function main() {
     ),
   );
 
+  // ───── v1.31.0 ArrivalReaction."lineEncrypted" (Bytes, nullable) ─────
+  // The data-arrival spine's generated reaction line. Nullable by design — a
+  // provider-less install writes markers with no line at all — and
+  // `rotateBytesColumn` already skips a NULL / zero-length payload, so those
+  // rows are scanned and cleanly left alone.
+  results.push(
+    await rotateBytesColumn(
+      "ArrivalReaction",
+      "lineEncrypted",
+      prisma.arrivalReaction,
+    ),
+  );
+
+  // ───── v1.31.0 WorkoutInsight."paragraphEncrypted" (Bytes) ─────
+  // The per-workout Activity Insight paragraph. Not nullable — a row exists
+  // only where a paragraph was generated — so every scanned row rotates.
+  results.push(
+    await rotateBytesColumn(
+      "WorkoutInsight",
+      "paragraphEncrypted",
+      prisma.workoutInsight,
+    ),
+  );
+
   // ───── v1.18.1 clinical-spine notes (Bytes columns) ─────
   // "noteEncrypted" (LabResult / IllnessEpisode / IllnessDayLog) +
   // "contextEncrypted" (Biomarker). Mirror the CoachFact.factEncrypted block.

scripts/test-notifications.ts

@@ -1,11 +1,8 @@
 /**
  * Test script for notification delivery and reminder check.
  *
- * Usage (inside Docker container):
- *   npx tsx scripts/test-notifications.ts
- *
- * Or from host:
- *   docker compose exec app npx tsx scripts/test-notifications.ts
+ * Usage (from a source checkout with the target environment exported):
+ *   pnpm dlx tsx scripts/test-notifications.ts
  *
  * What it does:
  *   1. Lists all configured notification channels

src/__tests__/ai-consent-enforcement-guard.test.ts

@@ -0,0 +1,192 @@
+/**
+ * Structural guard on the AI consent boundary.
+ *
+ * Two surfaces shipped without a consent check — the self-context clarifying
+ * questions and the AI-composed proactive nudge — for the same reason: nothing
+ * connected "I am holding a live provider instance" to "I must have checked a
+ * receipt first". Behavioural tests close the two we found. This closes the
+ * class, so the third one cannot appear quietly.
+ *
+ * The invariant: a module that resolves a provider INSTANCE for a user
+ * (`resolveProvider` / `resolveProviderChain` / `resolveProviderForTest`) holds
+ * something it can call `generateCompletion` on. Every such module must also
+ * pull in a consent helper — or sit on the allowlist below with a written
+ * reason a reviewer signed off.
+ *
+ * WHAT THIS CANNOT PROVE — read this before trusting it:
+ *
+ *   - It is an IMPORT-level check. It proves a consent helper is in the
+ *     module's scope, NOT that the gate is reached on every path through the
+ *     file. A module could import `hasActiveConsentForSurface`, call it on one
+ *     branch, and egress ungated on another; this guard stays green.
+ *   - It cannot prove ORDER. A gate called after the provider call, or after
+ *     the snapshot is built, passes here and is still wrong.
+ *   - It cannot prove the SURFACE is right. Passing `"insights"` where the data
+ *     is a Coach snapshot passes here.
+ *   - It cannot prove an allowlist entry is HONEST. A reviewer who waves
+ *     through a new entry with a plausible-sounding reason defeats it entirely.
+ *     The allowlist is a review checkpoint, not a proof.
+ *
+ * What it does buy: a NEW ungated provider call site cannot land silently. The
+ * author must either wire a consent helper or edit this file, and editing this
+ * file puts the decision in front of a reviewer. That is the whole claim.
+ */
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { join, sep } from "node:path";
+import { globSync } from "node:fs";
+
+const SRC = join(process.cwd(), "src");
+
+/** Every non-test `.ts` / `.tsx` under `src/`, minus the generated client. */
+function sourceFiles(): string[] {
+  return globSync("**/*.{ts,tsx}", { cwd: SRC })
+    .filter(
+      (p) => !p.startsWith(`generated${sep}`) && !p.startsWith("generated/"),
+    )
+    .filter((p) => !p.includes("__tests__"))
+    .filter((p) => !p.endsWith(".test.ts") && !p.endsWith(".test.tsx"))
+    .map((p) => p.split(sep).join("/"))
+    .sort();
+}
+
+function read(rel: string): string {
+  return readFileSync(join(SRC, rel), "utf8");
+}
+
+/**
+ * The helpers that hand back a live, callable provider for a user. Deliberately
+ * NOT including the presence-only probes (`hasAnyConfiguredProvider`,
+ * `resolveProviderAvailability`, `userRowHasProviderCredential`): those never
+ * decrypt a key or construct a client, so they cannot egress anything.
+ */
+const RESOLUTION_HELPERS = [
+  "resolveProvider",
+  "resolveProviderChain",
+  "resolveProviderForTest",
+] as const;
+
+/** The two sanctioned consent APIs. Either satisfies the guard. */
+const CONSENT_HELPERS = [
+  // Chain-shaped: throw-form and predicate-form.
+  "assertConsentForChain",
+  "chainRequiresServerManagedConsent",
+  "hasActiveConsentForSurface",
+  // Document-class, pick-shaped.
+  "assertDocumentEgressConsent",
+  "isExternalDocumentEgress",
+] as const;
+
+/**
+ * Extract the named bindings a file imports from a given module specifier.
