Changelog

Added

• 🧭 **State-keyed booking flow (state-booking-flow.ts + wizard threading, dark).** One wizard, per-state config: residency question, under-18/non-resident copy, and the condition selector now come from stateBookingFlow(jurisdictionState). WA config is the verbatim legacy funnel (same strings, same CONDITIONS array object — pin-tested) and every existing entry point defaults to WA, so live booking is byte-for-byte unchanged. PA/OH flows render their own 24/26 official condition lists (ids = state-qualifying-conditions slugs, loss-free normalization downstream) and attest patientPhysicalState to their own state. A live state page's booking CTA passes &state=XX (shape-validated); unknown states fall back to the WA UI while the fail-closed write gate stays the real enforcement. MD/VA/MO/MN flow configs are a REQUIRED pre-flip step (noted in-module). 14 pin tests. (multi-state)(booking)(dark)
• 🗂️ **States menu registry (states-nav.ts, NOT wired).** Tiny client-safe list of every state front page (WA + 6 expansion states) for the future SiteNav "States" dropdown — built now, deliberately unwired per Doug ("menu wiring later"), so wiring it is a one-import change. (multi-state)
• 🛑 **Cert-issuance jurisdiction gate (cert-pdf-issue.ts).** Every cert artifact the pipeline can produce is a WASHINGTON legal document (legacy cert PDF + DOH 630-123, both RCW 69.51A) — an expansion-state visit could previously have fallen through and had a WA form printed for it. issueCertForAppointmentUnified now refuses (reason: jurisdiction-cert-artifact-missing) when Appointment.patientPhysicalState is set to any non-WA state, before the idempotency branch — same shape as the dob/email gates. null/WA = legacy funnel, unchanged. (multi-state)(hipaa-clean)(fail-closed)
• 📋 **Expansion cockpit: platform-artifacts panel (/admin/expansion).** The launch-readiness card now shows the ENGINEERING half of each state's flip picture — public page, condition set, PDMP reference, booking flow, cert artifact, consent copy — derived live from the modules that implement each artifact (state-platform-readiness.ts), so the checklist can never disagree with the code. Decision-support only; the runtime gates are unchanged. (admin)(multi-state)

Changed

• 🤝 **Honest-expectations FAQ on the PA + OH pages.** Both new state pages now carry the claim-class guard from the PA content plan verbatim in spirit: certification/recommendation is the physician's independent determination — you pay for the visit, never a guaranteed result. (content)(compliance-voice)

Added

• 🗺️ **Per-state qualifying-condition sets (state-qualifying-conditions.ts, dark).** PA's 24 Serious Medical Conditions (verified against pa.gov 2026-07-12; the 2 research-only conditions — TBI, Type II diabetes — are an explicit deny-list that can never certify) + OH's 26 OMMCP conditions (with the Medical Board's arthritis/migraines/CRPS-under-chronic-pain determinations encoded as normalizer variants). WA delegates to the untouched RCW module — same list object, same normalizer output, pin-tested byte-for-byte. Unknown states fail closed (null, no cross-state fallback — wrong-state labels invalidate certs). 18 pin tests. Rebuilds + supersedes the lost feat/pa-state-aware-cert branch. (multi-state)(dark)
• 💊 **Per-state PDMP reference (state-pdmp.ts) + state-keyed PdmpQuerySection.** Closes open-item D in each state's launch predicate: PA = PDMP review per 35 P.S. §10231.403(b) (pennsylvania.pmpaware.net), OH = MANDATORY OARRS query covering ≥12 months per OAC 4731-32-03 (ohio.pmpaware.net, lookback floor rendered in the UI). The encounter PDMP section now takes an optional jurisdictionState: absent = WA rendering verbatim-unchanged (pin-tested against the exact legacy strings); an unknown state fails closed with a manual-verify notice instead of deep-linking the wrong portal. New pin tests; all legacy WMC tier-1 pins still green. (multi-state)(provider)(dark)
• 🌐 **Pennsylvania + Ohio public state pages (states-content.ts, waitlist mode).** /telehealth/pennsylvania and /telehealth/ohio join the coming-soon registry with verified state facts (PA: $50/yr card, MMAP $0 fee reductions, padohmmp registry, Act 44 telehealth-by-statute; OH: state fee eliminated 5/15/2024, CTR physician, digital card) + per-state city lists and FAQs. comingSoon governs teaser copy only — bookability stays owned by the DB release gate, so both pages render waitlist CTAs until counsel + credentialing flip the state live. (seo)(multi-state)

Changed

• 🕶️ **Turner expansion seed now creates the provider DARK (isActive=false).** /api/public/providers lists active providers — the seed as written would have published 'Dr. Turner' on the public site before the NDA/IC are signed. Flip isActive by hand when he's papered. Also applied to prod: migration 87 (ProviderOnboardingAgreement e-sign table + per-state legal-reference columns — was never applied), canonical migration 88 (legalPredicateReviewedAt, backfilled from the divergent legalPredicateSetAt variant), and the seed itself — Dr. Turner provider row + 14 pending state-license shells + 14 state rules, every enforcementActive=false, zero live-behavior change. (multi-state)(dark)

Added

• 🛡️ **check-dispensary-scoped-reads gate (HIPAAGATE1 — the AUDITFIX1-class permanent fix).** The 2026-07-07 cross-tenant leak was an UNSCOPED READ (db.appointment.findMany missing dispensaryId in the dispensary cert route) found by MANUAL audit; the existing check-dispensary-scoped-writes gate scans create/upsert only, so that exact class could recur with every gate green. New READ-side sister gate: in any dispensary-context file (under /api/dispensary/ OR reading the x-dispensary-id header — capability-derived, new surfaces covered by construction), every read op (findMany/findFirst/findUnique/+OrThrow/count/aggregate/groupBy) on any model NOT on the two-entry NON_PHI_MODELS allowlist (dispensary/dispensaryUser) must carry dispensaryId in the query window. Fail-closed on new files AND new models — exempting is the reviewed act. Negative-tested: synthetic unscoped findMany fails the gate; live tree passes (4 context files, 2 read sites, AUDITFIX1 fix confirmed still scoped). Registered in gates.manifest.mjs (HIPAA section) + package.json check:dispensary-scoped-reads. [hipaa][gates]
• 🔦 **check-phi-in-logs multi-line blind spot CLOSED.** The gate's own header admitted 'Multi-line calls slip through (accepted false-negative)' — a console.error spanning lines (e.g. a template literal interpolating JSON.stringify(patient) on line 2) evaded the single-line 800-char capture and shipped PHI to the non-BAA Vercel logging plane with all gates green. Replaced with a paren-balanced multi-line extractor (string/template literals skipped opaquely, 4000-char cap bounds pathological input); all 5 existing violation classes now run over the FULL arg body. All exports/exemptions unchanged — 10/10 anti-divergence pin tests green; live tree stays at 0 violations; negative-tested with a multi-line stringify offender. [hipaa][gates]
• 📬 **check-safe-harbor-digest-content: hardcoded allowlist → capability-derived discovery.** The non-BAA digest gate scanned a hand-maintained 13-file list — FAIL-OPEN on new files: a brand-new digest renderer to the owner's gmail was invisible until someone remembered to add it, so a patient.firstName interpolation in a new digest would have shipped full names to a non-BAA inbox uncaught (§164.514(b)(2)(i) breach vector). The gate now auto-discovers any src/lib or src/app/api file referencing the non-BAA recipient rail (OWNER_ALERT_EMAIL / the gmail literal) — scope grew 13→30 files, all clean. Also added full-row egress detection (JSON.stringify of a patient-shaped receiver / object spread / bare-object interpolation — never maskable, flagged regardless of mask helpers on the line). One LINE_EXEMPT: workflow.ts waitlist greeting (that email goes TO the patient over the BAA M365 rail, not to the non-BAA inbox). Negative-tested: a synthetic NEW digest file with an unmasked firstName is caught with zero list maintenance. [hipaa][gates]
• 🚪 **check-admin-api-routes-self-auth gate — last un-gated route tier closed (2026-07-12 security-auditor recommendation).** Cron (60 routes) + portal tiers already had structural self-auth CI gates; /api/admin/* (213 routes) relied on the proxy edge gate alone — a proxy matcher regression or over-broad ADMIN_BEARER_ALLOW entry would leave a new admin route with NO auth. New gate (ported from the portal pattern): every admin route must call requireAdminFromHeaders / verifyAdminSession / verifyCronAuth, OR check the proxy-verified x-admin-id/x-admin-role headers inline, OR sit on a 4-entry justified PUBLIC_ALLOWLIST (login/forgot/reset pre-auth flows + the dedicated-bearer retell-sync trigger). 213/213 pass today; negative-tested with a synthetic bare route. [security][gates]

Fixed

• 🪝 **Working-clone hook wiring.** The gwfix clone had .githooks/pre-push on disk but core.hooksPath unset — local pushes from this clone ran ZERO of the 69 gates (CI still ran them; the first line of defense was silently absent). core.hooksPath now points at .githooks. Full suite verified green post-wiring: 69/69 in --env=ci including both new gates. [gates]

Added

• 🗂️ **Records-request processing fee, DARK (ROIFEE1 / Q42, Doug accepted recs 7/11).** New RECORDS_REQUEST_PROCESSING CertServiceRequest type + RECORDS_REQUEST_FEE_CENTS ride the EXISTING invoice-queue rails — createPatientForm drops a PENDING fee row (best-effort, err.name-only logging, idempotent per patient while one is open) only when formType=RECORDS_REQUEST and ROI_PROCESSING_FEE_ENABLED=true (default OFF, .env.example documented). Fee note renders on /admin/forms/new from the shared constant; type/label support added to /admin/invoice-queue, /admin/mailing, and the patient portal requests page. String column — no migration; patient self-upload (PatientUploadedRecord) untouched and free; PENDING→PAID stays the existing type-agnostic PATCH. [payments][forms]
• 💌 **Gated-authorization honesty email, DRAFT ONLY (Q41).** certGatedUnpaidEmail template in emails.ts — first-name-only (PHI-minimal), optional pay button + exact remaining balance, warm no-blame copy with phone + already-paid escape hatches. Deliberately NOT wired to any send path (the gate lives in auth-payment-gate.ts; the release path already emails the cert on payment) — pin test asserts it stays unwired until a deliberate, reviewed step. [emails]

