# Clinical platform — RESUME (end state)

**Status (2026-10-22): all phases implemented on `hazemdev3`, merged to `main`** (BE `12d7d0ff4`, FE `2643fa7c`). `/app` on moonui3 deployed (I18N `20261022plat15`). Dev BE: `local-deploy.sh` run, 0 pending migrations, autoload re-dumped with the ea-php82 CLI, `api/gyn/*` answers 401 over HTTP (module live). Nothing shipped to clients (MoonStack ship is the owner's step).

Ledger (what was reviewed / tested, every decision) = `LEDGER.md`. Briefs = `tasks/*.md` (+ `_COMMON.md`). Reviews = Fable / FIN / final sweep (paths in the ledger; copies were in the session scratchpad).

## What shipped (by phase)
| Phase | Commits (BE · FE) |
|---|---|
| P0 foundation | 622738b66 · d0944a478 |
| SEC1 sessions / 2FA / service tokens / idle logout | eb11b0c8d · 7b1626369 · b8294006 |
| D0 isolation + AF1–AF3 audit fixes | ad6889f95 f826f80a8 09c82c275 e53368038 7551cca82 e737588c8 |
| E1 field engine v2 | d2bddeb9f dd0f292fd 2d370635c |
| S1 visit shell (+ Fable review fixes, S1b exam findings) | d0944a478 f4cd1661c · a20910a2 086d37ee |
| P1 Rx v2 | e6e9d85b6 9c3c408a3 · 0ad598a8 ed92b24b |
| P3 executor + radiology | da48132da · da0d2933 |
| D1 observations | 6a4fec27b · 97c08367 |
| PERM | 73e762be0 46118cb62 (+ integration in 41e7570c4) |
| P5 documents + print engine (Arabic shaping) | 1ad99125d · 086d37ee |
| D2 facts (a/b/c) | f8860b8da b5b8418ea 90e1b35fa · b5d70794 |
| P2 inpatient meds [FIN] | 87a5efdd7 7693c314d · 854f1ffb |
| P4 results / claims [FIN] | 674a7bb31 |
| P6 POS pharmacy | 914a343e4 · 4f3edfe8 |
| S2 nutrition + dental as cards | ef1d0f968 db96e8d3a · 4f3edfe8 12ec01de |
| C1 entities / record / summary / timeline | 14889ec2e 15d7a6aff 41e7570c4 · 4826f8ee |
| SEC2 access audit | 41e7570c4 · b5d70794 |
| SEC3 PII encryption + encrypted backups | 41e7570c4 · dcadeeca |
| D3 intake | 56e85d560 · 59e94608 |
| D4 fold specialties | 61fe19c5b |
| S3 inpatient context | 56e85d560 · 59e94608 |
| G1–G7 GYN (Modules/Gyn) | 971a4c749 0cfa28869 094eed591 00d7baff8 58e2a780b f1a655da2 676d4dce6 · df64e0e6 d59df5ab cf5a4443 dae05a6d cf923bab c3f60505 7d4fcb59 |
| GYN cleanup + privacy read guard | a77650fcf |
| Final sweep fixes | b96fd40a5 |

## Switches (all OFF / safe by default)
`clinic.visit_shell` (+ per type `clinic.visit_layouts[type].features.shell` for nutrition/dental) · `hospital.mar_on_prescriptions` · `pharmacy.dispensing_enabled` · `clinic.print.engine=browser` · `clinic.intake.enabled` · `clinic.triage.enabled` · `MOON_PII_ENCRYPTION` · backup encryption · GYN features per clinic (`gyn.feature.*`, missing = on, only for gyn_ob departments).

## To test GYN on dev
Create a department of type «نسا وتوليد», turn on `clinic.visit_shell`, book a visit there. Company 1 already has the full GYN pack (`gyn:install-pack --company=1`).

## Owner decisions still open
1. Doctor to confirm clinical defaults: GYN discharge-sheet drugs (G4a), antenatal schedule offsets + VTE thresholds (G5a), urogyn follow-up 6 w/3/6/12 m (G6a), PROM / FSFI item wording (licensed instruments, paraphrased).
2. POP-Q points as answers (not observations) — design-gyn decision 19.
3. `gyn_consultant` / `gyn_doctor` get `clinic.export.deidentified`? (not granted)
4. Keep both the GYN follow-up card and the shared follow-up card?
5. Hospital `admissions.bill`, room-service menu, `surgeries.show`, nutrition shopping-list: enforce the own-patients scope there (needs a nursing/cashier policy) — currently unmapped.
6. Strip admin's existing medical permissions on live installs (`php artisan clinic:security:strip-admin-medical --dry-run` first).

## Not verified (do these before a client release)
- No full test suite was run (owner override); every WP's targeted suites + regression neighbours were. Failures seen: in the Phase-A baseline — ClinicRoleManagementTest ×3, RoleLifecycleTest ×1, ScreenPermissionTest ×1 (RoleAlreadyExists), AppointmentTest queue-index (ISS-2026-9102 — done visits stay on the queue). Seen during this work, cause NOT traced (not in the baseline): PatientFormRulesTest ×2 (expected arrays lack treatment_plan/general_health_note), LabRequestApiTest ×4 (sqlite havingRaw), POSProductApiTest conversion_factor precision. ClinicSettingsBackboneTest counts were broken by this plan's settings and are fixed (12d7d0ff4).
- Nothing was clicked through in a browser; the S2 identity harness (e2e/specs/s2-identity.spec.ts) needs E2E creds + encounters.
- SEC3 restore drill on MySQL (needs an empty `moonui3_restore_drill` DB + `DB_RESTORE_DRILL_DATABASE`).
- MoonStack packaging of the new `Modules/Gyn` module.

## Deferred (tracked in LEDGER)
Screen catalog regenerated + ScreenPermissionSeeder run on dev (5 new clinic screens) — existing custom roles need the new screen.* grants assigned by an admin. CardDef.priv dark styling for standalone private catalog cards · P1 composer prefill input · team label in TeamReferralResource · per-module summary read (perf) · Gyn show_if hook query cost · de-identified export structured value_json free text · HistoryQuestionController shows private field labels · S2b nutrition board split into 14 cards (needs the identity harness) · NEWS2 per-parameter scores · LIS PDF onto the P5 engine · hard 2FA enrollment guard · login token expiry default flip.