+ * Handles the multi-line `import { a, b } from "…"` form the codebase uses.
+ * Comments mentioning a helper are NOT import statements and do not count —
+ * that distinction is the whole point of parsing the import rather than
+ * grepping the file.
+ */
+function importedNamesFrom(source: string, moduleSpecifier: string): string[] {
+  const re = new RegExp(
+    `import\\s+(?:type\\s+)?\\{([^}]*)\\}\\s*from\\s*["']${moduleSpecifier.replace(
+      /[/\\^$*+?.()|[\]{}]/g,
+      "\\$&",
+    )}["']`,
+    "g",
+  );
+  const names: string[] = [];
+  for (const match of source.matchAll(re)) {
+    for (const raw of match[1].split(",")) {
+      const name = raw
+        .trim()
+        .replace(/^type\s+/, "")
+        .split(/\s+as\s+/)[0];
+      if (name) names.push(name.trim());
+    }
+  }
+  return names;
+}
+
+function resolvesAProvider(source: string): boolean {
+  const imported = importedNamesFrom(source, "@/lib/ai/provider");
+  return RESOLUTION_HELPERS.some((h) => imported.includes(h));
+}
+
+function importsAConsentHelper(source: string): boolean {
+  const imported = importedNamesFrom(source, "@/lib/ai/consent-guard");
+  return CONSENT_HELPERS.some((h) => imported.includes(h));
+}
+
+/**
+ * Modules that resolve a provider and deliberately carry no consent helper.
+ * Every entry needs a reason that survives a reviewer asking "what PHI does
+ * this send?" — the answer here is "none" in every case.
+ *
+ * `lib/ai/provider.ts` needs no entry: it DEFINES the resolution helpers rather
+ * than importing them, so the detector never flags it. That is correct — the
+ * resolver constructs clients and never sends a prompt, and gating it would
+ * invert the layering.
+ */
+const ALLOWLIST: Record<string, string> = {
+  // --- Capability / config probes: resolve a chain, never call it. ---
+  "lib/labs/ocr-capability.ts":
+    "Resolves the chain to REPORT which entry could do vision/text OCR (mode, reason, pdfSupported). Makes no completion call. Every consumer that then egresses a document is gated at its own call site with assertDocumentEgressConsent.",
+  "app/api/insights/provider-chain/route.ts":
+    "Lists the user's configured chain and which entry is active, for the settings UI. Constructs clients but never calls generateCompletion. No health data in the request or the response.",
+  "app/api/insights/comprehensive/route.ts":
+    "Uses the resolver only as a boolean probe ((await resolveProvider(userId)).type !== 'none') to set hasProvider on the response. The generation path itself lives in lib/insights/comprehensive-generate.ts, which is gated.",
+
+  // --- Connection test: a real provider call, but with no user data. ---
+  "app/api/ai/test/route.ts":
+    "Sends a fixed synthetic prompt to verify credentials resolve and the endpoint answers. No health data is read, so there is no PHI egress for a receipt to authorise. Bounded by its own 5/min rate limit.",
+};
+
+describe("every provider-resolving module carries a consent helper", () => {
+  const resolvers = sourceFiles().filter((rel) => resolvesAProvider(read(rel)));
+
+  it("finds the provider-resolving modules at all (the guard is wired up)", () => {
+    // A refactor that renames the resolver or moves the module would otherwise
+    // silently empty the set and make every assertion below vacuous.
+    expect(resolvers.length).toBeGreaterThanOrEqual(8);
+    expect(resolvers).toContain("lib/ai/coach/self-context-questions.ts");
+    expect(resolvers).toContain("lib/jobs/coach-nudge-ai.ts");
+  });
+
+  it("gates every provider-resolving module that is not explicitly allowlisted", () => {
+    const ungated = resolvers.filter(
+      (rel) => !importsAConsentHelper(read(rel)) && !(rel in ALLOWLIST),
+    );
+    expect(ungated).toEqual([]);
+  });
+
+  it("keeps the allowlist free of stale entries", () => {
+    // An entry that no longer resolves a provider is dead weight that hides
+    // the next real one. Delete it rather than letting it rot.
+    const stale = Object.keys(ALLOWLIST).filter(
+      (rel) => !resolvers.includes(rel),
+    );
+    expect(stale).toEqual([]);
+  });
+
+  it("requires a substantive reason on every allowlist entry", () => {
+    const thin = Object.entries(ALLOWLIST)
+      .filter(([, reason]) => reason.trim().length < 40)
+      .map(([rel]) => rel);
+    expect(thin).toEqual([]);
+  });
+});
+
+describe("the consent guard itself stays the single source of the policy", () => {
+  it("keeps the server-managed provider set defined in exactly one place", () => {
+    // Both operator-credential tags must be classified in consent-guard.ts and
+    // nowhere else — a second copy of this list is how the policy drifts.
+    const guard = read("lib/ai/consent-guard.ts");
+    expect(guard).toContain('"admin-openai"');
+    expect(guard).toContain('"admin-codex"');
+
+    const copies = sourceFiles().filter(
+      (rel) =>
+        rel !== "lib/ai/consent-guard.ts" &&
+        /SERVER_MANAGED_PROVIDER_TYPES/.test(read(rel)),
+    );
+    expect(copies).toEqual([]);
+  });
+});

