Hospital MAR U8 Review Queue

Candidate BoundaryCopy Anchor Link

Source checkpoint: cff2cc4849, plus review-loop changes on feat/hospital-nursing-discharge-u6-u8. Draft PR 2757 remains the integration boundary. This is a local candidate review, not a review of newly pushed code. No staging or clinical approval is implied.

CodeRabbit completed a nine-file scoped review with three findings and a 132-file filtered whole-PR review with 31 findings. Both snapshots exclude credentials, local configuration, schema dumps, session files and patient data. The whole-PR snapshot predates the fixes below. This queue records the source decisions for all 31 findings. CodeRabbit completed a 47-file follow-up and a four-file HTTP/documentation follow-up, both with zero findings. A separate bounded Hospital reviewer found two further issues. Both are fixed. Its repeat review and CodeRabbit's final four-file source review report no findings. Those checkpoints did not include a completed Compound multi-reviewer receipt. The later full Compound review and its follow-up are recorded below. Final evidence notes are outside the earlier source-review snapshots.

Applied ChangesCopy Anchor Link

• Recover a cancelled post-write history reader with one bounded read retry. Never repeat the clinical POST. Keep recovery blocked on a real read failure.
• Use explicit CMS permission keys so the backend RBAC catalogue can inspect them.
• Preserve the original browser assertion if diagnostic capture fails.
• Assert that the cancelled-reader test reaches the retry branch.
• Run journey history and exact-key receipt reads under enforced RLS.
• Share known direct-conflict codes between the command hook and recovery store.
• Use the OS temporary directory for default browser evidence.
• Preserve command field errors in HTTP validation responses.
• Permit reasoned non-administration of unresolved historical slots after source revision or stop. Keep administration blocked and retain missed-dose timing, current-revision, policy, assignment, reason and occurrence-version checks.
• Project source_revision and current_source_revision separately. The UI displays historical instructions but submits the current write precondition.

Final integrated results are recorded below. Release approval remains separate.

Whole-PR FindingsCopy Anchor Link

Reported severity is CodeRabbit's classification, not a confirmed impact score. Validate each pending claim against the source and plan before changing behavior.

Decision RationaleCopy Anchor Link

The three migration rollback suggestions conflict with the approved forward-only recovery strategy and backend rules. Applied migrations must not be rewritten. Dropping care tables or undoing provenance constraints is not a safe recovery procedure. The U2 guide documents the explicit stop and forward-repair route.

The overview had a dependency sequence, not a dated delivery timeline. Its unit labels are now explicit. The settled implementation plan remains unchanged; execution records and this queue hold current progress and evidence.

The workqueue cannot apply a database limit before computing clinical summary counts and merging current PRN availability. It now reads ordered scalar IDs, projects clinical rows in batches of 250, merges availability in order, and keeps only the requested page. A 264-row regression checks batch size, stable page order and full counts. It retains one state projector instead of a second SQL rule set. Both occurrence and availability streams now project graphs in batches. Their case-number maps are local to each batch. Scalar ID indexes still grow with the filtered result. The allocation tests measure records per instantiation event, not peak retained heap or constant-memory aggregation for unbounded data.

FHIR changes follow R4 Quantity rules and the R4 time primitive. Local MAR unit codes remain exact. They are not assumed to be UCUM. Only the known seconds denominator declares a UCUM system. Staff-only performers still require a valid Practitioner mapping before FHIR export.

Five clinical regression assertions failed before their fixes. Export/error-shape tests exposed five further failures, the old-browser handoff test failed once, and the wide-queue test observed a 264-row clinical allocation before batching. Tracing pending PRN care also found expired instructions shown as new-dose availability. A separate regression failed before the fix. Workqueue availability now uses the same explicit validity-window predicate as the dosing command. The focused integrated checkpoint passed 177 tests and 1,690 assertions without skips. The final integrated results are in the execution record.

Bounded Hospital ReviewCopy Anchor Link

The first reviewer found two P2 issues: expired held/resumed PRN still advertised new care, and availability loaded all active request graphs before filtering. Three regression assertions reproduced these issues after valid source/case preconditions were supplied. The corrected suite passes 24 tests and 726 assertions without skips. A 253-request test checks both streams, case-number search, full counts and page order. Expired obligations remain visible, with resolution/history actions but no normal administer, hold or resume action. Historical-care validation still uses the submitted event time.

Reviewer threads: 01a155d7-f302-7822-9451-217bfb4d9f98 and 01a155dd-23c0-7e53-9caf-8e481dd867d4. Both used the hospital_reviewer profile, configured as gpt-6-astra / high. Served-model, effort and usage receipts were not supplied. Do not infer model identity or cross-model independence from that configuration. Workers ran sequentially, made no edits, and were closed after their terminal results. The second found no further actionable issue in the two fixes. It did not run tests or perform full-PR review.

