` so short sub-pages no longer trigger a click-to-shift as the layout collapses inwards. - **Thresholds + Sources skeleton rows replace the single spinner.** The two settings sections render a row-shaped placeholder list while loading; the skeletons map over the same metric ordering as the live UI so the layout stays put across the loading-to-loaded transition. - **Heading weight + card cadence + label-input gap.** Standardised to `font-semibold` across every divergent `

` / `

` in settings and admin sections; card-internal vertical rhythm pins to `space-y-4`; the password-change dialog at `account-section.tsx` lifts `space-y-1.5 → space-y-2` across its three label-input pairs. - Health Score column rebalanced. The hero strip splits to a tablet-friendly `md:flex-row`; the Health Score card pins a `basis-` width so the column does not stretch past its content. The L2 disclaimer text bumps from `text-[10px]` to `text-[11px]` to clear the 12 px mobile floor concern. The retired inline ask-Coach button drops; the `onAskCoach` prop stays for backward compatibility (destructure-and-ignore). - Daily Briefing trim. The duplicate paragraph slot drops; the card renders a single insight line and the matching insights sub-page link. - `/api/version` carrier surface. The login overview CSV adopts carrier as a column and the per-row chip surfaces under the provider cell. Empty carrier renders as no chip rather than a placeholder label. - CoachLaunch `scope` parameter. Reserved on the `useCoachLaunch().askCoach(prefill, scope)` signature for v1.4.28's per-metric narrowing; currently a no-op on the sources rail. - CSV / pagination chrome out of the admin scroll wrappers. `login-overview-section.tsx` and `app-log-preview-section.tsx` now render the pagination controls and the summary line as siblings of the `overflow-x-auto` table wrapper. The CSV export button was already in the toolbar row above the table. - `measurement-list.tsx` filter row stacks on ` tx.workout.findFirst(...)))` loop for one batched `tx.workout.findMany` with a per-entry `OR` clause; per-batch round-trip count drops from 1+N to 2 for a 100-row batch. The createdAt-DESC tie-break is preserved via in-memory grouping. - Form input attributes wired across the surface. Measurement, medication, mood, settings, admin and auth forms pick up `inputMode` / `enterKeyHint` / `autoComplete` / `autoCapitalize` / `aria-required` / `aria-invalid` / `aria-describedby`. The Input primitive derives `inputMode` from the `type` prop when the caller does not pass one (`number → decimal`, `tel → tel`, `email → email`, `url → url`, `search → search`). Integer-only call sites still pass `inputMode="numeric"` explicitly. - Schedule day-of-week grid widens on narrow viewports. `medication-form.tsx` stacks the Daily pill above a fixed `grid grid-cols-7` so every weekday keeps the 44 px tap-target floor regardless of container width. - Public-page polish. `/about` and `/privacy` sticky headers pick up `pt-[env(safe-area-inset-top)]` so the brand row clears the iOS notch. `/privacy` mounts a default-closed `
` Contents TOC above the body with anchor links to every numbered section; the 19 HealthKit identifier `` elements gain `break-all` so the longest camelCase entries wrap. ### Fixed - Stray-brace typo at the insights-targets route. The trailing comment block at `src/app/api/insights/targets/route.ts:807` carried a stray `}` that the v1.4.25 polish pass missed; cleaned up alongside the prompt-side audit. - Chart-tick timezone audit.** `compliance-heatmap.tsx` parsed the day-key against local tz (`new Date(dateStr + "T00:00:00")`) and read `getDay()` / `getMonth()` (server-tz) while the dateKey was UTC-anchored via `toISOString().slice(0, 10)`. Pinned to `T00:00:00Z` + `getUTC` accessors so the Monday-alignment and month-marker placement stay correct under an SSR pass on a non-Berlin host. The five sibling chart files (`sleep-stage-stacked-bar`, `mood-chart`, `health-chart`, `medication-compliance-chart`, plus the broader insights surface) audit clean. - `/about` returned 401 to unauthenticated visitors. `/about` joined `proxy.ts` `PUBLIC_PATHS` in B3 but the client-side `auth-shell.tsx` `PUBLIC_PATHS` list was missing the entry, so the route surfaced the redirect-to-login screen instead of the credits. `isStandalonePublicPage` also matches `/about` so the route renders edge-to-edge. - Insights empty-state CTAs hit a 404. The CTAs targeted `/measurements/new`, which is not a route. Swapped to `/measurements?add=` with a `MEASUREMENT_TYPES` allow-list on the consumer side; the measurements page reads the query param, opens the form with `defaultType` set, then `router.replace`s to a clean URL. - `/api/version` register button below the tap floor. The `/auth/register` submit button promotes to `size="lg" min-h-11 w-full` so the primary action stays finger-tap reachable on narrow viewports. - Workouts pagination broken under canonical dedup. Pulling the full filtered set and slicing post-dedup yields the correct `meta.total` and a no-overlap, no-gap descending order across pages. New regression test paginates eight twin clusters across two pages. - `useIsMobile` first-paint desktop flash. The hook now reads through `useSyncExternalStore` with `getServerSnapshot() => false` and `getClientSnapshot()` reading `window.matchMedia(query).matches` synchronously. SSR still resolves to `false`; the first client render reads the live media-query state without waiting an effect tick. - `Sheet` close-X tap target. Widened to match the `Dialog` primitive's 36 px floor. - `/about` and `/privacy` anchors occluded by the sticky header. `scroll-mt` widened so the section start lands below the sticky header rather than behind it. - `MedicationComplianceChart.compareBaseline` prop intent. The prop was carried by 24 call sites uniformly but was never consumed; explicitly destructured with `void compareBaseline;` so the type contract is preserved and the dead-prop signal clears. - DrugLevelChart dead axis labels. Dropped the empty `` child of `` (an invisible SVG node beneath the x-axis) and the duplicate Recharts `label={…}` prop on `` that tried to paint the unit-less caption inside a 1 px-wide axis where it could never be read. The external `` above the chart remains the single source of truth. - `not-found.tsx` missing. New branded 404 page with the ``, the 404 eyebrow, the headline and a single back-to-dashboard ``. `min-h-dvh` follows the dynamic viewport on iOS Safari; `pt-[calc(env(safe-area-inset-top)+3rem)]` keeps the headline clear of the notch. ### Removed - Orphan `/api/audit-log` route. The route file (1 281 B) had no callers, no test fixture and no DTO. Five admin / monitoring endpoints (`/api/admin/ai-settings`, `/api/admin/backup/test`, `/api/admin/status-overview`, `/api/monitoring/glitchtip/test`, `/api/monitoring/umami/test`) defer to v1.4.28 because each is referenced by README or CHANGELOG — a wire-or-remove decision the maintainer owns. - `` surface. The standalone dashboard preview retired alongside the layout-test contract flip; `dashboard-layout.test.ts` now guards against accidental reintroduction. - 14 dead exports across `glp1-knowledge.ts`, `scheduling/cadence.ts` and `glp1-snapshot.ts`. Eight type symbols on `glp1-knowledge.ts` drop to internal types; `ExpectedDose` drops its `export` keyword; `__testables.WEEKDAY_KEYS` retires with zero callers. `routeForBrand` and `GLP1_DRUG_IDS` stay exported because the test suites read them. - `BASE_SYSTEM_PROMPT` + `INSIGHTS_SYSTEM_PROMPT` bare-symbol exports. Verified clean — only locale-suffixed `_DE` / `_EN` forms remain. - Stale legacy insights-prompt module. Pruned alongside the v1.4.25 native-locale rebuild that displaced it. - Three dead Coach prefs. `showEvidenceByDefault` UI retires from the Coach settings sheet; the persisted Zod field stays for backward compatibility. ### Infrastructure - `MAXMIND_LICENSE_KEY` wired into the GHCR build workflow. A new `Fetch GeoLite2 databases` step in `.github/workflows/docker-publish.yml` between the metadata-action and the buildx build-push exports the secret from repo secrets. Offline GeoLite2 is optional in this release: when the secret is unset the workflow emits a `::warning::`, drops an `.empty` marker into `assets/geolite2/`, and continues so the Dockerfile `COPY` still has a non-empty source. The runtime resolver in `src/lib/geo.ts` detects the marker on first lookup, falls back to the existing `ipwho.is` provider, and sends a one-shot admin notification (`notifications.admin.offlineGeoUnavailable`) with a pointer to the GitHub Actions secrets page so the maintainer hears about the gap from the running app. The `/api/version` endpoint exposes `offlineGeoEnabled: boolean`; the `/admin` overview snapshot and the full `/admin/system-status` page render a green / yellow chip from that flag. Setting the secret and redeploying lights the feature up without code changes. - Migration `0061_audit_log_carrier`. Additive, `IF NOT EXISTS`-guarded, forward-only. Adds two columns to `AuditLog`: `asn` (`bigint`) + `carrier` (`text`). Safe to re-apply on the demo server. ### Tests - `pnpm test --run` — 4004 / 4005 passing, 1 skipped. Across 357 files. The skipped test is a pre-existing visual-regression placeholder. - 6 new `responsive-sheet.test.tsx` smoke tests pin the dialog-vs-sheet branch, the `data-variant` hook, the footer-slot contract and the SSR `useIsMobile` first-paint. - 16 new `metric-availability.test.ts` cases cover each metric × `{has data, no data, undefined summaries, missing summary entry, BMI-from-WEIGHT derivation, sys-vs-dia independence, mood/medication overrides}`. - 6 new `insights-tab-strip.test.tsx` cases assert backward-compat without `availability`, pill-drop when data is missing, overview pill always renders, mood + medication