Hospital and Inventory Release Acceptance

U4 Lab Candidate AddendumCopy Anchor Link

PR 2746 adds the U3 private-document foundation and the U4 PDF-first Lab workflow. This addendum does not change the earlier PR 2642 evidence below. Use Lab QA and private-document QA. Local synthetic policies and scanner results are not clinical or deployment approvals.

• Record the verified backend/frontend source commit and full local gate results below.
• Verify migration/snapshot parity and the local real-HTTP browser journeys in both presets.
• Complete the last scoped external review follow-up. It completed with no findings; see the pre-merge record below.
• Accept D2: private storage/scanning, retention, legal hold, deletion, and deployment preflight.
• Simmi records the deployed U4 candidate. Do not deploy before D2.
• QA records the Lab journey and retry/scope tests on that candidate.
• The qualified clinical owner accepts D3, including report timestamp, validity, review authority, and active-care handoff.

No U4 deployment, staging QA, or clinical approval is recorded by this addendum.

Local Candidate EvidenceCopy Anchor Link

Verified source: f025a1edcad1c4168ccf4d9205bf36b72c1f16b4. It contains U4 commit 63a0454864, base e0cc14fb4f, and test-only CI corrections. The following documentation commit does not change runtime source.

The browser runs used guarded synthetic databases and a local test scanner. They ran before the Connect-only base sync; that sync changed no Hospital or Clinical runtime file. The complete post-sync backend/frontend gates above cover the merged source. The full backend run used the canonical eight-shard ratchet with only owned database/log names changed. No shared database was reset.

Four scoped CodeRabbit rounds completed. The final follow-up was denied twice by quota, including after the first stated wait expired. Reported implementation defects were corrected. The forward-only migration and server-audit decisions follow the current backend contract; see Lab review decisions. At that point, the last URL-cleanup/scope-fixture/preset-test changes had no completed external recheck. The pre-merge record below supersedes that limit. The small CI test corrections retain manual review and automated coverage, not a separate external review claim.

Code review: harness-native fallback. The full CE review could not produce separate merge/report leaves under the active main-thread tool mapping. Scoped CodeRabbit review and a manual requirements, security, migration, API, concurrency, and changed-code review supplied coverage. This is not an independent CE persona-panel receipt.

The CI corrections capture the original Growth campaign timestamp, control OT settings read fixtures, and avoid typing an unrelated reason one character at a time in a clock-control test. No Growth production code, clinical rule, CI baseline, or time-control assertion changed.

Pre-merge VerificationCopy Anchor Link

Source candidate: 389e65d435ce5dd382d8c66c9d50556c0d58790c. Base: 5e4adb0777f8c39ffb8cff8f76403bd661491bbe. The base sync merged without conflicts, including the upstream Hospital test fixes. It changed no Hospital or Clinical runtime source from the earlier browser candidate.

• Full backend domains: 17,955 runs, 76,265 assertions, zero failures or errors, and 10 existing skips.
• Backend dependencies, schema-version/parity guards, Minitest-only guard, and changed-file Ruby lint pass. Ruby lint inspected 69 files.
• Identity and Integration RLS audits pass. The same two absent Integration registry tables remain warnings.
• Pricing: 20 runs, 26 assertions, zero failures, errors, or skips.
• Full frontend CI passes: zero lint errors and test failures, 212 existing type errors within the unchanged 254 ceiling, and passing wire-shape guards. Hospital has 235 passing tests and a clean strict typecheck. Its build passes with the existing large-chunk warning.
• Fumadocs build and search indexing pass. Existing documentation warnings remain.
• The final scoped CodeRabbit follow-up completed with zero findings. It reviewed the six URL-cleanup, scope-fixture, both-preset journey, browser-script, and QA files from the prior quota-blocked round.
• Manual review checked document privacy, category access, current-source readiness, transaction locks, migration scope, and frontend request cleanup. No new merge blocker was found. The CE independent-panel limit above still applies.

The user requested code merge after review. This does not approve deployment or clinical activation. D2, D3, deployed manual QA, and the applicable pilot approvals remain open.

Release BoundaryCopy Anchor Link

This record covers PR 2642. The branch is feat/hospital-readiness-qa-inventory. It contains theatre configuration, persisted readiness, the Inventory source ledger, and Hospital case-stock commands. It does not complete every Hospital workflow. Use the implementation backlog for remaining work.

Local tests do not prove deployment. A staging demo does not approve clinical policy or opening stock. Keep the PR as draft while required checks fail, except for the explicit Billing-only merge exception below. Keep the tracked issue open for QA.