src/__tests__/bearer-scope-enforcement-guard.test.ts

@@ -0,0 +1,195 @@
+/**
+ * Structural guards on the Bearer-scope enforcement boundary.
+ *
+ * The correctness argument for the fail-closed default is structural, not
+ * empirical: there is exactly ONE place a raw Bearer token becomes a user, and
+ * exactly ONE authorisation arm inside it. Seven behavioural tests cannot cover
+ * 300-odd routes; what they can do is rest on that invariant. These guards are
+ * what keep the invariant true.
+ *
+ * They are tripwires, not proofs. They cannot show an allowlist is correct —
+ * only that it has not changed without someone editing this file. A reviewer
+ * who waves through a bad addition defeats all four, and no test substitutes
+ * for that review.
+ */
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { join, sep } from "node:path";
+import { globSync } from "node:fs";
+
+const SRC = join(process.cwd(), "src");
+
+/**
+ * Every non-test `.ts` / `.tsx` under `src/`, excluding the generated Prisma
+ * client (9 MB; never read it) and test files themselves.
+ */
+function sourceFiles(): string[] {
+  return globSync("**/*.{ts,tsx}", { cwd: SRC })
+    .filter(
+      (p) => !p.startsWith(`generated${sep}`) && !p.startsWith("generated/"),
+    )
+    .filter((p) => !p.includes("__tests__"))
+    .filter((p) => !p.endsWith(".test.ts") && !p.endsWith(".test.tsx"))
+    .map((p) => p.split(sep).join("/"))
+    .sort();
+}
+
+function read(rel: string): string {
+  return readFileSync(join(SRC, rel), "utf8");
+}
+
+function filesMatching(re: RegExp): string[] {
+  return sourceFiles().filter((rel) => re.test(read(rel)));
+}
+
+describe("T1 — the Bearer resolution set is frozen", () => {
+  /**
+   * Files allowed to turn a raw `Authorization: Bearer` value into a user.
+   * This is the set that can circumvent the enforcement point, so it is the
+   * only set that matters for the fail-closed guarantee.
+   *
+   * Two of these authenticate a request; the rest are the resolver itself and
+   * the two edges that wrap it.
+   */
+  const RESOLUTION_ALLOWLIST = [
+    // The resolver. Owns the one authorisation arm.
+    "lib/auth/bearer.ts",
+    // The REST edge — maps `requireAuth`'s optional scope onto the union.
+    "lib/api-handler.ts",
+    // The MCP edge — the one deliberate `any-valid-token` posture.
+    "lib/mcp/auth.ts",
+    // The `/mcp` transport, via `resolveMcpAuthContext`.
+    "app/mcp/route.ts",
+    // Hand-rolled Bearer authentication: the external medication-ingest
+    // surface, which gates on BOTH `medication:ingest` and the per-medication
+    // `medication:<id>:ingest` grant and never touches `requireAuth`.
+    "app/api/ingest/medication/route.ts",
+  ].sort();
+
+  it("no file outside the allowlist resolves a Bearer token to a user", () => {
+    // `resolveBearerToken` is the shared primitive; a `tokenHash` lookup is the
+    // hand-rolled equivalent. Either one turns a bearer credential into an
+    // identity, so both have to stay inside the allowlist.
+    const resolvers = filesMatching(
+      /resolveBearerToken|apiToken\.findUnique\([\s\S]*?where:\s*\{\s*tokenHash/,
+    );
+
+    expect(resolvers).toEqual(RESOLUTION_ALLOWLIST);
+  });
+
+  it("the resolver exposes exactly one authorisation arm", () => {
+    const src = read("lib/auth/bearer.ts");
+    // One wildcard escape hatch, guarding one deny block. If a second
+    // `permissions.includes("*")` short-circuit appears, the arm has forked.
+    const wildcardChecks = src.match(/permissions\.includes\("\*"\)/g) ?? [];
+    expect(wildcardChecks).toHaveLength(1);
+  });
+});
+
+describe("T2 — `any-valid-token` is the single deliberate fail-open posture", () => {
+  it("appears at exactly one call site, and that call site is the MCP edge", () => {
+    // `bearer.ts` necessarily names the variant to declare the union; what
+    // must stay unique is a caller PASSING it.
+    const optedOut = filesMatching(/kind:\s*"any-valid-token"/).filter(
+      (rel) => rel !== "lib/auth/bearer.ts",
+    );
+    expect(optedOut).toEqual(["lib/mcp/auth.ts"]);
+  });
+
+  it("no route file opts out of the fail-closed default", () => {
+    const routes = sourceFiles().filter((p) => p.endsWith("/route.ts"));
+    const optedOut = routes.filter((rel) =>
+      /kind:\s*"any-valid-token"/.test(read(rel)),
+    );
+    expect(optedOut).toEqual([]);
+  });
+});
+
+describe("T3 — the mint sites are frozen", () => {
+  /**
+   * Every place an `ApiToken` row is created, with the scope set it may mint.
+   * A new mint site, or a new scope on an existing one, has to be named here —
+   * which is the point: a user-facing mint that hands out a broad scope is the
+   * one failure mode the enforcement change cannot catch by itself.
+   */
+  const MINT_SITES: Record<string, string> = {
+    // Cookie-equivalent. The ONLY `["*"]` mints, all behind a completed login.
+    "lib/auth/issue-token.ts": 'opts.permissions ?? ["*"]',
+    "lib/auth/login-response.ts": '["*"]',
+    "lib/auth/refresh-token.ts": '["*"]',
+    "app/api/auth/passkey/login-verify/route.ts": '["*"]',
+    // The working medication-ingest pair — family marker plus the per-
+    // medication grant that `/api/ingest/medication` actually gates on.
+    "app/api/medications/[id]/api-endpoint/route.ts":
+      '["medication:ingest", scope]',
+    // MCP, audience-bound to `/mcp`. `health:write` requires explicit consent.
+    "app/api/mcp/tokens/route.ts": "SCOPE_HEALTH_READ / SCOPE_HEALTH_WRITE",
+    "app/api/mcp/oauth/token/route.ts":
+      "SCOPE_HEALTH_READ / SCOPE_HEALTH_WRITE",
+  };
+
+  it("only the known files create ApiToken rows", () => {
+    const minters = filesMatching(/apiToken\.create\(|issueApiToken\(/).filter(
+      // `issue-token.ts` defines the helper; the others call it.
+      (rel) => rel !== "lib/auth/issue-token.ts" || true,
+    );
+    expect(minters).toEqual(Object.keys(MINT_SITES).sort());
+  });
+
+  it("no user-facing mint hands out a wildcard scope", () => {
+    // The four `["*"]` mints are all reached only by a completed
+    // password / passkey / refresh exchange. Every other mint is narrow.
+    const userFacing = [
+      "app/api/medications/[id]/api-endpoint/route.ts",
+      "app/api/mcp/tokens/route.ts",
+      "app/api/mcp/oauth/token/route.ts",
+    ];
+    for (const rel of userFacing) {
+      expect(read(rel)).not.toMatch(/permissions:\s*\[\s*"\*"/);
+    }
+  });
+
+  it("the retired generic token mint is gone", () => {
+    // `POST /api/tokens` minted `["medication:ingest"]` — a token that could
+    // not perform its advertised job (it lacked the per-medication grant) and
+    // could reach every other authenticated route. List and revoke stay.
+    const tokensRoute = read("app/api/tokens/route.ts");
+    expect(tokensRoute).not.toMatch(/export const POST/);
+    expect(tokensRoute).toMatch(/export const GET/);
+  });
+});
+
+describe("T4 — declared scopes are exported constants, never string literals", () => {
+  it("every requireAuth argument is an identifier", () => {
+    const offenders: string[] = [];
+    for (const rel of sourceFiles()) {
+      const src = read(rel);
+      // Call sites only — skip the declaration in `api-handler.ts`, whose
+      // parameter list is not an argument.
+      for (const m of src.matchAll(
+        /(?<!function\s)requireAuth\(\s*([^)\s][^)]*)\)/g,
+      )) {
+        const arg = m[1].trim();
+        if (!/^[A-Za-z_$][\w$]*$/.test(arg)) {
+          offenders.push(`${rel}: requireAuth(${arg})`);
+        }
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+
+  it("the declared scope vocabulary is closed", () => {
+    // Scopes a route may name. Adding one means adding a route that accepts a
+    // narrow token, which is a widening — it belongs in a reviewed diff.
+    const DECLARED_SCOPES = ["FHIR_READ_SCOPE"];
+    const used = new Set<string>();
+    for (const rel of sourceFiles()) {
+      for (const m of read(rel).matchAll(
+        /(?<!function\s)requireAuth\(\s*([A-Za-z_$][\w$]*)\s*\)/g,
+      )) {
+        used.add(m[1]);
+      }
+    }
+    expect([...used].sort()).toEqual(DECLARED_SCOPES);
+  });
+});