light-up, BMI-from-WEIGHT derivation. - Drift-guard test at `src/tests/i18n-drift-guard.test.ts` (16 cases) anchors the GLP-1 tile keys, the carrier keys, the insights empty-state keys, the notification dispatcher keys and the personal-record namespace across all six locales. - Locale-native date format test at `src/lib/i18n/tests/format-locale-order.test.ts` (7 cases) asserts ordering per locale. - `canonical-dedup.test.ts` (4 cases) plus the new pagination regression covers the workouts read route. - Auth + audit suites extended for the new ASN + carrier columns and the carrier short-label heuristic (14 cases under `geo-asn.test.ts`, 5 new cases under `audit.test.ts`, 8 new under `login-overview-csv.test.ts`). - `coach-launch-context.test.tsx` (3 cases) pins the new Coach launch context hook shape, the provider mount, and the null fallback outside the provider. ## [1.4.26] — 2026-05-15 Hotfix release. Adds a public, unauthenticated privacy-policy page at `/privacy` so the iOS native application can register a reachable URL in App Store Connect. The policy enumerates every Apple HealthKit identifier the iOS app reads, lists every active third-party sub- processor with its data-protection policy, restates the EU MDR medical-device boundary that scopes the AI Coach surface, and walks through the GDPR Art. 15-22 / DSGVO data-subject rights with concrete in-app routes the user can hit. The page bypasses the standard auth-shell so an App-Store reviewer or a first-time visitor sees the full document immediately. The conservative-semver pattern still applies: this could have been versioned `1.4.25.1` for symmetry with the iOS hotfix track, but 4-part versions break the strict-semver guard in `/api/version` so we incremented to the next clean patch instead. ### Added - Public privacy policy at `/privacy` with full HealthKit quantity-type enumeration (18 identifiers plus `sleepAnalysis`), Withings measurement-family list, sub-processor table (Anthropic, OpenAI, Withings, Apple, Telegram, GitHub, Cloudflare, Hetzner), Apple privacy-nutrition-label mapping, and a verbatim EU MDR 2017/745 + MDCG 2021-24 medical-device-boundary statement. - `auth.privacyPolicy` translation key in all six locales (English in EN, German in DE, native translations for FR / ES / IT / PL). ### Changed - The unauthenticated login page links out to `/privacy` below the sign-in card so a first-time visitor can review the policy before signing up, matching GDPR Art. 13 pre-signup expectations. - The auth shell now treats `/privacy` as a standalone public page — long-form legal content renders edge-to-edge instead of being squeezed into the centered login-card layout. ## [1.4.25] — 2026-05-14 Largest feature delta in the v1.4.x line. Insights expands from one page into seven dedicated metric routes; GLP-1 medication tracking lands end-to-end across injection picker, dashboard tile, weight-chart markers, therapy timeline, plateau detection, drug-level chart with a Research-Mode acknowledgment gate, EMA-sourced drug knowledge, EMA titration ladder, cadence visualisation, compliance chips, side-effect taxonomy, pen-and-vial inventory with a 30-day in-use clock, and a dedicated doctor-report section; cross-source priority becomes a two-axis resolver with a per-user Settings surface; per-user timezone threads through ten analytics and presentation surfaces; Withings coverage doubles with twelve new measurement types, webhook-driven BP / temperature ingestion, plus Activity (steps + distance + active-energy) and Sleep v2 (stage-level segments) syncs; the onboarding flow is rebuilt as a nested-route wizard with welcome carousel, goals chip-picker, source selection grid, baseline form, and a welcome-back resume banner; Personal Records ship end-to-end with a detection worker, push opt-in, and a metric-trend badge; Health Score gains a per-component provenance accordion; the Coach runs on native first-party prompts across all six locales with a 1800-assertion refusal-probe matrix; the OpenAPI drift gate flips to hard-fail; the GHCR image is multi-arch so Apple Silicon Macs and arm64 clouds pull native. Migrations 0043–0060 are additive and forward-only. `PROMPT_VERSION` 4.24.0 → 4.25.0 with GROUND RULE 9 (Coach refuses GLP-1 dose recommendations) and GROUND RULE 15 (Coach refuses drug-level estimates with MDR + MDCG 2021-24 cites). ### Added - Insights sub-pages — seven dedicated metric routes with a shared tab strip. `/insights/blutdruck`, `/insights/gewicht`, `/insights/puls`, `/insights/stimmung`, `/insights/medikamente`, `/insights/bmi` and `/insights/schlaf` each render the metric's full chart, range bands, trend annotations and correlation rows beneath the mother-page hero. Tab strip lifts the metric switcher above each chart for cross-metric scanning; the mother page slims to general status and the Coach hero. - Sleep sub-page with per-night stacked-bar of sleep stages. `/insights/schlaf` renders awake / REM / core / deep as stacked columns over the last 7 / 14 / 30 nights, sourced from the `sleepStage` column on `Measurement`. - Targets (`/insights/zielwerte`) redesigned with a conditional Coach-handoff card. New `` primitive replaces the v1.4.22 layout. Page-level consistency strip pins meta context above the cards. The Coach-handoff card only renders when a language-model provider is configured; rule-based mode hides it cleanly. Mobile-first three-column grid; per-card cog for visibility toggles. - GLP-1 medication tracking — full integration across ten surfaces. New `Medication.treatmentClass` enum (`GLP1`, `STANDARD`); `MedicationDoseChange` history table; `InjectionSite` enum with eight site values. A new body-map picker proposes the next rotation site based on the last fourteen days of injections. Medication-card grows a `glp1` variant (text-rich, no inline chart per directive — chart lives on the dashboard tile and `/insights/medikamente` therapy timeline). Dashboard tile shows next-injection schedule + week-over-week weight delta. Weight chart gains vertical injection markers. Therapy timeline on the insights sub-page plots titration alongside weight trace. Plateau- detection rule in `/api/insights/briefing` flags four-week stalls with referral framing. Doctor-report PDF carries a dedicated GLP-1 section. Migration 0046. - Doctor-report per-section toggles + mood default-off. New `User.doctorReportPrefsJson` column (Migration 0045) + `PUT /api/auth/me/doctor-report-prefs`. Each section (mood, achievements, GLP-1, etc.) gets a per-user toggle in Settings → Reports. Mood defaults to off (clinical-sensitivity); empty sections hide rather than render a "no data" stub. - Cross-source priority resolution — two-axis architecture. New `User.sourcePriorityJson` column (Migration 0048) stores a per-user resolver: a single-axis ladder by metric type plus an optional per-device-type override. `pickCanonicalSource()` walks the metric axis first; a per-device override (e.g. "BP from Withings BPM Connect, weight from Withings Body+") wins within that ladder. Defaults: cumulative + sleep + HRV + RHR favour Apple Health → Withings → manual; point measurements favour Withings → Apple Health → manual. The `default` sentinel is retired in favour of a null bucket. - Settings → Sources screen for per-user priority configuration. Drag-and-reorder list per metric, per-device override picker, reset-to-defaults action. Audit-log entry on every write. - Per-user timezone — Option B threaded through ten surfaces. New `User.timezone` column (defaults to `Europe/Berlin`). The CSV exporter emits ISO-8601 with offset; formatters honour the user's tz; Profile picker covers all IANA zones; admin sets the default for new accounts; signup detects the browser tz; the doctor-report PDF dates use the user's tz; chart x-axes take a `timezone` prop; Coach snapshot timestamps land in the user's tz; `MoodEntry.tz` records local-day grouping for weekday correlation (Migration 0044); the weight-weekday correlator buckets days in the user's tz. - Health Score provenance accordion. Each of the four scoring components (BP, weight, mood, compliance) gets an inline disclosure listing the canonical source (Withings / Apple Health / manual) and `asOf` timestamp behind the score number. `aria-labelledby` panel pairing for screen readers. - Four additional locales — French, Spanish, Italian, Polish. First-party translation bundles cover the full string surface with a `` flagging the locale as community-maintained and pointing at the translation-feedback issue template. Coach + insights system prompts ship as native per-locale bodies (no `REPLY LANGUAGE` footer indirection) with the full safety-contract matrix in YAML per locale + structural refusal-probe coverage in CI (see Tests). EN + DE stay Marc-maintained. Locale picker covers all six; signup browser-detect maps `fr|es|it|pl` to the corresponding bundle. - Coach — native first-party system prompts across six locales. Coach + insights system prompts move from EN body + `REPLY LANGUAGE` footer to native per-locale bodies; the safety contract matrix lives as YAML per locale (single source of truth across drafting + tests). The refusal-probe matrix in CI catches cross-locale prompt regressions before they reach the dispatch surface. - VO2 max dashboard trend tile (opt-in). Secondary-metric pattern — default-invisible, surfaces only when the user has VO2 max data from Apple Health. - Personal Records end-to-end — schema, detection worker, badge, push opt-in. Migration 0054 introduces the `PersonalRecord` table + `PersonalRecordDirection` helper; `GET /api/personal-records` is paginated (default twenty-five, max two hundred). A pg-boss worker sweeps MAX / MIN per metric and the workout slots on every batch-ingest + a thirty-minute fallback cron (concurrency five, warmup gate so the very first datapoint per