Reusable Inventory Domain Boundary
Accepted stock ownership, shortage policy, tracking, permissions, and expiry controls, with source delivery limits.
Date: 2026-10-11
Context
Hospital needs real stock operations, not case-only stock status. At decision time, the supported domain registry had no Inventory domain. The existing Hospital HTTP adapter rejects unsupported inventory methods. Historical stock migrations and mock screens did not establish a supported reusable ledger.
Current Status
The user later authorized source implementation. Inventory U1-U6 are committed locally.
The developer guide records tests, scoped reviews, and CI limits.
The supported registry now loads backend/domains/inventory.
Hospital integration, deployment, facility policy approval, and manual pilot acceptance remain open.
The decisions below preserve the original approval boundaries; they are not release evidence.
Accepted Decisions
Use one reusable Inventory domain, separate from Hospital orchestration. Inventory owns stock. Clinical owns protected case-consumption links. The user accepted this boundary on 2026-10-11.
Block negative stock, rather than allowing a privileged shortage override. The user selected this rule on 2026-10-11. Staff can still document actual clinical care and resolve stock discrepancies through audited reconciliation. This does not authorize automatic adjustment or receipt to conceal a shortage.
Track stock by store, OT, or ward location. Issue moves stock into tracked custody, not consumption or a patient charge. Record actual consumption separately. Return only unused quantities; quarantine damaged or expired returns. Support item-specific lot, expiry, and serial tracking. Keep reusable-instrument servicing outside this delivery. The user accepted this stock-tracking model on 2026-10-11. This stock-tracking approval does not approve a clinical shelf-life policy or authorize implementation.
Use four permissions: view_inventory, manage_inventory, manage_inventory_consumption, and manage_inventory_adjustments.
Separate stock setup/receipt/transfer from reserve/issue/consume/release/unused return and from adjustment/write-off.
Reversals require the original operation permission and the adjustment permission. Every write also requires view access.
Owners/admins receive default grants. Staff and practitioners need explicit grants through Shell RBAC.
All actions still enforce tenant/facility access and stock rules. Do not add a Hospital RBAC editor.
The user accepted this permission model on 2026-10-11. U2 now implements and tests source policies and Shell grant separation.
Require a validated lot expiry cutoff for expiry-tracked stock. The facility pharmacy or inventory lead must approve date-only and month-only label interpretation before pilot use. Do not use a blanket end-of-day assumption. Block allocation and consumption for expired, quarantined, or unresolved-expiry stock. Commands check expiry even if the background job is late. Reservation expiry is explicit and separate from lot expiry. The user accepted these controls on 2026-10-11. Facility label interpretation and pilot acceptance remain pending.
Add versioned validate_lot_expiry to validate unresolved expiry or correct a prior validation through the existing operations API.
Require verified interpretation approval evidence, expected versions, operation-key retries, immutable history, and audit evidence. Change no stock quantities.
Initial validation requires View and stock management. Correction also requires adjustment permission.
The server derives the cutoff; browser approval flags and cutoffs are not authority.
The user accepted this action on 2026-10-11. It does not approve a shelf-life policy or authorize implementation.
Deliver internal stock setup, opening balances, receipts, same-facility transfers, reservations, issue, consumption, unused returns, and audited corrections. Include reusable APIs, RLS/RBAC enforcement, audit history, and reconciliation. Exclude procurement, supplier payables, retail sales, valuation, cross-facility transfers, and instrument servicing. Inventory is a separate backend domain, not a separate MFA app in this delivery. Hospital U10 connects its inventory screens after ledger delivery. Pharmacy readiness and billing remain separate work. The user accepted this initial delivery scope on 2026-10-11. It does not authorize implementation or prove delivery.
Delivery Contract
Use the Inventory ledger API contract for detailed stock semantics and security. Use the reusable ledger implementation plan for source-owned implementation and tests. These documents record the source contract and implementation evidence. They do not prove deployment or consumer acceptance.
The ledger is a prerequisite of U10 in the Hospital gap-closure plan. Hospital must not create a second balance store or claim confirmed consumption without a ledger effect. Patient and case links remain Clinical-owned and require separate clinical authorization.
Consequences
Other apps can use the stock owner without depending on Hospital case models or presets. Receipt, transfer, issue, consume, return, and correction use one transaction contract. Source implementation, targeted RLS/RBAC tests, and reconciliation are complete locally. Full CI, deployment, and manual acceptance remain open. Hospital U10 is not implemented. Neither a plan nor this ADR proves a released Hospital inventory workflow.