src/__tests__/copy-matches-behaviour-guard.test.ts

@@ -0,0 +1,219 @@
+/**
+ * Copy-matches-behaviour guard.
+ *
+ * Three classes of copy that drifted away from the code they describe, each
+ * pinned here so the pair fails loudly if either half moves again:
+ *
+ *   1. DELETE CONFIRMATIONS. A confirmation is the moment a user weighs the
+ *      consequence. Four dialogs promised permanence on surfaces that render
+ *      an Undo affordance (measurements bulk, mood bulk, labs, illness) — a
+ *      cautious user declines a safe delete, and the warning loses weight
+ *      where it is true. This test pins both directions: undo-able surfaces
+ *      must offer the undo sentence and must NOT claim finality; the
+ *      genuinely permanent ones must keep their warning.
+ *
+ *   2. SLEEP DEBT. v1.19.0 replaced the summed shortfall with a running
+ *      balance that credits surplus sleep. The labels still described the old
+ *      arithmetic, so the word contradicted the number for anyone who caught
+ *      up after a short night.
+ *
+ *   3. GLUCOSE REFERENCE BAND. The declared diabetes opt-in has a server
+ *      preference and a route; the copy for its web control must exist in
+ *      every locale, since a missing key silently degrades to the raw key on
+ *      a surface that makes a clinical-adjacent claim.
+ *
+ * Reversibility evidence for the undo-able set:
+ *   - measurements: `POST /api/measurements/restore`, undo toast in
+ *     `src/components/measurements/measurement-list.tsx`
+ *   - mood:         `POST /api/mood-entries/restore`, undo toast in
+ *     `src/components/mood/mood-list.tsx`
+ *   - labs:         `POST /api/labs/restore`, undo toast in
+ *     `src/components/labs/lab-history-list.tsx`
+ *   - illness:      `POST /api/illness/episodes/[id]/restore`, undo toast in
+ *     `src/components/illness/episode-menu.tsx`
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+const MESSAGES = join(__dirname, "../../messages");
+const LOCALES = ["de", "en", "es", "fr", "it", "pl"] as const;
+
+function bundle(locale: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(join(MESSAGES, `${locale}.json`), "utf8"));
+}
+
+function resolve(obj: Record<string, unknown>, path: string): string {
+  let cur: unknown = obj;
+  for (const seg of path.split(".")) {
+    expect(cur, `${path} is missing at "${seg}"`).toBeTypeOf("object");
+    cur = (cur as Record<string, unknown>)[seg];
+  }
+  expect(typeof cur, `${path} must resolve to a string`).toBe("string");
+  return cur as string;
+}
+
+/**
+ * Per-locale phrases that assert a deletion cannot be taken back. A dialog on
+ * an undo-able surface must contain none of these.
+ */
+const FINALITY_PHRASES: Record<string, readonly string[]> = {
+  en: ["cannot be undone", "can't be undone", "permanently", "permanent"],
+  de: ["nicht rückgängig", "endgültig", "dauerhaft", "unwiderruflich"],
+  es: ["no se puede deshacer", "permanente", "irreversible"],
+  fr: [
+    "irréversible",
+    "définitivement",
+    "définitive",
+    "ne peut pas être annulé",
+  ],
+  it: [
+    "non può essere annullata",
+    "definitivamente",
+    "definitiva",
+    "permanente",
+  ],
+  pl: ["nie można cofnąć", "trwale", "nieodwracaln"],
+};
+
+/** Per-locale phrase that promises the short undo window. */
+const UNDO_PHRASES: Record<string, string> = {
+  en: "undo",
+  de: "rückgängig",
+  es: "deshacerlo",
+  fr: "annuler cette action",
+  it: "annullare",
+  pl: "cofnąć",
+};
+
+/** Confirmation bodies whose surface renders an Undo affordance. */
+const UNDOABLE_CONFIRM_KEYS = [
+  "measurements.deleteConfirmDescription",
+  "measurements.bulkDeleteConfirmBody",
+  "mood.deleteConfirmDescription",
+  "mood.bulkDeleteConfirmBody",
+  "labs.deleteConfirmDescription",
+  "illness.deleteConfirm.body",
+] as const;
+
+/**
+ * Confirmation bodies whose delete really is unrecoverable for the user —
+ * hard delete or a tombstone with no restore path. These MUST keep a
+ * finality warning; softening them would be the mirror-image bug.
+ */
+const PERMANENT_CONFIRM_KEYS = [
+  // hard delete + cascade of every recorded value
+  "labs.biomarker.deleteConfirmDescription",
+  // `?purge=true` hard-deletes the tag off every past entry
+  "mood.manage.purgeBody",
+  // GDPR Art. 17 account purge
+  "settings.deleteAccountConfirmDescription",
+] as const;
+
+describe("delete confirmations describe what the surface actually does", () => {
+  for (const locale of LOCALES) {
+    const msgs = bundle(locale);
+
+    describe(locale, () => {
+      for (const key of UNDOABLE_CONFIRM_KEYS) {
+        it(`${key} offers undo and claims no finality`, () => {
+          const copy = resolve(msgs, key).toLowerCase();
+
+          for (const phrase of FINALITY_PHRASES[locale]) {
+            expect(
+              copy,
+              `${locale}/${key} claims finality ("${phrase}") but the surface renders an Undo`,
+            ).not.toContain(phrase.toLowerCase());
+          }
+
+          expect(
+            copy,
+            `${locale}/${key} should tell the user the delete can be undone`,
+          ).toContain(UNDO_PHRASES[locale].toLowerCase());
+        });
+      }
+
+      for (const key of PERMANENT_CONFIRM_KEYS) {
+        it(`${key} keeps its finality warning`, () => {
+          const copy = resolve(msgs, key).toLowerCase();
+          const warns = FINALITY_PHRASES[locale].some((p) =>
+            copy.includes(p.toLowerCase()),
+          );
+          expect(
+            warns,
+            `${locale}/${key} deletes irrecoverably — the copy must say so`,
+          ).toBe(true);
+        });
+      }
+    });
+  }
+});
+
+describe("sleep debt is labelled as a balance, not a summed deficit", () => {
+  /**
+   * The figure is a running balance: a short night adds, a long night pays it
+   * down. Deficit/shortfall vocabulary describes the pre-v1.19.0 sum.
+   */
+  const STALE_SUM_VOCABULARY: Record<string, readonly string[]> = {
+    en: ["cumulative", "shortfall", "accumulated"],
+    de: ["kumuliert", "defizit", "aufgelaufen"],
+    es: ["acumulado", "acumulada", "déficit"],
+    fr: ["cumulé", "cumulée", "déficit"],
+    it: ["cumulato", "cumulata", "accumulato", "deficit"],
+    pl: ["skumulowan", "niedobór", "niedoboru"],
+  };
+
+  for (const locale of LOCALES) {
+    const msgs = bundle(locale);
+
+    it(`${locale} debt captions carry no summed-deficit wording`, () => {
+      for (const key of [
+        "insights.sleep.debt.caption",
+        "insights.sleep.debt.clearCaption",
+      ]) {
+        const copy = resolve(msgs, key).toLowerCase();
+        for (const term of STALE_SUM_VOCABULARY[locale]) {
+          expect(
+            copy,
+            `${locale}/${key} still describes the pre-v1.19.0 summed shortfall ("${term}")`,
+          ).not.toContain(term);
+        }
+      }
+    });
+  }
+
+  it("the explainer states that catch-up sleep pays the balance down", () => {
+    const copy = resolve(bundle("en"), "insights.sleep.debt.computedInfo");
+    expect(copy.toLowerCase()).toContain("balance");
+    expect(copy.toLowerCase()).toContain("catch-up");
+  });
+});
+
+describe("the glucose reference band control is translated everywhere", () => {
+  const KEYS = [
+    "settings.glucoseReference.title",
+    "settings.glucoseReference.description",
+    "settings.glucoseReference.enable",
+    "settings.glucoseReference.explainer",
+    "settings.glucoseReference.disclaimer",
+    "settings.glucoseReference.error",
+  ] as const;
+
+  for (const locale of LOCALES) {
+    it(`${locale} carries every key`, () => {
+      const msgs = bundle(locale);
+      for (const key of KEYS) {
+        expect(resolve(msgs, key).length).toBeGreaterThan(0);
+      }
+    });
+  }
+
+  it("the disclaimer refuses the diagnosis reading (EN)", () => {
+    const copy = resolve(
+      bundle("en"),
+      "settings.glucoseReference.disclaimer",
+    ).toLowerCase();
+    expect(copy).toContain("not a diagnosis");
+    expect(copy).toContain("never inferred");
+  });
+});

