Marc-André Bombeck 5f2a76ddbc fix(coach): close the budget-gate TOCTOU and count burned tokens ...

The daily token cap was read before the provider call and recorded only
after a successful reply, so concurrent requests could all read
`spent < cap` and all hit the provider, and an empty/sentinel reply
recorded zero spend despite burning upstream tokens.

Reserve the budget atomically before the call: a single upsert-increment
returns the new total, so concurrent requests serialise on the row and
cannot both pass the cap; over-cap refunds the reservation and surfaces
`coach.budget.exceeded` as an SSE error frame. Reconcile the reservation
to the actual token count immediately after the provider returns —
before any empty/sentinel short-circuit — so burned tokens are always
recorded. An integration test proves two concurrent requests cannot both
exceed the cap and that an empty reply still records its cost.

2026-06-19 21:16:43 +02:00

..

achievements-expansion.test.ts

feat(achievements): worker re-evaluates new + hidden achievements on data change

2026-05-10 10:34:32 +02:00

admin-backups-audit.test.ts

fix(notifications): auto-disable channels on persistent hard rejects (410, etc.)

2026-05-09 21:00:23 +02:00

admin-backups-download.test.ts

fix(admin): /admin/users mobile layout — card-list at < md, no truncation

2026-05-09 20:46:20 +02:00

admin-backups-restore.test.ts

feat(admin): restore from backup with full data replacement + triple-confirm

2026-05-09 20:58:33 +02:00

admin-backups-upload.test.ts

fix(mobile): bump chart controls + medication primary buttons + mood list icons to 44px

2026-05-09 20:50:08 +02:00

admin-data-wipe.test.ts

fix(tests): share next/headers cookieJar across integration suite

2026-05-09 18:08:11 +02:00

admin-drain-cumulative-endpoint.test.ts

chore(release): v1.4.30

2026-05-16 12:37:55 +02:00

admin-host-metrics.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

admin-reset-password.test.ts

v1.4.34.5 — audit follow-on: critical-path tests + iOS textarea zoom

2026-05-17 00:53:03 +02:00

analytics-bp-aggregate-paged.test.ts

chore(release): v1.5.0 — native iOS client public-beta + per-day stats overwrite + compliance fix

2026-05-24 22:22:30 +02:00

analytics-health-score.test.ts

test(blood-pressure): pin the in-target headline and BP pillar to the 90-day window

2026-06-14 14:26:58 +02:00

analytics-sleep-stages.test.ts

test(medications): make compliance and analytics tests timezone-stable

2026-06-08 20:09:17 +02:00

analytics-summaries-slice.test.ts

v1.4.33 — polish and reliability

2026-05-16 19:46:43 +02:00

analytics-weekday-tz.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

apns-dispatch.test.ts

chore(release): v1.5.0 — native iOS client public-beta + per-day stats overwrite + compliance fix

2026-05-24 22:22:30 +02:00

auth-flow.test.ts

style: prettier on W5 reconcile touchpoints

2026-05-10 22:30:53 +02:00

auth-password-change.test.ts

v1.4.34.5 — audit follow-on: critical-path tests + iOS textarea zoom

2026-05-17 00:53:03 +02:00

bp-in-target.test.ts

test(blood-pressure): pin the in-target headline and BP pillar to the 90-day window

