Recovery U5 Execution

CheckpointCopy Anchor Link

This first checkpoint is historical. The parent review section below records the later fixes and verification. Local U6-U8 remain separate work.

• Source/final HEAD: d5f14d2b76e87f72e6a57f22932ca40ce8787f7f.
• Worktree: isolated local worktree.
• Branch: feat/hospital-nursing-discharge-u6-u8. Draft PR 2757 is unchanged.
• Tracked baseline was clean. Only excluded .context/ and .compound-engineering/ directories were untracked. Their contents were not read or changed.
• LOCAL U5 only. behavior_changed: true. Local implementation/checks passed. Parent verification and whole-plan completion remain open.
• No agents, staging, commits, PR mutations, review services, deployment, role provisioning, database reset, shared database repair, dependency install or lockfile changes.
• Plan selected sections only. Unchanged SHA-256: 3a539e03f3f52384c706bca06d47d965def138ea5db7618db92aa30847791384.

Behavior And CoverageCopy Anchor Link

Clinical owns all measurements and medications. Recovery stores references, not copied values. Pain uses supported exam / Assessment string storage; notes use exam / Clinical Notes. Numeric codes/units come from Observation::VITAL_SIGN_CODES. No scale, clinical threshold, medical advice or approval is invented.

Correction creates a new canonical observation and immutable link. Only original status changes to entered_in_error; all other original columns stay unchanged. Canonical current charts exclude it. Generic CRUD cannot rewrite/delete managed evidence. Category batch saves retain managed rows and replace normal rows. An explicit managed ID rejects the batch atomically. Source races return structured RECOVERY_MANAGED_SOURCE HTTP 409, not a PG500. Ordinary notes still save.

Escalation persists separate raised, acknowledged and resolved events. Resolution requires acknowledgement. Each event retains actor/time/reason, predecessor and current evidence references.

Assessments retain actual approved policy reference/hash, actor/time, source versions, blockers and blocked/ready/unavailable outcome. Missing policy stores unavailable evidence with null policy fields. Latest selection uses the serialized command's expected stay version, not random UUID order when recorded times are equal. A receipt is historical evidence, not a current-readiness assertion.

MAR obligations retain evaluated time, current versions, commands and occurrence references. Held/due/overdue/resumed-correction states stay distinct. Superseded/cancelled future slots remain prescriber history, not unresolved nursing care. clearance_asserted: false is preserved. Missing MAR policy, no recorded orders, unavailable evidence or an old assessment is not clearance.

CareCommand reuses the StayCommand result/savepoint/receipt/audit protocol. Stay commands lock facility scheduling before the case. Care-only commands lock the case without taking the scheduling lock. Both lock the operation key after the case, then the owner/stay before children. Four independent connection tests run under kulcare_rls_test. Version advancement remains unconditional even when recorded clock values are equal.

Handoff loads a real facility-scoped policy and checks receiving categories separately. It names an existing active same-patient care context, records receiving actor/acknowledgement, and retains current obligations. It does not discharge the patient or finish the case/encounter. Production config/hospital_recovery_policies.yml stays empty. Test policies are explicitly synthetic.

TestsCopy Anchor Link

New:

• backend/domains/clinical/test/services/hospital/recovery_care_test.rb
• backend/domains/clinical/test/services/hospital/recovery_readiness_test.rb
• backend/domains/clinical/test/services/hospital/recovery_writer_guards_test.rb
• backend/domains/clinical/test/services/hospital/recovery_care_concurrency_test.rb
• backend/domains/clinical/test/requests/recovery_observation_conflicts_test.rb

Modified:

• backend/domains/clinical/test/services/hospital/recovery_test.rb
• backend/domains/clinical/test/services/medication_mar/projection_test.rb
• backend/domains/clinical/test/policies/hospital/recovery_policy_test.rb

The stay tests now use a real test-only policy registry instead of a stubbed handoff approval. MAR tests add current references and missing-policy evidence. Policy tests add canonical observation authority and separate assessment/handoff categories.

