Hospital Recovery U1 Execution
Source characterization evidence, verification limits and the next Recovery safety boundary.
Boundary
Source checkpoint: 4a40f034c8822a8252e691a4787fd0e1f9fa7447 plus local U1 tests and documentation on feat/hospital-nursing-discharge-u6-u8.
PR 2757 remains the single integration boundary.
The focused plan and Recovery guide define scope and the target contract.
U1 adds source characterization, a supported-writer/lock inventory, the proposed API/permission/receipt contract, a read-only reconciliation specification, and per-unit manual QA. It does not add or enable Recovery persistence, endpoints, UI commands, permissions, policies or discharge.
Evidence
The existing baseline passed 53 tests and 247 assertions, with no failures, errors or skips.
It covers canonical MAR source characterization, encounter clinical-data replacement and admission audit/bed operations.
The new Recovery suite passed 9 tests and 58 assertions, with no failures, errors or skips.
The final combined suite passed 62 tests and 305 assertions, with no failures, errors or skips.
Changed-test RuboCop passed with no offenses. Existing configuration/plugin warnings remain.
The Fumadocs production build passed and Pagefind indexed 509 pages. Its existing reports HTML warning remains unrelated.
Tests marked GAP deliberately capture reachable unsafe source behavior. They must change to preservation/rejection expectations when the relevant fix lands.
The first new-suite run exposed a synthetic enrollment clock error (INVALID_FIRST_SLOT).
The fixture clock now precedes the synthetic first dose. No production timing rule changed.
An initial baseline launch used the host's Ruby 4.0.7 and failed before Rails boot.
Verification uses the repository-required Ruby 3.4.9 explicitly.
Tests use the new disposable kulcare_hospital_recovery_u1_20261020_test database, cloned from the idle prior isolated Hospital CI database.
No existing database was reset. No development or staging data was changed.
This U1 run is not a new migration-built versus SQL-loaded parity proof.
Read-only metadata checks in that isolated database confirm bed RLS/force are off and bed-owned foreign-key count is zero. Room/ward/admission RLS is enabled and forced there. This evidence does not assert the current schema state of staging or production.
Review And Limits
CodeRabbit completed the approved eight-file U1 snapshot with zero findings.
The snapshot excludes application source, configuration, credentials, schema dumps, session artifacts and patient data.
The focused Compound review used a native adversarial reader; the external peer launcher requires npx, which repository rules prohibit.
No different-provider Compound receipt is claimed.
The first native review stopped before substantive review because decision-label filtering made its packet differ from the source.
The corrected packet uses an exact nine-file diff and excludes only the unchanged plan, which already has its separate six-lens document review.
The completed native review found a P2 contract defect: provisioning receipt lookup required an unknown created resource ID after a lost response. The contract now has a facility-scoped operation-key lookup with current configuration authority, and the QA guide covers that loss. The receiving actor's own authenticated handoff acknowledgement is also explicit. CodeRabbit reviewed the three corrected guides and completed with zero findings. The native P2 finding is resolved in the contract and QA specification. Runtime implementation remains later-unit work.
No production application code changed. Full backend/frontend CI, live browser QA, deployed-schema audit and clinical/capacity acceptance were not rerun or claimed for U1. Unit verification is the focused source regression, changed-test lint, documentation build and scoped review.
Open Safety Work
- Local U2 repairs source isolation/scoped references and adds shared occupancy/history constraints with both schema paths and enforced-role proof.
- Local U3 makes actual resource settings effective. Planning capacity cannot create beds.
- Local U4 protects competing writers and adds stay/move/handoff orchestration.
- Local U5 protects canonical observations and adds current-source care/readiness commands.
- Local U6-U8 add authorized HTTP/UI integration and full Recovery acceptance.
- Programme U8 still owns signed day-care discharge; D4/D5 policy/capacity and deployment/pilot gates stay open.
Manual QA
- Review the synthetic capacity-audit specification and D5 classification decisions with facility operations.
- Walk through receive, move, observations, escalation and handoff with nursing reviewers; record missing policy inputs without treating them as approval.
- Verify that live Recovery remains unavailable and no new clinical permission or policy was enabled.
Use the full per-unit QA guide during later delivery.