Added

• 📠 **Dead-channel patient-copy gate (DEADCHAN1, Q31).** New scripts/check-dead-channel.mjs (sister of check-contact-ssot, wired into package.json + gates.manifest for pre-push + CI) reads a new reviewed-code designation registry, scripts/channel-designations.mjs — fax=DARK (legacy AT&T/RC line; inbound gated on Notifyre DID + BAA, DOUG_GATES Q38) and sms-patient-phi=DARK (Telnyx BAA pending, no public DID). Any NEW reference to a DARK channel in patient-facing code (src/ minus admin surfaces + tests) fails the build — including Isabella's spelled-out fax digits ('eight eight eight, five oh four, six one two nine') and copy that renders the handle via the FAX constant import. Designation flips are reviewed PRs: the guard can't read prod env, so the registry IS the designation SSoT. [hipaa][gates]
• 🧮 **Baseline ratchet for the Q32 fax copy.** The 13 existing fax references in patient copy (voice-prompt spelled digits + comment literal, voice/booking tools, chat + SMS + email AI prompts, booking-confirmation + records-reminder + records-upload-invite email templates, booking UI ×2, records-request PDF) are baselined pending the DOUG_GATES Q32 fax-copy strip/update. The gate passes on baseline entries, fails on any NEW reference, and fails when a baseline entry stops matching (stale-baseline cleanup signal) — the baseline shrinks to zero when Q32 lands and never grows. Pin tests in src/lib/__tests__/check-dead-channel.test.ts. [hipaa][gates]
• 🗓️ **Quarterly dead-channel + designation checklist.** New docs/GW_DEAD_CHANNEL_AND_DESIGNATION_CHECKLIST.md runbook — PASS = the 4 hipaa-architect 2026-07-07 invariants (Privacy Officer named per §164.530(a) + breach contacts live/staffed/BAA-covered; every PHI transport has a signed unexpired BAA or stays flag-OFF; no dead channel wired to any patient path, handles enumerated + probed, spelled-digits trap called out with the Retell prompt-sync requirement; no PHI at the cross-tenant boundary). Documents how designations flip (reviewed PR; a new provider usually means a NEW number — update patterns too) and the baseline-ratchet rule. [hipaa][docs]

Added

• 🪪 **Provider.licenseExpiresAt (Q10 LICEXP1, Doug 'yes to all recs' 7/11).** New nullable expiry-date column (prod-migration-110-provider-license-expires-at.sql, expand-only, STAGED not applied — Doug runs it by hand against Neon before/with merge). NULL = inert. ADVISORY ONLY — deliberately not wired into cert-pdf-issue.ts; no hard-gate on cert issuance. [providers]
• 📅 **/admin/providers 'WA license expires' date field.** Edit-form date input next to the WA License #; the provider list shows the date with a red EXPIRED / amber expires-soon (≤90d) hint. Sent through the existing PATCH (zod-validated ISO date string; empty string clears to NULL). [providers]
• ⚠️ **Preflight banner license-expiry warnings.** Expired licenses = high ('update the expiry date or deactivate the provider'); expiring within 90 days = med; both link to /admin/providers. Providers without a date entered are never flagged. [providers]
• 🚦 **/admin/launch 'Provider license expiry' readiness tile.** Blocker if any active provider's license is expired, caveat if any expire within 90d, else ready — an advisory readiness signal, not an issuance gate. [providers][launch]

Changed

• 💳 **Wizard payment branch repointed off the Stripe test-key path (Q40a).** StepPayment's un-flagged default is now the DEFERRED panel (books via /api/appointments with no payment intent; the booking-confirmation email attaches the signed /pay HMAC pay-link — the exact rail staff-manual bookings use). The Poynt pay-to-confirm branch is unchanged and still takes precedence when SELF_SCHED_PAY_TO_CONFIRM is on; its server-flag-disagree fallback also lands on deferred now instead of Stripe. Stripe Elements survives ONLY behind the new explicit NEXT_PUBLIC_STRIPE_WIZARD_ENABLED legacy opt-in. [booking][payments]

Added

• 🗺️ **Telehealth prior-clinic rule enforced server-side (Q40b).** POST /api/appointments (the chokepoint every booking source flows through) now accepts priorClinic (lynnwood|olympia|spokane) and rejects a TELEHEALTH booking whose slot provider isn't in getRenewalProvidersForPriorClinic coverage for the named clinic (409, refund-safe, before the slot claim) — previously TELELOC1 lived only in the Isabella/chat tool layer and a direct POST bypassed it. Missing-priorClinic hard-require is behind TELEHEALTH_PRIOR_CLINIC_REQUIRED (default OFF; flip with the wizard flags). [booking][telehealth]
• 🧭 **Wizard + proposal threading for the prior clinic.** Step 3 asks a returning telehealth patient which clinic they were previously seen at (same question Isabella asks) and the answer rides the booking POST; chat/email proposals (BookingProposalPayload) now carry priorClinic from proposeBooking through confirmBooking so the tool lane satisfies the chokepoint gate too. Older signed proposals without the field keep working. [booking]

Added

• 🟢 **State-assistance flag (STATEASSIST1, cmrfa7m5).** New Patient.stateAssistanceEligible (prod-migration-109, expand-only) + front-desk toggle on the patient profile (self-attest per Doug 7/10 ruling, no proof docs — heroesEligible posture) + emerald chip on /admin/today + mark-paid modal pre-checks paidInFull with the $15 note. Set/cleared via POST /api/admin/patients/state-assistance (ADMIN/MANAGER/SCHEDULER, UPDATE_PATIENT audit). [patients][payments]
• 💵 **Partial-payment top-up (TOPUP1, cmrf6o1b).** mark-paid's 409 guard relaxed from any-sentinel to genuinely-fully-paid; a partial now accepts a top-up that ACCUMULATES amountCollectedCents (amount required — can't accumulate null; original sentinel kept for downstream prefix parsers; top-up method/ref/amount in the MARK_PAID audit row). 'Record top-up' button on Today board + appointment detail, balance-due banner, pre-filled amount. Cert auto-release unchanged — releaseGatedAuthForAppointment still requires isAppointmentFullyPaid. [payments]
• 📞 **Isabella full-contact widening, DARK (ISAFONE1, cmrfabln pt 2).** ISABELLA_FULL_CONTACT=true (env, default OFF) adds unmasked tel: links to the voice call log — same minimum-necessary rationale + flag shape as DEMI_FULL_CONTACT; VIEW_ISABELLA_COCKPIT audit rows carry fullContact=on while active. Doug flips the env (needs a real commit for pickup). [isabella][hipaa]

Fixed

• 🔒 **Patient-ID oracle closed (AVAILORACLE1).** Public /api/availability no longer accepts or looks up ?patientId= (a valid id changed the telehealth provider pool → attacker could confirm ids exist by diffing responses). The only real caller (/admin/appointments/new, authed) now derives the routing client-side and passes non-PHI ?telehealthClinic=olympia|general; stray legacy patientId params are ignored without lookup. [security]
• 🛡️ **Cron self-auth CI gate (CRONGATE1).** New scripts/check-cron-routes-self-auth.mjs (registered in gates.manifest + check:cron-self-auth) walks src/app/api/cron/**/route.ts and fails the push if any route skips verifyCronAuth — 60/60 green at introduction; empty allowlist by design. Closes the 'new cron route ships publicly reachable' gap. [security][cron]

Changed

• 🧹 **Salesforce W2L readiness retired (SFRETIRE1, Doug ruling).** The rail was decommissioned 2026-05-24 (no BAA; postToWebToLead hardwired skip) but its hardwired-false probe kept ONE permanently-red issue in /api/health readinessHint + a stale SF_W2L_OID preflight banner on every render — noise that buried real rail failures. Probe + banner removed; decommission stub + pinned tests remain as the re-enable-only-if-BAA record. [health]
• 📝 **RC softphone secret documented (RCRESTRICT1).** NEXT_PUBLIC_RC_CLIENT_SECRET added to .env.example with the exposed-by-design warning + rotate-on-offboarding rule; console-side scope/redirect restriction checklist + PKCE support-email draft handed to Doug (Desktop docx). [docs]

Changed

• 🌙 **Patient quiet hours 8am–8pm PT on the deposit-reminder lane (DEPREMIND2), then armed LIVE.** isWithinPatientSendWindow() (DST-safe PT wall clock) holds the once-ever ladder outside the window; the T-10h DEPOSIT_STAFF_ALERT is exempt by design (front-desk mailbox, overnight cutoffs must not be lost — structural pin covers the ordering). DEPOSIT_REMINDER_ENABLED=true set in prod; this deploy is the env pickup. [payments][cron][deposit]

Added

• 💰 **Pre-visit unpaid-deposit reminder ladder + T-10h staff notify (DEPREMIND1 — closes reviewer-feedback cmr5rnw0i).** New hourly cron /api/cron/deposit-reminder: r1 at booking+20h, r2 at T-72h, r3 at T-26h (each once ever, 6h min gap, PatientMessage.externalId dedup — payment-chase substrate), then a one-time front-desk email at the T-10h cutoff with an /admin deep link. NO auto-cancel — Doug §E ruling 2026-07-07, pinned in tests (route never writes Appointment.status). Eligibility mirrors the /pay deposit-button condition exactly (isDepositPayOptionEligible + bookingDepositInScope + fail-closed pricing), so a reminder is never sent that the pay page won't honor. Ships DARK behind DEPOSIT_REMINDER_ENABLED (+ goes quiet if BOOKING_DEPOSIT_ENABLED is off); heartbeat fires every authed run so the actor never reads stale while dark. New audit actions DEPOSIT_REMINDER_SENT / DEPOSIT_STAFF_ALERT (PHI-free detail). [payments][cron][deposit]