Existing tests inspected and used unchanged:

• backend/domains/clinical/test/models/observation_test.rb
• backend/domains/clinical/test/requests/observations_test.rb
• backend/domains/clinical/test/services/encounters/save_clinical_data_service_test.rb
• backend/domains/clinical/test/requests/encounters_save_clinical_data_test.rb
• backend/domains/clinical/test/services/hospital/surgical_cases_test.rb
• backend/domains/clinical/test/models/hospital/recovery_evidence_bindings_test.rb
• backend/domains/clinical/test/models/hospital/recovery_source_encounter_test.rb
• backend/domains/clinical/test/services/hospital/recovery_concurrency_test.rb

Additional characterization inspected: Recovery characterization, MAR nursing/order/correction tests, current source guards and existing race helpers. No baseline increase or accepted test skip.

Observed Red And FindingsCopy Anchor Link

Each behavior change below had red or characterization evidence before its production change.

The lock inversion, clock regression, latest-assessment ordering and terminal-state mapping each passed after their repair. Repairs used current source contracts, not weaker test expectations.

Runner bootstrap failures (test load path/support dependency order) are not behavioral red proof. Initial incorrect URL-prefix 404s are also not envelope proof. Synthetic staff/document fixtures were aligned to actual enum, scan and upload constraints; no production constraint was weakened. No unresolved two-attempt production repair cycle remains.

Commands And ResultsCopy Anchor Link

Database commands used only kulcare_hospital_recovery_u5_20261021_test, cloned by the parent. No schema reload/reset, seed command, fixed shard creation, full CI or structure dump was run. Normal test-harness reference setup and generated-tenant fixture cleanup ran only in that database.

Commands below show portable equivalents from backend/. The runs used Ruby 3.4.9 and PostgreSQL 17. Machine-specific toolchain paths are omitted.

Candidate migration, exit 0:

DATABASE_URL=postgresql:///kulcare_hospital_recovery_u5_20261021_test RAILS_ENV=test PARALLEL_WORKERS=1 bundle exec rails runner 'abort "wrong database" unless ActiveRecord::Base.connection.select_value("SELECT current_database()") == "kulcare_hospital_recovery_u5_20261021_test"; ActiveRecord.dump_schema_after_migration = false; ActiveRecord::MigrationContext.new(Rails.root.join("db/migrate").to_s).run(:up, 20261021170001)'

Final focused tests, exit 0: 192 tests, 1,204 assertions, 0 failures, 0 errors, 0 skips. Seed 41661. Measured test runtime: 19.835962 seconds.

DATABASE_URL=postgresql:///kulcare_hospital_recovery_u5_20261021_test RAILS_ENV=test PARALLEL_WORKERS=1 bundle exec rails runner 'ActiveRecord.maintain_test_schema = false; $LOAD_PATH.unshift(Rails.root.join("test").to_s); %w[domains/clinical/test/services/hospital/recovery_care_test domains/clinical/test/services/hospital/recovery_readiness_test domains/clinical/test/services/hospital/recovery_writer_guards_test domains/clinical/test/services/hospital/recovery_care_concurrency_test domains/clinical/test/services/hospital/recovery_test domains/clinical/test/services/medication_mar/projection_test domains/clinical/test/requests/recovery_observation_conflicts_test domains/clinical/test/policies/hospital/recovery_policy_test domains/clinical/test/models/observation_test domains/clinical/test/requests/observations_test domains/clinical/test/services/encounters/save_clinical_data_service_test domains/clinical/test/requests/encounters_save_clinical_data_test domains/clinical/test/services/hospital/surgical_cases_test domains/clinical/test/models/hospital/recovery_evidence_bindings_test domains/clinical/test/models/hospital/recovery_source_encounter_test domains/clinical/test/services/hospital/recovery_concurrency_test].each { |path| require Rails.root.join(path) }'

Pre-change commands used the same environment/runner prefix with only the test files named in the red table. Intermediate green tests/assertions: 13/111, 52/470, 131/636, 190/1,183 and 191/1,191. These are checkpoints, not additional coverage.