metric does not promote itself). Metric trend tiles render a PR badge when the record landed in the last thirty days, with WCAG-AA contrast in dark mode. A per-user push opt-in toggle (default off) wires into the existing dispatcher cascade. - Workouts — schema + typed batch-ingest endpoint. Migration 0053 introduces the `Workout` + `WorkoutRoute` tables; the Zod boundary in `src/lib/validations/workout.ts` covers a twenty-member sport-type union and a `GeoJSON LineString` route column in JSONB. `POST /api/workouts/batch` accepts up to five hundred rows per call, wraps `withIdempotency()`, returns the same `inserted | duplicate | skipped` envelope as the measurements batch, and reconciles inserted vs duplicate counts correctly under contention. Rate-limited and size-capped. - Onboarding rebuilt as a nested-route wizard. The legacy v1.4.20 onboarding ships as a six-step wizard at `/onboarding/[step]` powered by a new `` primitive: welcome carousel with value-prop slides, goals chip-picker, source selection 4-card grid (with Apple Health marked coming-soon), baseline form, source-connect step, and a done step. `User.onboardingStep` (Migration 0057, with Migration 0060 backfilling and flipping the column to `NOT NULL DEFAULT 0`) drives resume-state; a welcome-back banner surfaces on the entry page when an in-progress wizard is detected. `POST /api/onboarding/step` advances the wizard with rate-limit + audit, returns 409 on a concurrent advance to close the read-then-write race. The marketing entry-point swaps from the v1.4.20 single-page flow to the new wizard. Five locales carry the shell key surface (six total). - GLP-1 — EMA drug knowledge layer. A first-party drug-knowledge module covers five GLP-1 / GIP-GLP-1 drugs with EPAR-sourced half-life, recommended titration step, brand-name table, and a brand-to-id lookup. A drift-guard test pins the values against the EPAR + Psp 4.13099 references on disk so the module cannot silently drift. - GLP-1 — Research Mode with estimated drug-level chart, MDR acknowledgment dialog, and Settings toggle. A pure one-compartment pharmacokinetic helper produces qualitative drug-level traces from the user's injection history (steady-state approximation, observational use only). The chart renders on the GLP-1 medication detail page behind a Research-Mode gate: `User.researchModeAck*` columns (Migration 0058) record the acknowledgment version + timestamp; a dialog explains the EU MDR 2017/745 + MDCG 2021-24 context and cites EMA EPAR plus Schneck / Urva 2024 before the user can opt in. `GET / POST / DELETE /api/auth/me/research-mode` carries the acknowledgment lifecycle. A Settings → Advanced toggle exposes the opt-in plus a re-prompt banner whenever the acknowledgment version bumps. - GLP-1 — side-effect logging with a 21-entry × 5-category taxonomy. Migration 0059 introduces the `MedicationSideEffect` table; pure helpers produce the taxonomy + a five-point Likert severity scale; a section on the GLP-1 detail page lets the user log entries with category + severity + free-text notes. Category is derived server-side from the entry (no client-supplied category) so the taxonomy cannot drift between client and server. - GLP-1 — cadence visualisation + compliance chips. Pure helpers expand a medication's schedule into expected slots, pair each slot with the closest actual intake, and produce a cadence timeline + compliance chip strip on the detail page. `GET /api/medications/[id]/cadence` returns the structured payload; the helpers honour per-user timezone so cross-midnight doses bucket correctly regardless of locale. - GLP-1 — EMA titration ladder display. Pure helpers walk the EMA-sourced titration schedule from the knowledge layer; the GLP-1 detail page renders the user's current step + remaining ladder as observational reference, framed as reference-not-advice and bound by GROUND RULE 15. `GET /api/medications/[id]/titration-ladder` returns the structured ladder + current step. - GLP-1 — pen-and-vial inventory with a 30-day in-use clock. Migration 0056 introduces the `MedicationInventoryItem` table + a pure state machine (SEALED → IN_USE → EXPIRED) with a 30-day in-use clock from `markAsFirstUseAt`. An inventory card on the medication detail page surfaces the active pen, days remaining, and SEALED stock; intake events decrement the dose count, and a daily 03:00 cron flips expired in-use items in a single `updateMany`. Re-runs the state machine on every PATCH so a back-dated first-use immediately moves a stale pen to EXPIRED. - Apple Health identifier mapping (server-side). Ports the identifier table from `k0rventen/apple-health-grafana` and `dogsheep/healthkit-to-sqlite` with MIT and Apache-2.0 attribution recorded in source headers and `NOTICE`. Covers the v1.4.25 ingest surface; iOS-18 long-tail mappings (sleep apnea, GAD-7, paddle/row sports, FHIR clinical) carry inline release-window comments. - Audio-exposure and time-in-daylight measurement types. Migration 0052 adds `ENVIRONMENT_AUDIO_EXPOSURE`, `HEADPHONE_AUDIO_EXPOSURE` and `TIME_IN_DAYLIGHT` to the `MeasurementType` enum. Doctor report mentions them when populated; no dedicated chart yet. - Withings expanded coverage — twelve new measurement types and the BP / temperature webhook subscription. Migration 0049 adds HRV, body temperature, SpO2 v2, VO2 max, fat-free mass, fat mass, muscle mass, skin temperature, pulse-wave velocity, vascular age and visceral fat as `MeasurementType` values. Withings webhook coverage extended to BP and temperature so the latency goes from ~1 h polling to seconds. OAuth scope upgraded to include `user.activity` and an in-app banner prompts existing users to reconnect once. - Withings — Activity sync (steps + distance + active-energy). Calls `getactivity`, ingests one row per day, anchors at noon UTC so positive-offset users bucket cleanly into their local day. Backed by a pg-boss `activity-sync` queue plus a webhook enqueue hook on the new subscription channel. - Withings — Sleep v2 sync (stage-level segments). Calls `sleepv2_get` and writes per-night stage segments through the new `sleepStage` composite (Migration 0055 widens the Measurement unique index to include `sleep_stage` with `NULLS NOT DISTINCT`). Backed by a pg-boss `sleep-v2-sync` queue plus webhook enqueue. The sleep sub-page's stacked-bar chart renders the segments directly. - Withings — webhook subscriptions expanded to activity + sleep v2. Subscription registration plus webhook delivery routing for the two new event types. - Admin Login overview — location, provider and CSV polish. Adds a location column derived from the audit IP; adds a provider column distinguishing passkey, password, API-token and OAuth login paths; the CSV export drops two unused columns and the per-row collapse affordance comes off. - DELETE `/api/measurements/by-external-ids` for iOS deletion sync. Idempotent batch delete keyed on `(user, source, externalId)` tuples; rate-limited the same way as the batch ingest endpoint. - Multi-arch Docker image. GHCR publish workflow builds `linux/amd64` on `ubuntu-latest` plus `linux/arm64` on `ubuntu-24.04-arm` and merges the manifest. Apple Silicon Macs and arm64 clouds now pull native; the previously-stale README claim is accurate again. - GLP-1 endpoint hardening. `POST /api/medications/[id]/glp1` now parses through bounded Zod schemas (`glp1DoseChangePostSchema`, `glp1InventoryPostSchema`) with length-capped notes, finite-number guards on dose value, and bounded `effectiveFrom`. Every write produces an audit-log row and the route inherits the 30-per-minute-per-user rate limit from the rest of the medication surface. - Translation-feedback issue template. GitHub issue template for community translation corrections, paired with the maintainership banner copy on FR / ES / IT / PL surfaces. - Repository polish. README hero rewrite (what / who / try the demo, thirty-second read). Topics expanded 10 → 18. Branch protection v2 with conversation-resolution. GitHub Discussions enabled. Issue template + PR template carry-over from v1.4.20 preserved. ### Changed - Insights mother page slimmed; metric depth moved to sub-pages. `/insights` becomes a navigation hub with hero strip + Daily Briefing + correlations + trends row; per-metric depth lives one click away on the dedicated sub-pages. - Targets page-shell unified with the rest of Insights. Single consistency strip + Coach handoff + per-card actions rather than the v1.4.22 sparkline-everywhere layout. - Coach default-window preference plus chip-order rationalised. The window picker now persists per-user (last seven / thirty / ninety days); suggested-prompt chips reorder so health-focus chips lead and meta-discovery chips trail. Composer auto-grows on multi-line input. Distinct error UX for daily-limit hit vs provider rate-limit. Microphone affordance retired (was a placeholder). - Dashboard global comparison-overlay default removed. Per-chart preference from v1.4.22 is the only knob now; the dashboard-level default is gone. - **`medication_schedules.