Added

• 📇 **Chart identity card gains Phone + Email (CHARTCONTACT1).** Identity card on /provider/portal/encounters/[id] retitled 'Patient identity & contact' and now renders phone + email (with '— not on file —' empties). Recovered from draft PR #8 (#2a, the display-only piece) after Dr. Ari's 7/8 deactivation unblocked the safe subset. [provider][chart]

Fixed

• ✅ **Today board: immediate paid-status refresh after mark-paid (cmrf6mc5 — Kat).** MarkPaidButton now fires the Today client's load() callback on success so the PaymentBadge flips from 'Unpaid' → 'Paid (method)' without waiting for the 30 s poll. [admin-today][payments]

Changed

• 📋 **Isabella cockpit voice log row cap raised to 500 (KAT1).** Rows dropdown now offers 20 / 50 / 100 / 250 / 500; query hard-cap raised from 100 → 500. Kat feedback: 'this is only the last hour and a half.' [isabella][voice-log]

Changed

• 📞 **Isabella cockpit: voice call log promoted above email log (KOKPIT1).** Reordered Zone G (VoiceCallLog) to render before Zone E (SentEmailLog) on /admin/isabella. Closes reviewer-feedback cmrf59to8000404jok57wnppi. [cockpit][isabella][polish]

Fixed

• 💚 **Hardship-rate auto-stamp (HARDSHIP3, cmrfb90h pts 3-4).** releaseGatedAuthForAppointment (runs via after() on every payment path: /pay Collect, Poynt webhook paid+additional, Stripe webhook, mark-paid) stamps discountCents=RENEWAL_HARDSHIP_DISCOUNT when collected == undiscounted expectedAppointmentFeeCents − $15 EXACTLY and no discount recorded; guarded updateMany (discountCents:null) = once-only under webhook races; audited actor=system. One-row prod backfill applied (cmrbiekj, audited actor=backfill). Exact-match only — arbitrary shortfalls stay partial. [payments][auth-release]

Fixed

• 💳 **Visit-fee context at point of payment (cmrf7q1n).** BillViaPoyntButton/MarkPaidButton accept apptType/isNew/discountCents; Today board passes them + renders a renewal-vs-new chip; modals show an expected-fee banner and pre-fill from expectedAppointmentFeeCents instead of hardcoded $175. [payments][today]
• 🧮 **today-payments strip fee math (cmrfb90h).** expectedDollars now derives from expectedAppointmentFeeCents (type+isNew+discountCents) — the local ternary ignored both, so in-person renewals showed phantom $30-due and $130-discounted renewals phantom $15-due. [payments]
• 🏷️ **Honest partial labels (cmrfb90h).** PaymentBadge only says 'Deposit paid' when collected ≈ the $50 booking deposit; other shortfalls render '$X paid · balance due $Y'. [payments]
• 🗣️ **Voice-log summaries (cmrfabln pt 1).** Zone G rows prefer persisted aiCallSummary (scrub-then-trim, 120c) — only ~half of CALL rows have a subject, so most showed '(no transcript summary)'. [isabella]
• 🔗 **Expired-link refresh (LINKFRESH1).** Expired-but-authentic portal magic links render a one-click 'email me a fresh link' page (signature re-verified server-side; forged tokens still 404). Fixes the records-nudge lane emailing 15-min links from a daily cron, and every stale staff-sent link. [portal]
• 📪 **Records-nudge hardening.** Lane now honors contactFlag + emailBouncedAt, and writes its 14-day dedup row fail-closed BEFORE sending (a silent log failure could re-nudge the same patient daily). [records][cron]
• 🛡️ **Security sweep smalls.** Lead-document viewer gets the same CSP ('script-src none' + nosniff) as the patient-document route (stored-SVG XSS); SVG upload sanitizer now rejects script-less XSS vectors (event handlers, javascript:/data: hrefs, foreignObject); admin bearer-allow proxy branch strips spoofable x-admin-* headers. [security]

Fixed

• 🚦 **Deploy unblocked (GATEFIX1).** check-phi-in-logs vs RENEWHARD1 collision: cron/renewals message-HEAD logging (160-char slice, justification in source) added to PHI_LOG_EXEMPT (8/10 cap) instead of reverting to the err.name-only blindness the 7/02→7/10 outage post-mortem removed. Six blocked releases (KATFIX1-4, RENEWCOCKPIT1, RECNUDGE1) ride this deploy. [infra][compliance-gate]

Added

• 📎 **Booked-patient records nudge (RECNUDGE1).** records-reminder cron gains a pre-lead lane: upcoming ≤7d SCHEDULED/CONFIRMED × real email × 0 MedicalDocument/PatientUploadedRecord → recordsUploadInviteEmail w/ minted portal token; dedupe via CommunicationLog templateType=RECORDS_NUDGE (14d); cap 25/fire; heartbeat carries patientNudges. [records][cron]

Fixed

• 📅 **Same-day + location badges on the voice log (KATFIX-cmrf5efv + cmrf5fe9).** getVoiceCallLog enriches rows with the matched patient's TODAY appointment (PT-day bounds, SCHEDULED/CONFIRMED, batched in-query); VoiceCallLog renders the amber badge with time + clinic/Telehealth. [isabella][calls]

Fixed

• 🗓️ **Calendar type color-coding + labels + legend (KATFIX-cmrexvu6).** Visit TYPE drives block color (sky/emerald), status stays in tooltip; cancelled/no-show gray + line-through. [admin][calendar]

Fixed

• 📧 **Outbound recap emails store their sent text (KATFIX-cmrf36n1).** sendVoiceCallSummaryEmail returns the tag-stripped rendered body (≤2000c); the Retell webhook's PatientMessage OUT row leads with it. Ledger parity with inbound/staff-composed rows. [isabella][messages]

Fixed

• 💬 **Chart conversation thread chronological (KATFIX-cmrextfi).** CommunicationPanel sorts by occurredAt ascending at render — prop order and append order no longer matter. [admin][messages]
• 🧾 **Bill-via-Poynt persistent confirmation (KATFIX-cmrf9lgu).** sentConfirmed state flips the trigger to '✓ Invoice sent — bill again' + inline note after either success path. [admin][payments]

Added

• 📊 **Renewal worklist + per-patient timeline (RENEWCOCKPIT1).** List drives off Patient.certExpiryDate (window −60d…+90d, cap 400) with LEFT-joined pipeline stage, derived booked-from-appointment, last-touch = max(PatientMessage OUT, WorkflowEvent RENEWAL_*), replied detection; NEW drill-in /admin/renewals-pipeline/[patientId] merges WorkflowEvent + CommunicationLog(RENEWAL) + PatientMessage(email/SMS/CALL w/ AI summaries) + Appointments + pipeline stamps. RBAC ADMIN/MANAGER/SCHEDULER + render re-check; new audit action VIEW_RENEWAL_PATIENT_TIMELINE (counts-only detail). Follow-up queued: claim/snooze/note work-lane (expand-only migration). [renewals][cockpit]
• 🩺 **Renewal sender hardening (RENEWHARD1).** Per-touch catch logs the error-message head (160c, PHI-safe) not just err.name; blockFailures counted into the heartbeat + response — sent=0-with-failures can never read healthy again (the exact blindness that hid the 7/02→7/10 outage). Sends also log subject/body-head via logCommunication so timelines show WHAT was sent. [renewals][observability]

Added

• 📤 **Bulk signed-authorization upload w/ fuzzy filename→patient matching (AUTHUP2).** _BulkAuthUpload on /provider/portal/today; last-name-weighted token scoring on a non-rendered matchKey (display stays list-redacted per the PHI pin — buildAuthUploadMatchKey helper keeps the page clean); confident matches (score ≥2, no tie) pre-fill, everything else demands an explicit pick; sequential posts to the existing provider-scoped rail. LIVE E2E: bridge 307→cookie, POST ok, GET round-trip 200/209B, foreign-appointment 404, fixtures deleted. [provider-portal][records]
• 🏷️ **$130 hardship rate named in renewal emails (HARDSHIP2, Doug 'yes add it').** Shared HARDSHIP_RATE_LINE_HTML at the 3 renewal price mentions — 'On Social Security (SSDI/SSI), state assistance, or a veteran? Your renewal is $130 — just check the box on the payment page.' Ties to the /pay self-attest checkbox. [renewals][emails][copy]

Added

• 📤 **Per-appointment signed-authorization upload on the provider Today page (AUTHUP1).** New _AuthUploadCard client component → existing POST /api/provider/documents (provider-scoped appointment check, private blob, compression + MIME allowlist, PROVIDER_DOCUMENT_UPLOADED audit). Sits outside the chart Link so row navigation is untouched; accepts PDF/JPG/PNG/HEIC; multi-upload per patient. [provider-portal][records]

Fixed

• 🔗 **/renew one-click link un-dead-ended (RENEWFLOW1).** BookingParamHandler consumes renewAuthId → opens the modal type=returning + prefill (until the wizard flips on and takes over the params natively). [renewals][booking]
• 🧑‍⚕️ **SLOTSAFE2 — provider-collision filter on /api/availability** (month + day modes): the wizard/reschedule pickers share the same offer-time truth voice/chat got this morning. [slots][booking]
• 📄 **/get-started truth pass:** window-aware scheduling tile (Fridays-only copy self-reverts after 7/24 via isFridayOnlyCoverageWindow) + closed Spokane clinic removed from the in-person list (Lynnwood/Olympia/Seattle). [copy][truth]
• 💵 **One balance story:** 3 conflicting framings unified — 'collected at your visit; authorization issued once you're paid in full.' Cert email's portal mention now links the portal. [emails][copy]