Final changed-file lint, exit 0: 24 files inspected, 0 offenses. Existing configuration excludes the migration. Existing plugin/configuration warnings remain. The first cache attempt was denied outside the sandbox; later runs used --cache false. Focused rubocop -a formatting used the same explicit file list before the final read-only command.

bundle exec rubocop --cache false --force-exclusion --format json --out /tmp/recovery-u5-rubocop-final.json domains/clinical/services/hospital/recovery/care_command.rb domains/clinical/services/hospital/recovery/care_input.rb domains/clinical/services/hospital/recovery/care_projection.rb domains/clinical/services/hospital/recovery/policy_registry.rb domains/clinical/services/hospital/recovery/source_guard.rb domains/clinical/services/hospital/recovery/stay_command.rb domains/clinical/services/hospital/recovery/handoff_authority.rb domains/clinical/services/medication_mar/obligations.rb domains/clinical/services/hospital/surgical_cases/transition_service.rb domains/clinical/services/encounters/save_clinical_data_service.rb domains/clinical/controllers/observations_controller.rb domains/clinical/controllers/encounters_controller.rb domains/clinical/models/observation.rb domains/clinical/policies/hospital/recovery_policy.rb db/migrate/20261021170001_recovery_correction_source_integrity.rb domains/clinical/test/services/hospital/recovery_care_test.rb domains/clinical/test/services/hospital/recovery_readiness_test.rb domains/clinical/test/services/hospital/recovery_writer_guards_test.rb domains/clinical/test/services/hospital/recovery_care_concurrency_test.rb domains/clinical/test/services/hospital/recovery_test.rb domains/clinical/test/requests/recovery_observation_conflicts_test.rb domains/clinical/test/services/medication_mar/projection_test.rb domains/clinical/test/policies/hospital/recovery_policy_test.rb test/support/hospital_recovery_care_helpers.rb test/support/hospital_recovery_cleanup_helpers.rb

Other checks:

• git diff --check: passed.
• git rev-parse HEAD: expected source HEAD; no commit created.
• git status --short --untracked-files=no: clean before work.
• git status --short --untracked-files=normal: final allowed-path manifest plus excluded artifacts.
• ruby -c db/migrate/20261021170001_recovery_correction_source_integrity.rb: syntax check.
• Read-only psql confirmed exact owned database name, the local database role, migration marker 20261021170001, nullable assessment policy columns and the actual replacement constraint. Socket access first failed under the sandbox; reviewed per-command database access then succeeded. Permission settings were not changed.

Migration And SchemaCopy Anchor Link

New forward migration: 20261021170001_recovery_correction_source_integrity.rb.

• Replaces only clinical.protect_recovery_observation(). Retirement requires the same-stay linked replacement and immutable correction command, matching set key, actor, time, reason, replacement link ID and exact nullable care identity. Only original status may change.
• Makes assessment policy_reference/policy_hash nullable. The replacement recovery_assessment_contract permits both null only for unavailable with POLICY_UNAVAILABLE.
• No new table, index, RLS policy, grant or clinical constant.
• SQL has only the narrow forward splice and one migration marker. No dump regeneration. Published U2/U4 migrations are unchanged.
• Down raises IrreversibleMigration to preserve evidence. Use forward repair.
• Production correction never disables a trigger. Existing synthetic fixture cleanup is limited to the generated tenant in the disposable database.
• Parent owns canonical forward/SQL-load parity and deployment lock review.