src/__tests__/i18n-english-leak-guard.test.ts

@@ -81,6 +81,8 @@ const LEGIT_IDENTICAL = new Set<string>([
   // Clinical abbreviations / SI units — identical across locales.
   "charts.vo2Max",
   "cycle.insights.crosstab.unitGlucose",
+  "dashboard.metric.unit.bmi",
+  "dashboard.metric.unit.mood",
   "dashboard.metric.unit.glucose",
   "dashboard.vo2Max",
   "dashboard.vo2MaxShort",
@@ -110,6 +112,7 @@ const LEGIT_IDENTICAL = new Set<string>([
   "settings.moodLogUrl",
   "settings.sections.export.import.appleHealth.title",
   "settings.sections.sources.sourceLabels.APPLE_HEALTH",
+  "settings.appleHealth.title",
   "mood.tag.fastFood",
   // Technical / config labels conventionally kept verbatim.
   "admin.hostMetrics.diskBusyPercent",

src/__tests__/i18n-reverse-coverage.test.ts

@@ -108,6 +108,19 @@ function collectReferences(
     /(?<![a-zA-Z0-9_])t\(\s*["']([a-zA-Z][a-zA-Z0-9_.-]+)["']/g;
   for (const m of allText.matchAll(literalKeyRe)) literalKeys.add(m[1]);
 
+  // Plural-tier composition: `tCount("dashboard.staleHintWeeks", n)` and the
+  // underlying `pluralKey("…", n, locale)` both resolve to `<base>One` /
+  // `<base>Few` / `<base>Other` at runtime, so the base literal accounts for
+  // exactly those three leaves and no others. Kept as an explicit tier list
+  // rather than a prefix match so a stray sibling key under the same base still
+  // reports as an orphan.
+  const pluralKeyRe =
+    /(?:pluralKey|tCount)\(\s*["']([a-zA-Z][a-zA-Z0-9_.-]+)["']/g;
+  for (const m of allText.matchAll(pluralKeyRe)) {
+    for (const tier of ["One", "Few", "Other"])
+      literalKeys.add(`${m[1]}${tier}`);
+  }
+
   const dottedBases = new Set<string>();
   const concatPrefixes = new Set<string>();
   const dynamicSuffixes = new Set<string>();
@@ -232,5 +245,5 @@ describe("i18n reverse coverage", () => {
           "Wire a call site, or add a DB-driven prefix to DYNAMIC_ALLOWLIST_PREFIXES.",
       );
     }
-  });
+  }, 15_000);
 });