The earlier tool-unavailability statement was too broad. Tool discovery exposed native reviewer tools. The two bounded reviews above used them. A full Compound workflow later completed and returned Not ready with the eight findings below.

Final VerificationCopy Anchor Link

• Full backend CI passes: 18,127 domain tests, 78,553 assertions, zero failures or errors and 10 existing skips. Pricing passes 20 tests and 26 assertions. Changed-file RuboCop checks 70 files with no offenses. Schema and RLS guards pass.
• Frontend CI passes: zero lint errors, 212 existing type errors below the 254 ceiling, zero test failures and passing wire guards. Hospital has 328 passing tests across 36 files. This ratchet is not a clean platform typecheck.
• Both schema paths pass 22 constraint/RLS tests and 318 assertions each, with no failures, errors or skips. The migration-built database was not rebuilt.
• The focused MAR, RLS and RBAC run passes 388 tests and 2,838 assertions with no failures, errors or skips. Hospital strict types and the production build pass. The existing bundle-size warning remains.
• Both live browser journeys pass six checks with mock mode off. Desktop and narrow screenshots show no horizontal overflow. Each journey verifies current history after reload, view-only access, case context and lost-response recovery with exactly one dose POST.
• The first browser attempt failed its JavaScript-error check while frontend CI rebuilt shared packages and triggered HMR. It is not counted as a pass. After CI, the isolated frontend restarted and both journeys passed on fresh fixtures.
• CodeRabbit CLI 0.9.0 reports review_completed, zero findings and 47 reviewed files. Snapshot hash: 97da19923cfd1728caadd5f7ac5177b1987861aba4ddfda9b9d1a02bb23569cf. The manifest is /private/tmp/hospital-mar-review-20261020-u4oia0-manifest.json. The receipt is /private/tmp/hospital-mar-review-20261020-coderabbit.log.
• The final four-file source receipt also reports zero findings. Snapshot hash: e3ad8f4b9fb824d02fe49b74ec247b85967b02e95c84c689e36f51284c4879e7. Its manifest is /private/tmp/hospital-mar-peer-review-20261020-cvdFIU-manifest.json. The receipt is /private/tmp/hospital-mar-review-20261020-coderabbit-peer.log.

All 31 findings have a source decision. There is no open accepted production finding from these CodeRabbit passes. A zero-finding receipt does not provide clinical approval or replace the full Compound multi-reviewer workflow.

Full Compound Follow-upCopy Anchor Link

The full review examined local commit bad877425a63 against base 647645d15695: 142 tracked files and 18,232 changed lines. Thirteen local review lenses completed. A fresh validator confirmed eight findings. The run returned Not ready. Its report is /private/tmp/compound-engineering-501/ce-code-review/20261020-hospital-8ijzv2/report.md. This local path is evidence for this checkout, not a portable guide dependency.

The P3 documentation advisory is also applied. The orchestration smoke-test section now identifies its U2 statement as historical, not the current next step.

Proof-first frontend checks reproduced the missing envelope, denied view-only history and null-label rejection. Backend checks reproduced denied history, 25 original-time aggregates and 27 matching link reads for a 25-source page. The source query test then narrowed its SQL matcher to exclude nested subqueries. Integrated MAR/RLS/RBAC checks pass 398 tests and 4,806 assertions without skips. The focused frontend adapter/recovery/UI checkpoint passes 83 tests. The final follow-up results are recorded below. Prior checkpoint results do not validate a later source change.

One hospital_implementer worker drafted the backend regression file and was stopped before its handoff: 01a1565e-c0c6-7f41-8846-747daa5ce937. The orchestrator inspected it, repaired fixture/query-capture issues, observed red failures, and owns all subsequent changes and verification. The worker did not complete an implementation unit. Its configured model is gpt-6.1-sol / high; served-model, effort and usage receipts were unavailable. No other writer ran concurrently. The worker is closed.

The Anthropic peer transfer was not approved by the permission gate. No source was sent to that peer. A local adversarial review covered that lens; this is not a completed cross-model review. CodeRabbit follow-up remains within the approved scoped source boundary. Clinical activation, deployment and human acceptance stay open.

Follow-up Review DecisionsCopy Anchor Link

A second full Compound review completed at repair base bad877425a63, with 20 staged repair files and ten selected lenses. Receipt: /private/tmp/compound-engineering-501/ce-code-review/20261020-mar-fixes-Pf5J7a/review.json. It returned Ready with fixes for one P2 test defect. The assertion queried a cache key the page never creates. It now requires real new-scope list entries and checks their empty data before and after the old response resolves. This was a coverage defect, not a reproduced production disclosure.