Added

• 📝 **Consent-chase panel on /admin/today (INBOXQUIET1).** lib/consent-chase.ts (landed a commit early via the RENEWFIX1 sweep): appointments in the next 7d (SCHEDULED/CONFIRMED/PENDING_APPROVAL) whose patient has no SIGNED INFORMED_CONSENT or NEW_PATIENT_PACKET PatientForm — deduped to earliest visit per patient, soonest first. Rows show visit date (bold ≤2d, TODAY/tomorrow callouts), consent state (never sent / sent Nd ago / opened but unsigned) + inline SendConsentFormButton reuse. Metadata-only VIEW_CONSENT_CHASE_PANEL audit row (actor + count), AdminTodayTiles-style degrade-to-null resilience. [consent][today]
• 📝 **Unsigned-consent banner on the patient profile.** Renders when the patient lacks a signed consent AND has an upcoming visit or a stale outstanding send — days outstanding + next-visit countdown + inline resend. Escalates amber→rose when the visit is ≤2 days out. Derived from the already-loaded patientForms + upcomingAppts (zero new queries on the high-traffic chart page). [consent][patient-profile]

Changed

• 📪 **Per-event staff-alert emails are now opt-in (Doug: 'those should all just go through flow').** With OWNER_ALERT_EMAIL/ADMIN_NOTIFY_EMAIL empty in prod, resolveStaffAlertRecipients() bottomed out at 'all active ADMIN users' — every new lead AND every signed form (the informed-consent pings) emailed Doug's personal inbox. sendLeadStaffAlert now gates on LEAD_STAFF_ALERT_EMAIL=true; sendFormStaffAlert gates signed/delivered on FORM_STAFF_ALERT_EMAIL=true. delivery_failed is NEVER gated (terminal fax/email failure to a provider office still alerts). recipientsOverride bypasses (test surfaces). Weekly stale-lead-escalation cron untouched — still the rot safety net. Gate helpers are pure fns in the shared modules with 10 pin tests. (Gate code itself rode into prod inside 5e6ae7e via the twin-session sweep; this entry documents it.) [email][staff-alerts]

Fixed

• 🔁 **Renewal outreach engine revived (RENEWFIX1).** prod-migration-108: ALTER TYPE WorkflowEventType ADD VALUE IF NOT EXISTS RENEWAL_21D / RENEWAL_0D (drift documented 6/05, never remediated; the 7/01 cadence rewrite queries CADENCE_EVENT_TYPES incl. both → every per-touch block threw invalid-enum, swallowed by the err.name-only catch, heartbeat sent=0 skipped=0 read healthy 7/02→7/10). Applied to prod + cron re-fired: sent=58 skipped=0. Follow-up hardening queued: catch should log the message class + heartbeat should carry failure counts so sent=0-with-errors can never look healthy. [renewals][incident]
• 🔗 **Email booking CTAs deep-link the booking modal.** BOOKING_URL → /?book=1 (type-neutral, no-show/reschedule lanes) + new RENEWAL_BOOKING_URL → /?book=1&type=returning for the 4 renewal templates + renewal SMS — patients stop hunting the homepage for Book Now. BookingParamHandler already reads both params. [renewals][emails]

Fixed

• 📞 **Auto-disable the widget's stale Environment override (RCENV1).** postMessage rc-adapter-set-environment {enabled:false, server: RC_APP_SERVER} at 0.8s/3s unless already signed-in — kills the partitioned-storage devtest hijack from the parent frame (iframe storage is partitioned per top-level site; top-level clears can't touch it). [softphone][rc]

Fixed

• 💳 **/pay charge path verified after the PAYFIX1 store pin (PAYVERIFY1).** Diag round-trip green: token mints, POYNT_STORE_ID resolves to Green Health Solutions (terminal 'Green Wellness' ACTIVATED — never deactivated), charge route entitled. Rogue radhealth.ai store holds zero devices; its deletion is refused by Poynt's public API (dashboard/support-only) → GoDaddy support ask filed with Doug; harmless meanwhile — nothing routes to it. Temporary CRON_SECRET_PREVIOUS diagnostic window opened + closed same-session (env deleted; this deploy flushes the runtime). [payments][poynt][incident]

Fixed

• ⏰ **No computed deadlines in patient acks (NOCLOCK1).** getStaleTransferAckCopy drops the nextBusinessTimeLabel interpolation for 'as soon as possible' + apology; pins inverted to FORBID clock times in ack copy. 988 line retained. [isabella][copy][sla]

Fixed

• 📞 **Softphone auto-sign-in retry ladder (RCRETRY1).** loginStatusRef-guarded retries at 0.5/2/5/12/30s stop as soon as rc-login-status-notify reports signed-in; single-shot 250ms injection was the fragile bit. PII-safe console breadcrumbs on fetch/network failure. Server JWT path verified live (webhook-renew renewed 2 subscriptions). [softphone][rc]

Added

• 🏷️ **Hardship self-attestation at checkout (HARDSHIP1 — Doug 2026-07-10).** CollectPaymentForm checkbox (hidden on admin custom charges) → live price drop to expected−$15; chargeViaCollect accepts hardshipAttest, floors the discount at PRICING.RENEWAL_HARDSHIP_DISCOUNT (never reduces a larger existing discount), persists discountCents on success, and stamps hardshipAttest=1 in the PAY_COLLECT_CHARGED audit row = the staff verification trail. Server recomputes everything; client amount is never trusted. [payments][pay]
• 💵 **Mark-paid checkbox refit to the defined discount.** '$15 off applied (Social Security / low income / veteran)' → stores exactly $15 as discountCents (was: computed expected−collected gap, which could mint arbitrary discounts). [payments]

Fixed

• 🗂️ **/admin/today: appointments first (cmrf9jkv, Kat-approved).** TodayClient renders above the AI pulse/ops tiles. [admin-today]
• 💵 **Mark-paid 'payment in full (discounted rate)' checkbox (cmrfb90h + state-assistance ask).** POST mark-paid accepts paidInFull; server computes discountCents = expected − collected so PaymentBadge/auth-release/today-payments all read PAID. [payments]
• 🧾 **Today's-payments strip: partial-state (deposit) awareness.** paid = collected ≥ expected (sentinel-only legacy rows still count paid); partial rows render with the real balance due instead of vanishing as 'paid'. [admin-today][payments]
• 🔐 **Proxy bearer-allow for the one-shot rogue-store removal diag** (hardcoded to the radhealth.ai store id, confirm-gated). [diag]

Fixed

• 💳 **/pay outage root-caused + fixed (PAYFIX1).** listStoreDevices() diag revealed 2 stores in the GW Poynt business — rogue 'radhealth.ai' (no devices) listed ahead of 'Green Health Solutions' (terminal 'Green Wellness' = ACTIVATED). resolveStoreId's stores[0] fallback had been charging the rogue store since ~6/25-7/2 → http-403 STORE_DEVICE_NOT_ACTIVATED on all 26 attempts. POYNT_STORE_ID env now pins the correct store (the fallback's escape hatch, used as designed). Chase cron stays paused until a live charge confirms. [payments][poynt][incident]

Added

• 🧾 **Admin Today 'Today's payments' strip (TODAYPAY1).** New lib today-payments.ts — paid = payment sentinel present OR amountCollectedCents>0 (same canon as /admin/reports/payments); PT-day window; fail-soft (loader fault hides only this strip). Rows link to the appointment detail page where the collection buttons live. RBAC unchanged (ADMIN/MANAGER/SCHEDULER). [admin-today][payments]
• 🔎 **Poynt store-device enumeration in the collect-verify diag.** listStoreDevices() (read-only, PHI-free: names/types/statuses/ids) surfaced in /api/admin/diag/poynt-collect-verify so the STORE_DEVICE_NOT_ACTIVATED root cause is pinpointed to a named device — evidence for the GoDaddy reactivation ask. [payments][diag]

Changed

• 💳 **Cardholder name fields on the Poynt Collect form (PAYNAME1).** displayComponents gains firstName/lastName — patient-typed, browser→Poynt direct, SAQ-A posture unchanged; the Poynt dashboard shows the real name instead of 'Card Customer'. Reconcile historic rows via /admin/reports/payments (MANUAL:POYNT: sentinels already carry the Poynt transaction id per appointment). [payments][poynt]

Changed

• 🗣️ **Greeting stops leading with the human option (GREET1, Doug 2026-07-10 live listen).** Removed the disclosure-breath 'talk to a person, just say so' insert (deleted voiceGreetingHumanOption(), both armed/unarmed variants — supersedes the FORCEXFER4 'one ask away' greeting line below) and the 'or would you rather I have someone give you a call?' invite branch; added an explicit 'do NOT offer a transfer/agent in the greeting — human option is REACTIVE only' instruction pointing at the unchanged live-transfer rule + reach-for-a-person guidance. FORCEXFER4's escalation choice + single-interim-line rules kept as-is. Synced live via sync-retell-prompt.mjs. [voice][isabella]

Changed

• 🗣️ **Help-first greeting + transfer-or-message choice + single interim line (FORCEXFER4 — Doug live-call feedback 9:51am).** Armed-variant greeting names her capabilities and keeps the live-person offer one ask away; can't-answer escalation offers team-member-on-the-line OR detailed message; live-transfer rule caps interim chatter at one line (the 9:51 call stacked three hold sentences). flagForHuman 'other' copy: 'our office manager' → 'a member of our team'. Prompt re-synced through the abstention gate. [voice][transfer][isabella]
• ⏸️ **Payment-chase cron PAUSED** — PAYMENT_CHASE_ENABLED removed from prod (the 9:00am fire emailed 11 patients at the Poynt-dead /pay page; the 2:00pm fire will not send). Re-arm = re-add the env + a real-commit deploy, after the Poynt store terminal is reactivated (STORE_DEVICE_NOT_ACTIVATED since ~6/25-7/2). [payments][cron]

Fixed

• 🗣️ **Transfer-first prompt restructure (FORCEXFER3).** voice-prompt.ts gains env-gated variants (greeting human-option, escalation paragraph, office-contact line) that REPLACE the no-transfer doctrine when DEMI_TRANSFER_NUMBER is set, instead of contradicting it in a trailing clause. Env unset → byte-identical legacy prompt (verified). Abstention eval: first broad draft FAILED AB03/SH01 (tool-first energy leaked into booking/clinical lanes) → narrowed to person-requests-only → 19/19 PASS, PATCHed live via sync-retell-prompt.mjs. [voice][transfer][isabella]

