Hospital MAR Local U2 Execution Record

Scope And StateCopy Anchor Link

This record covers local U2 in the canonical MAR plan. Delivery stays on feat/hospital-nursing-discharge-u6-u8, draft PR 2757. Use the source guide for the current boundary.

Clinical owns versions, occurrences, commands, and canonical administrations. Hospital owns the case link. No Inventory write, permission expansion, clinical policy constant, automatic enrollment, or clinical activation is part of U2.

Source And Model EvidenceCopy Anchor Link

Starting HEAD and existing PR head: 041a7729d4c1ca44995c79ce2262b24d2fc2b109. The intake remote base ref was ffbf70c6fab85225f3abf0f01de5c6f7fbe98012. Tracked source was clean. Pre-existing .context/ and .compound-engineering/ artifacts were excluded and their contents were not read. The user confirmed the other session in this worktree was idle. One worker owned implementation.

Codex CLI 0.163.0 accepted strict project configuration. The current catalogue listed all three requested models. A read-only parent dispatched and collected the three smoke tasks sequentially. Host checks found identical HEAD, full Git status, tracked diff, and seven setup-file hashes before and after the smoke. No explicit close tool was exposed; cleanup remained harness-owned.

Actual serving-model and reasoning-effort receipts were unavailable for the parent and workers. Profile names, requests, and worker self-reports do not prove a serving snapshot or cross-model independence. No substitution is claimed. Worker usage and attributable cost are unavailable. The smoke-parent receipt reported 660293 input tokens, including 618240 cached tokens, and 3686 output tokens. This is not total child billing or evidence of a cost saving.

VerificationCopy Anchor Link

Only owned disposable databases were used: kulcare_hospital_mar_u2_20261019_migration_test and kulcare_hospital_mar_u2_20261019_sql_test. Both names were absent at intake. The final full CI also owns Rails worker clones with _0 and _1 suffixes. Both clone names were absent before use. No shared database was reset or seeded. RLS grants ran in sequence after loads.

The migration path loaded the exact starting SQL, then applied the three forward migrations. The SQL path independently loaded the updated checked-in schema. Full schema-only dumps matched before test preflight. Comparison excluded owner, ACL, and dump nonce text and normalized only two equivalent PostgreSQL string-array CHECK coercions. It did not exclude missing constraints, indexes, functions, triggers, or policies. Actual non-bypass-role tests prove the test grants. Production role grants still require deployment verification.

Rails test maintenance compares a schema-file checksum. An early run reloaded old SQL and stopped before tests. After actual schema parity passed, the host recorded the verified schema checksum in the migration database metadata. Test maintenance stayed enabled; the focused migration run retained the schema built by migrations.

Focused command, from backend/, with RAILS_ENV=test, PARALLEL_WORKERS=1, Ruby 3.4.9, and DATABASE_URL set to one owned database:

mise exec ruby@3.4.9 -- bin/rails test \
  domains/clinical/test/models/medication_mar_constraints_test.rb \
  domains/clinical/test/models/hospital/mar_rls_test.rb

Full backend command, with DATABASE_URL set to the owned SQL-path database:

CI_LOG_TEE=1 RAILS_ENV=test PARALLEL_WORKERS=2 mise exec ruby@3.4.9 -- bin/ci

The final full run passed the unchanged zero-failure domains ratchet, pricing, style, and configured guards. The ten domain skips remain explicit. No runtime frontend change was made; frontend app CI and a real-HTTP nursing journey were not run or claimed. docs-site passed pnpm build; 82 local document links resolve.

T05-T09 cover scoped links, both nullable-encounter directions, immutable history, managed reparent/delete rejection, unique current outcomes, ordered corrections, Staff/current-StaffRole provenance without a Practitioner, legacy nullable rows, and raw reads/inserts/updates under the enforced role for two tenants. Positive correction, resume, and hold-resolution paths force deferred checks. Independent-connection command races remain later-unit proof.

Review And RepairsCopy Anchor Link

The first stable native review used snapshot cd53419f68d8b3f58d4b7df56d276ae0d11431d051534688e06ff2321663a6fd. It found five omitted SQL foreign keys, a hold-replacement performer gap, and deferred validation that could conceal a contradictory original receipt after correction. All three were fixed. The reviewer checked the fixes at snapshot a3259c0337fe94b6b47df0d71b1b91026a60276ea9a96bdba9f0a13d2a0bded8 and returned no additional findings in that targeted pass.

An earlier tested 14-file source snapshot was 0e860597d696c8b9adda5ad610aec8c1eab92f554e32bb12f25c4fc4f473864e. Only a test-context call changed after the native fix review: the absent-tenant probe now uses supported without_tenant, rather than with(nil). The host checked that delta and reran both focused paths. No source guard changed.