The review's three testing gaps are also addressed. Round-trips cover scheduled orders, PRN instructions and administration, corrections, nullable fields, array entries and numeric limits. Standard Coding.version and userSelected use value-free field descriptors. Legacy absent recovery keeps the key and blocks replacement. A changed clinical field cannot send a POST.

A bounded six-file source review reports no findings after these changes. The reviewer was closed: 01a1568b-2070-7003-a2df-1091ea71884c. No served-model or effort receipt was available. The full review's compact returns and worker IDs are in its collection.json; seven detailed artifacts were available. Three read-only profiles returned valid results without files. The merge, validator and report workers completed and were closed. No external peer job was started.

CodeRabbit completed the first 20-file repair review with zero findings. Its six-file follow-up reported the same minor duplicate-alert issue twice. The page now suppresses its alert only while the recovery dialog is actually visible. If a retry becomes uncertain and the dialog closes, the page error remains visible. A proof test failed with two alerts before this change and passes with one alert after it. The test also covers the later lost response. The final trivial suggestion to remove the global hidden: true alert count is rejected: the test first proves a visible alert inside the dialog, then counts all alerts, including hidden background alerts. The observed pre-fix count was two. A dialog-only count would miss that regression.

Focused frontend checks pass 89 tests. Backend CI passes 18,137 domain tests and 80,520 assertions, with zero failures/errors and ten existing skips. Pricing passes 20 tests and 26 assertions. The backend request and integrated no-skip MAR/RLS/RBAC checkpoints are recorded above. No migration, schema dump or permission-default change is part of this repair. Final frontend CI passes with zero lint errors and zero test failures. Its 212 existing type errors remain below the 254 ceiling; this is not a clean platform typecheck. Hospital strict types and production build pass. Hospital has 346 passing tests across 36 files. The existing bundle-size warning remains. Fumadocs builds and indexes 506 pages.

Each fresh live-HTTP browser journey passes eight checks, for Surgery Center and Hospital 50. Both verify original and corrected documented quantities after reload, audited view-only history, case context and lost-response recovery with one dose POST. Desktop and 390px screenshots have no horizontal overflow. The Hospital 50 narrow screenshots scroll history into view before capture; this capture-only adjustment does not change care or app behavior. The isolated servers are stopped. The mock demo on port 3006 remains running.

Final review receipts are /private/tmp/hospital-mar-p1p2p3-coderabbit2.log (20 files, zero findings), /private/tmp/hospital-mar-p1p2p3-coderabbit-closed.log (six files, the duplicated minor alert finding), and /private/tmp/hospital-mar-p1p2p3-coderabbit-final.log (two files, one rejected trivial test suggestion). The first snapshot hash is ee9c7eae28b9b6478da67fb448a89187bb15e37bab5903f2c25ffb82f11e3195. The final alert proof is /private/tmp/hospital-mar-p1p2p3-alert-red.log; the integrated frontend proof is /private/tmp/hospital-mar-p1p2p3-final-focused.log. The backend and frontend CI receipts are /private/tmp/hospital-mar-p1p2p3-backend-ci-final.log and /private/tmp/hospital-mar-p1p2p3-frontend-ci-final.log.

All eight original confirmed findings, the orchestration advisory, the later cache assertion and the accepted alert correction are closed in this local candidate. Clinical rules and the empty production policy registry are unchanged. This does not complete deployment, manual nursing QA or pilot approval.

Base Sync Follow-upCopy Anchor Link

The first integration sync includes base eb2992eddaa0. The two controller conflicts retain the incoming encounter and administration audit events and the existing MAR write guards, conflict responses, and FHIR performer checks. This first sync adds no migration or clinical policy.

The new per-action audit coverage guard first failed on the four MAR command routes. Each route already delegates to an atomic, audited Clinical command. The coverage table now names those four actions under service-owned auditing. No action is exempted or added to the audit backlog. The literal SQL matcher uses include? to meet the changed-file lint rule without changing its check.

Focused controller, audit, MAR command, export, query-count, and real-HTTP journey tests pass: 149 tests, 2,903 assertions, no failures, errors, or skips. The first serial attempt lacked grants on the new isolated test database and is not a pass. Provisioning the enforced test role resolves that setup error. Full frontend CI passes with zero lint errors and zero test failures. It has 213 existing type errors below the 254 ceiling, not a clean platform typecheck. Hospital strict types, all 346 tests, and the production build pass. The existing bundle-size warning remains. Fumadocs builds and indexes 506 pages. Final backend CI passes 18,786 domain tests and 87,014 assertions with zero failures/errors and eight skips. Pricing passes 20 tests and 26 assertions without skips. All 72 changed Ruby files pass lint. Schema and RLS guards pass. The receipt is /private/tmp/hospital-pr2757-sync-backend-ci-final.log.