src/__tests__/prefetch-page-caching-guard.test.ts

@@ -0,0 +1,118 @@
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import { describe, expect, it } from "vitest";
+
+/**
+ * Structural guard over the server-prefetching pages.
+ *
+ * A page that calls `dehydrate()` inside a `HydrationBoundary` serialises the
+ * caller's own health record into the HTML document. Two things must hold for
+ * every such page, and neither is enforced by the type system:
+ *
+ *  1. It must be session-gated at the edge, so `src/proxy.ts` stamps
+ *     `Cache-Control: private, no-store` on the document. A prefetching page
+ *     placed on a public path would ship a record with no cache directive at
+ *     all.
+ *  2. It must not opt into static or revalidated rendering. `export const
+ *     revalidate = <n>` or `dynamic = "force-static"` would let Next serve one
+ *     account's prefetched HTML to the next caller out of its own cache,
+ *     before the request ever reaches a header.
+ *
+ * The guard walks the app tree rather than naming files, so a NEW prefetching
+ * page is covered the moment it lands.
+ */
+
+const APP_DIR = join(process.cwd(), "src", "app");
+
+/** Mirrors the public-path allowlist in `src/proxy.ts`. */
+const PUBLIC_ROUTE_PREFIXES = [
+  "/auth/",
+  "/privacy",
+  "/about",
+  "/c/",
+  "/invite/",
+  "/onboarding",
+  "/mcp",
+  "/i18n/",
+  "/.well-known/",
+];
+
+function walk(dir: string): string[] {
+  const out: string[] = [];
+  for (const entry of readdirSync(dir)) {
+    if (entry === "node_modules" || entry === "__tests__") continue;
+    const full = join(dir, entry);
+    if (statSync(full).isDirectory()) {
+      out.push(...walk(full));
+    } else if (entry === "page.tsx" || entry === "page.ts") {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+/** Turn `src/app/insights/workouts/page.tsx` into `/insights/workouts`. */
+function routePathFor(file: string): string {
+  const rel = relative(APP_DIR, file).split(sep).slice(0, -1);
+  const segments = rel.filter(
+    // Route groups `(name)` and parallel/intercepting slots contribute no
+    // URL segment.
+    (s) => !(s.startsWith("(") && s.endsWith(")")) && !s.startsWith("@"),
+  );
+  return "/" + segments.join("/");
+}
+
+function isPublicRoute(routePath: string): boolean {
+  return PUBLIC_ROUTE_PREFIXES.some((p) => routePath.startsWith(p));
+}
+
+const prefetchingPages = walk(APP_DIR)
+  .map((file) => ({ file, source: readFileSync(file, "utf8") }))
+  .filter(
+    ({ source }) =>
+      source.includes("HydrationBoundary") && source.includes("dehydrate"),
+  )
+  .map(({ file, source }) => ({
+    file,
+    source,
+    routePath: routePathFor(file),
+    rel: relative(process.cwd(), file),
+  }));
+
+describe("server-prefetching pages cannot leak a cacheable record", () => {
+  it("finds the prefetching pages at all (guard is not vacuous)", () => {
+    expect(prefetchingPages.length).toBeGreaterThan(0);
+    // The dashboard is the canonical one; if it stops matching, the detection
+    // heuristic has drifted and every assertion below is silently skipped.
+    expect(prefetchingPages.map((p) => p.routePath)).toContain("/");
+  });
+
+  it("keeps every prefetching page behind the session gate", () => {
+    const publicOnes = prefetchingPages.filter((p) =>
+      isPublicRoute(p.routePath),
+    );
+    expect(
+      publicOnes.map((p) => `${p.rel} (${p.routePath})`),
+      "a page that dehydrates a record onto a public path gets no no-store header from the proxy",
+    ).toEqual([]);
+  });
+
+  it("lets no prefetching page opt into static or revalidated rendering", () => {
+    const offenders: string[] = [];
+    for (const page of prefetchingPages) {
+      if (/export\s+const\s+revalidate\s*=/.test(page.source)) {
+        offenders.push(`${page.rel}: exports revalidate`);
+      }
+      const dynamicMatch = page.source.match(
+        /export\s+const\s+dynamic\s*=\s*["']([^"']+)["']/,
+      );
+      if (dynamicMatch && dynamicMatch[1] !== "force-dynamic") {
+        offenders.push(`${page.rel}: exports dynamic = "${dynamicMatch[1]}"`);
+      }
+    }
+    expect(
+      offenders,
+      "a prefetched page must never be served from Next's own render cache",
+    ).toEqual([]);
+  });
+});

src/__tests__/proxy-onboarding-redirect.test.ts

@@ -130,6 +130,7 @@ describe("proxy.ts onboarding redirect (v1.4.22 C4)", () => {
   });
 
   it("generates CSP nonces without relying on Node Buffer", () => {
+    vi.stubEnv("NODE_ENV", "production");
     const originalBuffer = (
       globalThis as typeof globalThis & { Buffer?: Buffer }
     ).Buffer;
@@ -149,6 +150,7 @@ describe("proxy.ts onboarding redirect (v1.4.22 C4)", () => {
         value: originalBuffer,
         configurable: true,
       });
+      vi.unstubAllEnvs();
     }
   });
 });