Changed PathsCopy Anchor Link

• backend/db/structure.sql
• backend/domains/clinical/controllers/encounters_controller.rb
• backend/domains/clinical/controllers/observations_controller.rb
• backend/domains/clinical/models/observation.rb
• backend/domains/clinical/policies/hospital/recovery_policy.rb
• backend/domains/clinical/services/encounters/save_clinical_data_service.rb
• backend/domains/clinical/services/hospital/recovery/handoff_authority.rb
• backend/domains/clinical/services/hospital/recovery/stay_command.rb
• backend/domains/clinical/services/hospital/surgical_cases/transition_service.rb
• backend/domains/clinical/services/medication_mar/obligations.rb
• backend/domains/clinical/test/policies/hospital/recovery_policy_test.rb
• backend/domains/clinical/test/services/hospital/recovery_test.rb
• backend/domains/clinical/test/services/medication_mar/projection_test.rb
• backend/test/support/hospital_recovery_cleanup_helpers.rb
• backend/config/hospital_recovery_policies.yml
• backend/db/migrate/20261021170001_recovery_correction_source_integrity.rb
• backend/domains/clinical/services/hospital/recovery/care_command.rb
• backend/domains/clinical/services/hospital/recovery/care_input.rb
• backend/domains/clinical/services/hospital/recovery/care_projection.rb
• backend/domains/clinical/services/hospital/recovery/policy_registry.rb
• backend/domains/clinical/services/hospital/recovery/source_guard.rb
• backend/domains/clinical/test/requests/recovery_observation_conflicts_test.rb
• backend/domains/clinical/test/services/hospital/recovery_care_concurrency_test.rb
• backend/domains/clinical/test/services/hospital/recovery_care_test.rb
• backend/domains/clinical/test/services/hospital/recovery_readiness_test.rb
• backend/domains/clinical/test/services/hospital/recovery_writer_guards_test.rb
• backend/test/support/hospital_recovery_care_helpers.rb
• docs/guides/developer/hospital-surgery-center/recovery-u5-execution.md

Exclusions And Open GatesCopy Anchor Link

No new Recovery routes/HTTP activation, frontend, shell RBAC, Admin flags, permission catalogue, dependencies, lockfiles, credentials or local configuration changed. Existing generic error boundaries changed only because their conflict regression required it. U6 owns scoped reads, source redaction, Blueprinter/API contracts and receipt endpoints. U7 owns UI integration.

Policy requirements are structural evidence/freshness and authority contracts. Explicit authorized human assessment is required; this is not an automated clinical score. The empty production registry does not provide nursing approval.

Parent owns authoritative review, canonical CI, Identity RBAC/full suites, SQL-load parity, docs build, integrated HTTP/browser journeys, commits and PR updates. No external review receipt exists. Narrow inline lint suppressions cover unconditional version touch, status-only SQL correction and the direct SQL guard test; database guards remain active and parent review is open.

D4 nursing/readiness/handoff approval, D5 facility/capacity approval, manual QA, deployment and pilot acceptance remain open. Programme U8 signed home discharge stays unavailable.

Manual QACopy Anchor Link

Not performed. Use synthetic records in the approved test harness or the later U6/U7 boundary.

• Record vitals/pain/notes with an assigned nurse and both permissions. Reload canonical values, units, observed time and server provenance.
• Correct a measurement. Confirm original history and only the corrected current chart value.
• Raise, acknowledge and resolve escalation. Inspect distinct actor/time/reason history.
• Assess, then alter observations, MAR or document evidence. Confirm old readiness is ineffective.
• Check held/due/overdue/resumed correction, no orders, unavailable source and absent policy.
• Confirm generic managed mutations return 409 atomically while ordinary notes still save.
• Replay an exact key, change its payload, then revoke authority. Confirm one receipt, changed-payload conflict and fresh authorization before replay.
• Accept a valid continuing-care context under approved test policy. Inspect unresolved references/blockers, source-bed cleaning and unchanged case/encounter.
• Confirm signed home discharge stays unavailable and production policy registry is empty.