2026-06-14 14:26:58 +02:00

bulk-delete-source-filter.test.ts

feat(api): add bulk soft-delete for measurements and mood

2026-06-07 19:24:16 +02:00

cache-invalidation-coverage.test.ts

v1.4.34.5 — audit follow-on: critical-path tests + iOS textarea zoom

2026-05-17 00:53:03 +02:00

cascade-delete.test.ts

feat(db): RecommendationFeedback model with GDPR cascade + provider attribution

2026-05-10 01:25:57 +02:00

chart-overlay-prefs.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

coach-budget-reservation.test.ts

fix(coach): close the budget-gate TOCTOU and count burned tokens

2026-06-19 21:16:43 +02:00

coach-chat.test.ts

fix(coach): close the budget-gate TOCTOU and count burned tokens

2026-06-19 21:16:43 +02:00

coach-conversations.test.ts

feat(coach): GET list, GET single, DELETE conversation endpoints

2026-05-10 16:11:12 +02:00

coach-feedback.test.ts

fix(coach): feedback references coach_messages, drops plaintext column

2026-05-11 02:38:17 +02:00

coach-prefs.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

consolidate-daily-mean.test.ts

feat(measurements): consolidate gait/mobility HealthKit metrics nightly

2026-06-01 19:54:26 +02:00

consolidate-legacy-steps.test.ts

chore(release): v1.5.6

2026-05-29 22:07:10 +02:00

cycle-import-export.test.ts

test(cycle): cover cervix signs + secondary-symptom across the wire

2026-06-14 15:36:14 +02:00

cycle-routes.test.ts

test(cycle): cover cervix signs + secondary-symptom across the wire

2026-06-14 15:36:14 +02:00

dashboard-widgets-save.test.ts

feat(ux,settings): undo where it was missing and settings that behave one way

2026-06-11 02:19:28 +02:00

dense-intraday-retention.test.ts

fix(measurements): close residual P2002 in the dense intra-day fold

2026-06-03 09:17:13 +02:00

device-register.test.ts

chore(format): prettier sweep across develop

2026-05-11 08:27:51 +02:00

doctor-report-sections.test.ts

feat(settings): make medications a toggleable module

2026-06-16 21:31:54 +02:00

drain-per-sample-cumulative.test.ts

chore(release): v1.4.30

2026-05-16 12:37:55 +02:00

export-per-type.test.ts

test(export): integration test points at the new plain-segment endpoints

2026-05-10 00:11:36 +02:00

fitbit-activity-sleep-workout-sync.test.ts

fix(fitbit): single sync watermark, reject empty refresh token, correct interval time-anchor, mark provider experimental

2026-06-05 01:05:47 +02:00

fitbit-metrics-sync.test.ts

feat(fitbit): sync Google Health metrics with backfill and poll jobs

2026-06-04 22:17:55 +02:00

global-setup.ts

release: v1.4.2 — resurrect v1.4.1 work + bug-fix triple (#152)

2026-05-08 17:46:31 +02:00

idempotency-replay.test.ts

fix(tests): share next/headers cookieJar across integration suite

2026-05-09 18:08:11 +02:00

insights-comprehensive-cache.test.ts

v1.4.34.1 — insights cold-mount perf hotfix + scatter-card sizing

2026-05-16 22:26:59 +02:00

insights-feedback.test.ts

feat(api): /api/insights/feedback persists thumbs with provider attribution

2026-05-10 01:30:06 +02:00

insights-provider-chain-put.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

insights-provider-chain.test.ts

style(prettier): sweep formatting across the tree

2026-05-10 11:05:40 +02:00

insights-status-real-text.test.ts

test(insights): cover graded compression and stub-skip

2026-05-31 21:51:18 +02:00

intake-scheduled-for-targeting.test.ts

feat(ux,settings): undo where it was missing and settings that behave one way

2026-06-11 02:19:28 +02:00

intake-slot-dedup.test.ts

feat(ux,settings): undo where it was missing and settings that behave one way

2026-06-11 02:19:28 +02:00

integration-status.test.ts

chore(release): v1.4.47 — audit-backlog closure + drag-to-reorder + Coach disable + OAuth nonce ledger

2026-05-22 09:18:52 +02:00

measurement-rollups.test.ts

test(rollups): compare rounded rollup means to live SQL within hundredths, not bit-for-bit

2026-06-15 02:11:04 +02:00

measurement-soft-delete.test.ts

feat(rollups): make measurement rollups source-aware (migration 0115)