Merge ExceptionCopy Anchor Link

The user approved merging this work before the separate Billing repairs, provided the rest of the candidate is stable. The exception covers only the known Billing failures. It does not raise a CI baseline, skip a test, or waive any other failure. Record the final complete test results before merging.

This is code-merge authorization, not production or clinical activation approval. Candidate staging QA, the storage preflight, clinical readiness approval, and Inventory pilot approval remain required before activation.

OwnersCopy Anchor Link

An owner assignment is not approval. Record the reviewer, evidence reference, decision, and scope for each acceptance. Simmi can assign a qualified clinical or facility stock reviewer. Record that assignment before sign-off.

Staging PreflightCopy Anchor Link

Staging entry: Hospital app. API host: api-stg.kulcare.com.

The observed backend revision was c96cbfeda0e59aeb0508d771679e393705a25f89. It was not this PR candidate. Sign-in and City Hospital Main profile selection succeeded. The direct Hospital route then showed Access Restricted. The selected tenant returned SHOW_HOSPITAL_APP.enabled=false, with source default. No staging stock or clinical command was tested. No staging setting was changed during this check. On a later browser check, the OT Board opened without Access Restricted. The backend revision was still c96cbfeda0e59aeb0508d771679e393705a25f89. This resolves the observed route-access blocker, not the candidate deployment or workflow acceptance gates.

• Verify Hospital route access in the approved QA session. The OT Board now opens. No flag or grant was changed by the reviewer.
• Shell grants the approved QA roles and facility access. Do not grant production authority for convenience.
• Simmi records the reviewed candidate commit and deploys the backend and frontend that contain it.
• Record backend revision and frontend deployment revision. If deployments use different commits, prove that both contain the candidate.
• Apply all candidate migrations through the supported deployment task. Record migration status.
• Apply runtime RLS grants. Run the Identity and Integration RLS audits.
• Confirm HTTP mode. Do not enable a production mock fallback.
• Confirm expiry job queues, scheduling, file storage where applicable, and Inventory write controls.
• Use synthetic patients and approved test stock. Keep actual patient care outside this QA run.

The candidate includes 20261012000004_repair_release_rls_posture. It repairs existing log partition isolation and normalizes existing Identity policy expressions. It preserves the existing administrator policy. It does not grant a new administrator capability. Its rollback is intentionally blocked. Stop writes and investigate a failed release; do not remove isolation or drop populated stock tables. The readiness permission migration also refuses rollback. Removing its catalog rows could remove tenant grants. Use a reviewed forward migration instead of reporting a no-op rollback as success.

The candidate also includes 20261014150000_repair_active_storage_attachment_record_ids. Use the storage repair preflight before deployment. The migration refuses truncated UUID links. It does not guess file ownership or recover previously damaged links.

The Clinical audit coverage guard recognizes the two Hospital command controllers for create only. Their services record audit inside the mutation transaction. Regression tests reject the mutation when audit fails. The stock test also proves that the joined Inventory effect rolls back. An added update or destroy action does not inherit this coverage. It needs its own audit proof.

Whole-PR Review CorrectionsCopy Anchor Link

CodeRabbit reviewed the scoped source in three batches. The service limits each review to 150 changed files. Credentials, ignored local files, session files, and the full schema dump were excluded. The additive schema changes require separate local migration and structure checks. The three initial batches covered 265 changed files: 105, 111, and 49. Follow-ups covered 32 correction files, five final correction files, and the central Clinical policy matrix. Those review commands completed. Valid findings are fixed and tested. The two decisions below explain recommendations not applied as written. This is source review and a main-thread check, not a completed independent multi-agent CE review receipt. One later manual check found a separate package-preparation failure path in the CI runner. Its regression test failed before the fix and passes after it. The runner now keeps the gate failed even if the later typecheck succeeds. The external follow-up for this last correction was blocked by CodeRabbit's rate limit, which reported a 33-minute wait. That review remains pending.

The recommendation to clear every denied retry was not applied as written. Current authorization failure cannot establish the original transaction outcome. Preserving the key prevents duplicate stock effects. The accepted part of that finding is the explicit server error and operator recovery guidance. The suggested shared HTTP status constants were not imported. @kulcare/ui-kit has no such export. Its business status values do not replace HTTP response codes. The recovery test keeps the explicit 403 and 409 cases. A second comment proposed adding a shared export only for these test cases. That adds a shared UI API without a production caller, so it was not applied.

CI EvidenceCopy Anchor Link

The final merge candidate includes base 435a4a602f and the later CI corrections. The complete backend suite ran in six task-specific databases with CI eager loading, normal RLS test grants, and seed 22961. It ran 16,843 tests with 70,503 assertions: 15 failures, one error, and 10 skips. All 16 non-passing tests are in Billing. No other domain has a failure or error.