Two substantive repair rounds corrected fixture tenant-scope overwrite, timestamp precision, callback order, the three review findings, and the Minitest nil-message assertion error. Separate harness recovery addressed stalled worker DB approval, SQL checksum reload, and the final missing-context test call. The host inspected state before resuming the same worker. No second writer ran. No pre-implementation red result is inferred from a sandbox connection failure.

The first full serial CI run failed 43 role-provisioning preconditions after db:test:prepare reset grants. The supported two-worker setup provisions grants after each isolated clone loads. The next full run passed without a baseline change, disabled test, or schema-maintenance bypass.

The simplification passes made the pointer index explicit, added the case guard lookup index, and removed three redundant comments. Two helper comments stayed because proof files were protected during simplification. All four proof files were byte-identical at that boundary. No test was deleted or weakened.

A separate correctness follow-up strengthened the sequence-gap proof. It uses an otherwise valid source receipt, so missing outcome materialization cannot mask a missing ordering guard. Removing the ordering check in the owned database made this test fail. Restoring it made the test pass.

The CE review covered a frozen 19-file tree at snapshot 9ad5b53b0302400db6b88d2e596c194b0b929538e44bf8160240972bcbeffd47. Its testing pass found that random missing case IDs did not prove rejection of existing foreign cases. Its adversarial pass found that a stop/revise receipt could detach a still-current completed or held outcome and block later correction. Both findings were applied by the orchestrator. Real foreign cases now exercise the exact scoped FK with null encounters. Removing that FK made the test fail; restoring it made the test pass. The projection regression failed before the guard fix, then passed on both schema paths. Positive resume, correction, and unresolved cancellation also pass.

The targeted follow-up verified both repairs against the final 15-file source snapshot c4d25ad37bda53d832abbc4d73021f909669d2f1bb479a3d0fe134c8e326e38a. No additional directly related finding remained. CE returned status: complete with run_id: 20261019-mar-u2-1792374919. Its two confirmed findings were applied inline; none was skipped or left unresolved within U2. The original receipt reviews its frozen candidate; it does not silently include later fixes. Final full backend CI passed after the repairs. Review artifacts are local under /tmp/compound-engineering-501/ce-code-review/20261019-mar-u2-1792374919/. The source reviewers stayed read-only; the orchestrator persisted their returned JSON. Merge/report workers wrote only review artifacts. No cross-provider CE job started because the transfer approval covered CodeRabbit. Its local adversarial fallback ran; model-family independence remains unverified.

The user approved two scoped CodeRabbit transfers. The first reviewed 13 changed files plus 14 context files. The second added the validation migration, for 14 changed files and the same 14 context files. Both completed without a remote or paid-credit option. Neither included the SQL dump, credentials, ignored config, session artifacts, or patient data. The second review no longer reported the legacy-table validation-lock finding. The later projection guard and its proof were covered by the native follow-up, not by that CodeRabbit snapshot.

Unapplied Review Finding: Current-Source Care EligibilityCopy Anchor Link

CodeRabbit raised a major finding at check_medication_mar_command: selected version agreement does not reject ordinary care against a superseded or stopped version. This is real future command work, not proof supplied by U2. Local U3 T12-T15 and local U4 T20/T44 must check current source and status under the request lock before any supported care writer is exposed. The immutable receipt must retain accepted current, historical, and resulting version preconditions.

Do not add blanket current-pointer equality to every historical command or occurrence. Explicit late entry, historical PRN, and correction/reconciliation need their declared lineage. The implementation must distinguish these paths and prove stale-form rejection and races. No managed command API is exposed by U2. This finding remains open in PR 2757; clinical activation stays off.

Migration And Manual QACopy Anchor Link

Six indexes on existing source tables build concurrently. An invalid index stops the preparation migration. Operators must inspect and remove only that invalid index before retry. Nullable additions need no history backfill. Constraints on existing tables are added NOT VALID, then checked in a separate forward migration after installation locks are released. Final schema constraints are validated. See the PostgreSQL validation rules. Remaining brief column/FK DDL locks and validation duration need deployment review. All three down migrations refuse destructive rollback; preserve history and use a reviewed forward recovery migration.

• Review migration-built/SQL-loaded parity and enforced-role results.
• Review existing row counts, DDL lock duration, invalid-index recovery, and forward recovery before deployment.
• Verify deployment-role table/schema privileges and FORCE RLS.
• Confirm generic writer conflicts and concurrent enrollment in local U3.
• Confirm current-source preconditions and explicit immutable receipt meaning before exposing local U3/U4 commands.
• Keep clinical activation off until named D4 reviewers approve policy and qualified nursing QA accepts the deployed scope.

Keep tracking issue 2517 open. Source delivery, API integration, deployment, human QA, and pilot approval are separate states. This unit does not complete programme U6, U7, U8, or the Hospital release.