Fixed

• 📅 **AI channels never offer same-day slots (SLOTSAFE1 — Kat 2026-07-10).** dateRangeWindow (consumed ONLY by the voice + chat listOpenSlots handlers) floors from at the start of tomorrow PT (new pure startOfNextPtDay, 3 pins incl. the 8:04am incident shape). Same-day asks fall through to the existing capture-preference/callback framing. Staff + wizard surfaces untouched. [isabella][slots]
• 🧑‍⚕️ **Offer-time provider-collision filter.** New slot-offer-collision.ts reuses the providerOverlapWhere truth from the /api/appointments chokepoint (Dr. Ari 6/17 class: twin telehealth/in-person slot rows at one clock time — a booked appointment owns one row, its twin stayed offerable). Both listOpenSlots handlers now drop any slot whose provider has an ACTIVE appointment overlapping it, so Isabella never offers what booking would 409. One predicate, offer + write parity. [isabella][slots][double-book]

Fixed

• 📞 **Live transfers were never reachable (FORCEXFER2 — root-caused from Doug's 8:34am 7/10 test call).** Three independent breaks, each alone fatal: the live Retell prompt predated the transfer feature and hard-instructed 'do NOT promise to transfer' (drift flagged 7/9 but misread as benign — sync-retell-prompt.mjs had never been run since the clause shipped 6/04); DEMI_TRANSFER_NUMBER was absent from Vercel prod so flagForHuman's transferEnabled gate was false; and the forced-window check required !isAfterHours (9am–5pm) which killed the 8–9am slice of the 08:00-17:00 window. Fixes: prompt synced (abstention-eval gate PASS), env set via REST + real-commit deploy, and the window now gates on new business-hours.isOpenDay() (weekday + non-holiday, clock-agnostic) instead of the desk-shift clock. [voice][transfer][isabella]

Changed

• 📞 **Forced-transfer window for cell-phone coverage (FORCEXFER1 — Doug 2026-07-10 'it really should be pushed to her cell').** New pure voice-transfer-window-shared.ts (VOICE_TRANSFER_FORCE_WINDOW="HH:MM-HH:MM", clinic/PT wall clock via Intl so a UTC server can't shift the cutoff; 5 pin tests). Inside the window + business hours, flagForHuman treats staff as present WITHOUT the admin-heartbeat check (the heartbeat gate was built for Demi's DESK — a cell answerer has no /admin tab). Outside the window / env unset / malformed → byte-identical heartbeat-gated behavior (fail-closed to message-taking, 2pm cutoff EXCLUSIVE + self-expiring). Env set to 08:00-14:00 for Fri 7/10 Kat coverage; unset it (+ redeploy) to retire. Retell tool destination separately points at Kat's cell (swapped 7/9 via add-retell-transfer-tool.mjs). [voice][transfer][isabella]
• 🗣️ **Isabella's transfer copy is now staff-name-FREE.** 'I am bringing Demi on the line' / 'Let me get Demi' → 'a member of our team' — Demi's account has been deactivated since 6/16 and the line's coverage now rotates (Kat today), so promising a named person was a stale promise. The transfer_call tool description in add-retell-transfer-tool.mjs matches ('our on-duty team member'). Pin updated from asserting the name to BANNING any staff name in the spoken copy. [voice][copy]

Fixed

• 📅 **Dr. Frisch's non-Friday availability un-blocked (data fix — closes reviewer-feedback cmra10ub6).** Root cause was two-layered: (1) the original report (filed 7/6) hit the PROVIDER_SLUGS dead-id bug (prov-marnie never existed on prod) that FRIWIN1 fixed on 7/8; (2) FRIWIN1's window blocks were then applied to EVERY active provider — including Marnie Frisch (prov-olympia), whose separate Mon/Wed Olympia + telehealth practice isn't part of Dr. Morical's Friday-only coverage lane. Fix = deleted the three friwin1-agent ProviderDateBlock rows for prov-olympia ONLY (her own out-of-office blocks and every other provider's window blocks untouched). Live-verified: /api/availability month view now offers 2026-07-13 (5 telehealth slots) plus her 7/15/7/22/7/27/7/29 cadence; Morical's lane still Friday-only. Data-only — no code change. [scheduling][date-blocks][feedback-close] Closes reviewer-feedback cmra00klk. Closes reviewer-feedback cmra1a57b. Closes reviewer-feedback cmra10ub6.
• 🎥 **Dr. Morical's default doxy.me room set (data fix, provider row).** Her doxyMeUrl was NULL, so 6 of the 9 booked 7/10 telehealth visits had NO video link (staff had hand-set links on only 3). Set to the clinic's standard https://doxy.me/greenwellness room — the same value staff were already hand-entering and every other provider row uses — so effectiveVideoLink() now resolves a link for all 9 confirmed 7/10 visits (verified: 3 own links + 6 provider-fallback), and every future Morical telehealth visit inherits it. [telehealth][doxy][provider-data]

Changed

• 📋 **One form link for new patients (FORMMERGE1 — closes reviewer-feedback cmra00klk).** The NEW_PATIENT_PACKET is already the merged form the feedback asks for (pages 1-3 = health intake writing the same appointment-linked IntakeForm row; pages 4-5 = informed consent + 7-initial acknowledgement + e-signatures, in the requested order: history → medications → allergies → cannabis history → consents → signature; document upload stays on the portal). The duplication was in DELIVERY: booking confirmations sent new patients the standalone /intake card NEXT TO the packet card. Now: confirmation email sends new patients the packet card only (intakeUrl omitted when isNew + packet link exists; returning patients + packet-mint-failure fallback unchanged) · portal checklist collapses intake+consent into one 'New patient packet — intake + consent in one' step while the packet is pending (deriveAppointmentChecklist grew an optional consentIsPacket input — legacy callers unchanged) · the amber portal nudge + T-24h intake reminder (email + SMS) point at the still-signable packet instead of re-splitting the flow (fallback to /intake preserved). ZERO consent-language changes — every clause the packet carries is byte-identical to before; this is routing/presentation only. [forms][intake][consent][feedback-close]
• 🩺 **Website records-requirement truth sweep (QUALREC redo — closes reviewer-feedback cmra1a57b; the prior agent's v2.97.QUALREC1 fix was stranded by branch protection and never landed).** ~20 claims of 'medical records are helpful but optional' / 'we can assess you from reported history alone' corrected across: conditions/[slug] What-to-bring · locations/[city]/[condition] bullets · homepage Services card · main FAQ (3 answers) · per-condition FAQs + whatToExpect (chronic pain, cancer, MS, Parkinson's, HIV/AIDS, Crohn's, PTSD ×2) · telehealth per-condition FAQs (chronic pain, Parkinson's) · Spokane/Lynnwood location whatToExpect · 4 articles — and the 'Do You Need Medical Records?' article REWRITTEN from answering 'no' to the honest 'yes': WA authorization requires records documenting a qualifying condition; providers review existing records to confirm eligibility (they can't mint a diagnosis at the visit); GW's team helps patients request records before the appointment. Consistent one-message rule across every surface. [website][copy][records][feedback-close]

Fixed

• 🔌 **Feedback reconciler cron actually actuates on the :23 schedule (RECONCILE2).** RECONCILE1's outer gate accepted ONLY the dedicated FEEDBACK_FINALIZER_SECRET bearer — but Vercel's scheduler presents Bearer CRON_SECRET (GW has no cron dispatcher to construct a custom bearer the way the VRG twin's dispatcher does via bearerEnv), so every scheduled tick would 401 and the reconciler would stay inert forever, invisible to the watchdog. Outer gate now accepts EITHER the dedicated secret OR CRON_SECRET via verifyCronAuth — capability-neutral (any CRON_SECRET holder can already close rows directly via the [id]/agent PATCH this route self-calls); both-unset still 401 fail-closed. Also: canary heartbeat after auth + actor feedback-reconciler registered in cron-actors-shared + EXPECTED_CRON_ACTORS (staleAfterDays 1) so /api/health + cron-watchdog surface it. hipaa-architect delta review PASS 2026-07-08. Caught pre-live by the same review pass, shipped same-day. [feedback][reconciler][cron-auth]

Added

• 🧹 **Feedback finalizer/reconciler cron (RECONCILE1 — GW lane of the FINALIZER_RECONCILER spec; ported from the FedRAMP-reviewed VRG twin).** New /api/cron/feedback-reconciler (hourly :23) scans the changelog compiled into the running bundle for Closes reviewer-feedback markers, HARD-GATES on being the live production deployment with a known build sha, and PATCHes each matching STRANDED row (approved-autofix/agent-working) to done via the app's own /api/admin/reviewer-feedback/[id]/agent endpoint — carrying the real doneSha + version, so the close rides the audited path (close-gate + submitter-confirm email + thread entry), never a hollow close, never a raw DB write. Pure core in lib/feedback-reconciler.ts (PHI-blind by construction: reads row {id,status} + changelog text only), 11 pins. Outer gate = dedicated FEEDBACK_FINALIZER_SECRET bearer (constant-time; NOT CRON_SECRET) → 401 inert-by-default until the secret is set. Retires the feedback-stuck-in-loop watchdog red. [feedback][reconciler][watchdog]

Fixed

• 🧩 **Date-block parity on the last three slot-read surfaces (FRIWIN2).** /api/public/next-slot, home-server-data.ts getNextSlotDisplay (SSR homepage teaser), and the ai-draft BILLAVAIL1 availability block each read AvailabilitySlot through bookableSlotFilter but never filterBlockedSlots — during the FRIWIN1 window they could advertise/quote a blocked non-Friday day the /api/appointments chokepoint would 409. Each now filters through the same predicate (no-op when PROVIDER_DATE_BLOCKING_ENABLED is off); the two findFirst teasers became findMany(50)+filter+[0] since a block can cover a multi-day span of head slots. [date-blocks][parity][teaser]