*` columns mapped to snake_case via Prisma `@map`. Migration 0047 — cosmetic rename only, convention parity with the rest of the schema. Resolves the v1.4.24 demo-deploy schema-drift finding. - Top-page padding parity across `AuthShell`, Settings and Admin shells. Cross-page rhythm matches; the previous one-off paddings on Admin and Settings asymmetric to Insights are gone. - Settings icon + heading convention uniform across all twenty- three sections. Every section header pairs an icon with a heading; the v1.4.24-era split (icon-only on some, heading-only on others) is gone. - `PROMPT_VERSION` 4.24.0 → 4.25.0 carries two new safety ground rules across all six locales: GROUND RULE 9 forbids GLP-1 dose recommendations (Coach falls back to a clinical-referral framing on any dose question); GROUND RULE 15 forbids drug-level estimates and cites EU MDR 2017/745 + MDCG 2021-24 in the refusal copy. Coach + insights system prompts ship as native bodies per locale rather than the legacy `REPLY LANGUAGE` footer. - Dashboard top-tile polish. Tile headings collapse to a single line per locale (BP / BF abbreviations land in EN + DE + the four Romance locales); the trend arrow moves inline next to the headline value; the value row baseline-aligns across tiles regardless of font fallback. Regression guard pins the baseline contract. - OpenAPI drift gate flips to hard-fail. `pnpm openapi:check` CI step now red-bars a PR on any drift between the Zod registry and `docs/api/openapi.yaml`. The v1.4.23 warn-only window closes; iOS DTO codegen can rely on the spec being authoritative. - Coolify auto-deploy gate exposed as an explicit maintainer-toggleable repo variable. `vars.COOLIFY_AUTO_DEPLOY` is now a `true | false` switch in the deploy workflow instead of the implicit secret-presence gate that silently no-op'd in v1.4.21-23. - Settings → Sources sentinel cleanup. The `default` device-type bucket sentinel is retired in favour of a null bucket at the storage layer; the Settings UI reads cleaner and the reorder helpers (`reorderLadder`) collapse the two `moveSource` + `moveDeviceType` paths into one. - Section wrapper for medication detail. A new `` wraps the three medication-detail shells (titration, scheduling, side-effects) plus the inventory disclosure top so cross-section chrome stays consistent and future sections drop in without copy-paste. - Shared route ownership helper. Nine medication routes (`titration`, `side-effects`, `inventory`, `cadence`, `intake`, `compliance`, `phase-config`, `api-endpoint`, plus the GLP-1 convenience route) now call `assertMedicationOwnership` from `src/lib/medications/route-guards.ts` rather than open-coding the lookup; rate-limit headers across the same surface align on the option-bag form `apiError(..., { headers: rateLimitHeaders(rl) })`. ### Fixed - Settings save regression on Zod v4 record semantics. `z.record(z.string(), …)` switched to `z.partialRecord(…)` on the dashboard-prefs schema so optional keys round-trip cleanly through the PUT. The save-then-blank-load bug from v1.4.24 is gone. - Comparison-shift baseline regression. Comparison overlay was subtracting the wrong-period baseline on several charts; baseline lookups now match the caption window. Three regression guards. - Raw metric-token leaks in generated prose — `metric:` identifiers surfaced in three surfaces that escaped the v1.4.22 sweep (`` fallback path, briefing `keyFinding` helper, and Coach in-flight bubble). `stripChartTokens()` regex widened to cover lowercase prose remnants; prompt-side GROUND RULES 8 and 13 reaffirm the constraint. PROMPT_VERSION 4.23.0 → 4.24.0 carried the prompt change; 4.25.0 inherits. - Withings BP and temperature webhook latency. Webhook subscription now covers BP and temperature endpoints, so the earliest a measurement reaches the user drops from ~1 h to seconds. - Dev-server crash on Tailwind v4 `color-mix` parser + Next 16 api-handler private-field. Two unrelated dev-time crashes surfaced together: Tailwind v4 choked on a `color-mix()` invocation in a chart token; Next 16 + Webpack fallback hit a private-field access on a force-static route handler. `color-mix` invocation replaced; api-handler guards the field access. Production unaffected — these surfaced only under the dev compile path. - Insights duplicate `StatusCard`. The mother page rendered two copies of the BP status card at certain viewports due to a hero-strip ↔ correlation-row overlap. Card hoisted to the single canonical location. - Coach-feedback admin header layout shift. Sticky-header contract mismatch — the section's ` ` carried a different top padding than its siblings, so navigating into the section visibly shifted the chrome. Padding parity restored across all admin sections. - Notification-status-card heading icon parity. Was the one section without an icon next to its heading; aligns with the cross-section convention now. - WCAG 2.5.5 touch-target floor across the top bar, section strips and the injection-site picker. Several pill chips and the injection-picker dots sat below the 44-px floor; all hit the floor now without changing the visual density at typical rendering sizes. - Sleep-stage chart strokes resolve through Dracula tokens. The chart was using the legacy `hsl(var(--border))` form which Tailwind v4 rejects; switched to the resolved token. - "Per night" hardcoded German in four locales. The sleep-page subtitle suffix was hardcoded `pro Nacht` and rendered as raw German across FR / ES / IT / PL. Translated in all six locales; an i18n drift-guard covers the contract. - Cross-page top-padding asymmetry. AuthShell, Settings, Admin all carry the same top padding now (see Changed). - `berlinIsoWeekday()` timezone hard-code. The weekday helper hardcoded Europe/Berlin; now takes a `timezone` argument and threads through the weight-weekday correlator. - Batch-ingest race reconciliation under contention. Two concurrent batches with overlapping `externalId` sets returned inconsistent `inserted` / `duplicate` counts because the reconciliation pass was logically inverted (no-op when the catch fired). Fixed; replay regression test seeds the race. - `requireAuth()` blocks narrow-scope iOS Bearer tokens on unscoped routes. v1.4.24 closed the inverse hole (Bearer with no scope reaching unscoped handlers); this release closes the over-broad version — a token scoped exclusively to `medication:ingest` could not reach handlers that don't declare a `requiredPermission`. Now declared-scope tokens are allowed through provided the route's declared scope (or wildcard) is in the token's set. - `createMeasurementSchema` dropped `deviceType` on single-entry POST. The batch route accepted `deviceType` per row; the single-entry POST stripped it on the Zod boundary. Mirror parity restored. - Personal-records endpoint unpaginated. `GET /api/personal-records` now clamps `?limit` (default twenty-five, maximum two hundred); the unbounded read is gone. - Withings activity sync bucketed positive-offset users into the wrong day. The per-day row was anchored at 23:59:59 UTC, so a user in `Pacific/Auckland` saw activity rows attached to the following local day. Anchored at noon UTC (`T12:00:00.000Z`) with a regression suite covering Berlin / Los Angeles / Tokyo / Auckland. - Cadence and compliance helpers ignored per-user timezone. `expandScheduleSlots`, `pairDoses`, `buildCadenceTimeline` and the compliance-chip helper now accept a `timeZone` argument that threads through `Intl.DateTimeFormat`, so cross-midnight doses bucket correctly regardless of user locale. The cadence route resolves through `resolveUserTimeZone(user)`. - Inventory state-machine ignored back-dated first-use. Issuing a PATCH that pushed `markAsFirstUseAt` more than thirty days into the past left the item in IN_USE; the state machine now re-runs on every PATCH and the stale item flips to EXPIRED. Regression test pins the contract. - Inventory expire-stale cron looped per row. Replaced the row-by-row `prisma.update` loop in `expireStaleInUseItems` with a single `updateMany`; bulk-update contract pinned by test. - Onboarding step write was read-then-update. A concurrent advance could double-step the wizard. The update now conditions on `{ id, onboardingStep: current, onboardingCompletedAt: null }` and returns 409 on conflict. - Workout schema accepted `endedAt <= startedAt`. `createWorkoutSchema` gained a `.superRefine` rejecting zero-duration and inverted windows; the PR detection worker's MIN-direction slot also guards against `durationSec === 0` so a malformed row cannot promote itself to a personal record. - Personal Record detection duplicate writes under contention. Same-millisecond writes into a null workout slot now reconcile to a single row; regression test seeds the race. - Source-priority parse failures were silent. Storage parse errors now route through an observer breadcrumb and the resolved blob is frozen at construction so downstream mutation is caught immediately. - Health-Score `asOf` derived non-deterministically. The `asOf` timestamp now derives from the input dates instead of the wall clock so repeated computes against the same dataset produce stable timestamps. - Source-priority audit-log entries missed two write paths. Doctor-report-prefs and source-priority PUTs were not landing audit-log rows; both write paths emit now. - Personal-record badge dark-mode contrast. Lifted to WCAG-AA contrast on the `` surface. - Range-bar zone backgrounds. `` mixed Tailwind raw palette tokens with Dracula tokens; all zone backgrounds now resolve through Dracula tokens with the pinned test rewritten. - Research-Mode acknowledgment dialog footer scrolled below fold. The footer pins outside the scrolling region on small viewports. - 44-px touch-target floor across the onboarding wizard. Shell back/skip/next, carousel pager, source-card grid, baseline and goals-chip CTAs all hit the WCAG 2.5.5 floor without changing visual density at typical rendering sizes. - Workout endpoint reconciled inserted-vs-duplicate counts incorrectly under contention. Race-recovery path produced inconsistent envelope counts; corrected with a regression test seeding the contention window. - Legacy Withings `?secret=` webhook form had no counter. An in-memory `withings.webhook.legacy_form_total` counter surfaces through `ops-stats`; the warning text gained the re-subscription URL for affected accounts. - Acknowledgment dialog i18n back-button. Medication history page back-button hard-coded `Zurück`; routed through `t()`. - Sleep + audio-exposure + comparison-hint i18n keys. Backfill pass picked up the keys missed by the v1.4.22 sweep across all six