Hospital Recovery QA

Current BoundaryCopy Anchor Link

This checklist follows the focused Recovery plan. Local U1-U7 now implement the live Recovery workflow. Use U8 evidence for automated checks and limits. Run these manual checks against the deployed candidate in HTTP mode, not the mock demo. Unchecked steps are pending manual evidence, not failed automated tests. Signed home discharge requires programme U8 and is not a positive U7 acceptance claim. The U2 execution record tracks source/schema verification. Persistence alone does not make the later controls available.

Safe Setup And EvidenceCopy Anchor Link

• Record candidate/deployed backend and frontend commits, facility, preset, timezone and policy identity.
• Use synthetic patients and approved QA accounts. Do not publish real clinical data or tokens in screenshots or PRs.
• Use a disposable local test database for destructive/race tests. Do not reset or repair development, staging or production without approval.
• For live integration, use the authenticated platform in HTTP mode, not the standalone mock demo.
• Prepare separate accounts for configuration, stay management, observation recording, readiness/handoff, read-only care and denied access. Keep assignments/grants explicit.
• Record implementation, deployment, manual QA, D4 clinical, D5 capacity and pilot decisions separately.

Automated Local JourneyCopy Anchor Link

Use a fresh empty disposable database named kulcare_hospital_recovery_u8_<digits>_<surgery_center|hospital_50>_browser. Keep its name below PostgreSQL's 63-byte identifier limit. Load the committed SQL schema and provision the existing non-bypass test-role grants in that database. Never use a shared development or staging database. Fixture generation refuses nonempty data; failed setup requires another fresh database, not a reset command.

Run from backend/, with DATABASE_URL selecting that database, RAILS_ENV=test, PARALLEL_WORKERS=1, and a new private temporary session-file path:

HOSPITAL_RECOVERY_BROWSER_FIXTURE=true HOSPITAL_RECOVERY_BROWSER_SESSION=/tmp/recovery-qa-session.json bin/rails runner domains/clinical/test/support/hospital_recovery_journey_fixture.rb
HOSPITAL_RECOVERY_BROWSER_SERVER=true HOSPITAL_RECOVERY_BROWSER_SESSION=/tmp/recovery-qa-session.json HOSPITAL_RECOVERY_BACKEND_PORT=4027 bin/rails runner domains/clinical/test/support/hospital_recovery_browser_server.rb

Start the authenticated shell in real HTTP mode on a free port, proxying to that backend. Do not use Hospital's mock-enabled standalone dev command. From frontend/, with the supported Ruby executable on PATH:

HOSPITAL_RECOVERY_URL=http://127.0.0.1:3027 HOSPITAL_RECOVERY_BROWSER_SESSION=/tmp/recovery-qa-session.json HOSPITAL_RECOVERY_EVIDENCE=/tmp/recovery-qa-evidence pnpm exec node scripts/hospital-recovery-journey.mjs

Run pnpm exec node --test scripts/hospital-recovery-delayed-reader.test.mjs from frontend/ to test the runner's failed-response, missing-request and cleanup paths. These tests do not replace the real HTTP journey.

The test uses synthetic clinical policies and guarded fixture-only controls for app/module availability and two concurrency cases. It verifies real care with the non-bypass request pool. The lock observer must see two distinct waiting HTTP writers before release. One case races Settings against intake; the other races existing admission assignment against intake. The latter enables the legacy admission API only after the primary care journey, in the synthetic database. It does not add that gate to Hospital or implement ward admissions. It creates no clinical approval. Keep session files and screenshots private; do not attach tokens to a PR. Run once per fresh preset.

Local U1: Source And Contract ReviewCopy Anchor Link

• Review RC01-RC09 and confirm that GAP examples record current risks, not approved behavior.
• Review the read-only audit specification with facility operations. Identify who will approve resource classification/counting under D5.
• Walk through receive, bed move, observations, escalation, continuing-care handoff and blocked home discharge with nursing/clinical reviewers.
• Record the required clinical policy inputs and named reviewers. Do not mark that walkthrough as policy approval.
• Confirm explicit nursing grants and approved policy. Missing policy must not become clinical clearance.

