OT Scheduling Settings

Ownership And ScopeCopy Anchor Link

Gap-closure U14 extends Clinical Hospital scheduling. It uses the existing theatre JSONB column and timestamp version contract. No schema migration or new permission key is required. Shell owns RBAC administration; Admin owns feature flags. The focused plan defines scope. The QA guide owns manual acceptance.

Wire ContractCopy Anchor Link

Theatre create/update accepts availability_rules:

{
  "weekly_windows": [
    { "day": 1, "start_time": "09:00", "end_time": "17:00" },
    { "day": 5, "start_time": "22:00", "end_time": "02:00" }
  ],
  "maintenance_windows": [
    {
      "starts_at": "2026-10-16T23:00:00+05:30",
      "ends_at": "2026-10-17T01:00:00+05:30",
      "reason": "Equipment service"
    }
  ]
}

Day 0 is Sunday. Weekly times use the Identity facility timezone. A closing time before opening belongs to the next day. End 24:00 means next midnight. Equal times are invalid. Missing/null weekly_windows means unrestricted hours; [] means closed all week. Overlapping/adjacent opening intervals form one opening. Maintenance requires an explicit offset, an increasing interval, and a reason. Legacy metadata is preserved when supported rule keys change.

Booking plus its historical turnaround must fit fully within opening hours. Maintenance uses half-open intervals: a booking may end its turnaround exactly when maintenance starts, or start exactly when maintenance ends. At repeated local weekly boundaries, include both occurrences. A nonexistent weekly boundary provides no opening for that row on that date. The maintenance editor rejects nonexistent local times instead of shifting them silently.

Configuration responses add opaque version, using new before first persistence. Requests that include module_settings.surgeon_conflict_policy must supply its current version. A stale/missing version returns 409 STALE_WRITE. Other existing configuration callers remain supported; a supplied version is always checked. JSON settings merge by top-level key, so policy edits preserve module restrictions and other configuration. Validations still apply to the resulting configuration.

Scheduling And Lock OrderCopy Anchor Link

SchedulingLock acquires one transaction-scoped facility advisory lock before case, booking, theatre, or configuration row locks. Booking create/update, configuration update, and theatre update use it. Theatre availability is checked after the theatre row is reloaded under lock. Existing cross-theatre surgeon locks and database exclusion constraints remain in place.

An operation follows the settings committed before it acquired the lock. A later settings edit does not erase an earlier valid booking. Configuration and theatre edits use opaque versions to reject stale overwrites. Cancellation/postponement remain available when a new rule makes a booking unsuitable.

Surgeon policy remains warning or blocking. Warning requires confirmation and a reason. A confirmation cannot bypass blocking or an opening/maintenance conflict. Equipment tags remain display metadata, not qualification rules.

Review Projection And UICopy Anchor Link

The authorized day response adds review_conflicts on booked/confirmed slots. Types include outside_availability, maintenance_window, theatre_unavailable, and existing theatre/surgeon overlap types. Each row has type, blocking, and booking_id. Window conflicts have no other booking ID. The projection uses one bounded candidate query rather than one conflict query per displayed booking. It does not persist a second scheduling state or modify booking history.

The HTTP adapter maps rules and conflicts into typed DTOs. Settings provides separate policy and versioned theatre editors. Edits invalidate scoped schedule queries. The board displays review labels rather than a false schedule-ready label. Stale editors retain input until an explicit reload. Scope changes reset editors. Policy writes send only the version and policy. Availability row keys are local to an edit session and do not enter the API payload. A whole-draft replacement, such as explicit reload, must remount the availability editor to reset row identity. Settings uses UI-kit selects, checkbox, calendar, time, and combined date/time controls. Theatre name and code share a desktop row and stack on narrow screens. The OT booking editor uses the same controls. Incomplete or invalid clock text does not trigger timezone conversion and cannot enable a booking write. See shared date/time controls for their value and form contracts. No timezone conversion belongs inside the shared controls.

Standalone mock mode supports these controls as a prototype. It uses the fixed synthetic facility timezone and cannot prove RLS, real concurrency, or DST safety. Use real HTTP-mode acceptance and backend tests for those guarantees.

Release LimitsCopy Anchor Link

Implementation and merge are not deployment or acceptance. Record the deployed commit, actor, facility, and QA evidence before pilot use. This unit does not complete Lab, pharmacy, MAR, recovery, insurance, billing, or clinical clearance.