Marc-André Bombeck
75c43c74bc
Four honesty fixes with no behaviour change to the math. The validation header claimed more than it proves. The ridge FIT is out-of-sample and no training fold sees ahead — that holds. But feature SELECTION and per-user standardisation both run over the whole window before the split, a small documented optimism (measured at about one part in sixty on the error). The header now says exactly what is and is not leak-free, and says to nest the screening if the feature set ever grows or the optimism is ever measured larger. The per-weekday observation floor had no consumer: no weekday board is built on this fit, the forecast only publishes seasonalUnlocked and leaves the weekday view to the insights page, which has its own floors. Removed rather than left as a number nothing reads, with a note to bring it back alongside such a board. Two comments were wrong and are now true: the route's parameter is declared for the exported type, not to steer a method check the wrapper resolves from the Next.js request with a GET fallback; and the label surface imports the key parser from feature-keys.ts, not features.ts. And the write-surface guard now states its own structural blind spot, the way the session-surface guard does: the wipe path deletes this table through a dynamically-resolved delegate the literal matcher cannot see, which is why that deletion is correctly not counted as a writer. The Coach staleness fixture moves above the forecast floor, because the read path now refuses below it: a one-entry account correctly gets an absence rather than the present forecast that case exercises.
src/app/
The Next.js App Router tree: the page surfaces a logged-in user sees and the REST API under api/. Server components are the default; "use client" is added only where a hook, state, or browser API needs it. Routing is file-based — a page.tsx is a page, a route.ts is an API endpoint.
API routes (api/)
Every endpoint wraps its handler in apiHandler (@/lib/api-handler), parses any body with Zod safeParse, narrows userId from the session or Bearer token (never from the body), and returns the { data, error, meta? } envelope. requireAdmin() is cookie-only, so api/admin/ is unreachable by Bearer token. Notable groups:
auth/— login, register, password, passkey (WebAuthn), refresh, Codex device-OAuth.measurements/,mood-entries/,medications/,sleep/— the core health-data CRUD + batch/bulk ingest.ingest/— external Bearer-token ingest surfaces.insights/,analytics/,dashboard/— AI insights, the Coach SSE stream, trend summaries, the first-paint dashboard snapshot.withings/,whoop/,fitbit/,integrations/,sync/— OAuth connect/sync/webhook surfaces and the offline delta feed.fhir/,share-links/,doctor-report/,export/,import/— clinician-facing FHIR R4 read API, shareable records, report + data export.notifications/,devices/,send/,telegram/— channel registration, device tokens, dispatch, webhook intake.admin/— operator panel APIs (cookie-only).health/,version/,meta/,internal/— health check, build-version probe, runtime metadata, worker-internal routes.
Page surfaces
measurements/, medications/, mood/, insights/, achievements/, notifications/, settings/, onboarding/, admin/, plus the public about/, privacy/, bugreport/, the share-record route c/, and the root dashboard (page.tsx). Shared shell + chrome lives in layout.tsx; error.tsx / global-error.tsx / not-found.tsx / loading.tsx cover the framework boundaries. layout.tsx holds the one nonce-bound dangerouslySetInnerHTML (theme bootstrap).
Conventions
See ../../CLAUDE.md. The request-flow walk in .planning/codebase/arch.md annotates each layer with file:line citations. Related dirs: handlers compose ../lib/; pages render ../components/.