Changed

• 📅 **Friday-only coverage window through 2026-07-24 (FRIWIN1 — Doug 2026-07-08).** Mechanism = the EXISTING ProviderDateBlock rail, finally armed: 15 ProviderDateBlock rows inserted (every active provider × the three non-Friday ranges 7/8-7/9, 7/11-7/16, 7/18-7/23; Fridays 7/10, 7/17, 7/24 deliberately uncovered) + PROVIDER_DATE_BLOCKING_ENABLED=true flipped in Vercel prod (was staged-dark since migration 80). Blocks self-expire as the dates pass — no cleanup deploy. Applied via scripts/friwin1-friday-only-window-2026-07-08.sql (data-only, reversible, no schema change). Booking chokepoint (/api/appointments 409), availability route, admin manual/reschedule already enforced blocks; this ship adds the missing parity in BOTH Isabella listOpenSlots paths (chat booking-tools.ts + voice voice-tools.ts now run filterBlockedSlots so she can't QUOTE a blocked slot the booking POST would refuse). [scheduling][coverage-window][date-blocks]
• 🚪 **Dr. Ari (Dawn Reardon, prov-reardon) deactivated — she no longer works with GW (Doug 2026-07-08).** Provider.isActive=false removes her open future slots from every surface via the shared bookableSlotFilter; her (and Ruth's) ProviderSchedule rows also deactivated so the Sunday slot cron + Isabella's standing-windows describer stop using them. Her existing booked appointments were NOT touched (2 fall on blocked days → staff reschedule list). [roster][provider-sunset]
• 🩺 **Dr. Morical wired into the rules layer (window-scoped).** PROVIDER_SLUGS.morical added (prod cuid); getRenewalProvidersForPriorClinic includes her for EVERY prior clinic while isFridayOnlyCoverageWindow() is true, so telehealth-renewal scoping (TELELOC1) resolves to her real Friday slots; normalizeLocationId("Seattle") now maps to the prod Seattle Location id so voice IN_PERSON lookups reach her office's slots; PROVIDER_HOME_CLINIC.morical=lynnwood (renewal catch-all clinic — Seattle is deliberately NOT a new LocationSlug to avoid rippling the persona tool enums). New dep-free src/lib/coverage-window-shared.ts holds the dated gate (start 7/8 00:00 PT, end 7/24 23:59 PT) — every copy/routing consumer self-reverts after the window. [rules][teleloc1][window-scoped]
• 🗣️ **Patient-facing copy states the new reality (self-reverting).** Wizard Step 3: new patients read 'First visits with us are in person at Dr. Morical's office in Seattle — we're currently scheduling Fridays'; renewals read 'Renewals are currently done as telehealth video visits via doxy.me — we're scheduling Fridays'; the telehealth info box now says the doxy.me link is EMAILED BEFORE the appointment (honest while Dr. Morical's doxy room URL is not yet on file — the confirmation email already falls back to 'a secure video link will be emailed to you' when Provider.doxyMeUrl is null). Isabella's location list (all 5 persona formats) leads with a window line — PROVIDER-NAME-FREE per the standing Doug 2026-06-19 rule ('Fridays only… new patients in person at our Seattle office… renewals by telehealth video'). Voice static prompt grew ~190 chars → VOICE_PROMPT_SOFT_CAP_CHARS consciously bumped 33500→34000 with history note (assembled-playbook ceiling untouched at 42000). [copy][isabella][wizard]

Fixed

• 🪤 **PROVIDER_SLUGS pointed at dev-seed provider ids that never existed on prod.** dawn: "prov-dawn" / marnie: "prov-marnie" vs prod's prov-reardon / prov-olympia (verified read-only against the prod Provider table) — every TELELOC1 telehealth-renewal providerId scope resolved to nonexistent rows → zero dated slots → silent standing-windows fallback on chat + voice since 7/4. Slugs corrected + the two stale pin tests re-pinned to prod truth. [silent-failure][teleloc1]
• 🧪 **Baseline-red repaired: emails↔/pay deposit-mirror pin.** AUDITFIX1 (7/7) rewrote /pay's DEPOSIT_CENTS literal to derive from the PRICING SSoT and left the source-regex pin red on clean HEAD. Pin now asserts the SSoT-derived form AND that PAY_DEPOSIT_CENTS equals PRICING.NEW_PATIENT_DEPOSIT * 100. Suite 11331/11331 green. [tests][baseline-red]

Fixed

• 💵 **Isabella billing draft-suggest quoted stale prices (AUDITFIX1).** patient-email-draft-suggest.ts CATEGORY_TONE_HINTS.billing hardcoded $149 new in-person / $99 returning telehealth — the SSoT (PRICING in constants.ts) is $175 / $145. Reachable in prod today via the admin/manager/scheduler messages/[id]/draft-suggestion route (not flag-gated). Now interpolates PRICING.NEW_IN_PERSON / PRICING.RETURNING_TELEHEALTH. [pricing][ssot][isabella]
• 🔒 **Cross-tenant PHI isolation on dispensary-partner cert routes (AUDITFIX1).** api/dispensary/certs (list) and api/dispensary/cert/[token] (PDF download) authenticated the partner via x-dispensary-id but filtered the Appointment query only on dispensaryConsent / share-token — never on dispensaryId. A second BAA-signed partner would have seen every tenant's consenting patients (name/DOB/conditions) and could pull any cert PDF by token. Added the dispensaryId tenant scope to both where clauses, restoring the PLAN_TENANT_ISOLATION invariant. Latent today (single active partner); this closes it before partner #2. [phi][tenant-isolation][dispensary]
• 📮 **HIPAA §164.526 amendment path pointed at an unprovisioned mailbox (AUDITFIX1).** amendment-request.ts staffAlertEmail() fell back to the literal alerts@greenwellness.org (never provisioned) when MARIANE_EMAIL/ALERTS_TO are unset — used both for the internal 60-day-clock staff alert AND the patient-facing denial letter that tells a patient where to send a Statement of Disagreement. Fallback now resolves to the provisioned EMAIL (admin@). [hipaa][mailbox][ssot]
• 🧹 **SSoT hygiene (AUDITFIX1).** pay/[appointmentId] deposit now derives from PRICING.NEW_PATIENT_DEPOSIT instead of a hardcoded 5000; Dr. Ari provider-welcome front-desk contact now uses the provisioned EMAIL instead of unprovisioned info@greenwellness.org. [ssot][cleanup]

Changed

• 🧹 **CS Command Center ages out abandoned obligations into a 'stale' tier (CSCLEAN1).** Root cause of Doug's 'HARD BREACH · 269 bh' screenshot: computeCsObligations had ZERO aging-out logic, so an item nobody worked (e.g. a lead_followup 'promised for 2026-05-17', ~50 days old) composted as a live hard breach forever — sorted oldest-first to the TOP and burying today's real breaches, and inflating the headline breach count. New slaStateFor reclassifies a NON-LEGAL-lane obligation past STALE_AGE_BUSINESS_HOURS (240bh ≈ 6 working weeks) from hard_breach → stale: muted slate tone (not red), sorts below fresh breaches (SEVERITY_RANK), dropped from the fresh-breach headline + the per-lane breachCount + the patient-slip-watchdog escalation, surfaced instead as a separate '+ N stale (abandoned 6wk+)' count. NEVER hidden — a human still triages via the existing desk overlay. records_export is a LEGAL lane (WA RCW 70.02.080 15-working-day clock) and is EXPLICITLY EXEMPT (isLegalSlaLane) — it stays hard_breach forever. Nothing goes stale without first being a hard breach (240bh >> every non-legal lane's hard threshold). Pins cover the aging-out boundary + the records-legal exemption. [cs-command-center][sla][cleanup]

Added

• 🩺 **HIPAA Notice of Privacy Practices — 4 required §164.520(b) elements added (RIGHTS1).** Researched against eCFR/Cornell LII, drafted in regulation-standard language, hipaa-architect-verified. (1) The prescribed header (§164.520(b)(1)(i)) is now the exact verbatim mandated string. (2) NEW 'Our Legal Duties' section carries the breach-notification duty (§164.520(b)(1)(v)(A), a 2013 Omnibus hard requirement that was absent). (3) NEW 'Uses That Require Your Written Authorization' section (§164.520(b)(1)(ii)(E) — psychotherapy notes, marketing, sale of PHI, other-uses-only-with-authorization, revocable). (4) NEW cash-pay restriction right (§164.522(a)(1)(vi)) — directly relevant since GW is 100% cash-pay. Effective date bumped to 2026-07-07. Privacy Officer stays a title (publication doesn't require a named individual). Counsel does a final read + supplies the internal §164.530(a) designation. [privacy][hipaa][npp]

Fixed

• 💳 **Terms names the correct payment processor — Poynt, not Stripe (RIGHTS1).** §3 said fees are collected 'via Stripe'; the live rail is Poynt. Factual correction to a legal document. [terms][accuracy]
• 🚨 **Terms leads with a 'not for medical emergencies — 911 / 988' notice (RIGHTS1).** Standard telehealth-ToS safety disclaimer, placed as a prominent alert at the top of the Terms (911, the 988 Suicide & Crisis Lifeline, and text HOME to 741741 — mirroring our live footer + Isabella crisis copy). The site had this in the footer but not the Terms body. Effective date bumped to 2026-07-07. [terms][safety]

Added

• 🔒 **Standalone Consumer Health Data Privacy Policy at /consumer-health-data-privacy (MHMDA1).** WA My Health My Data Act (RCW 19.373.020) requires a SEPARATE consumer-health-data policy with its own prominent, distinct homepage link — a subsection embedded in the HIPAA Notice does not satisfy the statute, which carries a private right of action (highest website legal exposure per the 2026-07-07 rights audit). The MHMDA content that has been live at /privacy since v2.97.AE3025 is relocated VERBATIM to the new standalone page (only edit: 'above/below' cross-references fixed to explicit /privacy links now that it stands alone). /privacy keeps a short pointer section. Distinct homepage link added to the HomeContent footer + the shared SiteFooter. Structural relocation of already-published text — NOT new legal wording; counsel confirms the standalone text carries nothing beyond the statute (filed as a Doug/counsel gate). [privacy][mhmda][wa-law]