Route And UsageCopy Anchor Link

implementation_engine_binding: null; run_id: null. Requested/actual route: sole native inline writer. No fallback, detached worker, delegation or commit. No model/effort was requested in this task. The guide's configured implementer profile is a reference, not a serving receipt. Actual model/effort and token/cost usage receipts are unavailable. No usage estimate is made.

standalone_shipping_skipped: true; settled_decision_conflicts: []. Local U5 is ready for parent verification. This does not complete the whole plan or approve release.

Review Finding #1: Canonical Observation OwnershipCopy Anchor Link

This section records only the bounded finding #1 fix. It does not change findings #2-5 or the parent review receipt. This writer did not run an external review.

Source And ScopeCopy Anchor Link

• Source and terminal HEAD: d5f14d2b76e87f72e6a57f22932ca40ce8787f7f.
• Branch: feat/hospital-nursing-discharge-u6-u8.
• Preflight matched the supplied 30 tracked dirty paths. No pre-existing untracked files were listed outside the excluded .context/ and .compound-engineering/ paths. Neither excluded path was inspected.
• One inline implementation writer. No delegation, stage, commit, push, branch change, deployment, configuration edit or permission change.
• Requirements: R4 correction history, R5 canonical encounter context, R8 existing authorization/RLS boundaries, KTD3 canonical values, and U5/AE6 alternate-writer protection. No new routes, grants, policies, migrations or dependencies.
• Comparable patterns: current Observation Blueprinter views, encounter clinical data preloads, SaveClinicalDataService, and the CMS composite hook and shared UI-kit Badge. No new service, transport or query-key pattern was introduced.

Behavior ChangedCopy Anchor Link

Canonical normal/detailed Observation responses now include a boolean recovery_managed. It comes from the persisted Recovery observation link, not from a code or value match. No case, bed, stay or link reference is added to the response. List, nested encounter and batch-result serialization preload the link instead of issuing a new query for each observation.

The actual CMS composite hook excludes managed and retired observations from editable encounter snapshots. It returns current managed records separately. The encounter page shows these records, values, units, statuses and observed times in a read-only section with shared UI/theme components. It adds no edit control or unauthorized Hospital link.

The exported actual buildBatchPayload filters managed and retired notes/vitals before mapping or deriving existing BMI values. The legacy saveObservations path deletes only editable exam records and creates only editable inputs. Ordinary records with identical clinical codes and values remain distinct and can still save. The backend explicit managed-ID guard is unchanged and still returns structured 409. Canonical APIs retain entered-in-error history; no global history filter was added.

Changed PathsCopy Anchor Link

• backend/domains/clinical/models/observation.rb
• backend/domains/clinical/blueprints/observation_blueprint.rb
• backend/domains/clinical/controllers/observations_controller.rb
• backend/domains/clinical/controllers/encounters_controller.rb
• backend/domains/clinical/services/encounters/save_clinical_data_service.rb
• backend/domains/clinical/test/requests/recovery_observation_ownership_test.rb (new)
• frontend/packages/shared-services/src/domains/clinical/types.ts
• frontend/apps/cms/src/features/encounter/hooks/useEncounterClinicalData.ts
• frontend/apps/cms/src/features/encounter/hooks/__tests__/useEncounterClinicalData.recovery.test.ts (new)
• frontend/apps/cms/src/features/encounter/pages/EncounterPage.tsx
• frontend/apps/cms/src/features/encounter/pages/__tests__/EncounterPage.readOnly.test.tsx
• frontend/apps/cms/src/features/encounter/components/RecoveryObservations.tsx (new)
• This execution record (append only).

Existing Tests InspectedCopy Anchor Link

Backend paths below are relative to backend/domains/clinical/test/.