src/__tests__/proxy-page-no-store.test.ts

@@ -0,0 +1,112 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { NextRequest } from "next/server";
+
+/**
+ * Session-gated pages serialise one account's health record into the HTML
+ * document — the dashboard, Insights, the workouts list, the medications
+ * list and the Coach all server-prefetch their data through a TanStack
+ * `HydrationBoundary`, so the record ships inside the payload rather than
+ * arriving over a later fetch.
+ *
+ * Those pages are dynamic today only because they read the session cookie.
+ * That is a property of the page code, not a guarantee — so the proxy pins
+ * `Cache-Control: private, no-store` on every session-gated page response.
+ * `private` bars shared caches (a CDN, a reverse proxy); `no-store` also
+ * bars the browser disk cache and the bfcache snapshot.
+ *
+ * These tests pin both sides: gated pages carry the header, and the public
+ * surfaces that are deliberately cacheable do not.
+ */
+
+vi.mock("@/lib/process-type", () => ({
+  shouldRunWeb: () => true,
+}));
+
+import { proxy } from "../proxy";
+
+beforeEach(() => {
+  vi.stubEnv("NODE_ENV", "production");
+});
+
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
+function makeRequest(pathname: string): NextRequest {
+  return new NextRequest(`http://localhost${pathname}`, {
+    headers: { cookie: "healthlog_session=sess-1" },
+  });
+}
+
+/** The pages that server-prefetch and dehydrate a record into the HTML. */
+const PREFETCHING_PAGES = [
+  "/",
+  "/coach",
+  "/insights",
+  "/insights/workouts",
+  "/medications",
+];
+
+/** Other session-gated surfaces that render account data. */
+const OTHER_GATED_PAGES = [
+  "/documents",
+  "/settings/profile",
+  "/admin/users",
+  "/mood",
+];
+
+describe("proxy.ts no-store on session-gated pages", () => {
+  it.each(PREFETCHING_PAGES)(
+    "sets private, no-store on the prefetching page %s",
+    (path) => {
+      const res = proxy(makeRequest(path));
+      const cacheControl = res.headers.get("cache-control") ?? "";
+      expect(cacheControl).toContain("no-store");
+      expect(cacheControl).toContain("private");
+    },
+  );
+
+  it.each(OTHER_GATED_PAGES)(
+    "sets private, no-store on the gated page %s",
+    (path) => {
+      const res = proxy(makeRequest(path));
+      const cacheControl = res.headers.get("cache-control") ?? "";
+      expect(cacheControl).toContain("no-store");
+      expect(cacheControl).toContain("private");
+    },
+  );
+
+  it("still emits no-store when the request carries no session cookie", () => {
+    // The unauthenticated caller gets a redirect to /auth/login, which never
+    // reaches the header block — assert the redirect rather than a header, so
+    // the test states what actually happens on that arm.
+    const res = proxy(new NextRequest("http://localhost/medications"));
+    expect(res.status).toBe(307);
+    expect(res.headers.get("location")).toContain("/auth/login");
+  });
+
+  it("leaves the public legal + auth surfaces cacheable", () => {
+    for (const path of ["/privacy", "/about", "/auth/login"]) {
+      const res = proxy(makeRequest(path));
+      expect(res.headers.get("cache-control"), path).toBeNull();
+    }
+  });
+
+  it("leaves the immutable locale catalog cacheable", () => {
+    const res = proxy(makeRequest("/i18n/en"));
+    expect(res.headers.get("cache-control")).toBeNull();
+  });
+
+  it("does not blanket API routes, which manage their own caching", () => {
+    const res = proxy(makeRequest("/api/user/avatar/user-1"));
+    expect(res.headers.get("cache-control")).toBeNull();
+  });
+
+  it("keeps the stricter share-link posture on /c/<token>", () => {
+    const token = "hls_000000000000000000000000000000000000000000000000";
+    const res = proxy(makeRequest(`/c/${token}`));
+    const cacheControl = res.headers.get("cache-control") ?? "";
+    expect(cacheControl).toContain("no-store");
+    expect(cacheControl).toContain("must-revalidate");
+  });
+});

src/__tests__/proxy-worker-health.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it, vi } from "vitest";
+import { NextRequest } from "next/server";
+
+vi.mock("@/lib/process-type", () => ({
+  shouldRunWeb: () => false,
+}));
+
+import { proxy } from "../proxy";
+
+function request(pathname: string): NextRequest {
+  return new NextRequest(`http://localhost${pathname}`);
+}
+
+describe("worker-only process HTTP boundary", () => {
+  it("allows the process-aware health endpoint through", () => {
+    const response = proxy(request("/api/health"));
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("X-HealthLog-Process-Type")).toBeNull();
+  });
+
+  it("continues to refuse non-health HTTP traffic", () => {
+    const response = proxy(request("/api/version"));
+
+    expect(response.status).toBe(503);
+    expect(response.headers.get("X-HealthLog-Process-Type")).toBe("worker");
+  });
+});

src/__tests__/service-worker.test.ts

@@ -3,14 +3,16 @@
  *
  * `public/sw.js` is plain script (no module system), so the test boots it
  * inside a vm context with a fake CacheStorage and dispatches the captured
- * event listeners. Three behaviours are pinned:
+ * event listeners. Four behaviours are pinned:
  *
- *   1. the offline HTML fallback only serves a shell cached under the
+ *   1. cache write and trim failures never replace a successful network
+ *      response for API, navigation, or static-asset requests;
+ *   2. the offline HTML fallback only serves a shell cached under the
  *      CURRENT `CACHE_VERSION` cache names (a stale pre-update shell would
  *      reference a chunk graph that no longer exists);
- *   2. `activate` enables navigation preload and `networkFirst` consumes
+ *   3. `activate` enables navigation preload and `networkFirst` consumes
  *      `event.preloadResponse` when the browser supplies it;
- *   3. `trimCache` reads the key list once and deletes the excess prefix
+ *   4. `trimCache` reads the key list once and deletes the excess prefix
  *      in a single pass (the previous loop re-fetched all keys per delete).
  */
 import { describe, it, expect } from "vitest";
@@ -34,10 +36,15 @@ const FALLBACK_VERSION = /\/\* @sw-version-fallback \*\/\s*"(v[^"]*)"/.exec(
 )![1];
 const CURRENT_PAGE_CACHE = `healthlog-pages-${FALLBACK_VERSION}`;
 const CURRENT_STATIC_CACHE = `healthlog-static-${FALLBACK_VERSION}`;
+const CURRENT_DATA_CACHE = `healthlog-data-${FALLBACK_VERSION}`;
 
 class FakeCache {
   map = new Map<string, Response>();
   keysCalls = 0;
+  putError: Error | undefined;
+  putDelay: Promise<void> | undefined;
+  onPut: (() => void) | undefined;
+  keysError: Error | undefined;
 
   private keyOf(request: RequestInfo | URL): string {
     if (typeof request === "string") return new URL(request, ORIGIN).href;
@@ -50,6 +57,9 @@ class FakeCache {
   }
 
   async put(request: RequestInfo | URL, response: Response): Promise<void> {
+    this.onPut?.();
+    if (this.putDelay) await this.putDelay;
+    if (this.putError) throw this.putError;
     this.map.set(this.keyOf(request), response);
   }
 
@@ -61,6 +71,7 @@ class FakeCache {
 
   async keys(): Promise<Request[]> {
     this.keysCalls += 1;
+    if (this.keysError) throw this.keysError;
     return [...this.map.keys()].map((url) => new Request(url));
   }
 
@@ -102,12 +113,14 @@ interface SwHarness {
   listeners: Map<string, (event: unknown) => void>;
   cacheStorage: FakeCacheStorage;
   navPreload: { enabled: boolean; enable: () => Promise<void> };
+  lifetimePromises: Promise<unknown>[];
   context: Record<string, unknown>;
 }
 
 function bootServiceWorker(): SwHarness {
   const listeners = new Map<string, (event: unknown) => void>();
   const cacheStorage = new FakeCacheStorage();
+  const lifetimePromises: Promise<unknown>[] = [];
   const navPreload = {
     enabled: false,
     enable: async () => {
@@ -173,7 +186,7 @@ function bootServiceWorker(): SwHarness {
   };
   vm.createContext(context);
   vm.runInContext(SW_SOURCE, context);
-  return { listeners, cacheStorage, navPreload, context };
+  return { listeners, cacheStorage, navPreload, lifetimePromises, context };
 }
 
 async function dispatchActivate(harness: SwHarness): Promise<void> {
@@ -200,11 +213,161 @@ function dispatchNavigationFetch(
       captured = p;
     },
     preloadResponse,
+    waitUntil: (p: Promise<unknown>) => {
+      harness.lifetimePromises.push(p);
+    },
   });
   if (!captured) throw new Error("fetch handler did not respond");
   return captured;
 }
 
