Hospital MAR Local U5 Execution Record

StateCopy Anchor Link

U5 adds authorized facility HTTP routes for the MAR services described in the canonical MAR plan. The verified source checkpoint is local on feat/hospital-nursing-discharge-u6-u8. No push, deployment, or clinical activation was performed.

The routes are not connected to a typed Hospital frontend adapter or live MAR page. The production policy registry is empty. The API reports policy_unavailable and denies new clinical writes until an approved policy is deployed. This record does not provide clinical approval.

ImplementationCopy Anchor Link

The controller supports:

• Facility capability and policy availability.
• MAR worklist, occurrence detail, and history.
• Case-linked eligible medication source list, detail, and immutable versions.
• Prescriber order commands and nursing dose/PRN commands.
• Exact operation-key receipt lookup and reasoned corrections.
• Case/facility scoping, Pundit authorization, effective permissions, module and feature-flag gates, and PHI access audit before disclosure.

The current implementation uses one facility controller with shared lookup, access, and audit helpers. It delegates writes to the existing U3/U4 command services. This consolidates the plan's proposed small controllers without changing route ownership. Serialization uses Shared::BaseBlueprint, following the current Hospital Lab blueprint. Worklist permission reads use one request snapshot of the canonical nursing policy; each write rechecks current authority.

The request tests cover an unavailable policy, source-view permission separate from nursing authority, foreign-facility denial, worklist actions, PHI-audit fail-closed behavior, dose command receipts, PRN availability, and rejection of an unapproved configuration policy reference.

VerificationCopy Anchor Link

Run the focused regression from backend/ against the disposable MAR test DB:

DATABASE_URL=postgresql:///kulcare_hospital_mar_u3_20261019_v2_test \
  PARALLEL_WORKERS=1 RAILS_ENV=test mise exec ruby@3.4.9 -- bin/rails test \
  domains/clinical/test/services/medication_mar/prn_test.rb \
  domains/clinical/test/services/medication_mar/reason_policy_test.rb \
  domains/clinical/test/services/medication_mar/late_entry_test.rb \
  domains/clinical/test/requests/medication_mar_export_test.rb \
  domains/clinical/test/requests/hospital/mar_test.rb \
  domains/clinical/test/services/medication_mar/dose_command_test.rb \
  domains/clinical/test/services/medication_mar/correction_command_test.rb \
  domains/clinical/test/services/medication_mar/order_command_test.rb \
  domains/clinical/test/services/medication_mar/concurrency_test.rb \
  domains/clinical/test/policies/clinical_policy_matrix_test.rb

The non-bypass role must be provisioned after the test schema is current:

DATABASE_URL=postgresql:///kulcare_hospital_mar_u3_20261019_v2_test \
  RAILS_ENV=test mise exec ruby@3.4.9 -- bin/rails db:rls_test_role:provision

The compound review collection for U4 completed five of nine reviewers. Four did not run because of model usage limits. Completed findings were addressed, but no complete compound review receipt exists. Record this as a review limit, not as a clean full review.

The external review found that PRN availability did not use the case filter and case-number search. The regression now uses another patient and linked case. Both selectors use the same facility/case scope before pagination. An inactive held dose now offers only reasoned omission/refusal. Missing policy removes PRN write actions. Source setup gaps require audit even when there are no dose rows. The exact command parameter is redacted from request logs.

Manual QACopy Anchor Link

Run these checks only in an approved non-production environment with an approved test policy and test patient. Do not activate nursing writes in production from this checklist.

• Confirm the capability endpoint reports policy_unavailable and write actions are denied when no approved policy is deployed.
• With an authorized view-only role, open the facility MAR worklist and confirm no administration action is available.
• Remove the source-view grant while keeping nursing authority. Confirm the medication source list, detail, and versions return forbidden.
• Request a case or occurrence from another facility. Confirm it is not disclosed, including when the user belongs to the same tenant.
• Use two patients with PRN orders. Filter by one case and search by its case number. Confirm only that case appears, and paging totals match the filtered set.
• Make PHI audit unavailable. Confirm the worklist/source response fails closed and contains no patient or medication details.
• Record a dose using a valid approved test policy. Confirm authenticated User provenance, exact dose/route, source and occurrence versions, immutable receipt, and one canonical administration.
• Retry the same operation key and payload. Confirm one clinical event and the same receipt. Retry the key with a changed payload and confirm conflict.
• Open the source history and verify corrections preserve the original outcome and identify the correction actor and reason.
• Stop an order with a held dose. After historical recording windows expire, explicitly omit/refuse it. Confirm preserved hold history, current authority, required reason, and removal from unresolved obligations. Administration and resume must remain blocked.
• Confirm the MAR page remains unavailable until the typed adapter and live UI pass their own acceptance checks.

Human nursing/clinical approval, pilot acceptance, and deployment remain open.