• requests/recovery_observation_conflicts_test.rb: all three conflict cases; unchanged and rerun.
• services/hospital/recovery_writer_guards_test.rb: all four writer guard cases; unchanged and rerun.
• services/hospital/recovery_care_test.rb: record/reload/correction provenance case; unchanged, not rerun in this bounded fix.
• requests/observations_test.rb: tenant, category and pagination cases; unchanged, not rerun.
• services/encounters/save_clinical_data_service_test.rb: create and category replacement cases; unchanged, not rerun.
• requests/encounters_save_clinical_data_test.rb: request setup and current baseline notes; unchanged, not rerun.

CMS paths below are relative to frontend/apps/cms/src/features/encounter/.

• hooks/__tests__/clinicalDataParsers.test.ts: parser patterns; unchanged and rerun.
• pages/__tests__/EncounterPage.mar-guard.test.tsx: conflict UI and access cases; unchanged and rerun.
• pages/__tests__/EncounterPage.readOnly.test.tsx: save/finalize, suspended practice, conflict and old-response cases; retained and rerun. One Recovery read-only rendering/save case was added.

Proof And CommandsCopy Anchor Link

All commands ran from the existing workspace. No install, full build, canonical CI, schema preparation or external review command ran. Backend tests used only kulcare_hospital_recovery_u5_20261021_test. Schema maintenance was disabled.

Before production edits, from frontend/:

pnpm --filter @kulcare/cms test:run src/features/encounter/hooks/__tests__/useEncounterClinicalData.recovery.test.ts
pnpm --filter @kulcare/cms test:run src/features/encounter/pages/__tests__/EncounterPage.readOnly.test.tsx

• Hook/builder RED: exit 1, three tests failed. The actual builder emitted five notes instead of one. The hook exposed five editable notes instead of one. The legacy saver attempted managed and retired deletes instead of only the ordinary row.
• Page RED: exit 1, one failed and five passed. The Recovery read-only region was absent. Existing page tests also emitted React act(...) warnings.

Before production edits, from backend/:

RAILS_ENV=test PARALLEL_WORKERS=1 DATABASE_URL=postgresql:///kulcare_hospital_recovery_u5_20261021_test bundle exec rails runner 'ActiveRecord.maintain_test_schema=false; $LOAD_PATH.unshift(Rails.root.join("test").to_s); require Rails.root.join("domains/clinical/test/requests/recovery_observation_ownership_test")'

The first sandboxed attempt could not connect to local PostgreSQL (Operation not permitted). The per-command escalated attempt found a wrong relative test helper path. That test-only path was corrected before production edits. The same command then produced the expected RED: exit 1, two runs, 11 assertions, zero failures, two errors. Both errors were KeyError: key not found: "recovery_managed" on canonical responses. No database repair or role provisioning was attempted.

Final focused backend check, from backend/, with per-command database access:

RAILS_ENV=test PARALLEL_WORKERS=1 DATABASE_URL=postgresql:///kulcare_hospital_recovery_u5_20261021_test bundle exec rails runner 'ActiveRecord.maintain_test_schema=false; $LOAD_PATH.unshift(Rails.root.join("test").to_s); require Rails.root.join("domains/clinical/test/requests/recovery_observation_ownership_test"); require Rails.root.join("domains/clinical/test/requests/recovery_observation_conflicts_test"); require Rails.root.join("domains/clinical/test/services/hospital/recovery_writer_guards_test")'

Exit 0: 10 runs, 138 assertions, zero failures/errors/skips (seed 12693). The three new request cases cover metadata/no workflow-reference disclosure, bounded link queries on both list endpoints, retained entered-in-error history, an enforced tenant-RLS-role read, and two real endpoint save/reload rounds. Fixtures include final, corrected and entered-in-error managed notes/vitals plus ordinary notes/vitals with identical values. Managed IDs, statuses and full persisted attributes stay unchanged. Existing conflict tests cover direct update/delete, explicit managed-ID batch rejection and atomic conflict handling. An earlier passing focused run had 9 runs and 94 assertions before the fixture and enforced-role coverage were expanded.