Local U2: Shared Source SafetyCopy Anchor Link

• Compare migration-built and SQL-loaded isolated databases for RLS, scoped FKs, grants, owner uniqueness and immutable history.
• Verify no-tenant, foreign-tenant and same-tenant foreign-facility rejection with the non-bypass role.
• Inspect the read-only synthetic audit. Confirm no automatic classification, bed release, occupant move or admission creation.
• Verify an existing valid admission can still be read, moved and discharged through supported paths.
• With approved synthetic occupied care, try bed deactivation, room PATCH/DELETE and ward deactivation. Expect HTTP 409 CAPACITY_CONFLICT, unchanged care and no database details.
• Rename an occupied bed, room and ward. Confirm descriptive edits still work and do not change the occupant.
• Trigger a stale bed edit. Expect HTTP 409 STALE_WRITE in the shared error envelope.
• On an owned disposable database, verify a round-trip move cannot reuse its first movement receipt. Confirm all genuine movements remain visible.
• Verify a rejected bed release at transaction commit leaves occupancy unchanged and creates no success audit.
• Review the enforced-role evidence tests for foreign care identity, exact-null encounter, author provenance, corrections and escalation successors.
• Record unresolved legacy inconsistencies and a forward recovery action before a facility cutover.

Local U3: Resources And Effective SettingsCopy Anchor Link

The U3 execution record covers internal service proof. Local U6/U7 expose the HTTP and browser operations. Do not use the mock page as integration evidence.

• Set a planning recovery count, reload and confirm that no beds were created.
• Provision two named resources under real active groups/rooms. Check unique names/codes and real counts after reload.
• Lose a successful provisioning response before receiving the new bed ID. Look up the same key at the facility-scoped receipt route and recover one created resource; denied lookup must not look like absence.
• Edit one resource in two tabs. Confirm the second stale save cannot overwrite the first.
• Keep an unsent draft while a resource refetch brings a newer version. Confirm save is blocked, the draft stays visible and only explicit reload replaces its fields and token.
• Target an unavailable resource. After the confirmed rejection and successful refresh, select a new target. If refresh fails, confirm the old key stays blocked. A network or 503 result must remain unresolved.
• Open readiness assessment. Confirm the evidence-review checkbox starts unchecked and save is blocked. Review explicitly, then change a source and confirm review is required again.
• Complete a continuing-care handoff, then try a new receive command for the same case. Confirm rejection with no second stay, occupancy or receipt. Exact original-key replay must still work.
• Attempt occupied bed and parent deactivation/reclassification/reparenting through each supported UI/API path. Confirm rejection.
• Complete cleaning and maintenance transitions; compare actual assignable capacity with the board.
• Capture a child-bed edit, move its unoccupied room to another group, then submit the old edit. Expect a stale conflict, no overwritten name, and no extra receipt. Reload and save with the new version.
• Compare counts for a real synthetic active admission and a Recovery stay. Neither is available capacity. Confirm resource-only responses contain no patient or encounter identity.
• Revoke the actor's membership while a resource write waits on a facility lock. Confirm denial after the wait, with no new resource, receipt or audit.

Local U4: Stay And Physical HandoffCopy Anchor Link

The U4 execution record covers the internal command candidate and its three forward migrations. HTTP/UI steps remain pending until U6/U7. Automated synthetic tests are not manual or clinical acceptance.

• Apply the candidate migrations in a disposable database. Confirm an incompatible permission row or conflicting source care stops preflight without rewriting grants or clinical identity.
• Confirm manage_recovery has an empty default-role list. Give a QA nurse an explicit grant and current assignment; do not infer authority from owner/admin alone.
• Receive a case without an admission or encounter. Confirm the case, patient and MAR links are unchanged.
• Receive valid care whose encounter derives its patient from registration. Reject a non-null wrong patient or a terminal source encounter.
• Race two clients for one available bed, including an existing inpatient writer. Confirm one winner and no partial stay/admission/source-bed change.
• Test discharge-first and receive-first ordering. Only one may establish terminal discharge or active Recovery care for the source encounter.
• Try generic source identity/status updates during active care. Confirm they cannot detach or finish that care.
• Move a patient between two recovery beds. Confirm one stay, one occupied target, source cleaning and full movement history after reload.
• Attempt foreign, inactive, self-referential and unacknowledged continuing-care destinations. Confirm rejection without release.
• Deactivate an empty room, then attempt intake into its bed with current versions. Expect 409 RESOURCE_UNAVAILABLE, no stay or receipt, and no bed change. An audit outage remains 503, not a resource conflict.
• Exercise a supported existing receiving context with an authorized receiving actor. Confirm obligations remain visible and the source bed releases once.
• In each preset, hold a MAR dose and link a required Lab report with a failed scan. Check both blockers before handoff. Accept a supported continuing-care handoff. Confirm the held occurrence, report identity/revision and failed scan remain in the source and stored handoff evidence. Retry and retrieve the same receipt. Confirm one bed release, no new discharge summary and no clinical clearance.
• If no eligible destination exists, record handoff as unavailable, not passed or discharged.
• Attempt direct case completion and a browser-supplied discharge proof. Confirm neither ends active care or bypasses programme U8.
• Repeat uppercase-selector requests with the same key. Confirm one effect; changed payloads must still conflict.
• Distinguish a confirmed receipt, authorized absence, forbidden lookup and unavailable lookup. A failed lookup must not start a new operation.