locales. - Build resolution for safety-contract YAML. The loader now resolves the YAML matrix path from `cwd` rather than `__dirname` so the build does not break when the bundler reshapes the module-relative root. - GLP-1 drift guard self-skips when the EMA research file is absent. Local checkouts without the reference file no longer red-bar the test. - `x-axis` chart ticks resolved in user timezone. `xAxisTicks` now renders the tick formatter in `user.displayTimezone` instead of hard-coding Europe/Berlin. - Chart token references switched to `var(--token)` form. Recharts strokes were still using `hsl(var(--token))`; switched to bare `var(--token)` so Tailwind v4's color-mix parser resolves them. - `detectGlp1Plateau` branches lacked direct coverage. Added Prisma-mocked unit tests covering the previously-uncovered branches. ### Security - Withings webhook secret no longer leaks into structured logs. `WITHINGS_WEBHOOK_SECRET` was landing as a URL path-segment in `http.path` on every Wide Event the request produced. The logging stack now carries a parameterised `PATH_SECRET_PATHS` registry seeded with the `/api/withings/webhook/[token]` shape, and `WideEventBuilder.setHttp` rewrites path + route segments to `[REDACTED]` before they reach stdout / the in-memory ring buffer / Loki. Existing query-string redaction is unaffected. - Coach refuses GLP-1 dose recommendations. GROUND RULE 9 across all six locales — the Coach surfaces a clinical-referral message on any dose adjustment ask, never a number. PROMPT_VERSION 4.25.0 carries the rule. - Coach refuses drug-level estimates with regulatory cites. GROUND RULE 15 across all six locales — the Coach refuses any ask for an estimated drug level or pharmacokinetic prediction, cites EU MDR 2017/745 + MDCG 2021-24 in the refusal copy, and routes the user to the Research Mode disclosure flow. Adversarial refusal-probe matrix exercises 20+ paraphrasings per GROUND RULE across six locales in CI on every push, so prompt-injection regressions surface before reaching the dispatch surface. - Research Mode is gated by an MDR acknowledgment dialog. The estimated drug-level chart on the GLP-1 detail page renders only after the user opts in through a dialog that cites EU MDR 2017/745 + MDCG 2021-24, EMA EPAR and the Schneck / Urva 2024 pharmacokinetic reference. The acknowledgment version re-prompts the user on bump. - GLP-1 convenience endpoint hardened. `POST /api/medications/[id]/glp1` parses through bounded Zod schemas (`glp1DoseChangePostSchema`, `glp1InventoryPostSchema`), enforces length caps on notes, finite-number guards on dose value, and bounded `effectiveFrom`; every write produces an audit-log row and the route inherits the 30-per-minute-per-user rate limit from the rest of the medication surface. - GLP-1 medication strings sanitised before LLM prompt interpolation. A malicious or malformed medication name no longer reaches the prompt body verbatim. Sanitiser passes Latin-letter + digit + common punctuation only. - Batch-ingest rate limit (sixty per minute per user default). `POST /api/measurements/batch`, `POST /api/workouts/batch` and `DELETE /api/measurements/by-external-ids` carry a token-bucket rate limit returning the standard 429 envelope. - Audit-log writes on source-priority and doctor-report-prefs PUTs. Every change to either preference produces an `AuditLog` row for the user's audit-log surface and the admin cross-section view. - Withings OAuth `user.activity` scope upgrade with explicit user reconnect. New scope only takes effect after the user re-authorises; the reconnect banner makes the requirement visible. - Source-priority storage is per-user. No cross-user lookup paths; one user's priority blob never enters another user's resolver. ### Refactor / Hygiene - `pickCanonicalSource` becomes a two-axis lookup with single- axis fallback. Reuses `getDeviceTypeLadder()` so the per-device override can be queried from the canonical-row picker without duplicating ladder logic. - Health-Score `COMPONENT_ORDER` hoisted + `Intl.DateTimeFormat` memoised. Provenance accordion calls the formatter once per render rather than four times. - `SubPageSlug` type + array derived from `SUB_PAGE_METRIC` record. Single source of truth for the seven sub-page slugs. - `source-priority` `default` sentinel → null bucket. Settings → Sources stops carrying a fake `default` device- type entry; the null bucket reads cleaner at the storage layer. - `apple-health-mapping` sleep branch collapsed. Three sleep- stage cases shared the same body; collapsed to one. - `HK_QUANTITY_TYPE_TO_MEASUREMENT` removed. The legacy view was a redundant projection of `APPLE_HEALTH_TYPE_MAP`; all callers go through the canonical map now. - Dead-code cleanup pass. Drops `` (zero callers since v1.4.20), ``, `` wrapper and three orphan `insightsGeneralStatus` query keys from the v1.4.16-era hero. Removes the orphan `/api/insights/general-status` route (superseded by `` since v1.4.16). - Coach `` controlled-prop refactor is fully in place — the v1.4.24 follow-up of `useResettableValue` is now the only call path; the legacy remount hack code is gone. - 380 dead i18n keys dropped. Runtime probe across the six locales identified 380 keys with zero call sites and zero runtime resolutions; all six locale bundles are smaller by that count. Top namespaces: `settings`, `admin`, `classifications`, `medications`. The remaining ~148 keys are queued for a second pass in v1.4.26. - Dead system-prompt constants removed. `BASE_SYSTEM_PROMPT` and `INSIGHTS_SYSTEM_PROMPT` constants had no remaining importers after the native per-locale prompt move; both deleted. - `useInsightStatus` hook extracted. The four insights sub-page status queries collapsed into a single hook so the duplicated `useQuery` + Suspense fallback shape lives in one place. - `` wrapper. Three medication-detail shells (titration, scheduling, side-effects) and the inventory disclosure top share a single wrapper; future medication detail sections drop in without copy-paste. - Shared helpers across the medication + onboarding surfaces. New modules `src/lib/api/read-error.ts`, `src/lib/medications/route-guards.ts`, `src/lib/medications/research-mode-types.ts` and `src/lib/medications/dose-string.ts` consolidate previously duplicated patterns. Three near-identical dose-string parsers collapse to one `parseDoseMg`; four-times-duplicated `readError` collapses to one; nine medication routes call the shared `assertMedicationOwnership`. - Side-effect taxonomy drift-guard. `SIDE_EFFECT_CATEGORY_VALUES` and `SIDE_EFFECT_ENTRY_VALUES` now derive from the Prisma enum via `z.nativeEnum`; a drift-guard test pins Prisma enum ↔ taxonomy map ↔ validator triangle so the three cannot drift. - Side-effect category derived server-side. The `createSideEffectSchema` no longer accepts a client-supplied `category`; the server derives it from the entry. Removes the defensive 422 path and the cross-tier drift surface. - Dashboard top-tile baseline alignment. Inline trend arrow + baseline-aligned value row across all dashboard tiles, with the baseline contract pinned by regression test. - Range-bar Dracula token swap. `` zone backgrounds resolve through Dracula tokens with the pinned test rewritten; raw palette references gone. - 44-px touch-target floor across the top-bar + section strips. WCAG 2.5.5 alignment across the broader navigation surface, complementing the onboarding-specific pass. - Cat-C typo + naming polish from the W10 review pass. Minor identifier renames flagged by the dead-code probe; no functional change. - `safeRequestProp` widened catch. Narrowed catch broadened to tolerate `undefined` requests after the hygiene-review pass surfaced the regression. - `pickCanonicalWorkout` helper for cross-source workout dedup. Source-priority logic centralised for the v1.5 iOS workout-ingest path. - Insights regenerate button relocated; tab strip lifted. Tab-strip extraction + relocation of the regenerate button to the top-right, paving the way for the seven sub-page surfaces. ### Tests - 2244 → 3828 passing unit tests across 344 files (+1584; one pre-existing skip carries through). Integration suite 140 → ~170 across 11 files. e2e green on the W2 CI fix (coach-prefs URL mock + Pixel-5 selector hardening) plus the Fix-I hot-fix that re-anchored the dashboard insight-card and the mobile x-axis tick locators. - Coach refusal-probe matrix. 