CodeRabbit completes the four-file sync review with zero findings. The snapshot hash is 747aadd6899064ba4ac1e3d1f2f32787160f7ecf1327982f0b3a03c20094900c. Its receipt is /private/tmp/hospital-pr2757-sync-coderabbit.log. Controllers compare against the prior PR head; the audit table compares against incoming base. This isolates the sync changes and is not a new whole-PR source review. Credentials, local configuration, schema dumps, patient data, Billing work, and session artifacts are excluded. The focused Compound review also completes with no findings. One read-only Hospital reviewer checks the same stable snapshot; no cross-provider review is claimed. Its snapshot hash covers sorted paths and file contents, not the manifest JSON bytes. The review receipt is /private/tmp/compound-engineering-501/ce-code-review/20261020-base-sync-ecE0Ms/review.json.

Cloudflare shows the docs build as skipped because the account used all 3,000 included build minutes. GitHub reports that check as failed. Local build success does not clear the remote check. Build settings and access controls are unchanged. The user will move the docs app to Pages. No paid-plan upgrade, check override, production deployment, or clinical activation is part of this sync.

Second Base UpdateCopy Anchor Link

Base moved again during verification, to 8393b0392c. This adds the upstream audit-failure reporting and IPD admission fixes. The only merge conflict is in the SQL migration-version list. The resolved list retains all three MAR versions and both incoming admission versions. The SQL file is not regenerated. The isolated loaded schema confirms all five versions, nullable unassigned beds, and the valid unique active-admission-per-bed index.

Code review: skipped (mechanical diff). This second sync takes upstream source unchanged and combines the migration-version entries. The earlier four-file review does not claim to review the newer upstream changes. Integration checks are rerun against the newer base instead of reusing the first sync's results.

Backend CI passes 18,795 domain tests and 87,046 assertions, zero failures/errors, and eight skips. Pricing passes 20 tests and 26 assertions without skips. The focused audit/MAR regression passes 149 tests and 2,903 assertions without skips. The final SQL-loaded MAR constraint/RLS suite passes 22 tests and 318 assertions without skips. Hospital strict types pass. Receipts use the prefix /private/tmp/hospital-pr2757-sync2-.

One frontend run is interrupted because Connect generates a large stream of React act() warnings. Its named 90-test file had completed; the output alone does not prove an application loop. The interrupted run is not a pass. The replacement runs the same canonical CI with no warning or assertion suppression. That unchanged retry passes: zero lint errors, zero test failures, and passing wire guards. Its 214 existing platform type errors stay below the 254 ceiling. No Connect source or test change is made. The receipt is /private/tmp/hospital-pr2757-sync2-frontend-ci-retry.log. The updated docs build also passes and indexes 506 pages.

Candidate manual QA remains open:

• Save ordinary encounter data and complete an unmanaged administration. Confirm the expected audit event and actor; do not copy clinical content to activity metadata.
• Try generic edits to a managed MAR source. Confirm the conflict response, intact medication history, and no successful-write audit event.
• Use an approved test policy to record and correct a dose. Confirm one source command, one transactional activity event, and preserved provenance.
• Verify the docs check after build capacity or Pages integration is ready.
• Complete deployed nursing QA and obtain clinical/pilot acceptance.

Earlier Checkpoints And Stop RuleCopy Anchor Link

Before the whole-PR fixes, full backend CI passed 18,107 domain tests with 77,817 assertions, zero failures/errors and 10 existing skips. Pricing passed 20 tests and 26 assertions. Frontend CI passed with zero lint errors, 212 existing type errors below the 254 ceiling, zero test failures and passing wire guards. Those checkpoint results did not verify later source edits.

The initial live browser journeys pass six checks per preset. They precede the new current-revision wire field. The final journeys above replace them. Fumadocs built and indexed 505 pages before this review-queue page was added. Record final counts in the U8 execution record.

The later checkpoint passes 50 backend tests with 577 assertions and no skips, plus 71 frontend tests. Hospital typecheck and ESLint pass. All nine changed Ruby files pass RuboCop. Fumadocs builds and indexes 506 pages. These focused checks alone did not close the whole-PR findings. Final results are above.

Do not mark U8 complete, push a ready PR or activate clinical writes while a confirmed clinical defect or required verification remains open. Use the MAR QA guide for candidate handoff.