Fix review findings in the Grove FHIR migration

[lukaskollmer]

♻️ Current situation & Problem

A review of the Grove FHIR migration stack (#202 → ...) found some problems, which this PR fixes on the app side.

• A SensorKit sensor could stop uploading permanently. Each strategy published its records in one for … try loop, so a single record that Grove refuses aborted the batch. The batch was then never acknowledged and was delivered again on every run. Separately, when SensorKit did not replay a pending batch exactly (pendingBatchMismatch), neither the fetcher nor logout cleanup could recover, because resetAllQueryAnchors swallowed the error with try?.
• The FHIR exchange ledger cost O(n²) per HealthKit batch. The ledger is one keychain-encrypted LocalStorage value (Grove's default setting). Every sample decrypted, rewrote and re-encrypted the whole ledger, so large deliveries and month-sized historical-export batches could not finish in a background window.
• State of Mind samples, and any HeartRisk response with a skipped optional question, lost their HealthKit data. This is fixed in Grove, and this PR takes it in by bumping the pin.

⚙️ Release Notes

• --studyBundle defaults to .firebase(.stanford) again, instead of .bundledWithApp(.stanford). The loader still substitutes the active study variant and still falls back to the bundled definition when the hosted one fails to load.
• SensorKit: rework processing so a single failing record doesn't cancel the whole batch (we used to have a for ... try loop, which caused the batch to never get acknowledged/finalized, causing it to get re-run on every launch)
• SensorKit: a record whose Grove preparation fails is refused and logged. Logs contain only the sensor, ordinal and diagnostic code, no PHI. Its reservation is released and the rest of the batch still gets acknowledged. Upload, account-fence and cancellation errors still abort without acknowledging.
• SensorKit: on pendingBatchMismatch or retryContentChanged, the fetcher calls SensorKit.discardPendingBatches(for:) and drops that sensor's retry bookkeeping, and the next run fetches the range again under fresh identities. lastSensorKitFetch is only updated when the fetch succeeded. resetAllQueryAnchors now propagates failures, and clearPendingAccountData counts the anchor reset toward success.
• FHIR exchange ledger: HealthKit deliveries, historical export and retractions reserve a whole batch in one transaction. An exact retry only reads the ledger. Single-key reservations such as SensorKit's use one transaction without an extra read.
• Grove is pinned to 611d0cd8 and StudyDefinitions to d1cbe285, in the project, MyHeartCountsShared, Package.resolved and the submodule.

Behavior changes to be aware of:

• Refused SensorKit records are dropped with a log line instead of wedging the sensor.
• After an abandoned batch, up to one batch per incident can be uploaded twice under new IDs.
• A sensor that keeps failing leaves lastSensorKitFetch stale, so foreground launches retry it.

Out of scope, per the review triage:

• Dashboard read-compat for pre-migration LDL, score and Timed Walk documents: dropped. The dashboard has only shipped to TestFlight, so this is a one-time loss.
• Backend items (MyHeartCounts-Firebase), still open:
  • the LDL writer still uses loinc.org as the quantity system;
  • nothing consumes healthDeletions/;
  • the status patch has no effect on Bundle documents.

📚 Documentation

Doc comments cover the study-bundle default, the refusal rule, and the batch reservation's durability and retry guarantees.

✅ Testing

• Compiled locally: the app and the MyHeartCounts Unit Tests plan (build-for-testing, generic iOS Simulator, Xcode 27), with packages resolved against the new pins.
• Not run locally: the app unit tests need a simulator, so CI runs them.
• SwiftLint strict passes on every changed file.

New tests:

• StudyBundleLaunchOptionsTests.defaultsToFirebase
• DeviceUsageFHIRExchangeTests.refusedRecordsDoNotFailTheirBatch and accountFenceAbortsBatchInsteadOfRefusingRecord
• FHIRExchangeStateTests: three batch-reservation tests (input order, existing keys consume no sequence, stale account generation), healthKitBatchReservesEverySampleUpFront, and abandoningSensorBatchesDropsOnlyThatSourcesRetryState
• QuestionnaireGroveProjectionTests.bloodPressureRefusesAnIncompleteComponentSet now expects Grove's componentIncomplete.

Not covered by tests:

• Fetcher-level recovery (discard on mismatch, the per-sensor success flag, the cleanup verdict). It needs a live SensorKit reader and a device.
• The refusal loops for ECG, wrist temperature, CSV and PPG. Only the device-usage strategy has a test.

Code of Conduct & Contributing Guidelines

By creating and submitting this pull request, you agree to follow our Code of Conduct and Contributing Guidelines:

• I agree to follow the Code of Conduct and Contributing Guidelines.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 5ed40784-4aa3-4e12-b906-1f5ef74aaaf5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}