1800+ assertions exercise 15 GROUND RULES across six locales with 20+ adversarial paraphrasings each. CI runs the matrix on every push; any prompt-injection or jailbreak regression surfaces before reaching the dispatch surface. Drift-guard tests pin the YAML-per-locale safety-contract matrix in lockstep with the validator-derived enums. - New unit suites (selection): GLP-1 plateau-detection text formatter; two-axis source-priority resolution (single-axis fallback, per-device override, mixed-bucket selection); source-priority Settings reducer (reorder, reset, validate); medication-card GLP-1 variant + injection-site-picker (RTL); doctor-report prefs PUT contract; personal-records pagination clamp; `berlinIsoWeekday` timezone-aware suite; sleep-stage chart i18n-suffix drift-guard; Health-Score provenance i18n drift-guard; api-handler private-field crash regression; pure cadence + compliance helpers with TZ assertions across UTC+0, UTC+9, UTC-8; side-effect taxonomy drift-guard; EMA titration ladder helpers; pen-inventory state-machine + 30-day clock helpers; PR detection worker (MAX / MIN per metric + workout slots + warmup gate + null-slot dup regression + zero-duration guard); Withings activity TZ regression across Berlin / Los Angeles / Tokyo / Auckland; Withings sleep v2 segment ingest; log-redaction path-segment rule + `setHttp` rewrite; GLP-1 endpoint Zod + audit + rate-limit; onboarding step concurrent- advance regression; inventory PATCH state-machine back-dated first-use regression; bulk-update contract for the expire-stale cron; brand-name guard + sentinel-preservation + safety-contract parity for the YAML matrix; locale auto-discovery + fallback- chain runtime guard. - New integration suites: two-axis canonical-source resolution end-to-end; `requireAuth()` narrow-scope on unscoped route; batch-ingest race reconciliation under contention; workout-batch race + size-cap + ingest end-to-end; PR-detection end-to-end; cross-source priority for Withings Activity + Apple Health; Withings sleep-stage composite ingest; per-user timezone end-to- end (Pacific/Auckland). - Migrations: 9 new (0051–0059) + 1 hardening (0060 `onboarding_step_not_null` backfill + NOT NULL flip). All additive and forward-only; migration 0057 comment rewritten to match PG11+ fast-path ADD COLUMN DEFAULT semantics. ### Deferred to v1.4.26 See `.planning/v1426-backlog.md` for the full backlog with effort estimates and source citations. Headline items: - `User.onboardingGoals` column + server-side persistence for the goals chip-picker selection (today the picker holds the choice client-side only; the dashboard-widgets seed feature reads it in v1.4.26). - `advance()` hook extraction for the three onboarding step components — pattern surfaced in the simplifier review, deferred to avoid collision with v1.4.25 touch-target work. - `glp1-pk.ts` unused-export decision (internalise vs wire dashboard chip). - Seven orphan endpoint go / no-go decisions (`/api/admin/ai-settings`, `/api/admin/backup/test`, `/api/admin/status-overview`, `/api/monitoring/{glitchtip,umami}/test`). - ~148 dead i18n keys remaining after the W10 runtime-probe sweep (the v1.4.25 pass removed 380 of the 528 candidates; the remaining ~148 need second-pass call-site verification). - FR / ES / IT / PL prose hand-review by a native speaker for the Coach + insights surface (the structural refusal-probe matrix covers safety; the user-facing prose still benefits from a human pass). - Coach `lastYear` baseline + row-tap-to-prefill polish. - Sleep sub-page stacked-column visual polish (stage colours + legend density). - Mood verbal-labels persistence behind a per-user toggle. - Drug-level chart-side 90-day staleness clock wiring (the acknowledgment dialog already re-prompts on version bump and Coach refuses at GROUND RULE 15; the clock is defence-in-depth). - iOS-18 long-tail HK identifier mappings (sleep apnea, GAD-7 / PHQ-9, running form, paddle / row / ski distances, pregnancy / cycle, FHIR clinical). - VO2 max chart-row card on `/insights/` (dashboard tile shipped; chart card queued alongside the iOS body-composition page). - Lazy-loaded locale JSON bundles (all six locales import synchronously at present, ~675 KB to every client). ### Deferred to v1.5 - iOS Swift app — P1 through P5. Login + dashboard + widget (P1); Apple Health sync (P2); Coach extended for HRV / sleep / resting HR / steps (P3); per-metric APNs alerts (P4); workouts + GeoJSON routes (P5). All server contracts locked in v1.4.25. - Workout ingest API matching the v1.5 iOS contract. Schema shipped this release; endpoint signature finalised during the iOS sprint. - Two-Brain Coach refactor. Statistical findings produced by a deterministic pipeline; LLM owns the narrative layer only. Reduces hallucination surface; unblocks evidence-grounded citations. - HRV anomaly detection against a rolling baseline. - Mindfulness, dietary-water and symptoms-unification ingest types. - ECG waveform ingest + FHIR / HKClinicalRecord. - Pearson incomplete-beta replacement for the rigorous surfacing-gate (v1.4.23 carryover). ## [1.4.24] — 2026-05-12 Security + accessibility hardening release. Closes the highest-priority findings from a focused security audit of the v1.4.23 release: a Bearer token that omits a scope no longer authenticates routes which never declared one, the public Umami proxy is rate-limited, the proxy nonce is Edge-runtime portable, a session-expiry delete race can no longer 500 a parallel request, the import-validation envelope now matches the standard error contract, and the runtime Docker image installs Prisma 7.8 alongside pinned worker dependencies. Accessibility passes on the notifications surface, admin shell, chart overlays and notification settings deep-link anchors round out the user-facing work. ### Security - Bearer auth is fail-closed when a route declares no scope.** `requireAuth()` previously let any non-revoked, non-expired API token through whenever a handler omitted the `requiredPermission` argument. A narrowly-scoped token (e.g. `["medication:ingest"]`) could therefore reach every handler that called `requireAuth()` bare — including account-sensitive routes such as `/api/auth/profile`, `/api/auth/password`, `/api/withings/credentials`, `/api/settings/data`, `/api/export/full-backup` and `/api/tokens`. The Bearer path now throws `HttpError(403)` with audit reason `scope_required` unless the token carries the `["*"]` wildcard (the iOS app login token), preserving the existing session-cookie path and the explicit-scope path (`/api/ingest/medications`). The admin surface is unaffected — `requireAdmin()` was already cookie-only. - Public Umami analytics proxy now rate-limits by client IP. `POST /api/send` forwards browser analytics events to the configured Umami origin. The SSRF allow-list and 64 KB body cap were already in place, but the endpoint itself was unbounded. Added a 120-events-per- minute-per-IP gate using the existing `checkRateLimit` infrastructure; abuse returns the standard `429` envelope without invoking the upstream fetch. - Edge-runtime portable nonce generation in the proxy. The proxy previously assembled the CSP nonce via `Buffer.from(...)`, which is not guaranteed in the Edge runtime. Switched to `btoa(String.fromCharCode(...new Uint8Array(16)))`. Same 128 bits of entropy, Node-and-Edge compatible without a runtime declaration. - Session-expiry delete race no longer 500s a parallel request. `getSession()` reaped expired session rows with `prisma.session .delete()`; two requests arriving at the same expired session would race and the loser would surface a 500. Replaced with `deleteMany` + a catch-all guard, matching the discipline already used in `destroySession()`. ### Fixed - `POST /api/import` returns the standard `{ data: null, error }` envelope on validation failure. The handler previously returned the validation message inside `apiSuccess(...)` with status 422, which clients could not distinguish from a successful import. - Runtime Docker image pins Prisma 7.8 + worker dependencies. The multi-stage image was installing `prisma@7.4.0`, `@prisma/engines @7.4.0`, unpinned `pg-boss@12`, `@prisma/adapter-pg@7` and `pg@8` into the worker prefix while the app code shipped Prisma 7.8 from the lockfile. Pinned to `prisma@7.8`, `@prisma/engines@7.8`, `pg-boss@12.18`, `@prisma/adapter-pg@7.8` and `pg@8.20` so migration engine and generated client cannot drift across a deploy. - Notifications page surfaces a load error instead of a silent "no channels" empty state. `useQuery` failures now render an alert with `role="alert"` and `notifications.loadError` copy (EN/DE), so a transient 500 on `/api/notifications/preferences` stops looking like a misconfiguration. ### Accessibility - Notification-preference switches carry accessible names. Each switch in the per-event table now exposes an `aria-label` combining event-type label and channel label; the mobile per-event layout pairs each `` with its `` via `htmlFor`/`id` so screen readers announce the channel a toggle controls. - Mobile admin navigation surfaces an Overview link. The mobile admin section pill-rail prepended an Overview chip pointing at `/admin`, matching the desktop sidebar root and unblocking users who land on a sub-section without a path back. - Notification settings deep-link anchors land on the right card. Onboarding and admin-driven deep links into `#telegram`, `#ntfy` and `#web-push` now resolve to the corresponding cards in `NotificationsSection` instead of falling back to top-of-page. - Chart-overlay comparison-baseline toggles expose `aria-pressed`. The new per-chart comparison-baseline selector renders three pill buttons (none / last month / last year) with the correct pressed-state semantics for assistive tech. ### Changed - Per-chart `comparisonBaseline` overlay preference. The comparison overlay is now configurable per chart from the existing overlay-controls popover instead of being a single global toggle. `ChartOverlayPrefs` adds a `comparisonBaseline: "none" | "lastMonth" | "lastYear"` field (defaults to `"none"`); a per-chart selection overrides the dashboard-level default for that chart only. `ChartOverlayKey` is extended with `bmi`, `bodyFat`, `sleep` and `steps`, mirroring the chart surfaces already on the dashboard. - Trend-card layout tolerates long labels and long values. `TrendCard` switches to `min-w-0` + `flex-wrap` containers and `[overflow-wrap:anywhere]` text utilities so locale labels ("Letzter Wert" / "Resting Heart Rate") and large tabular numbers no longer push the tile off-axis on narrow viewports. - Lint-clean Coach drawer + message thread. The `useCallback` dependency on the drawer's reset closure now includes the stable `setInputValue` setter, and the message thread memoises the derived `messages` array. Both removed the only two warning-level hook lints carried over from v1.4.23. ### Tests - New unit test in `require-auth-bearer.test.ts` proves that a Bearer token with permissions `["medication:ingest"]` is rejected (403 with audit reason `scope_required`) when the route did not declare a scope; the existing success case was updated to use the wildcard scope so the new fail-closed branch does not collide with it. - New unit suite under `src/lib/auth/tests/session.test.ts` covers