Recovery U6 Execution

Source HEAD: b0856fd0312721c8f390136811d813d8a8f855cc. Local U6 exposes U3-U5 through Clinical facility APIs. It is not programme U6. Status: implementation and accepted review repairs pass local verification. The CodeRabbit follow-up is complete; U7/U8 and release acceptance are separate.

Final parent checkpoint: the scoped CodeRabbit follow-up completed with no code finding. Its only suggestion was to remove execution metadata. This named execution record retains that evidence under the orchestration rules; durable behavior stays in the main Recovery guide. Post-commit canonical lint passed 157 files. Both forward-migrated and SQL-loaded schemas passed 797 tests and 6,846 assertions, with no failures/errors and one existing skip. U6 is committed and pushed as e37d0f9c346a88e628b30b4952b37fb9e9c651a1. The parent owns final verification, source commits, review receipts, the existing draft PR, and shipping. One writer edits at a time.

Owner: Clinical Hospital Recovery. Current patterns: Hospital BaseController, MarController, MarBlueprint, Lab request tests, and MAR Workqueue. Access composes existing policies. It is not a second permission resolver or clinical store. Shell owns RBAC; Admin owns flags. No migration or lockfile change is required. Pre-existing .context/ and .compound-engineering/ remain excluded.

Current EvidenceCopy Anchor Link

Results below are parent-reported. This documentation writer ran no tests, builds, database commands, or external review.

The controller now uses one Access instance per request. Each instance caches actor, source, policy, and readiness answers, including false and nil results. Commands still construct fresh checks across lock boundaries. This is not a cross-request or cross-lock authorization cache. The final results above cover the cache repair. The scoped CodeRabbit follow-up completed against an isolated snapshot, with no remaining code finding. The cache test observes real registry construction with no injected policy map; the current constructor loads the deployed YAML. It is not a filesystem profiler.

Test-first evidence also includes six initial HTTP missing-route failures and a cleaning-scope red: a Recovery-only nurse received 201 instead of 403 for an inpatient bed. The command now checks Recovery care area under lock. Current resource, ward, and room DTOs include per-row allowed_actions; occupied and other care-area beds do not offer cleaning. This grants no ward-care authority.

The six confirmed review repairs cover required board disclosure audit, denied observation-source isolation, normalized resource receipt UUIDs, permission-resolution scope, single-snapshot board counts, and persisted escalation lifecycle counts. Additional tests cover policy selection and case-first detail locks during concurrent correction. The lock monitor bypasses Rails query cache. Count fields share a snapshot; page rows and resource totals can reflect later commits. Writes still check current versions and ownership.

HTTP ContractCopy Anchor Link

All paths are relative to /clinical/facilities/:facility_id. Responses use { data, meta: { request_id, pagination? } }. Data includes evaluated_at and timezone. Errors use { data: null, error: { code, message, details }, meta: { request_id } }. Internal results and policies are not DTOs.

Commands accept only { command: { action, operation_key, input } }. Case/resource IDs come from paths. Provision input has no target ID. Other fields follow ResourceInput, StayInput, or CareInput. Versions are opaque strings. Only the HTTP adapter decodes numeric case/stay/bed versions. Parent, admission, and configuration timestamps remain exact strings. Unknown fields and versions such as 00, +1, numbers, or floats fail. New writes return 201; exact replay 200.

Receipts expose id, operation_key, action, authenticated actor_user_id, recorded_at, reason, and an action-specific whitelisted result. Exact lookups require current action/source authority, including after handoff. Authorized absence returns 200 with receipt: null and outcome: absent. Foreign family/case/resource keys have that same absence result. Errors 403, 409, 422, and 503 mean forbidden, conflict, invalid input, and unavailable. Unknown transaction outcomes require receipt reconciliation, not blind retry.

Board filters: status=all|active|waiting, resource_id, case_id, page, and per_page (1-100; default 25). POST adds search (at most 200 characters) for patient name, facility MRN, or case number. Rails filters redact search and command payloads; POST search suppresses SQL debug logs. Counts use the filtered, unpaginated population. Active stays have no date cutoff. Board rows never load observation or MAR histories. Detail uses the existing CareProjection.

Only GET recovery_resources adds data.policy_options and data.selected_policy for current RecoveryResourcePolicy update authority. Each identity contains only reference and computed content_hash. Selection must pass registry validation and facility scope. Other viewers receive neither field. An empty production registry gives authorized configuration users [] and null. This adds no approval text, clinical rules, permission, or activation.

Continuation And Clinical BoundariesCopy Anchor Link

U7 can call GET recovery/capability when ordinary Hospital context or the app flag blocks Recovery. It requires current base Recovery view and assignment, not the app flag, Recovery module, or manage_recovery for reading. It supplies facility_id, preset, display_name, capacity_model, configuration_version, evaluated_at, timezone, and route_scope: [recovery]. It grants no other module. read_available and continuation_available require current base authority. intake_available, provision_available, allowed_actions, and resource_actions are separate. Case actions also use current stay and approved policy context. App/module off removes receive/provision, not authorized active care, resource reconciliation, history, or receipts. Suspended practice removes writes; authorized GET and POST search remain available. Other shell gates stay intact.

Source status distinguishes available from forbidden. Observation values/IDs require canonical Observation view authority; denied sources do not query or expose escalation content. MAR retains MarPolicy and its source gate. Detailed readiness needs source permissions and Readiness view authority. Policy output contains reference/hash only. Production policy registry remains {}; synthetic policies and values grant no clinical approval.

