Recovery U7 Execution

Source HEAD: e37d0f9c346a88e628b30b4952b37fb9e9c651a1. The writer verified this full HEAD before edits. The only initial untracked paths were .context/ and .compound-engineering/. Both remain unread and unchanged. This is local frontend work, not deployment or clinical acceptance. The parent owns the integration commit, existing draft PR, canonical CI, integrated review, browser acceptance, and release decisions.

Contract And ImplementationCopy Anchor Link

Owner: Clinical Hospital Recovery. The frontend consumes U6 through the shared API client. Comparable implementations are hospitalMarApi, marRetryStore, useMARCommand, LiveMARPage, and the versioned configuration editor. Shell owns authentication and RBAC. Admin owns flags. No owner moved.

Recovery has runtime-validated camel-case DTOs, string versions, scoped query keys, and private command recovery. Its keys extend the Hospital base prefix with authenticated user.id. MAR keys and pending records are unchanged. Live calls require a real facility profile and user ID. A scope-keyed remount removes old selections, drafts, and search. Aborted old writes cannot update the new scope or clear its pending record.

Search uses the private POST endpoint. Search text is not a URL selector, query key, persisted field, or log message. Search revision keys are memory-only. URLs accept UUID selectors, supported status, and pagination only. MAR return uses only returnTo=recovery; it does not accept a return URL.

Each command has one stable key. An uncertain response blocks new commands. Only an authorized exact lookup with receipt: null and outcome: absent permits an exact-payload retry. Forbidden, missing-route, unavailable, timeout, and malformed results remain unresolved. A confirmed receipt does not clear pending state until current readers refresh. Direct known rejections also require refresh before a new action. A reused-operation conflict is not cleared.

Session storage holds scope, selectors, action, versions, source fingerprint, field shape, and payload digest. It holds no observation values, notes, human search, resource labels, or clinical assessment values. Reload recovery uses the saved safe envelope and exact re-entry of private fields. Digest mismatch cannot send a replacement. Invalid saved data requires supervised reconciliation.

The live board uses canonical resources and server population counts. The inspector uses current server actions, linked observation corrections, authenticated provenance, paginated history, escalation events, current gate evidence, and existing eligible continuing-care targets. It has no second MAR form, admission creator, free-text receiving actor, or home-discharge control. The original mock page remains behind explicit development/test mock mode.

Resource settings provision actual wards, rooms, and beds. Changes carry current target and parent versions. Operational cleaning uses row actions, not configuration authority. The board also offers row-authorized cleaning without opening settings, including intake-off continuation. Occupied and non-Recovery resources have no board cleaning control. Conflicts require current records, not overwrite. Planning values and preset selection do not create resources. Policy choices come only from the installed server options. Clearing selection sends null through the current versioned configuration service. An empty production registry remains unavailable, not approved or ready.

Exact /hsp/recovery delegates from authenticated shell routing to the Hospital capability boundary. Its scope must be exactly Recovery. Ordinary context is not required for that continuation. Other Hospital routes retain the existing flag and module gates. Navigation uses the same capability. Case and dashboard read the same Recovery query families; confirmed writes invalidate the Hospital base prefix and canonical clinical reader families. Live case workflow control does not offer unsigned completion or a readiness transition from stored Recovery status. It links to the current Recovery workbench. The recorded case step remains distinct from current gate evidence.

Pattern departures are limited to actor-specific Recovery subkeys and retry storage, and the exact continuation route. The existing profile ID is role-based, not a user identity. The ordinary Hospital context cannot authorize continuation when intake is disabled. These changes do not replace platform authorization.

Requirement EvidenceCopy Anchor Link

Synthetic fixtures are test data, not a source for clinical constants or approval. Observation kinds and units follow the current canonical Observation/CareInput contract. No thresholds, scores, policy rules, or nursing authority were inferred.

Proof Before BehaviorCopy Anchor Link

• Baseline: the five assigned existing suites passed, 35 tests. Hospital strict typecheck exited zero before implementation.
• The initial adapter/retry suites failed because the live service did not exist. The live component suite also failed on its missing live-page import.
• A functional version regression exposed 00 reaching transport. The input validator now rejects noncanonical numeric-version strings before transport.
• A functional receipt regression rejected a second-precision timestamp with INVALID_RESPONSE. The actual Blueprinter initializer uses iso8601 without fractional precision. Responses now accept valid serialized precision, while command times and timestamp versions retain the six-digit UTC input contract.
• A retry regression exposed missing saved safe versions/selectors. The private envelope now retains these without clinical values or human labels.
• The shell test failed at the ordinary flag gate before exact delegation. Layout continuation tests failed before capability-based continuation.
• A live case regression exposed Complete case from stored ready_for_discharge. The Recovery-phase control now links to current care. The affected two suites then passed all 30 tests; mock completion is unchanged.
• A late path check found that settings-only cleaning did not support narrow continuation. The first test hit an ambiguous text selector. With that selector fixed, characterization of the original read-only row failed on the missing resource-reason field. The row-control repair then passed the final 33-test Recovery check without a settings request. The selective red excluded the other 17 tests in that file; the final whole-file check ran all 18.