the expired-session delete-race path: a rejected `deleteMany` must still resolve `getSession()` to `null` and clear both the session and onboarding cookies. - New unit suite under `src/app/api/send/tests/route.test.ts` covers the rate-limited Umami proxy: a 429 short-circuits the upstream fetch and a 200 still proxies under quota. - Extended import-route test asserts the new `apiError` envelope: `data === null` and a populated `error` for invalid payloads. ## [1.4.23] — 2026-05-11 ### Added - Apple Health measurement schema + batch-ingest contract. Seven new `MeasurementType` values (`HEART_RATE_VARIABILITY`, `RESTING_HEART_RATE`, `ACTIVE_ENERGY_BURNED`, `FLIGHTS_CLIMBED`, `WALKING_RUNNING_DISTANCE`, `VO2_MAX`, `BODY_TEMPERATURE`), `APPLE_HEALTH` joins `MeasurementSource`, and `Measurement` picks up a nullable `sleepStage` column scoped via CHECK constraint to `SLEEP_DURATION` rows. Sleep is now persisted in minutes instead of hours. Migration `0036_apple_health_measurement_types` is strictly additive — no row mutations, no rename, the legacy `(user_id, type, measured_at, source)` unique index stays. A new composite unique index `(user_id, type, source, external_id)` becomes the Apple Health dedup key. New endpoint `POST /api/measurements/batch` accepts ≤500 entries per call, wraps `withIdempotency()`, returns per-entry `inserted | duplicate | skipped` status with a typed reason field, and is idempotency-replay safe. Sleep-stage aggregation in `/api/analytics` rolls multi-stage nights into one Berlin-day datapoint with a per-stage breakdown over the trailing 30 days. - APNs scaffolding + dispatcher cascade rewire. `@parse/node-apn` joins the senders cascade as channel-type 4 (APNs → Telegram → ntfy → Web Push, deterministic order). Provider is lazily-initialised per gateway (`sandbox` vs `production`), JWT auto-rotates inside the library. Permanent failures (`Unregistered`, `BadDeviceToken`, `DeviceTokenNotForTopic`) drop the dead Device row mirroring the web-push 410 cleanup. `Device` model gains nullable `apnsToken` + `apnsEnvironment` columns with a paired CHECK constraint (either both set or both null) and a partial unique index on `apns_token`. Migration `0037_apns_device_columns`. `POST /api/devices` accepts paired `apnsToken` + `apnsEnvironment` with a 422 when one comes without the other and a 409 + `apns_token_owned_by_other_user` audit reason when a token already belongs to a different account. Production without `APNS_KEY_ID` is a no-op rather than a boot failure; partially-set env triggers a single warning at first dispatch. - OpenAPI 3.1 generator + drift CI gate. `pnpm openapi:generate` reads Zod v4 `.meta()` annotations on the existing validation schemas and emits a byte-stable `docs/api/openapi.yaml` (`zod-openapi` - `yaml@^2` with `sortMapEntries: true`). The eight iOS-critical routes are registered now: `auth/login`, passkey verify, `auth/refresh`, `measurements` GET + POST + batch, `devices` POST, and the comprehensive insights bundle. A new `pnpm openapi:check` CI step diffs generated vs committed; warn-only for v1.4.23 so a registry oversight on a non-iOS route doesn't red-bar a PR, flips to hard-fail in v1.4.24. The legacy hand-maintained spec is preserved at `docs/api/openapi-v1422-legacy.yaml` so iOS DTO reference doesn't disappear during the incremental migration. - Device-management endpoints for native + web settings. `GET /api/auth/me/devices` lists active devices with label, last- seen timestamp, channels (`web_push` / `apns`), and an `isCurrent` marker keyed off the session's `deviceId` (not the forgeable `X-Device-Id` header). `DELETE /api/auth/me/devices/[id]` revokes a single device in one transaction: refresh tokens, access tokens, notification channels, push subscriptions, and the `Device` row. `DELETE /api/devices/[id]` is the native-friendly mirror the iOS APNs-rotation flow calls. Cross-user attempts return 404 with no enumeration leak. - Per-user Coach prefs surface (settings cog returns). New `User.coachPrefsJson` column (migration `0038_coach_prefs`) + `GET / PUT /api/auth/me/coach-prefs`. The settings cog on the Coach drawer opens a right-edge `` letting users dial in `tone`, `verbosity`, focus-metrics, and exclude-metrics. The system prompt prepends a per-user OVERRIDE block; the snapshot pipeline reads prefs BEFORE measurement queries so excluded metrics never enter the snapshot in the first place. - Per-message Coach thumbs feedback + admin aggregate view. Each Coach reply renders a 👍 / 👎 affordance. `RecommendationFeedback` gains a polymorphic `target_type` discriminator (migration `0040_recommendation_feedback_target_type`); legacy recommendation feedback rows backfill to `RECOMMENDATION`, new Coach rows persist with `COACH_MESSAGE` and the message's `coach_messages.id`. New endpoint `POST /api/insights/chat/messages/:id/feedback`. A new admin section `/admin/coach-feedback` renders helpful-rate buckets by (promptVersion, tone, verbosity) and gets a sidebar entry - EN/DE i18n bundle. ### Changed - Refresh-token reuse-detection scopes to the originating device. Pre-1.4.23 a replayed refresh token revoked every refresh token the user owned. v1.4.23 narrows the blast radius to the device that issued the token (legacy null-deviceId tokens still fall back to user-wide revoke as a safety hatch). A two-device household no longer gets logged out of both phones when one replays. - Pearson surfacing gate raised from n≥14 to n≥20. Conservative patch on the low-df p-value path — trades a small number of borderline correlation cards for stricter false-positive control. The rigorous incomplete-beta replacement is queued for v1.4.24. - Coach drawer prefill becomes a controlled prop. The `` mount-cycle hack is replaced with a `useResettableValue` hook + pure `nextResettableValue` helper. The drawer rerenders without remounting; the prefill state lives on the parent as a fully-controlled input. - `/api/analytics` BP-in-target aggregate becomes cursor-paged. The unbounded `findMany` lands as `fetchBpSeriesChunked` cursoring in 5 000-row batches with a new `analytics.bp_in_target.row_count` wide-event for slow-query attribution. Replay regression test seeds 6 000 rows across a chunk boundary. - Coolify webhook contract documented end-to-end. GHCR build → `force=true` Coolify deploy → `/api/version` poll → host-side retag fallback if the `:latest` digest hasn't moved. The CI step now emits a `::notice::` line with the deploy timestamp + image sha so future runs surface the contract without opening the verbose log. - Coach feedback foreign-key targets `coach_messages` directly. The plaintext `content` column on `recommendation_feedback` is retired — feedback rows now reference the canonical encrypted message row, and the aggregator queries through the FK rather than reading prose into memory. - PROMPT_VERSION 4.22.0 → 4.23.0 with a new GROUND RULE 12 (EN + DE): treat Apple Health categories (HRV, sleep, resting HR, steps, active energy, flights, distance, VO2 max, body temp) as silent when the snapshot doesn't carry them. No apologetic openers about missing data. `aiInsightResponseSchema.dailyBriefing .keyFindings[].sourceMetric` and `trendAnnotations` enums extend to admit the nine additive HealthKit categories. - `medication_schedules.days_of_week` column deployed. Migration `0039_medication_schedule_days_of_week` adds the nullable column (NULL = daily). Closes the v1.4.22 schema-drift watchlist item. ### Fixed - Admin coach-feedback sidebar entry. The W5 H7 admin section shipped without a sidebar nav entry, so the page was unreachable from the chrome. - APNs `NotificationChannel` auto-upsert on device registration. Registering a fresh device with an `apnsToken` now creates the matching `NotificationChannel` row in the same transaction instead of leaving the device row orphaned from the cascade. - Partial unique index enforces `apns_token` global uniqueness. App-layer guard catches the cross-user-hijack case; the DB-layer partial unique index (`CREATE UNIQUE INDEX … WHERE apns_token IS NOT NULL`) is the defence-in-depth backstop. - Apple Health source badge renders on mobile measurement card. Desktop list rendered the chip; the mobile card variant fell back to source-less prose. Both surfaces now share the same renderer. - Coach prefs sheet skeleton + save toast. Initial open painted a flash of unstyled defaults; save action ran silently. The sheet now shows a skeleton during the prefetch and confirms persistence via the standard toast. - Device revoke cascade wraps refresh + access + channels + Device row in one transaction. Pre-fix a mid-flight failure could leave the device row gone while the refresh tokens stayed live. - `isCurrent` device marker keys off the session's `deviceId`, not `X-Device-Id`. The header is forgeable; the cookie-bound session record is not. Regression test in the device-list route. - Sentinel parser annotates partial-malformed entries instead of collapsing the whole block. `SentinelParseResult.malformedEntries[]` now carries per-line typed reasons; the chat route splits `coach.keyvalues.parse_partial` from the full-block `coach.keyvalues.parse_failed` wide-event for partial recovery. ### Security - APNs send-side defence-in-depth. Hex format validated at the registration boundary; cross-user-hijack guard duplicated at the APNs-token layer (409 + dedicated audit reason). Send-side payload redacts the resolved user + device IDs before logging. - Coolify webhook URL scrubbed from the deploy runbook. Webhook - token live in GH secrets; the runbook references the secret names rather than the raw URL. - Coach prose encryption-at-rest restored. The plaintext `content` column on `recommendation_feedback` was dropped after the feedback rows migrated to a `coach_messages` FK. Cypher text is now the only on-disk