+function dispatchApiFetch(harness: SwHarness, path: string): Promise<Response> {
+  let captured: Promise<Response> | null = null;
+  harness.listeners.get("fetch")!({
+    request: new Request(`${ORIGIN}${path}`),
+    respondWith: (p: Promise<Response>) => {
+      captured = p;
+    },
+  });
+  if (!captured) throw new Error("fetch handler did not respond");
+  return captured;
+}
+
+function dispatchAssetFetch(
+  harness: SwHarness,
+  path: string,
+): Promise<Response> {
+  let captured: Promise<Response> | null = null;
+  harness.listeners.get("fetch")!({
+    request: new Request(`${ORIGIN}${path}`),
+    respondWith: (p: Promise<Response>) => {
+      captured = p;
+    },
+  });
+  if (!captured) throw new Error("fetch handler did not respond");
+  return captured;
+}
+
+describe("sw.js — best-effort cache writes", () => {
+  it("returns the original successful API response when cache.put rejects", async () => {
+    const harness = bootServiceWorker();
+    const dataCache = await harness.cacheStorage.open(CURRENT_DATA_CACHE);
+    dataCache.putError = new Error("CacheStorage quota exceeded");
+    const networkResponse = new Response(
+      JSON.stringify({ data: { weightKg: 80 }, error: null }),
+      {
+        status: 200,
+        headers: {
+          "Content-Type": "application/json",
+          "X-Network-Response": "original",
+        },
+      },
+    );
+    harness.context.fetch = async () => networkResponse;
+
+    const response = await dispatchApiFetch(
+      harness,
+      "/api/measurements?type=WEIGHT",
+    );
+
+    expect(response).toBe(networkResponse);
+    expect(response.status).toBe(200);
+    expect(response.headers.get("X-Network-Response")).toBe("original");
+    expect(await response.text()).toBe(
+      JSON.stringify({ data: { weightKg: 80 }, error: null }),
+    );
+  });
+
+  it("returns the original successful navigation response when cache.put rejects", async () => {
+    const harness = bootServiceWorker();
+    const pageCache = await harness.cacheStorage.open(CURRENT_PAGE_CACHE);
+    pageCache.putError = new Error("CacheStorage quota exceeded");
+    const networkResponse = new Response("network shell", {
+      headers: { "X-Network-Response": "original" },
+    });
+    harness.context.fetch = async () => networkResponse;
+
+    const response = await dispatchNavigationFetch(harness, "/measurements");
+
+    expect(response).toBe(networkResponse);
+    expect(response.headers.get("X-Network-Response")).toBe("original");
+    expect(await response.text()).toBe("network shell");
+  });
+
+  it("does not delay a successful navigation response while cache.put is pending", async () => {
+    const harness = bootServiceWorker();
+    const pageCache = await harness.cacheStorage.open(CURRENT_PAGE_CACHE);
+    let releasePut!: () => void;
+    pageCache.putDelay = new Promise<void>((resolve) => {
+      releasePut = resolve;
+    });
+    let notifyPutStarted!: () => void;
+    const putStarted = new Promise<void>((resolve) => {
+      notifyPutStarted = resolve;
+    });
+    pageCache.onPut = notifyPutStarted;
+    const networkResponse = new Response("network shell");
+    harness.context.fetch = async () => networkResponse;
+
+    const responsePromise = dispatchNavigationFetch(harness, "/measurements");
+    await putStarted;
+
+    let settledResponse: Response | undefined;
+    void responsePromise.then((response) => {
+      settledResponse = response;
+    });
+    try {
+      await new Promise<void>((resolve) => setImmediate(resolve));
+      expect(settledResponse).toBe(networkResponse);
+      expect(harness.lifetimePromises).toHaveLength(1);
+    } finally {
+      releasePut();
+      await Promise.all(harness.lifetimePromises);
+    }
+
+    expect(await pageCache.match(`${ORIGIN}/measurements`)).toBeDefined();
+  });
+
+  it("returns the original successful static response when cache.put rejects", async () => {
+    const harness = bootServiceWorker();
+    const staticCache = await harness.cacheStorage.open(CURRENT_STATIC_CACHE);
+    staticCache.putError = new Error("CacheStorage quota exceeded");
+    const networkResponse = new Response("immutable chunk", {
+      headers: { "X-Network-Response": "original" },
+    });
+    harness.context.fetch = async () => networkResponse;
+
+    const response = await dispatchAssetFetch(
+      harness,
+      "/_next/static/chunks/app.js",
+    );
+
+    expect(response).toBe(networkResponse);
+    expect(response.headers.get("X-Network-Response")).toBe("original");
+    expect(await response.text()).toBe("immutable chunk");
+  });
+
+  it("returns the original successful API response when cache trimming rejects", async () => {
+    const harness = bootServiceWorker();
+    const dataCache = await harness.cacheStorage.open(CURRENT_DATA_CACHE);
+    dataCache.keysError = new Error("CacheStorage keys unavailable");
+    const networkResponse = new Response(
+      JSON.stringify({ data: { weightKg: 80 }, error: null }),
+      { headers: { "Content-Type": "application/json" } },
+    );
+    harness.context.fetch = async () => networkResponse;
+
+    const response = await dispatchApiFetch(harness, "/api/measurements");
+
+    expect(response).toBe(networkResponse);
+    expect(response.status).toBe(200);
+    expect(await response.text()).toBe(
+      JSON.stringify({ data: { weightKg: 80 }, error: null }),
+    );
+    expect(dataCache.keysCalls).toBe(1);
+  });
+});
+
 describe("sw.js — activate", () => {
   it("drops stale-version caches and enables navigation preload", async () => {
     const harness = bootServiceWorker();