2026-06-04 09:29:49 +02:00

measurements-aggregate-daily.test.ts

chore(release): v1.4.29

2026-05-16 10:59:42 +02:00

measurements-batch-delete.test.ts

chore(release): v1.7.0

2026-05-31 14:36:17 +02:00

measurements-batch.test.ts

fix(measurements): merge MANUAL and Apple Health rows for the same reading

2026-06-04 16:44:39 +02:00

measurements-sleep-list.test.ts

test(sleep): integration coverage for the list collapse and analytics reconcile

2026-06-04 18:56:20 +02:00

medication-administrations.test.ts

feat(fhir): add a MedicationAdministration per acted intake

2026-06-02 16:45:23 +02:00

medication-cadence-worker.test.ts

feat(ux,settings): undo where it was missing and settings that behave one way

2026-06-11 02:19:28 +02:00

medication-compliance-rollup-slot.test.ts

fix(medications): converge intake writes onto existing slot rows across sources

2026-06-10 11:18:00 +02:00

medication-weekly-compliance.test.ts

test(medications): make compliance and analytics tests timezone-stable

2026-06-08 20:09:17 +02:00

medications-intake-bulk.test.ts

test(medications): anchor bulk-intake fixtures to relative past instants

2026-06-12 12:05:24 +02:00

mock-next-headers.ts

fix(tests): share next/headers cookieJar across integration suite

2026-05-09 18:08:11 +02:00

mood-entries-bulk.test.ts

test(mood): align integration fixtures with the curated default catalog

2026-06-14 11:31:52 +02:00

mood-entries-external-id.test.ts

fix(mood): honour externalId for idempotent re-import on the native entry routes

2026-06-05 03:45:04 +02:00

mood-entries-note-column.test.ts

chore(release): v1.4.30

2026-05-16 12:37:55 +02:00

mood-insights-crosstab.test.ts

fix(insights): resolve cross-source double-count and read truncation in mood crosstab

2026-06-05 03:25:22 +02:00

mood-tag-groups.test.ts

test(mood): align integration fixtures with the curated default catalog

2026-06-14 11:31:52 +02:00

partial-unique-live-rows.test.ts

fix(db): live-row partial unique for intake re-take, mood external-id dedup key, perf indexes

2026-06-05 03:01:36 +02:00

passkey-register.test.ts

v1.4.34.5 — audit follow-on: critical-path tests + iOS textarea zoom

2026-05-17 00:53:03 +02:00

pr-detection-end-to-end.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

rate-limit.test.ts

release: v1.4.2 — resurrect v1.4.1 work + bug-fix triple (#152)

2026-05-08 17:46:31 +02:00

server-cache-routes.test.ts

v1.4.34 — apple-health import + reliability + web-freeze

2026-05-16 21:25:26 +02:00

settings-account-delete.test.ts

chore(release): v1.4.45 — analytics 9 s perf fix + audit-marathon closure + v1.4.44 hotfix merged

2026-05-21 23:13:21 +02:00

setup.ts

feat(mood): tags get groups, icons and a home of their own

2026-06-12 22:03:01 +02:00

source-aware-rollups.integration.test.ts

feat(rollups): collapse overlapping sources across all read paths

2026-06-04 10:05:47 +02:00

source-priority-two-axis.test.ts

chore(release): v1.5.0 — native iOS client public-beta + per-day stats overwrite + compliance fix

2026-05-24 22:22:30 +02:00

sync-changes.test.ts

chore(release): v1.7.0

2026-05-31 14:36:17 +02:00

sync-state.test.ts

chore(release): v1.7.0

2026-05-31 14:36:17 +02:00

timezone-per-user.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

user-avatar.test.ts

feat(avatar): self-hosted avatar storage replacing the Gravatar leak

2026-05-28 22:39:20 +02:00

whoop-connect-ticket.test.ts

feat(whoop): native-scheme connect redirect and Bearer connect ticket

2026-06-05 08:10:13 +02:00

withings-activity-sync.test.ts

v1.4.37 — final web polish before iOS focus

2026-05-17 15:36:38 +02:00

withings-oauth-flow.test.ts

test(withings): scope the expired-nonce assertion to the token URL

2026-06-19 20:45:46 +02:00

withings-oauth.test.ts

chore(release): v1.5.0 — native iOS client public-beta + per-day stats overwrite + compliance fix

2026-05-24 22:22:30 +02:00

withings-sleep-stage-composite.test.ts

chore(release): v1.4.25

2026-05-14 23:49:32 +02:00

withings-sleep-sync.test.ts

v1.4.37 — final web polish before iOS focus

2026-05-17 15:36:38 +02:00

workout-batch-create.test.ts

feat(workouts): accept an optional HR series on the batch contract

2026-06-02 22:02:46 +02:00

workout-batch-race.test.ts

chore(release): v1.4.49 — audit-backlog closure + server reminder suppression + diagnostic endpoint + analytics cold-path fix

2026-05-23 12:51:41 +02:00