The first UI run found an icon component passed where PageHeader needs an element. Type narrowing was also required for shell user ID. Test repairs used JWT claims rather than a nonexistent persisted selected-profile field, keyboard Select input, and explicit calendar-day selection rather than assumed focus. No repair assumption required a second unsuccessful repair cycle.

VerificationCopy Anchor Link

All pnpm commands run from frontend/. The first package run passed 379 tests across 40 suites before the live case guard. The second package run passed 380 tests across 40 suites in 174.10 seconds. That second run precedes the final board-cleaning row control. The final focused Recovery check, typecheck, lint, and build include that last repair. At the parent's handoff request, no third package-wide run started. Parent canonical verification must cover the final integrated tree. No workspace build ran.

Existing tests inspected include Recovery/MAR, configuration effects, surgical case detail, layout switcher, live workflow states, MAR HTTP/transport/retry, and live MAR. Changed old assertions remove the obsolete Recovery placeholder and recognize the capability boundary. They do not remove sibling-module gates.

No test code is skipped or disabled by this unit. The selective case red used -t 'does not offer unsigned Recovery completion'; that command excluded the other 12 tests in that file. The subsequent whole-file run passed all 13. Existing interaction suites emit React act warnings. No warning baseline, type baseline, package, or lockfile was changed. Component service mocks do not prove real HTTP authorization, RLS, transactions, audit delivery, both-preset browser layout, or resource races.

Changed PathsCopy Anchor Link

Paths below are relative to the repository root.

frontend/apps/hospital/src/services/hospitalRecoveryApi.ts
frontend/apps/hospital/src/services/recoveryTypes.ts
frontend/apps/hospital/src/services/recoveryRetryStore.ts
frontend/apps/hospital/src/services/hospitalQueryKeys.ts
frontend/apps/hospital/src/features/recovery/useRecoveryScope.ts
frontend/apps/hospital/src/features/recovery/useRecoveryCommand.ts
frontend/apps/hospital/src/features/recovery/pages/RecoveryPage.tsx
frontend/apps/hospital/src/features/recovery/pages/LiveRecoveryPage.tsx
frontend/apps/hospital/src/features/recovery/components/RecoveryControls.tsx
frontend/apps/hospital/src/features/recovery/components/RecoveryInspector.tsx
frontend/apps/hospital/src/features/recovery/components/RecoveryResourceEditor.tsx
frontend/apps/hospital/src/features/recovery/components/RecoveryResourceRow.tsx
frontend/apps/hospital/src/features/recovery/components/RecoveryCasePanel.tsx
frontend/apps/hospital/src/features/recovery/components/RecoveryMetric.tsx
frontend/apps/hospital/src/features/configuration/pages/HospitalConfigurationPage.tsx
frontend/apps/hospital/src/features/surgicalCases/pages/SurgicalCaseDetailPage.tsx
frontend/apps/hospital/src/features/dashboard/pages/HospitalDashboardPage.tsx
frontend/apps/hospital/src/features/mar/pages/LiveMARPage.tsx
frontend/apps/hospital/src/layouts/HospitalLayout.tsx
frontend/apps/hospital/tests/recovery-fixtures.ts
frontend/apps/hospital/tests/recovery-http-api.test.ts
frontend/apps/hospital/tests/recovery-retry-store.test.ts
frontend/apps/hospital/tests/recovery-live.test.tsx
frontend/apps/hospital/tests/recovery-layout.test.tsx
frontend/apps/hospital/tests/live-mar.test.tsx
frontend/apps/hospital/tests/live-workflow-states.test.tsx
frontend/apps/hospital/tests/live-configuration-effects.test.tsx
frontend/apps/shell/src/components/AppRoutes.tsx
frontend/apps/shell/src/components/__tests__/AppRoutes.test.tsx
docs/guides/developer/hospital-surgery-center/recovery-u7-execution.md

Open Gates And ExclusionsCopy Anchor Link

No backend, migration, SQL, package, lockfile, shared theme, auth-core, plan, or agent configuration changed. No delegation, external review, install, Git write, server, database command, deploy, or policy activation ran. Port 3006 was left alone. No implementation or review result from a different agent is claimed.