form. ### Refactor - `revokeDeviceCascade(deviceId)` helper. The four-way revoke (refresh + access + channels + device row) lived inline at three call sites. Helper now owns the transaction wrapper; call sites drop to one line. - `useCoachPrefs()` hook. Coach drawer + settings sheet shared the same fetch + mutate + invalidate triplet; the hook collapses the three call sites into one with shared optimistic-update logic. - `buildCoachSnapshot` scope-record argument. The build pipeline passed seven booleans across three callees; collapses to a single `scope` record. Per-stream toggles read off `scope.has(metric)`. - OpenAPI registry uses static imports instead of dynamic require. The lazy require pattern broke type inference at the registration site; the static import keeps the generator output deterministic. ### Deferred to v1.4.24 - Pearson incomplete-beta p-value (W5 H6 carried as the conservative n≥20 patch). - Settings-cog vs per-message-controls UX consolidation (waits on first-week thumbs data). - OpenAPI drift gate flip from warn-only to hard-fail (requires registry catch-up first). - `coach-prefs.test.ts` integration `NextRequest` URL mock regression — predates v1.4.23, surfaced during the W6 reconcile. - Sec-MED-1 follow-ups: intra-batch dedup accounting (Sec-LOW-1), idempotency 422 retry hint (Sec-LOW-2), APNs key-file path redaction (Sec-LOW-3), refresh-failure audit userId (Sec-LOW-4). ### Deferred to v1.5 - iOS native client (P1: login + dashboard + widget) — server contracts all locked in v1.4.23. - Apple Health sync (P2) — schema + batch endpoint shipped; iOS `HealthKitService` + `SyncCoordinator` wire still pending. - Coach extended for HRV / Sleep / Resting HR / Steps (P3) — schema slot + GROUND RULE 12 landed; prompt rules + i18n bundles pending. - Per-metric APNs alerts (P4) — sender + dispatcher shipped; per- event opt-out + background pushes pending. ## [1.4.22] — 2026-05-10 ### Added - Per-target sparkline + Δ-vs-last-month caption on the Targets / Zielwerte page. Each `` grew a 30-day inline SVG sparkline beneath the range bar plus a localised "Δ −2.3 kg vs. last month" caption. The API ships `points30d` and `deltaVsLastMonth` per target; both null when either window has fewer than 3 readings so cold-start accounts don't paint a misleading flat trace. BMI piggybacks on the weight series so its sparkline shares the range bar's y-axis. - Sticky section navigation above the Insights hero. A pinned strip (Allgemein / Blutdruck / Gewicht / Puls / Stimmung in DE; General / Blood Pressure / Weight / Pulse / Mood in EN) lifts the section tabs above the hero so they stay visible during scroll. Active section tracks the highest-intersection observed entry; `aria-current`, focus-visible ring, and `motion-reduce` gating ship from day one. - Comparison-overlay as a single global preference under Settings → Dashboard. The on-surface `` retired from `/insights`; the canonical picker has lived in Settings → Dashboard since v1.4.16 phase B8 and every chart already consumed it. Two surfaces for the same concept violated the no-split-Settings rule. - Collapsible evidence disclosure under each Coach assistant message. Numbers move out of the prose into a `---KEYVALUES---` … `---END---` sentinel block that the route parses out server-side and renders as a "Worauf bezieht sich das?" / "What I'm looking at" `` disclosure under each assistant turn. Closed by default, hidden when no key-values came back. Hard caps on the sentinel (1 KB payload, 8 lines max, per-line Zod) so a prompt-injection attempt can't grow the persisted envelope. - User avatar parity with the Coach avatar. The Coach drawer's user-side bubble used a smaller initials avatar than the Coach's gradient one. The user avatar now reuses the existing `gravatarUrl` field from `/api/auth/me` at the same dimensions as the Coach avatar; initials fall back when no Gravatar is configured. ### Changed - Coach prompt rewrite — warm, motivational-interviewing tone with prose-first responses + evidence collapsible. PROMPT_VERSION ratchets 4.20.2 → 4.22.0 (first minor-digit bump in v1.4.x). The Coach used to open every reply with a number — clinical, database-cursor energy. The new persona is "warm, neugierig, zurückhaltend": a partner sitting alongside the user, not pushing data. Numbers move into the collapsible evidence block; the prose reads like a real conversation. Persona + sentinel land together because either alone is incomplete. - BP-in-target headline re-anchored to the last-30-day window. Fourth attempt at this metric. v1.4.19 routed the headline to `allTime` to fix the algorithmic 50/50/50 pin; v1.4.22 re-anchors to `windows.last30Days?.pct` and surfaces all-time as a sub-row, because v1.4.19's fix was emotionally wrong — the headline became the slowest-moving aggregate possible, punishing a user who put in real recent work. The tile also gets a synthesised trend arrow (slope from 7d/30d delta), a 7-day-trend chip, and a comparison-overlay caption. - "Muster" renamed to "Zusammenhänge" (DE) / "Patterns" renamed to "Relationships" (EN). The picked-bucket-of-correlations row read like an autopsy. The new label sits closer to what the row actually shows. Picked "Zusammenhänge" over "Trends" because the row directly above already uses Trends. - Onboarding redirect for users with `null onboardingCompletedAt` moves to server-side enforcement in `proxy.ts`. The previous post-hydration redirect inside `` `useEffect` produced a brief dashboard flash on incomplete onboarding. The proxy runs in the Edge runtime so the auth routes mirror `onboardingCompletedAt` into a non-httpOnly `hl_onboarding` cookie; the proxy short-circuits before hydration. Tampering only skips a UX hint and never bypasses a server check. - `setOnboardingPendingCookie` folded into `createSession()`. Issuing a session without onboarding state used to require two call sites to stay in sync; the helper now takes `onboardingPending` as a required parameter so the contract is type-impossible to break. ### Fixed - Raw `metric:` token leaks in recommendation prose. `` text is now wrapped in `stripChartTokens()`. The leak traced to a single missing call on the recommendation path; chart tokens never belonged in user copy. - DE locale `componentMood`, `componentBp`, `componentCompliance` rendered English nouns in the German bundle. Four Health-Score component labels normalised to `Stimmung`, `Blutdruck`, `Einnahmetreue`, `Gewicht`. The i18n-integrity test pins the contract. - Admin / API tokens horizontal scrollbar at desktop + iPad-mini viewports (5th attempt). A live Playwright probe confirmed `whitespace-nowrap` on the date ``s was the residual culprit. The two classes are gone; date + time wraps to two lines on narrow viewports. The earlier four fixes had targeted the wrong layout layer. - Sentinel-only / malformed `---KEYVALUES---` block. When the model emits a sentinel-only or malformed envelope, the fallback now produces a polite invitation ("I'd like to look at this with you — could you share which window you want me to focus on?") instead of surfacing the raw marker. A new integration test covers the empty-prose-after-strip branch. - BD-Zielbereich tile delta math period-aligned with the comparison window. The tile's compareDelta was subtracting `bpInTargetPctAllTime` while the caption said "vs last month", which produced numbers the caption couldn't justify. It now subtracts `bpInTargetPctPriorMonth` / `bpInTargetPctPriorYear` to match. Two new bp-in-target unit tests + two insights-polish guards. - Coach drawer settings cog removed. The cog was a dead button in v1.4.21; per-user prompt-tuning is deferred to v1.4.23. No dead buttons in this release. - Coach disclaimer pinned at the bottom of the message thread. Clinical-adjacent UI must not gate the disclaimer behind a chevron tray; the disclaimer now stays visible at the bottom of the message thread on every viewport, and the rail-footer duplicate kept for desktop redundancy. - `hl_onboarding` UX-hint cookie now `SameSite=Strict`. A cross-site request couldn't usefully exfiltrate the cookie (no auth value, only an onboarding state flag) but `Lax` was still over-permissive. Strict aligns with the cookie's same-site-only consumer. - `PUBLIC_PATHS` exact-match guard against future subroute prefix bypasses. `/onboarding` is now exact-match + explicit-subroute, not a `startsWith` check. Two new proxy guards pin the contract. - `targets/route.ts` daily buckets keyed in Europe/Berlin. The targets sparkline was the last analytics surface still bucketing in UTC, which produced a one-day-off trace for users in CEST. `berlinDayKey()` lifted to a shared `src/lib/analytics/berlin-day.ts` helper; four new DST + UTC- midnight edge-case unit tests. - Streaming bubble vs persisted-twin race window. The 150ms grace window suppresses the persisted twin while the in-flight streaming bubble is still rendering, so the thread never paints two copies of the same reply for a frame. - Sticky section navigation a11y polish. `aria-current` on the active section; focus-visible ring on keyboard navigation; `motion-reduce` honoured for smooth-scroll; the glow-bleed fixed via `bg-background/95 backdrop-blur`; the mobile cliff tightened from `scroll-mt-28` to `scroll-mt-16` so the strip no longer eats the heading at 280px viewports. - BP tile mobile density at =sm`. ### Refactor - `createSseStream` shared helper extracted from the chat route. Preparation for v1.5 iOS streaming endpoints, which will reuse the SSE primitives. Three unit tests pin sync, async, and throw paths. Source: `src/lib/sse/create-stream.ts`. - `` extracted from desktop + mobile api-token surfaces. The badge logic was duplicated verbatim in two layouts; one component, two consumers. - Five simplify apply-yes items in one commit.** `canSubmit` collapse, weekly-report `