Observation DTOs contain command-compatible kind, human display, value, unit, observed/recorded times, and authenticated provenance. Unsupported legacy kinds return null without losing display. Detail is bounded at 25; use paginated history for older values/corrections. Retired originals are not current values. Home discharge is always unavailable. No admission or encounter creation, signed discharge, ward orchestration, Pharmacy, insurance, or Billing is added.

Requirement Coverage And ScopeCopy Anchor Link

Actual U6 scope is 28 paths from git diff HEAD --name-only, not the initial 22-path list. This documentation correction changes only this guide. Paths below are relative to the repository root:

backend/domains/audit/test/audit_coverage_test.rb
backend/domains/clinical/blueprints/hospital/recovery_blueprint.rb
backend/domains/clinical/controllers/hospital/configurations_controller.rb
backend/domains/clinical/controllers/hospital/recovery_controller.rb
backend/domains/clinical/policies/hospital/recovery_policy.rb
backend/domains/clinical/policies/hospital/recovery_resource_policy.rb
backend/domains/clinical/routes.rb
backend/domains/clinical/services/hospital/recovery/access.rb
backend/domains/clinical/services/hospital/recovery/board.rb
backend/domains/clinical/services/hospital/recovery/care_command.rb
backend/domains/clinical/services/hospital/recovery/care_projection.rb
backend/domains/clinical/services/hospital/recovery/configuration.rb
backend/domains/clinical/services/hospital/recovery/handoff_authority.rb
backend/domains/clinical/services/hospital/recovery/http_input.rb
backend/domains/clinical/services/hospital/recovery/policy_registry.rb
backend/domains/clinical/services/hospital/recovery/resource_command.rb
backend/domains/clinical/services/hospital/recovery/stay_command.rb
backend/domains/clinical/test/policies/clinical_policy_matrix_test.rb
backend/domains/clinical/test/policies/hospital/recovery_policy_test.rb
backend/domains/clinical/test/requests/hospital/recovery_current_evidence_test.rb
backend/domains/clinical/test/requests/hospital/recovery_review_regressions_test.rb
backend/domains/clinical/test/requests/hospital/recovery_test.rb
backend/domains/clinical/test/services/hospital/recovery_policy_registry_test.rb
backend/domains/clinical/test/services/hospital/recovery_resources_test.rb
backend/test/support/hospital_recovery_care_helpers.rb
backend/test/support/hospital_recovery_request_helpers.rb
backend/test/support/rbac_helpers.rb
docs/guides/developer/hospital-surgery-center/recovery-u6-execution.md

Portable Check TemplatesCopy Anchor Link

These are commands for the parent, not new execution receipts. From backend/, use the repository Ruby version and PostgreSQL tools on PATH. Set TEST_DATABASE_URL to the explicitly assigned, prepared disposable database. Use existing non-bypass RLS grants and isolated runtime resources. Do not reset, seed, migrate, or repair shared data. This focused runner skips schema preparation:

DATABASE_URL="${TEST_DATABASE_URL:?Set assigned disposable test URL}" \
  RAILS_ENV=test PARALLEL_WORKERS=1 bundle exec rails runner - <<'RUBY'
require 'uri'
expected = URI.parse(ENV.fetch('DATABASE_URL')).path.delete_prefix('/')
actual = ActiveRecord::Base.connection.select_value('SELECT current_database()')
abort 'Unexpected test database' if expected.empty? || actual != expected
ActiveRecord.maintain_test_schema = false
$LOAD_PATH.unshift(Rails.root.join('test').to_s)
%w[
  domains/clinical/test/requests/hospital/recovery_review_regressions_test.rb
  domains/clinical/test/services/hospital/recovery_policy_registry_test.rb
  domains/audit/test/audit_coverage_test.rb
].each { |path| require Rails.root.join(path) }
RUBY

Record the observed seed and counts. This is a focused template, not a replay of a private runner. Canonical CI belongs to the parent and prepares its database. Only with explicit disposal authorization for CI_TEST_DATABASE_URL:

DATABASE_URL="${CI_TEST_DATABASE_URL:?Set assigned disposable CI URL}" \
  RAILS_ENV=test PARALLEL_WORKERS=1 bin/ci

Review Limits And Open GatesCopy Anchor Link

Recorded worker IDs: implementation 01a15b8d-56f4-7df0-b498-665a75af5be4, simplification 01a15ba0-ebb5-7ba0-a9d1-567955755ca4, repair 01a15bb5-1416-7393-869b-9ec01ca6f757. Parent collected and closed them. Requested Hospital profile pins are configuration, not served-model receipts. Actual served model/effort and measured token/cost usage are unavailable here. No different-provider receipt is claimed. The parent owns final receipt mapping.

The documentation correction is inline, sole-writer work without delegation. No model/effort was specified for it; no served-model receipt is available. No Git writes, database work, tests, builds, installs, or deployment ran here. No schema, grants, production registry, configuration, or clinical constant changed. U7/U8 integration, real-server/browser acceptance in both presets, clinical/facility D4/D5 approval, nursing authority rollout, deployment, and pilot acceptance remain separate open gates. Automated tests grant none.

Manual QA for the existing PR/issue remains open:

• Use separate Recovery, configuration, source-view, and denied accounts.
• Provision named groups/rooms/beds; compare actual counts with planning values.
• Receive a day-care case without an encounter; record/correct care and reload.
• Reconcile a lost response by exact key; revoke authority and repeat.
• Check foreign facility/tenant denial and no disclosure after audit failure.
• Disable intake; verify only authorized Recovery continuation remains.
• Check approved existing continuing-care targets; deny self-source/home discharge.
• Record named D4/D5 reviewers and separate deployment/pilot decisions.