Added

• ♿ **New /accessibility statement page (A11Y1).** Closes the missing-accessibility-statement gap the ADA + rights audits flagged. Honest + factual: aspirational WCAG 2.1 AA conformance target (never a guarantee), a plain-language summary of what the site does (skip link, keyboard operability, labels, contrast checks, reduced-motion, resizable text), honest known-limitations (third-party Doxy.me video, some documents), and a real barrier-report + accommodation path (email/phone, 2-business-day aim, staff completes the task by phone so nobody is turned away from care over a website barrier). Prose in body-string literals (JSX-entity-gate-safe, same pattern as /terms). Linked from SiteFooter. [accessibility][ada]

Fixed

• 🔗 **Footer now links Terms of Service + Accessibility (A11Y1).** The inner-page SiteFooter previously linked only the HIPAA Privacy Notice + Cookie preferences; /terms existed but was reachable only from the homepage footer, and /accessibility is new. Both are now in the shared footer on every inner page. [footer][links]
• ⌨️ **Confirmation dialog is keyboard- and screen-reader-accessible (A11Y1, WCAG 2.1.1 / 4.1.2).** The shared ConfirmDialog (used across patient + admin confirm flows) now carries role=dialog + aria-modal + aria-labelledby/describedby, the click-to-dismiss scrim is aria-hidden (was a phantom focus stop), and the keyboard cursor lands on the Cancel button when it opens. [a11y][dialog]
• 📄 **Patient document uploader is keyboard-operable (A11Y1, WCAG 2.1.1 / 1.3.1).** The my-appointments upload dropzone was a click-only div — a keyboard-only patient couldn't open the file picker. It now has role=button + tabIndex + Enter/Space activation + a visible focus ring, and the file input carries an accessible label. [a11y][patient-portal]

Changed

• 📣 **Bulk 'Send reminder to N' widened to the front-desk tier (ADMINEFF3).** It shipped MANAGER_RESTRICTED in ADMINEFF2 because a bulk patient-facing outbound fan-out is a Doug-gate tier (autonomy playbook §5); the SCHEDULER-widening was filed as a default-with-override gate and Doug approved it 2026-07-07 ("I don't object; it's admin now"). The bulk-remind route role array now includes SCHEDULER (matching the per-item [id]/remind route the front desk uses 10-20×/day), with a paired SCHEDULER_ELIGIBLE EXCEPTIONS entry in the scheduler-coverage gate, and the server-side canBulkRemind gate now shows the button for exactly the roles the route accepts (ADMIN/MANAGER/SCHEDULER) so a role that would 401 never sees it. Zero change to the send itself — consent gates, confirm modal, 50 cap, and 12h dedupe are untouched. [appointments][bulk][rbac]

Added

• ☑️ **Bulk confirm + bulk reminder on /admin/appointments (BULKAPPT1).** Row checkboxes + select-all-on-page + a bulk bar. **Confirm N** (front-desk tier, SCHEDULER) mirrors the per-item confirm route EXACTLY per appointment — only SCHEDULED→CONFIRMED, one CONFIRM_APPOINTMENT audit row each, race-safe conditional updateMany, skip+report non-eligible ids, cap 100 (new POST /api/admin/appointments/bulk-confirm). **Send reminder to N** (MANAGER+ only — a patient-comm fan-out is a Doug-gate tier per the autonomy playbook; SCHEDULER-widening filed as a default-with-override gate) calls the SAME extracted send per appointment (new src/lib/appointment-reminder-send.ts, lifted VERBATIM from the [id]/remind route so consent gates + pay-link threading + vendor-error capture can't drift), cap 50, behind a required confirm modal, with a bulk-only 12h REMINDER_24H dedupe so a double-submit can't double-text patients. Sends stay SEQUENTIAL (the vendor-error caches are module-global). Pure eligibility/partition/summary logic in import-free src/lib/appointment-bulk-actions.ts (14 pins). No new content, no migration, no PHI in audit/logs. [appointments][bulk][hipaa-clean]
• ⌨️ **Keyboard nav + bulk-dismiss on /admin/isabella-drafts (BULKDRAFT1).** Per-card checkboxes + select-all + 'Dismiss N selected' — the bulk path makes N SEQUENTIAL calls to the EXISTING per-draft /api/admin/messages/[id]/draft-suggestion endpoint (one aiSuggestedReplyDismissedAt stamp + one audit row each, byte-identical to a single dismiss; DELIBERATELY no new bulk server route so the SCHEDULER-worked queue stays SCHEDULER-eligible). Keyboard: j/k (or ↓/↑) move a focus ring, u=use, d=dismiss, o=open, x=select; ignored while typing, on modifier combos, and (action keys) on auto-repeat. u/d route through each card's own DraftActions so the hotkey path IS the click path. Pure key logic in import-free src/lib/isabella-drafts-hotkeys.ts (19 pins). [isabella-drafts][keyboard][bulk]

Changed

• ⚡ **isabella-today loads its 'From Mariane' + schedule-availability lanes inside the main Promise.all batch (BULKAPPT1 sibling).** They previously ran as two sequential DB round-trips AFTER the main 13-query batch; they never depended on any other lane's result, so folding them into the batch removes serial latency on high-volume days. Behavior-identical (same missing-table fallback, same swallow-all availability catch); structural pin guards against a sequential-await regression. [isabella-today][perf]

Added

• 📞 **'Lead callbacks due' tile on /admin/admin-today (ADMINEFF1).** The front-desk morning anchor surfaced ZERO lead work — a promised follow-up call was only visible if someone remembered to open /admin/leads (or was Doug/Mariane, whose pages both have the tile). New count-only getDueTodayFollowupLeadCount() in src/lib/leads.ts uses the SAME derivation as the /admin/today tile + the /admin/leads due_today view (FUPDUE1 invariant: tile == destination; deliberately no LEAD_MARKED_READ release — read ≠ contacted), 1000-row bounded like the badge cohort. Fail-soft loader, no PHI, hidden at zero, deep-links to /admin/leads?status=due_today. [admin-today][leads]
• 🔄 **Refresh affordance on /admin/cs-command-center (ADMINEFF1).** The noon/close sweep anchor was the only daily surface without RefreshShell (admin-today + isabella-today both have it) — a crisis flagged after the page was opened waited on a manual reload. Same 60s auto-refresh + button, same component. [cs-command-center]
• 🩺 **PreflightWarnings now checks the WA-license hard-block (ADMINEFF1, OPSVIS1 follow-up).** The every-admin-page checklist banner checked npi/email/doxyMe but NOT licenseNumber — the one field that actually hard-blocks cert issuance (cert-pdf-issue.ts license-required gate). Now flags active providers missing it: high severity when a CERT_DOH_* form path is enabled (issuance blocks today), med otherwise. [preflight][cert-readiness]

Fixed

• ☎️ **Phone search now matches phone-SHAPED queries, not just bare digits (ADMINEFF1).** phoneSearchClauses only expanded to format variants when the query was 100% digits — so an E.164 caller-ID paste ('+12065550100') or a dashed '206-555-0100' against the parens-stored '(206) 555-0100' returned ZERO results for a patient who was on file. Any query that is only digits + phone punctuation (10-11 digits) now expands to the same variants. Pin test deliberately FLIPPED (the old pin asserted the miss); 3 new pins cover E.164/dashed/formatted. Benefits /admin/patients search + every other phoneSearchClauses caller. [patients][phone-search][pin-flip]
• 🖨️ **Mailing: printing labels arms the mark-mailed step (ADMINEFF1).** 'Print all' and per-row print now pre-select the printed rows, so the existing 'Mark N as mailed' bulk button is immediately ready instead of requiring a manual re-select of everything just printed. Selection is inert until staff explicitly confirm the bulk modal — no write-path change. [mailing]

Added

• 📋 **'Waiting on the office' obligation strip on /admin/admin-today (OPSVIS1).** Three count-only, deep-linked tiles surfacing standing daily obligations that were invisible on the front-desk anchor page (each only alarmed elsewhere or nowhere): unmailed completed certs (was Doug's 7am briefing email only — patients legally waiting on their mailed authorization), PENDING $50 service-request fees (was /admin/invoice-queue only, no chase anywhere), and pending Isabella email drafts (was /admin/isabella-drafts only). New src/lib/mailing-queue.ts provides getUnmailedCertCount() (status COMPLETED + certPdfUrl + mailedAt null) as the single source of truth — the AdminNav mailing badge + the 7am daily-briefing now call it too (3 inline copies consolidated, behavior-identical) — plus getPendingServiceRequestCount(). Each tile loads via its own fail-soft .catch(()=>null) AFTER the page's main Promise.all, so a count failure hides only that tile, never the page. Count-only, no PHI, hidden at zero. [admin-today][obligations][hipaa-clean]
• 🩺 **Provider setup-incomplete banner on /admin/providers (OPSVIS1).** An active provider with no WA practitioner license number HARD-BLOCKS every cert they'd issue (cert-pdf-issue.ts license gate) — but that only surfaced reactively, per-cert, at issuance time. The page now shows an amber banner naming each active provider missing a license (rose 'hard-blocks issuance' chip), NPI, or signature, each with a 'Complete setup' jump to that provider's edit form. Derived entirely client-side from the already-loaded provider list — no new query, admin-facing config visibility only (not the cert logic). [providers][cert-readiness]

