Recovery U8 Acceptance

ScopeCopy Anchor Link

This records the local verification candidate under the Recovery plan, not programme U8 signed patient discharge. The integration boundary is draft PR 2757, starting from U7 commit 3385deecca. The ABDM discharge contract is required for the later signed report. No report-conformance or network-certification claim is made.

Implementation And EvidenceCopy Anchor Link

• recovery_journey_test.rb drives both presets with and without an admitted source through real HTTP under the existing non-bypass test role. It provisions real resources, receives once, records canonical MAR and observations, corrects evidence, checks assessment staleness, resolves escalation, moves/cleans, hands off to an eligible existing admission and reconciles exact receipts. Self-source, foreign target, home discharge and revoked receipt access fail.
• The initial draft failed: request-harness state replaced its medication instance; nil assertions, timestamp precision and duplicate active episode fixtures were incorrect. The fixes change synthetic setup, not clinical guards. The four journeys then passed 294 assertions on each independent schema path.
• The browser fixture/server/control require explicit test opt-in, owned database names and private mode-0600 session files. Fixtures refuse nonempty databases. Policy references are TEST-ONLY-NOT-APPROVED. Source enrollment uses its real command and actor. Peer staff must be active; fixture setup now states this.
• The server verifies every request-pool connection uses kulcare_rls_test with neither superuser nor RLS-bypass authority. Synthetic clock and policy injection apply only to the explicit test runner. No production policy is installed.
• frontend/scripts/hospital-recovery-journey.mjs uses the established MAR/Lab regression pattern and actual local HTTP. It captures private synthetic desktop/mobile screenshots and counts page errors. It does not mock clinical endpoints. Lost-response testing commits a real command before discarding its reply. Test controls change fixture availability and prepare the two synthetic concurrency cases. They are not application routes.
• Browser verification exposed a real shell defect. An exact /hsp/recovery parent consumed its nested route and redirected to the OT board. The shell stub was strengthened to use descendant Routes: 1 failure/26 passes before the fix, 27 passes after. One /hsp/* mount now retains the exact Recovery continuation exception; sibling routes keep ordinary flag gating.

Verification CheckpointCopy Anchor Link

Full backend CI passed: 19,055 domain tests, 89,807 assertions, no failures or errors, eight existing skips. Pricing passed 20 tests/26 assertions. Schema/RLS guards passed with the two existing absent Integration registry warnings. The focused suite passed on both independent schema paths: 821 tests, 7,233 assertions on SQL and 7,235 on forward migrations, with no failures or errors and one existing skip each. Explicit eight-file Ruby lint passed. Frontend CI passed its aggregate ratchet. Inspection found two changed-file test-type errors hidden by that ratchet. Both invalid ByRoleOptions.exact properties are now removed. The post-fix gate passed. The existing baseline remains unchanged. The local documentation build passed with 517 pages.

Initial browser journeys passed on both presets with no page errors. Review then found that two assertions were too weak. View-only access ran after handoff, when every actor loses actions. The identity check reloaded and removed the selected case itself. These runs are checkpoints, not final acceptance. The corrected journey checks active-care denial, writes with intake disabled, exact-key recovery with the app disabled, and native cross-tab identity changes with an open draft and a delayed real response. The corrected Surgery Center and Hospital 50 journeys each passed seven checks with zero page errors on independent fresh synthetic databases. The parent inspected the mobile output; the script checked both 390px and 1440px layouts for horizontal overflow. An initial corrected run exposed a cancelled-route test-harness error; that failed run does not count as passing. The final handler waits for the delayed reader and accepts only known cancellation errors before checking scope cleanup.

CodeRabbit completed its initial 20-file review with three findings about the same temporary-path portability defect. The guards now accept both /tmp and /private/tmp, while retaining ownership, mode and symlink checks. A scoped follow-up identified connection-URL loss in the fixture control and misplaced local release checkboxes in the QA guide. The control now retains the supplied PostgreSQL host, port, credentials and query parameters and changes only the guarded test database name. Two synthetic URL cases passed. The QA guide now keeps local release checks under local U8. Its checkpoint wording was corrected. That review completed with four findings. Its fourth finding identified a remount risk when the Recovery exception changed the Hospital parent type. A Hospital-local gate now retains one stable child tree and uses the existing Identity tenant/user flag checks. It adds no shared authorization bypass. The shell regression suite passed 28 tests, including a one-mount round trip from Recovery to Cases and back. The five-file corrections review completed with zero findings. Canonical frontend CI passed its aggregate ratchet; the changed-file type corrections are recorded above. The earlier seven-check browser runs are not post-correction evidence; the nine-check runs below are. No whole-PR approval is claimed. Independent correctness and testing reviewers identified the two acceptance defects above. The review hash over application/test paths differs from the hash over all 20 paths; they are different recipes, not matching snapshot identities. The complete Compound review is recorded below.

