Hospital MAR Local U4 Execution Record

StateCopy Anchor Link

U4 source implementation has passed local verification under the canonical MAR plan. Starting commit: e38f4ded57, the user-requested local U3 checkpoint. The integration branch remains feat/hospital-nursing-discharge-u6-u8 for draft PR 2757.

This record accompanies the verified local U4/U5 source checkpoint. No push, deployment, or clinical activation was performed. The final focused regression, full backend CI, changed-source lint, and scoped CodeRabbit follow-up pass. Clinical approval and manual acceptance remain open. See the U3 record for earlier checkpoint limits.

Current ImplementationCopy Anchor Link

Clinical owns the nursing command, canonical administrations, occurrence projection, and immutable receipts. Hospital owns the case link and case event. The comparable implementations are the U3 MedicationMar::OrderCommand and Hospital::Readiness::Command. Both use current authority, ordered locks, operation keys, and transactional audit.

The local implementation adds:

• A nursing policy that requires active User and tenant membership, current active facility assignment, view grants, and execution or management authority.
• Explicit nursing policy settings. Timing windows and allowed assignment categories have no production defaults. The production registry stays empty.
• Scheduled-dose commands for administer, hold, resume, omit, refuse, and explicit missed confirmation.
• Exact dose/route confirmation and User performer/recorder provenance. A staff nurse does not require a fabricated Practitioner.
• Canonical outcomes, immutable receipts, occurrence projection, and required audit in one transaction. Hold resolution preserves the original record.
• Same-key receipt recovery after current access checks. A changed payload conflicts instead of recording another event.

The implementation also adds immutable corrections, PRN occurrences and limits, and historical late entry, including initial PRN events. PRN limits use actual event times across the order lineage. A corrected or backdated event must satisfy each affected later rolling interval, not only its insertion time.

Late entry requires management authority and the actual performer's own User identity. The historical version must have been active at the event time and within source validity. A stopped current order stays stopped. Completed or already resolved care is not silently replaced by late entry. An existing refusal or omission requires the explicit correction workflow, not a second late-entry administration. That workflow retains its original record and performer. A prior completed receipt always blocks a new physical dose on the same occurrence, including after a correction-to-hold and resume chain.

The policy controls whether ordinary observed administration needs a narrative reason. Hold, resume, non-administration, late entry, and correction always need one. Missing policy fields fail closed. No policy threshold is supplied by a client or inferred from an empty registry.

Source stop and source hold remain possible while a nursing hold exists. The prescriber must acknowledge the held obligation. Its on_hold administration and held resolution stay visible; source status blocks new care. This avoids deleting the hold or reopening it as an unperformed dose. It does not assert that the held obligation is clinically resolved. An assigned nurse can explicitly omit or refuse that held occurrence after the source stops, with a reason, current source and occurrence versions, selected approved policy, and current recording time checks. The new receipt links the original hold. This remains possible after historical care/correction windows expire; it does not authorize administration or resume on an inactive source.

Projection starts due state at the inclusive early boundary and derives overdue state at the inclusive late boundary. It never creates a missed administration from elapsed time. Obligations retain holds and unresolved slots. No recorded orders does not assert medication clearance.

Canonical readers retain User performer/recorder and receipt lineage. Staff FHIR export fails explicitly when a valid Practitioner mapping is absent. Valid Practitioner exports retain nested dose data. A shared FHIR dosage mapper serves both the exporter and generic FHIR route. It emits validated numeric JSON without Float conversion and sends a unit code only with its declared system. This follows FHIR R4 JSON decimals and Quantity rules. Legacy free-text doses/rates remain text, not guessed quantities. A JSON string dosage also remains text. Such a row does not fail an otherwise valid bundle or raise in the generic FHIR route. Exact numeric values retain their precision.

The U5 facility HTTP routes are tracked separately in the U5 execution record. There is no typed frontend consumer or live UI control yet. No Inventory or Billing effect is added.

EvidenceCopy Anchor Link

Execution uses one inline writer, with no model CLI or worker swarm. Pre-existing .context/ and .compound-engineering/ artifacts remain untouched. No schema, migration, permission default, or lockfile changed.

The test database is the owned disposable kulcare_hospital_mar_u3_20261019_v2_test. Full CI also owns its _0 and _1 worker clones. Both names were confirmed absent before CI. No shared database was reset or seeded.

Run focused checks from backend/:

DATABASE_URL=postgresql:///kulcare_hospital_mar_u3_20261019_v2_test \
  RAILS_ENV=test PARALLEL_WORKERS=1 mise exec ruby@3.4.9 -- bin/rails test \
  domains/clinical/test/services/medication_mar

The first approval-service timeouts did not execute tests. Later approved runs produced the results above. An early projection test also needed a distinct case number and a reused procedure, not a second procedure with a duplicate name.