The Hospital profile guide requests gpt-6.1-sol with high effort. This writer did not change model or effort. A served-model/effort receipt and measured token/cost usage are unavailable. No worker was launched, and no harness worker ID is available here. Configuration is not an observed receipt.

The parent must retain these gates and copy concrete QA steps to the existing PR or issue. Automated tests do not grant D4/D5, nursing, deployment, or pilot approval.

• Run authenticated real-HTTP journeys in both presets at 390px and 1440px.
• Provision groups, rooms, and beds; rename, classify, move parents, and test occupied-parent refusal.
• Receive, move, clean, observe, correct, and compare board/case/dashboard after hard reload.
• Raise, acknowledge, resolve, and reassess using an approved test policy; verify stale evidence and unavailable sources.
• Recover lost responses, denied lookup, exact absence, refresh failure, and identity/facility/profile changes.
• Complete MAR round-trip, keyboard checks, pagination, and existing continuing-care handoff; refuse home discharge.
• Run parent canonical CI and integrated review. Record all remaining accepted exceptions explicitly.
• Record separate manual QA, D4/D5, nursing authority, deployment, and pilot decisions.

Handoff state: waiting for parent integration and review. The sole source writer stops writing at handoff. No remaining local command is running. The changed paths above are the complete 30-path unit, including tests and this guide.

Bounded Review RepairsCopy Anchor Link

This subsection records the repair batch from /tmp/recovery-u7-repairs-packet.md. It supersedes the earlier verification and path counts for this local handoff. HEAD still equals e37d0f9c346a88e628b30b4952b37fb9e9c651a1. Before edits, git diff HEAD -U8 | shasum -a 256 matched 52039336805b19e94db3ab68f397dd54dabf63fbcf12001ad07f5193d03ad689. The staged candidate retains that hash. No source mismatch or unexpected edit was found. Prior staged work and excluded artifacts remain intact.

All eight confirmed CE findings were applied. None was skipped. The completed review report and separate CodeRabbit log were read; no review was rerun.

CodeRabbit outcomes: denied ordinary context no longer blocks confirmed cleaning; the pending key clears once. Broad Hospital invalidation marks data stale without making unrelated readers decide command success. Clinical source families remain invalidated. Saved policy writes retain success after unrelated query failure; current resource errors stay visible. Observation tests use Date-only mocking at a fixed mid-month date and restore it. Actual Calendar checks show the prior day on October 1, but not November 1, because outside days depend on the visible grid.

Retained gaps are covered. Nested record/correct retry reloads preserve arrays, numeric values, correction links, exact payloads and digests without private values or notes in storage. Three reds exposed blank numeric/boolean coercion; explicit re-entry is now required. Resource tests cover room/bed parent versions, rename, classification, deactivation, parent change, inactive-parent refusal and stale responses. The R10 edge case reproduced with the actual configuration field: an unresolved stored reference can now be explicitly cleared by version.

Initial post-fix failures included duplicate text selectors, a prefixed error message, and test API/type assumptions. The installed Vitest is 1.6.1. Existing matchers, void cleanup callbacks and narrowed payload assertions fixed those assumptions. No dependency, guard, policy or clinical rule changed to pass tests.

All commands below ran from frontend/ on final application and test source.

pnpm --filter @kulcare/hospital test:run tests/recovery-http-api.test.ts tests/recovery-movement-transport.test.ts tests/recovery-retry-store.test.ts tests/recovery-live.test.tsx tests/recovery-layout.test.tsx tests/recovery-inspector-safety.test.tsx tests/recovery-command-races.test.tsx tests/recovery-resource-forms.test.tsx tests/recovery-scope-races.test.tsx tests/recovery-calendar.test.tsx
pnpm --filter @kulcare/shell exec vitest run src/components/__tests__/AppRoutes.test.tsx
pnpm --filter @kulcare/hospital typecheck
pnpm --filter @kulcare/hospital lint
pnpm --filter @kulcare/hospital test:run
pnpm --filter @kulcare/hospital build

Results: focused 84/84 in 10 suites (29.47 seconds); shell 27/27 (2.65 seconds); strict typecheck and lint exit 0 with no diagnostics; full Hospital 432/432 in 46 suites (192.75 seconds); build exit 0 (3.41 seconds), with the large-chunk warning. Existing interaction suites emit React act warnings. git diff --check passes. recovery-live.test.tsx has 871 lines, below the 1000-line limit.