Final focused frontend check, from frontend/:

pnpm --filter @kulcare/cms test:run src/features/encounter/hooks/__tests__/useEncounterClinicalData.recovery.test.ts src/features/encounter/pages/__tests__/EncounterPage.readOnly.test.tsx src/features/encounter/pages/__tests__/EncounterPage.mar-guard.test.tsx src/features/encounter/hooks/__tests__/clinicalDataParsers.test.ts

Exit 0: four files, 60 tests passed. The three new hook tests call the real exported builder and real composite hook. They cover ownership/status exclusion, two builder save/reload rounds, same-value ordinary rows and legacy delete/create calls. Transport is mocked in these CMS tests; this is not live HTTP integration proof. The page test renders the actual new read-only component and confirms no edit controls and no managed rows in the submitted editor snapshot. Existing React act(...) warnings and i18next debug output remain; no warning-free claim is made. Both final focused checks passed without a failed production repair round.

Review Limits And Manual QACopy Anchor Link

No additional required consumer edit was found. The existing Copy Previous loader uses the same composite hook, so it receives the filtered editable slices. No other consumer file was changed. No new clinical constant, approval, mock fallback, migration, lockfile, schema, RBAC, policy, MAR or locking change belongs to this fix.

Request tests stub request authentication/authorization to isolate serialization and writer behavior. The separate enforced-role case exercises tenant RLS. These tests do not replace the parent's real-actor API/RBAC verification. No browser screenshot, live HTTP CMS journey, full CI, schema parity, lint, typecheck, build, CE or CodeRabbit check ran in this bounded writer task. The parent retains those gates and its existing review receipt. D4/D5 approval, nursing QA, deployment, signed discharge and pilot acceptance remain separate and open.

Manual QA was not performed:

• With synthetic current and corrected Recovery notes/vitals, open CMS and confirm current values, units, status and observed time are read-only.
• Save an ordinary note and vital twice, then hard reload. Confirm no extra Recovery copy and no retired value returned to the current editor/chart.
• Read canonical history and confirm the original entered-in-error records retain their IDs, values and times.
• Use an observation-only reader and confirm the new field is boolean only, with no case/bed/stay/link reference or Hospital action grant.
• Check narrow/wide views and keyboard use. Confirm the read-only values fit without obscuring editor controls.
• Attempt generic managed update/delete and an explicit managed-ID batch edit. Confirm structured 409 and no partial ordinary edits.

Requested role: single bounded implementation writer. The guide profile is hospital_implementer, configured as gpt-6.1-sol / high. The worker did not spawn another profile or change model/effort settings. Actual served-model, reasoning-effort, worker-ID, token and cost receipts are unavailable. No configured value or self-report is offered as a served-model receipt. This fix is ready for parent verification, not clinical release.

Parent Review And FixesCopy Anchor Link

The Compound review completed as run 20261021-recovery-u5 against HEAD d5f14d2b76 and its stable U5 diff. Ten lenses produced eight claims. The merge and independent validation stages retained five defects. The initial verdict was Not ready. That receipt is not a clean-review claim for the fixes.

Observed parent red proof:

• Policy selection, handoff revocation and correction-kind tests: 44 tests, 426 assertions, five failures, no errors or skips.
• Controlled care/stale-OT race: five tests, 64 assertions, one PostgreSQL deadlock error. The report named both real backend PIDs and the lock cycle.
• Direct correction-receipt guard: 12 tests, 26 assertions, one failure because the old function allowed a different measurement kind to retire the original.

The new database guard requires the same canonical observation code/category. Negative non-bypass tests cover missing or mismatched receipt action, actor, time, reason, result link and stay, plus incomplete assessment policy identity. The new tests do not disable production guards.