The backend domains ceiling remains zero. The whole backend ratchet is not green. The user approved this bounded merge exception while a separate agent repairs Billing. Do not expand this exception to another failure.

Canonical whole-frontend CI passed. Lint is zero against ceiling zero. Tests have zero failures against ceiling zero, and wire-shape guards pass. Typecheck has 252 errors against the existing ceiling of 254; it is not a clean typecheck. Hospital has 195 passing tests across 27 files.

Other backend gates pass: dependency check, schema-version guard, migration parity, Minitest-only guard, changed-file Ruby lint, both RLS audits, and the pricing gate. Pricing ran 20 tests with no failures, errors, or skips. The complete RBAC suite passed 312 tests with no failures, errors, or skips. The corrected episode, goal, and PHR cache requests passed 39 tests with no failures, errors, or skips. Episode and goal creation now assert persisted audit rows for the correct tenant and resource.

Base synchronization exposed a missing schema marker for data migration 20261009000000. The migration ran on a disposable database. Before/after schema-only dumps were identical before the marker was added. No production or staging data was changed. Request fixtures use real persisted users and request rows, not incomplete user doubles or a missing factory.

Keep the broader suite failures visible. Do not raise a ceiling or skip a security check. The standard shard runner uses fixed database names and log paths. Use task-specific names when another agent runs backend tests. Provision RLS test grants after the last schema load.

Staging QACopy Anchor Link

Record the deployed commits, tenant, facility, role, command keys, screenshots, and results. Do not attach tokens, credentials, patient payloads, or private evidence files to the PR. These steps are not marked complete by local component tests.

• Open Hospital from the platform dashboard and by direct URL. Return to the dashboard.
• Save a theatre change. Reload and confirm it persists. Reject a competing stale edit.
• Check Surgery Center and Hospital 50 access under approved facility configuration.
• Switch facility and profile. Confirm protected data and editors reset.
• Run the readiness QA checklist. Check list/detail agreement, stale evidence, denied review, and transition blockers.
• Run the Inventory pilot controls checklist. Record the approved manifest and read-only reconciliation.
• Run the case-stock checklist. Include reserve, issue, actual use, unused return, pending use, reconciliation, cancellation, and corrections.
• Retry an unknown command result with its original key. Confirm no duplicate effect.
• Test grant revocation, direct API denial, same-tenant cross-facility denial, and the source write stop.
• Check activity and PHI audit records. Confirm generic Inventory audit has no patient or case data.
• Confirm missing workflows show unavailable states, not false ready states or zero results.
• Record defects and rerun affected checks on the fixed deployed commit.

Clinical ApprovalCopy Anchor Link

Use the readiness framework. A test rule is not a clinical protocol. Do not activate active-care transitions with a test rule.

• Simmi or the named qualified clinical reviewer approves checklist content and applicable procedures.
• Approve evidence freshness, responsible roles, review authority, override authority, and emergency rules.
• Approve representative planned, postponed, cancelled, and overnight case outcomes in the declared scope.
• Approve active-case policy binding and the care-continuity handoff. Do not bulk-rebind active care without review.
• Record the approved policy version, external approval reference, reviewer, decision, and scope.

Clinical approval reference: Pending. Clinical decision: Not approved yet.

Inventory Pilot ApprovalCopy Anchor Link

Use Inventory pilot operations. Only an authorized operator records a facility lead's approved counts. Do not treat a demo quantity, test assertion, or successful import call as physical verification.

• Simmi or the named facility stock lead approves item units, conversions, lots, serials, expiry cutoffs, and quarantine interpretation.
• Approve the opening count manifest, count date, opaque reference, and responsible operators.
• Record the immutable opening approval ID and import result. Confirm identical retry behavior.
• Accept reconciliation before activation and after the complete case-stock exercise.
• Accept shortage races, pending obligations, expiry, damaged returns, and reasoned corrections.
• Accept the write-stop procedure, controlled re-enable, and unresolved discrepancy handling.
• Record pilot facility, accepted scope, exceptions, reviewer, and explicit decision.

Inventory approval reference: Pending. Inventory decision: Not approved yet.

Final AcceptanceCopy Anchor Link

• Attach complete frontend and backend CI results for the final candidate. Do not substitute old remote checks.
• Attach full-PR review results and resolution records.
• Complete the staging checklist on the candidate, or record a blocking defect.
• Obtain both clinical and Inventory approvals for the declared release scope.
• Record product and QA acceptance. Add the QA label where supported. QA closes the issue after verification.

Release decision: No-go until required evidence and approvals are complete.