MAR and Recovery PR Review Repairs
Findings, repair decisions, verification and release limits for PR 2757.
Reviewed Source
PR 2757 uses integration branch feat/hospital-nursing-discharge-u6-u8.
The whole-PR review inspected 1993c60d6457e283a243cfcd1bab13829a8cbe82
against base 4fbc673f94d5ca19450fadaab1ff4240ba487ee6.
That merge preserved the base clinical read-only controls and both schema histories.
Only .context and .compound-engineering artifacts existed before repairs.
They are excluded from this work.
Findings And Decisions
The Compound review completed 14 lenses. A validator confirmed seven unique findings. CodeRabbit completed a separate source-only whole-PR review with 12 findings. The first CodeRabbit attempt exceeded its file limit and did not complete; the organization-scoped retry did. No cross-provider corroboration or actual serving-model receipt is available.
| ID | Repair |
|---|---|
| CE1 | Bind MAR retry, query, case-context and remount keys to the authenticated user. Verify direct and lookup receipt actors. Preserve unowned legacy intents for supervised recovery. |
| CE2 | Audit every MAR summary independently of page rows. Empty pages fail closed on audit failure. |
| CE3 | Batch history checks for the capped setup-gap list. Preserve reasons and full counts. |
| CE4 | Permit existing non-dose to non-dose corrections after stop/revision. Keep physical-dose authority, target and correction-window checks. |
| CE5 | Keep each resource draft's selected version until explicit reload. Block stale-draft save without discarding fields. |
| CE6 | Treat direct resource-unavailable conflict as a known rejection. Release its key only after fresh reads. |
| CE7 | Accept canonical dosage objects and arrays unchanged. Do not infer a schedule. |
| CR1 | Capture browser failure screenshots without repeating the overflow assertion. Preserve the original failure. |
| CR2, CR3, CR6, CR9 | Correct stale ownership, API, dashboard and QA descriptions. |
| CR4 | Use exact PostgreSQL blocking-PID array membership and a bounded observer backoff. |
| CR5 | Apply private-path, empty-database and non-bypass request-pool guards to the MAR browser harness. |
| CR7 | Use the shared 30-second polling constant. |
| CR8 | Require explicit Recovery evidence review on initial load and after changes. |
| CR10 | Reject new receive after a closed stay. Preserve active-stay conflict and exact-key replay. |
| CR11 | Rejected. A destructive down migration would remove clinical history. Current backend rules allow the documented forward-recovery procedure. Do not edit applied migrations. |
| CR12 | Require persisted audit evidence. Map nil, unsaved and raised audit failures to typed unavailability with rollback. |
| CI1 | Move clinical conflict rendering into the existing owning concern. Keep the lint ceiling unchanged. |
| CI2 | Expect the canonical admission writer's patient identity. Keep separate nullable legacy encounter coverage. |
| CI3 | Update CMS auth mocks without removing tab/read-only assertions. |
The scoped frontend review also found the case-context cache omission and missing real-hook/logout coverage. Both are included in CE1. It required object-shaped dosage regression coverage, included in CE7.
Execution And Proof
Native execution was used. Recovery scope and browser-safety helpers are the current comparable patterns. Backend changes stay in Clinical. No new source, permission resolver, migration, policy approval or schema change is introduced.
A read-only explorer mapped the backend repairs. One bounded implementer wrote backend code while the parent performed read-only preparation. A separate reviewer inspected stable frontend files only. No workers committed or published. Requested profiles were the named Hospital profiles. Actual served models, effort and total usage receipts are unavailable.
| Task | Worker ID | Requested profile |
|---|---|---|
| Backend source map | 01a15e68-69e0-78d3-a648-23e91ce1c73a | hospital_explorer |
| Backend repairs | 01a15e6a-eb00-7b61-82b3-cfa0f0803639 | hospital_implementer |
| MAR scope review | 01a15e6d-3687-74c1-acd4-610647742512 | hospital_reviewer |
| Reuse, quality and efficiency | 01a15e7d-139e-7d92-a7f0-deac58b60dae | hospital_reviewer |
| Test and comment value | 01a15e7d-1540-7d50-bff1-1136e88273e8 | hospital_reviewer |
All workers returned and were closed. The final simplicity pass found no useful behavior-preserving code change. One optional test-comment removal was not applied: that proof file stays protected from simplification edits. No safety check, test or clinical release gate was removed.
Expected failures were observed before MAR scope, resource-draft, review-checkbox and backend fixes. The initial full Hospital rerun also exposed source-outage fixtures that lacked the new identity contract. Those fixtures are now explicit; real identity readiness and logout use separate live MAR tests.
The scoped CodeRabbit correction review completed with two findings. Both were accepted: restrict the non-dose interval exception to the retained original event time, and remove the old owner-role claim from the MAR QA evidence section. Six changed-time regressions failed before the tighter guard. A changed time must pass historical authority; retaining a post-stop non-dose time remains valid. The four-file external follow-up completed with zero findings. Later Ruby formatting changed no behavior.
Focused checks pass: 119 backend tests with 3,087 assertions, 26 harness safety tests with 114 assertions, 22 CMS tests, 98 frontend repair tests and 11 retry/form tests. These are separate runs with overlap, not a combined test count. The retained-time follow-up passes 17 tests and 265 assertions. Strict Hospital types and the Hospital build pass. The build retains the existing large-chunk warning. Frontend CI passes with zero lint/test failures and 209 existing type errors below the unchanged 254 ceiling. Hospital has 446 passing tests across 46 files. This is not a clean platform typecheck.
Fresh real-HTTP Chrome journeys pass in both presets: Recovery has nine checks per preset with zero page errors; MAR has eight checks per preset. Every request pool uses the verified non-bypass role. Sessions are private mode-0600 files. Screenshots at wide and narrow widths were inspected. All isolated QA servers were stopped; existing demo servers were not changed. Docs build indexes 518 pages.
The first full backend pass had no test failures but was red on two harness formatting offenses, then corrected. Final canonical backend CI passes with 19,302 tests, 90,933 assertions, no failures/errors and eight skips. Pricing passes 20 tests and 26 assertions. Changed Ruby lint passes. This rerun includes the tighter retained-time guard. No CI baseline or migration changed in this repair batch.
Release Gates
- Record final canonical backend/frontend CI and changed-source diagnostics.
- Record fresh real-HTTP MAR and Recovery journeys in both presets under non-bypass RLS.
- Complete the scoped external correction review and resolve valid findings.
- Simmi records the deployed candidate and staging QA results.
- Named owners approve D4 clinical policy, D5 capacity and pilot acceptance.
- Programme U8 implements and validates signed ABDM discharge.
The PR stays draft while required gates remain open. Local care/handoff is not signed discharge. No deployed QA, clinical approval or pilot acceptance is claimed. The old Cloudflare Worker was deleted. Use the replacement Pages check on the actual pushed head; historical Worker failure is not a current build result.