Hospital MAR U7 Live UI

Delivery BoundaryCopy Anchor Link

This is local U7 of the canonical MAR plan. It is not programme U7 Recovery. The integration branch and draft PR 2757 remain the delivery boundary. Local U8 still owns the real HTTP acceptance journey and release evidence. Deployment, clinical policy approval and nursing pilot approval remain open. The production policy registry remains empty. This unit does not enable clinical writes, add permission defaults, or change the database schema.

ImplementationCopy Anchor Link

Live mode uses LiveMARPage and the typed hospitalMarApi. Mock mode keeps the separate prototype. The live worklist does not request Recovery Board or prototype MAR orders. Loading, denied access, missing policy, source failure and an empty result have separate states. Counts come from the filtered source. Search applies only to loaded rows and stays in memory. Dates use the facility timezone.

Source controls use the shared reference drug service. Source changes require the current case version, source revision or enrollment fingerprint, approved policy hash, reason, and explicit review of concurrent orders and unresolved occurrences. The source API supplies the full review set, not just the visible worklist page. A changed review set resets the form. The server checks prescriber assignment and remains the authority for every command.

Nursing controls use current server actions and current effective grants. They support administration, hold, resume, omission, refusal, confirmed missed doses, PRN, late entry and correction. Corrections use the approved field and outcome lists and submit only explicitly selected fields. They do not replace a refusal or documented dose when only time is corrected. History retains actual time, recording time, reason, recorded actor, outcome and documented dose. The current detail distinguishes prescribed dose from documented dose. Corrections keep the original performer separate from the correction actor. Scoped clinical viewers can read audited history without nursing write grants. Times require an explicit choice; missing or repeated local times are rejected. Decimal doses remain strings. The browser does not choose the clinical actor.

Commands save opaque recovery selectors, a payload digest, the original concurrency envelope and field structure before POST. They do not save clinical values. The exact-retry form remains available if a current action disappears. Private drafts stay in memory. A lost response blocks new commands until exact-key lookup succeeds. A confirmed receipt still requires a current read before the intent is cleared. Authorized absence requires the original payload and key. A direct, known stale-write rejection permits a new draft only after current data refreshes. A failed refresh retains the known rejection across reload. An idempotency conflict does not clear an uncertain command. Scope changes abort requests and reset private UI state without deleting an old scope's unresolved intent.

Case links preserve case context. CMS blocks a managed-source save without discarding the session edits or showing save success. It constructs the MAR link from validated selectors and current grants, not an arbitrary server URL. The dashboard and case panel read MAR directly; they do not infer care from beds. Navigation and direct routes require both cases and mar, plus MAR read grants.

Configuration can select a deployed approved policy reference with the existing versioned settings API. An unknown reference is rejected by the server. A Connected badge means the UI has an API connection, not that clinical activation or policy approval is complete. Shell retains role management; Admin retains feature flag management.

Manual QACopy Anchor Link

Use synthetic records only. Run clinical commands only with an approved test policy and an authorized assigned test practitioner. Never activate a policy on staging merely to complete this checklist.

• Open live MAR as a view-only user. Confirm no nursing or source-write controls.
• Disable cases, then mar. Confirm both navigation and direct entry deny access.
• With no approved policy, confirm existing reads remain distinct from empty data and writes stay unavailable.
• Test loading, empty, 403 and 503 states. Confirm no prototype data appears.
• Open MAR from a case and return. Confirm the same case stays selected.
• Filter dates, status and kind. Confirm facility-local times and source counts.
• Search loaded rows. Confirm the name and clinical text do not enter the URL or browser storage.
• Create a coded order. Enroll a legacy source with explicit instructions. Revise, hold, resume and stop an order.
• Change a concurrent order before submission. Confirm stale review is rejected and current review is required.
• Record all nursing outcomes and PRN with an explicit event time, dose confirmation and required reason or indication.
• Correct only policy-approved fields. Confirm the original history remains and a stale target is rejected.
• Test late entry against its historical version. Confirm rejected care does not appear as recorded care.
• Lose a POST response. Confirm only exact-key lookup runs, no replacement POST, and denied lookup leaves the intent blocked.
• Change facility or profile during a read or command. Confirm old data and private drafts disappear without deleting the old pending key.
• Save a managed medication change in CMS. Confirm the save is blocked, edits remain, and the authorized MAR handoff keeps case context.
• Confirm dashboard and case MAR reads show unavailable states rather than false zero counts when the source fails.
• Review desktop and narrow layouts, UI-kit date/time/select controls, dialogs, focus and text wrapping.

Verification LimitsCopy Anchor Link

Focused component tests use synthetic API responses. They do not prove clinical approval or the real browser-to-database journey. Backend request tests cover the additional read projections and management grant checks. Keep unchecked manual steps open until a reviewer runs them.

• Backend CI passes: 18,097 domain tests, 77,661 assertions, no failures or errors, and 10 existing skips. RLS guards, changed-source RuboCop and the separate pricing gate pass. The owned disposable MAR database was used, not development.
• Focused Hospital checks cover source actions, nursing outcomes, PRN, correction, uncertain recovery, stale reads, cancellation and private drafts. CMS checks cover handoff permissions, blocked-save state and reset on encounter change.
• Hospital type checking, the production build and the Fumadocs build pass. The production build retains the existing large-chunk warning.
• Final frontend CI passes: zero lint errors, 212 existing workspace type errors within the 254-error ceiling, zero test failures and passing wire-shape guards. Hospital's focused type check is clean. The CMS handoff and save-race suites pass nine tests. One prior CI test task was externally killed without test diagnostics; the isolated retry completed successfully.
• Chrome checks used an isolated synthetic component harness at 1440px and 390px. The worklist and administration dialog fit without horizontal overflow. The confirmation control stays disabled before explicit time and dose confirmation. The live shell requires login. No authenticated clinical browser journey or staging approval is claimed.
• CodeRabbit reviewed the scoped U7 snapshot and reported five findings. Explicit correction-field selection, CMS conflict reset, source-read handoff permission and shared query constants were corrected. The DatePicker label finding does not apply: the current shared component forwards aria-label, and the source control tests find the labeled date buttons. Follow-up findings added a CMS save-generation guard, separate facility save invalidation from chart reset, stronger stale-error assertions and shared feedback delays. These corrections prevent old responses from changing the current encounter or removing drafts. The final two-file CodeRabbit follow-up completed with zero findings. Review covered scoped U7 changes, not a new review of every earlier PR checkpoint.
• Code review: skipped (ce-code-review unavailable). This host does not expose the required independent reviewer and finish-leaf tools. CodeRabbit evidence and the local review are separate; no full Compound review receipt is claimed.

The implementation used the main agent context, not a worker swarm. No model switch or served-model receipt is claimed. The intentional shared-services dependency has its matching Hospital lockfile entry. No schema dump, local configuration, credentials or session artifacts belong to this unit's commit.