The repair changes these 18 paths. The first ten already belonged to U7; the seven new test/helper paths are within the packet allowance. This guide is the remaining path. Paths below are relative to frontend/apps/hospital/.

src/features/recovery/components/RecoveryInspector.tsx
src/features/recovery/components/RecoveryResourceEditor.tsx
src/features/recovery/useRecoveryCommand.ts
src/layouts/HospitalLayout.tsx
src/services/recoveryRetryStore.ts
src/services/recoveryTypes.ts
tests/recovery-http-api.test.ts
tests/recovery-layout.test.tsx
tests/recovery-live.test.tsx
tests/recovery-retry-store.test.ts
tests/recovery-calendar.test.tsx
tests/recovery-command-races.test.tsx
tests/recovery-inspector-safety.test.tsx
tests/recovery-movement-transport.test.ts
tests/recovery-resource-forms.test.tsx
tests/recovery-scope-races.test.tsx
tests/recovery-test-helpers.tsx

No technical scope blocker remains. This is local repair and automated proof, not integrated review or U8 completion. Parent owns canonical CI, re-review, integration, Git/PR work and real-HTTP/browser acceptance. No database, server, install, delegation, external review, policy activation, backend, lockfile, schema, shared theme, auth-core or agent-configuration change occurred. The profile requests Sol (gpt-6.1-sol) with high effort. Actual served model, effort and token/cost receipts remain unavailable. No worker ran. All local check sessions have ended. The writer stops at handoff. Clinical policy, D4/D5, nursing authority, deployment, QA and pilot gates remain open.

Parent collection: implementation worker 01a15bcc-c672-7ab0-9932-fb224b3e32aa and repair worker 01a15bfe-b441-7260-b6bb-e7f784272a40 stopped writing and were closed after collection. The completed Compound receipt is 20261021-recovery-u7. Nine lenses produced thirteen claims, merged into eight confirmed findings. The receipt covers the pre-repair tree, not a clean result for the repaired source. Bounded follow-up reviews and final canonical CI remain required before the U7 commit. The CodeRabbit initial review completed with three comments; the scoped follow-up completed with three comments.

Final Follow-UpCopy Anchor Link

The parent collected the repaired canonical frontend CI with exit 0. Lint and wire guards passed. The type ratchet retained 214 existing workspace errors against its 254 ceiling; Hospital strict typecheck passed. The documentation build indexed 515 pages. These results do not grant deployment or clinical approval.

Two bounded reviewers inspected the repaired source identified by SHA-256 af0df20b33e8e7297dd5b8ad3a830865323f1de33292a03ec0c831ebc3ae3347. Reviewer 01a15c0c-1ddf-74f1-a9f8-878a65730cfc found no remaining issue in the evidence, draft, escalation and settings repairs. Reviewer 01a15c0c-1edf-7bf2-bd52-041860d97bef found an initial identity-hydration deep-link loss. Both reviews were static, not independent runtime verification. The parent collected and closed both workers.

The hydration regression first failed because the selected patient disappeared. The layout now distinguishes first ready identity from a later scope change. Initial case and resource selectors survive; later identity changes still clear them before the workbench mounts.

CodeRabbit's follow-up completed with three comments. The parent fixed the secondary-reader failure: history and target errors no longer keep confirmed commands pending. Current capability, board, resource and case failures still block clearance. A regression with failing history reads first failed both race schedules, then passed after separating critical and secondary refetches. The combined layout and command-race run passed all 10 tests.

The polling values now use the existing UI-kit frequent interval. Recovery keeps its contract page size of 25 in one named constant shared by board and metric; the UI-kit default is 10 and is not a drop-in replacement. No page-size behavior changed. The suggestion to remove this execution record is rejected: the orchestration guide requires named evidence records. Durable user contracts remain in the Recovery guide; this page records historical checkpoints. Earlier 30-path and 18-path counts describe earlier batches, not the final 38-path commit.

Final focused tests passed 85/85 in 10 suites. The full Hospital run passed 433/433 in 46 suites. Strict typecheck, lint and build exited 0; the existing large-chunk and React act warnings remain. Reviewer 01a15c10-824c-7e62-8316-fe0932a5cf77 found no further issue in the four frozen hydration/refresh source and regression files, then was collected and closed. That review inspected history/target handling but did not execute tests; targets share the history branch and do not have a direct failure test in that batch. All check and external-review processes ended. U8 real-HTTP and browser acceptance remain open. No clinical, deployment or pilot approval is claimed.