Closed Acceptance GapsCopy Anchor Link

• Both presets passed the final nine-check browser journey after the route correction, with zero page errors. It includes private 390px/1440px evidence, active-care viewer denial, in-place identity changes with a delayed real reader, disabled-intake care writes, and disabled-app receipt recovery.
• Two independent HTTP clients race Settings room deactivation against Recovery intake. They also race canonical admission bed assignment against Recovery intake. The observer requires two distinct PostgreSQL waiters before releasing its locks. Each race commits one writer and verifies current occupancy, unchanged losing care and authorized exact receipts where supported.
• The admission compatibility case enables the legacy writer's feature and inpatient service level only after the primary Hospital care journey. Both presets complete primary care without those gates. No production Hospital gate, admission UI or policy is added by this test setup.
• The first lock observer reused a cached zero count and failed. Its query now runs uncached. That failed run is excluded from passing evidence.
• Twenty safety tests cover opt-in and environment checks, disposable database names, private paths, file mode/ownership/symlinks, mismatched fixtures and policies, nonempty fixture rejection, unsafe pool roles, later unsafe pool connections and connection return on failure. These guard tests complement, not replace, real non-bypass HTTP execution.

Review Follow-UpCopy Anchor Link

Compound run 20261021-141040-9757b9cf completed seven lenses and a separate validation pass against the frozen U8 candidate. Both findings were confirmed: AE4 needed an HTTP handoff with unresolved obligations, and a failed detail interception could leave the browser runner waiting without a deadline. This is a local U8 review, not a new whole-PR approval. The native adversarial lens ran; no independent-provider or served-model verification is claimed.

The AE4 addition uses a real required Lab source linked to a report with a failed scan. Both presets hold a dose through the nursing HTTP API, expose both blockers, and hand off to a supported receiving admission. Assertions check the stored dose, version, report and readiness references, false clearance, unchanged source encounter, exact retry/read and one bed release. The six HTTP journeys passed 384 assertions. The integrated suite then passed 824 tests on each schema path: 7,331 assertions on SQL and 7,329 on forward migrations, no failures/errors and one existing skip each.

The test-only delayed reader now settles failed responses, bounds missing requests, releases on all exits and removes its interception. Six Node tests cover these paths, including expected cancellation after capture. The approval marker test now isolates a wrong marker from a wrong facility. Shell route tests remain 28 passing. Explicit lint passed for all ten Ruby files.

CodeRabbit's completed 23-file pass found an inactive room represented as 503 RESOURCE_UNAVAILABLE. The new request regression first failed with 503. Recovery now returns 409 RESOURCE_UNAVAILABLE without a stay, receipt or bed change. Actual source and audit outages retain their unavailable responses. The nine-file follow-up found a diagnostic capture that could hide the original browser failure. Its text capture now has a deadline and a fallback. An older review-snapshot attempt was stopped after eight seconds and discarded; it is not a completed review. The final four-file correction review completed with zero findings. All accepted review findings have fixes and focused proof.

Post-fix frontend CI passed with the baseline unchanged. Changed-file inspection confirmed the two invalid route-test options are gone. Existing workspace type debt remains; this is not a clean workspace-type claim. Hospital strict typecheck passed. Both presets passed the corrected nine-check browser journey with zero page errors. The fresh Hospital suite passed all 433 tests across 46 files; Existing React act warnings remain and are not clinical acceptance evidence. Desktop/mobile screenshots were inspected; overflow checks passed. The final backend CI passed 19,058 tests and 89,903 assertions, no failures or errors and eight existing skips. Pricing passed 20 tests/26 assertions. Style, schema and RLS guards passed. The earlier run had passing tests but failed its style step before the lint corrections; it is not the final green receipt.

Local U8 implementation and automated verification are complete. No migration, schema-dump or lockfile change belongs to this unit. Deployed QA, clinical acceptance and a final whole-PR approval remain separate and open. The guarded acceptance servers were stopped after the browser runs. Private fixture/session files and screenshots remain outside the repository.

Run LimitsCopy Anchor Link

The initial U8 worker 01a15c13-c551-7620-a534-cc3e41198708 stopped with a usage limit error before verification or a completed handoff. Its four draft files were preserved and completed by the parent. It did not complete U8. No served model, effort or cost receipt is available. Unrelated local session artifacts, credentials, schema dumps and lockfiles remain excluded.

Release GatesCopy Anchor Link

• Record deployed backend/frontend commits and QA outcomes for both presets.
• Obtain D5 approval for actual capacity/classification and cutover findings.
• Obtain D4 nursing, readiness and continuing-care policy approval and grants.
• Confirm active-care continuation and exact-key recovery on the deployed candidate.
• Obtain named facility/clinical/pilot acceptance; QA retains issue closure.
• Implement programme U8 signed discharge with the current Recovery source gate, atomic clinical/occupancy transitions and validated ABDM report output.