Local U5: Nursing Evidence And ReadinessCopy Anchor Link

• Record structured observations with units, observed time and a note. Check author, recorded time and the same values on board/case after reload.
• Correct an observation with a reason. Confirm the original survives and the correction is linked.
• Try generic observation update/delete and encounter category replacement. Confirm protected Recovery evidence survives while ordinary notes still save.
• Raise an escalation, acknowledge it, then resolve it with separate reasons/actors where policy requires. Acknowledgement alone must not clear it.
• Hold a MAR dose and assess readiness. Confirm current obligations and source links remain visible.
• Change clinical evidence after assessment. Confirm the previous assessment becomes ineffective.
• Test missing policy, no orders and unavailable required document source. None may become automatic clinical clearance.

Local U6: Access, Audit And RecoveryCopy Anchor Link

• Exercise allowed and denied actions independently. A configuration admin without clinical authority cannot chart or clear care.
• Remove an actor's current facility assignment; reload and attempt a direct API command. Confirm denial.
• Test suspended membership/practice and foreign-facility selectors. Confirm no protected data or receipt existence is exposed.
• Lose a response after a committed command. Recover the exact key and verify one effect/event/receipt.
• Repeat the same key with a changed payload. Confirm a conflict, not a second effect.
• Make receipt lookup fail or become forbidden. The UI must not treat this as authorized absence or create a fresh command automatically.
• Exercise required audit failure in an isolated test. Confirm no clinical read or committed mutation is returned.
• Disable new intake with active care. Confirm the authorized continuation and receipt-recovery path remains available.
• Open /hsp/recovery through the real shell with ordinary app access off. Confirm no OT-board redirect. Confirm sibling Hospital routes remain blocked.

Local U7: Live UI And ContextCopy Anchor Link

• Use search, filters, pagination, awaiting-assignment queue and patient inspector with real APIs in both presets.
• Follow case-to-Recovery-to-MAR and return. Confirm authorized selection/context and no nested-route loop.
• Switch facility/profile while loading and while a draft is open. Confirm old data, selected case and drafts do not appear in the new scope.
• Verify loading, empty, unavailable, forbidden, validation, stale/conflict and service-error states independently.
• Verify shared-kit controls, labels, keyboard focus and 390px/1440px layouts.
• Compare dashboard, case and board counts after mutation and hard reload. An unavailable source cannot appear as zero.
• Keep an active stay across the facility-local midnight boundary. Confirm it remains in occupancy and active-care views.

Local U8: Integrated Acceptance And ReleaseCopy Anchor Link

• Complete receive, observations, current MAR actions, escalation/reassessment, recovery-bed move and cleaning through real HTTP.
• Complete verified continuing-care handoff where a supported destination exists. Confirm no home-discharge claim.
• Keep home discharge blocked with a precise programme U8/source reason until signed discharge exists.
• Record concurrency, exact-key recovery, source protection, schema parity and current whole-PR review/CI evidence.
• Verify the product, API, developer and QA pages render in Fumadocs.
• Record actual deployed commits, D4 nursing/readiness/handoff approval, D5 capacity mapping and pilot decisions.
• Add remaining defects and manual checkboxes to the existing PR/issue. QA retains issue-closing authority.

Signed Discharge And ABDMCopy Anchor Link

These checks belong to programme U8, not local Recovery U8 completion. Use the ABDM discharge contract.

• Confirm Recovery assessment/handoff cannot create a signed discharge report.
• Require the named signed source revision, signer and amendment history.
• Require pinned ABDM profile-validator evidence for day-care and admitted report fixtures, including the real encounter mapping and terminology.
• Compare PDF and FHIR content; test rejected missing data and broken references.
• Record clinical and Integration review. Verify consent/network transfer separately; no screenshot or JSON shape assertion is a compliance certificate.