Hospital MAR Local U3 Execution Record

Scope And StateCopy Anchor Link

This record covers local U3 of the canonical MAR plan. It is part of draft PR 2757. The starting commit is f7bd865b5d96da1099d0bc9ab232347dbf88dec0.

U3 is a local implementation checkpoint. Final verification remains open. The user requested this checkpoint before U4. Do not use it as release approval.

Execution uses one inline writer. No worker swarm or model CLI was started. Pre-existing .context/ and .compound-engineering/ files remain excluded. No production data, credentials, schema dump, or local configuration belongs in the external review snapshot.

Command BoundaryCopy Anchor Link

Clinical owns MedicationMar::OrderCommand, structured instructions, immutable versions, and dose occurrences. Hospital owns the case link. The service checks the current active User, tenant membership, facility clinical assignment, and effective prescribe or manage_prescriptions grant. A nurse or an administrator has no implicit prescriber authority.

The production policy registry is empty. A test policy is synthetic and does not grant clinical approval. Writes require an explicit facility policy reference, its matching content hash, and an allowed prescriber role category. No default dose window, clinical interval, or nursing authority is introduced.

Instructions support explicit single doses, bounded scheduled slots, and PRN limits. Dose amounts are decimal strings with explicit units and coded routes. Ambiguous local times, invalid offsets, free-text regimens, expired PRN windows, and schedules outside source validity are rejected. PRN orders create no scheduled dose occurrences.

Commands lock case context before the canonical request. They check source and case revisions, acknowledge current concurrent orders, and require acknowledgement of unresolved occurrences. A revision retains completed outcomes and past unresolved slots. It supersedes eligible future unresolved slots. A source change cannot erase a documented nursing hold; that obligation requires explicit nursing resolution.

Each successful command records its immutable receipt, source version, case event when linked, and required audit event in one transaction. Same-key retries return the original receipt after current access checks. Changed payloads conflict. No command writes to Inventory or Billing.

Alternate WritersCopy Anchor Link

Managed generic request edits, transitions, dispense, deletion, and generic administration writes return MAR_MANAGED_SOURCE. The conflict gives an open_mar_order action and safe return context. The normal guard includes the request, facility, and linked case selectors. A database race fallback gives the MAR route without guessing selectors.

Encounter medication replacement locks existing sources before other batch writes. A managed-source conflict rolls back the whole batch, including observations. Database guards remain active when a writer races enrollment. Unmanaged medication behavior stays unchanged.

Longitudinal import copies ordinary medication content, not the current MAR version pointer. The target tenant must establish its own source authority.

VerificationCopy Anchor Link

Only owned disposable databases were used. The final candidate database is kulcare_hospital_mar_u3_20261019_v2_test. No shared database was reset or seeded.

Race tests use separate RLS-enforced connections and bounded barriers. The generic-controller tests stub authentication to isolate conflict behavior; they do not prove actor authorization. Command authorization tests and the existing enforced-role suite cover separate security boundaries.

The initial race run found a real same-key replay defect. The second enrollment could observe the new case link after it waited for the source lock. The command now checks the locked current link against its selected case before replay. Fixture cleanup was also repaired so deferred constraints finish before test triggers are restored. These are separate fixes, not one test-harness explanation.

Source revision versus nursing administration remains U4 proof. Do not mark all of T13 or T15 complete based on the prescriber tests alone.

The final test command and external review must run after the approval service recovers. This batch is committed locally at the user's request; it is not pushed or release-ready. U4 and U5 have not started at this checkpoint. The review snapshot contains only the scoped changed files; it excludes credentials, local configuration, schema dumps, patient data, and session files.

Follow-Up In Local U4Copy Anchor Link

The U4 source batch reruns U3 with nursing outcomes, corrections, source-change races, generic-writer protection, canonical export, and policy/Audit coverage. Its final focused run passes 214 tests and 3,498 assertions, with one existing matrix skip. This supersedes the earlier unavailable database rerun, not the still-open deployment or clinical release gates. See the U4 execution record for full-CI and review evidence.

Manual QACopy Anchor Link

These steps require the later facility API and UI. They remain open.

• Use an approved synthetic policy in a disposable facility. Create an order for a case without an encounter. Reload its immutable source history.
• Enroll an existing coded order. Repeat the exact operation key and confirm that no second version, case link, or occurrence set appears.
• Revise future instructions. Confirm that past outcomes remain unchanged and only acknowledged eligible future slots are superseded.
• Hold, resume, and stop the source. Confirm reasons and version lineage.
• Try the same managed order through generic Clinical and CMS writes. Confirm an actionable conflict and no partial encounter save.
• Confirm a denied prescriber, stale revision, changed policy hash, and disabled module cannot change the source.
• Complete U4 source-change versus dose races before nursing acceptance.

U3 does not grant D4 approval, enable clinical use, or replace the remaining plan verification and release gates.