The correction-chain regression found a real redosing defect: completing a dose, correcting it to held, and resuming it could allow another physical dose. Its test failed before the immutable-receipt guard and passes after it. The guard does not infer safety from the current projection alone.

Race tests use separate non-bypass RLS connections, barriers, bounded joins, and tenant-scoped cleanup of synthetic committed fixtures. They cover same-key recovery, two keys and actors, source revision versus nursing care, and competing PRN requests. Generic export tests stub authentication to isolate export behavior; they are not proof of HTTP authorization. Local U5 owns that boundary.

The correction race exposed a cleanup-only cycle between commands and prior administrations. The shared test helper now clears only that fixture reference with history guards disabled inside its cleanup transaction. No production constraint changed. A failed teardown left one synthetic tenant graph; an exact-database, tenant-ID, and facility-ID guarded cleanup removed it. A later organization lookup fix avoids reliance on a cached cross-tenant association. The corrected integrated run then passed.

Full CI found two Audit controller tests using mocks that could not represent a canonical request. Those tests now use a real unsaved request and keep their event assertions. The Clinical policy matrix now covers both MAR policies. Literal permission keys replace the dynamic permission loop. No policy or catalog test was disabled, and the zero-failure baseline was not raised.

The plan permits an assigned prescriber to hold prescribe or manage_prescriptions. The source policy and matrix now use that alternative. Denial fixtures explicitly revoke both grants. A clinical assignment is still required; a management grant alone is not prescriber qualification.

The CodeRabbit source snapshot is 2ec9d9fe3d800c8a799e0c63547e7579e391242fb12e07d8e03ddf7bcbde1502. It excludes credentials, local configuration, schema dumps, patient data, and session artifacts. The first CLI pass covered only ten existing files because new files were untracked in the isolated repository. It is not full coverage. The corrected pass staged all 45 files and used the Kulcare repository remote for organization matching. It returned a completed review with all 45 paths.

The follow-up source context has 49 files at snapshot 36310fead3ebf0489500587a7c8567bedf2126a0c141147410d8d81382b2e302. Two denial-fixture edits after that snapshot revoke both prescriber alternatives; they do not change production code. The final focused run includes those edits. CodeRabbit is the external review in this run. No independent native-agent review or serving-model identity is claimed.

The final source context is 49 files at snapshot d76a8b3c70baed5c647950c03dd9d6391e17d8176c20ebf918754f8b0140ee2e. The export follow-up reviewed its three changed files and returned zero findings. The subsequent boundary follow-up reviewed projection.rb, its boundary tests, and the added prior-version PRN proof; it also returned zero findings. These are scoped reviews, not a claim that the whole Hospital programme was reviewed or that release acceptance is complete.

The final U4/U5 follow-up contains only eight application/test files and the two execution guides. Its diff SHA-256 is 91fc6c9cc4c35faef4148d93be73dd0c095b7ca2743d4243feccb752c5fe1ce8. Automatic approval review rejected an earlier broad worktree command because it did not enforce the claimed file scope. The isolated snapshot enforced the 10-file manifest and was approved. Its review completed with zero findings. The final evidence-only guide refresh follows that snapshot; application source matches the reviewed and full-CI-tested candidate.

The last plan check found that due state started at the scheduled timestamp, not the approved early boundary. The exact plan fixture failed at 04:59:00Z before the fix. It now proves upcoming at 04:58:59Z, due at 04:59:00Z and 05:04:59Z, and overdue at 05:05:00Z. Additional stress fixtures use different synthetic windows; none is a production medication protocol.

Remaining Delivery And Release WorkCopy Anchor Link

• Publish the verified local checkpoint through the existing draft PR when delivery is requested. The completed external review does not change the partial Compound review limit.
• Local U5 adds authorized facility APIs and request tests. Typed frontend transport, live UI, and end-to-end acceptance remain later work.
• Keep deployment, nursing QA, D4 approval, and pilot acceptance open.

Manual QACopy Anchor Link

These steps need the typed frontend adapter and UI. They remain open.

• Give an assigned staff nurse explicit grants. Record a scheduled dose and confirm exact dose, route, actual time, performer, and recording time.
• Hold and resume a dose. Confirm preserved hold history and no completed administration from resume alone.
• Omit, refuse, and confirm a missed dose. Confirm reasons and no automatic missed record from elapsed time.
• Recover a lost response with its original key. Confirm one clinical event.
• Use two nurse sessions on one dose. Confirm only one current outcome.
• Change the source or revoke authority with a pending form. Confirm a controlled rejection and a current refetch.
• Correct an event with an approved actor. Confirm the original performer, correction actor, history chain, and no new stock event.
• Verify PRN limits across order versions and approved late-entry boundaries through the later facility APIs and UI.
• Check the selected policy's early and late boundaries. Confirm that elapsed time changes the display state but does not create a missed administration.
• Verify staff FHIR rejection and valid Practitioner export behavior.

No checkbox here grants nursing authority or accepts the pilot.