Parent verification after those repairs:

• Policy/replay/correction/locking group: 49 tests, 513 assertions, no failures, errors or skips.
• Final contention tests: six tests, 81 assertions, no failures, errors or skips.
• Fresh forward migration database: 732 tests, 6,150 assertions, no failures or errors, one existing policy-matrix skip.
• Fresh SQL-load database: the same 732 tests, 6,147 assertions, no failures or errors, the same existing skip.
• Both schema paths have trigger MD5 fa9b44fb7859ab1dd7108231f460f68f, the same assessment constraint and the intended nullable policy columns.
• Parent CMS focused tests: 14 passing tests. Existing React act warnings remain.

The schema databases are disposable: kulcare_hospital_recovery_u5_migration_final_20261021_test and kulcare_hospital_recovery_u5_sql_final_20261021_test. The forward path used the actual migration context from the U4 schema. The SQL path loaded the final schema directly. Neither path used development or staging data.

The first full backend run found missing policy-matrix rows. They were added with real permission checks and synthetic category arguments, not skip entries. The next full run passed all 18,957 domain tests but failed five new style checks. Style fixes and the final larger run remain separate evidence. Frontend diagnostics also found one new incomplete test-fixture cast under the existing type baseline. The fixture now supplies its complete typed data. No baseline was increased, and a ratchet pass is not called a clean typecheck.

CodeRabbit DecisionsCopy Anchor Link

The approved scoped CodeRabbit agent review completed with five findings.

• Applied: portable guide paths and measurement-kind protection in the command and database. A current follow-up must also inspect the CMS fix.
• Applied the managed-copy defect with persisted ownership, not the suggested value/code deduplication. The latter would erase distinct ordinary events.
• Rejected the unconditional reversible-migration claim. Backend instructions permit explicit forward recovery. Restoring the old constraint can make retained missing-policy evidence invalid; this migration fails down explicitly.
• Did not add multiple current assignment support. The proposed state violates the supported Staff.user_id, StaffRole staff/facility and live PractitionerRole uniqueness contracts. Staff and practitioner roles are already checked separately. No production incidence was established.

The mandated cross-model launcher requires npx, which repository instructions prohibit. The local adversarial lens ran instead. This is not an independent provider receipt. Fixed Hospital profiles have no observed served-model, reasoning-effort or billing receipt.

The parent dispatched writer 01a15b6b-b5bb-7ff1-94aa-c6bb45233286 only for finding #1. The writer did not delegate. The parent inspected its actual paths and retained ownership of all verification, commits and PR changes.

Final Automated CheckpointCopy Anchor Link

The parent completed the final backend CI run: 18,979 domain tests and 88,726 assertions passed, with eight existing skips. All 20 pricing checks passed. Changed-file lint inspected 128 files with no offenses.

Frontend CI passed lint, tests and the type-error ratchet. The workspace retains 214 existing type errors; this is not a clean strict typecheck. The new CMS fixture error was fixed without raising the baseline. Hospital and CMS builds passed, with existing large-chunk warnings. The docs build indexed 513 pages.

Two bounded source re-reviews found no remaining defects in the five accepted findings. The CodeRabbit follow-up completed with one minor guide-format finding, which was fixed. The last patient-list and bulk-vitals ownership preloads came after that review snapshot. Parent regression tests passed: 39 tests and 222 assertions. Final backend CI includes those changes. Whole-PR review in U8 must cover the integrated source again.

Remaining GatesCopy Anchor Link

Local U6 HTTP and U7 UI are not delivered by this unit. No deployment, manual QA, D4/D5 or pilot approval is implied. The checks below remain manual gates.

• Revoke only the handoff permission, then only the approved receiving category. Confirm exact replay returns no receipt and does not release again.
• Change only the facility MAR policy selection after assessment. Confirm readiness becomes stale/unavailable while recorded outcomes remain history.
• Attempt a different-kind correction. Confirm original value/status remain unchanged and no new correction link is stored.
• Run the CMS current/corrected observation round-trip checks above after the paired backend/frontend deployment.