Fixed

• ⚠️ **The 'patient was NOT emailed' authorization warning no longer vanishes on refresh (OPSVIS1, regression from today's FBGRIND1).** FBGRIND1 added router.refresh() after Authorize to flip the status pill — but the Actions block hosting the button is gated on status ∈ {SCHEDULED,CONFIRMED,PENDING_APPROVAL}, so the refresh flipped status→COMPLETED and UNMOUNTED the whole block, silently discarding the email-failure warning before staff could act (a success hiding a partial failure — the exact class PROVEYES1 fixed). Now the refresh fires ONLY when the patient was actually notified; on an email failure the warning persists in place so staff know to send the cert manually. [authorize][cert-delivery][regression]

Changed

• 📧 **Callbacks-owed digest routes to the shared admin mailbox (CALLBACKADMIN1, Doug 2026-07-02: 'demi no longer works for GW, change it to admin').** Set CALLBACKS_OWED_DIGEST_RECIPIENTS=admin@greenwellness.org (BAA-covered M365) in prod AND hardened the code default: resolveRecipients() now falls back to a named DEFAULT_DIGEST_RECIPIENTS=['admin@greenwellness.org'] when the env is unset/empty, instead of the previous 'all active ADMIN users' scatter — deterministic, survives staffing changes, cannot rot to a departed inbox (the exact dead-mailbox failure the workflow-map audit flagged: the env was set 39d ago, pre-offboarding). Subject line 'Demi —' → 'Front desk —' (buildDigestSubject + pin test updated). No PHI/schema change; the digest stays count+deep-link only. [callbacks][digest][staffing][hipaa-clean]

Added

• ☀️ **'Your Day' daily-workflow runbook (WORKFLOW1) at /admin/workflow.** Static staff-facing guide built to the /admin/training idiom (admin-session gated, ALL_ADMIN roles, sticky table-of-contents deep-links). Designed from a 4-lane operational map (Isabella handoff boundary, patient-journey crons, inbound-comms queues, staff-surface inventory) and hipaa-architect-reviewed: the two crisis blocks (morning Band 0 + the during-day crisis-text row) carry the built machinery's safety language verbatim — 911 for immediate danger, warm re-share of 988 / Crisis Text Line 741741 / DV hotline 1-800-799-7233, an explicit no-counsel/assess/diagnose ban, and 'resolved is a queue action, not a clinical all-clear.' Every page reference is a real (22 routes, all verified present). Registered in the nav SSoT (nav-config.ts, Help group, 'Your Day', Sunrise icon) so it feeds both the sidebar and the ⌘K palette; /admin/training gains a cross-link card. Documents only what's live today — fax dark, reminder calls + returning-patient SMS not-yet — so staff stop expecting them. [training][staff-ops][hipaa]

Added

• ✅ **Non-blocking 4-step appointment checklist on the patient portal (CHECKLIST1, row cmr5row2i — Doug picked option ii).** New pure derivation seam deriveAppointmentChecklist() (pin-tested 15/15) + thin AppointmentChecklist component on each upcoming-appointment card, ordered deposit → intake → consent → ID. False-pending guarded: any payment signal marks deposit done, ID pending_review renders done ('WA ID in review'), consent satisfied done, consent create (no signable row) omits the step rather than dead-linking. Links reuse the exact surfaces the confirmation email resolves (signed /pay via buildPayUrl, /intake/, /patient/forms/ via resolveConsentEnsureAction, /patient/portal/id). NextStepsBanner untouched; no new data exposure — all signals derive from the patient's own rows the page already loads. [patient-portal][forms]
• 💳 **Pay link in visit reminders (REMPAY1, residual of row cmr5rnw0i — Doug-approved).** New shared deriveAppointmentPayLink() helper (byte-equivalent to the booking-confirmation route's inline derivation; that route can adopt it later) threads an HMAC-tokened /pay URL into reminderEmail from the 48h/24h cron + the admin manual-remind route. Amber pay card mirrors the DEPCOPY1 confirmation branching: deposit-eligible → '$50 deposit holds your appointment; remaining balance due after your visit' with both buttons; partial-paid → 'Pay remaining balance'. Fail-quiet: a derive failure never blocks the reminder. Forward-safe pins: only the $50 figure may appear, never the fee/balance amount; every /pay href carries the token; fully-paid renders zero pay hrefs (12 new pin tests). reminders-2h is SMS-only — unchanged. [emails][payments]

Changed

• 💳 **Booking-confirmation payment section names the deposit workflow directly** — when deposit is offered (hosted-paylink mode, nothing collected, fee > $50), the heading is now 'Confirm your appointment with a $50 deposit' and the body reads 'A $50 deposit today holds your appointment. The remaining balance is due after your visit, before your authorization is issued.' Both existing buttons stay clickable and both still link to the standard HMAC-tokened /pay URL — pinned by two new tests (deposit-first branch + fallback branch). Non-eligible fallback (due==deposit, in-portal Collect, or partial-paid) keeps the classic 'Pay ahead of your visit' heading since deposit isn't offered there. Mariane reviewer-feedback cmr5rds28. [admin][payments]

Fixed

• ✉️ **Email thread view shows sent replies (row cmr9ho8ru).** The thread page now canonicalizes its URL key (message-id links resolve to the row's threadId and the query matches both), and all four AI-reply create sites in email-ai.ts fall back to threadId ?? inboundMessageId so future auto-replies land in the conversation their inbound message anchors — previously a NULL threadId left every AI reply body invisible (only the audit marker showed). [messages][email]
• 📊 **Today 'Follow-ups due' tile == destination list (FUPDUE1, row cmr98bdw1).** Tile universe was a 365d follow-up scan; the /admin/leads due-today view only pulled 30d, so older promised callbacks were counted but never listed. The page now supplements the due_today view (only) with the same 365d derivation the tile uses — shared LEAD_BADGE_FOLLOWUP_LOOKBACK_DAYS constant, same helpers, deduped by id — while the 30d array stays the sole universe for every chip, the header, and the Mark-all-read write cohort (invariant preserved). Tile also returns a PRE-slice totalDueTodayFollowups so the count is exact, with '(showing 10)' when the preview is trimmed. [leads][today]
• 🩺 **Cert-issuance errors, stuck status, and PDF downloads (CERTUX1, row cmr0313ul).** Admin approve + authorize-override routes return friendly issue reasons (raw code preserved in reasonCode); the cert-pdf fast path self-heals appointment status to COMPLETED on both idempotent branches (was sticking at Awaiting Authorization after a successful reissue); admin + patient cert download routes stream the private blob correctly; AuthorizeButton guards a null certExpiry; provider portal copy no longer dead-ends at 'portal profile'. Fastest real-world unblocker is data entry: the provider's WA license number on /admin/providers. [certs][authorization]
• 🪪 **WA ID upload in the booking checklist (IDUPLOAD1, row cmq61ukdl).** bookingConfirmationEmail gained an optional 'Upload your Washington ID' card (link-only, mirrors the intake/consent cards) gated by the patient's derived ID status; both production senders wire it, and the portal NextStepsBanner prompts for it too — including asking for a fresh photo after a rejected upload. Hard-blocking confirmation on ID is a separate policy call (gate row filed). [emails][patient-portal]
• 📝 **Training quiz fee/mailing answers aligned (rides MAILCOPY1).** The 'Check your understanding' quiz taught the stale $25 resend fee and dispensary-pickup framing as correct answers on the same screen the copy fix corrected — quiz strings now derive from RESEND_FEE_CENTS and teach the mail-everything workflow. Also trimmed the ORACLECLOSE1 staffSummary to satisfy the ≤800-char changelog pin test (pre-existing red). [training][copy]

Fixed

• 📋 **Signed new-patient packet now creates the appointment-linked intake record (PKTLINK1, Mariane intake-cluster cmq6203a7).** The packet e-sign extracted intake answers into the patient chart but passed appointmentId: null, so the per-visit IntakeForm row never existed — and all three nag surfaces (the /my-appointments checklist, the portal NextStepsBanner Priority-1 card, and the day-before intake-reminder cron) key on exactly that row, so packet-signers kept being told to 'complete your intake'. The sign route now resolves the patient's SOONEST upcoming SCHEDULED/CONFIRMED appointment without an IntakeForm (pure rule in packet-intake-appointment-shared.ts, pin-tested; mirrors the cron's status cohort exactly — COMPLETED/NO_SHOW/CANCELLED/PENDING_APPROVAL never receive a late intake link) and upserts the IntakeForm against it (idempotent — appointmentId is @unique). Zero-candidate → null → prior behavior (chart baseline still updates, sign never fails; resolution sits inside the existing swallow-catch). Cron cohort predicate extracted to intake-reminder-shared.ts + pin test proving a packet-created IntakeForm drops the appointment out of the reminder cohort. [forms][intake][cron-dedup]
• ✉️ **Booking-confirmation consent card is packet-aware.** For new patients the consent link points at the NEW_PATIENT_PACKET (intake + consent in ONE e-sign), but the email rendered it as a second standalone 'Complete your consent form' card next to the intake card — reading as two separate forms. New optional consentIsPacket on bookingConfirmationEmail (default false = unchanged copy) retitles the card 'Complete your new patient packet'; wired from BOTH senders that run ensureConsentFormForBooking (/api/integrations/email and the staff resend-confirmation route — lane parity) off appointment.isNew, the same input the form-type pick keys on. Email-preview route stays on the default. Suppressing the separate intake card when a packet is pending is deliberately deferred. [emails][copy]

Fixed

• 📬 **Stale mailing/training copy corrected (MAILCOPY1, copy-only).** The admin training 'Mailing & Resends' section and the /admin/mailing PageHelp still described the pre-5/19 dispensary-pickup workflow ('most authorizations are picked up at a dispensary' / 'didn't pick up at dispensaries') and the pre-6/1 $25 resend fee — contradicting both the public How-It-Works copy (fixed 5/19 per Mariane) and the live request form, which auto-fills $50 from feeForCertRequest. Reality: the To-mail queue holds ALL completed unmailed authorizations regardless of dispensary consent, and both resend + change fees are $50 (RESEND_FEE_CENTS/CHANGE_FEE_CENTS, Doug-raised 2026-06-01). Training fee strings now derive from those shared constants (imported from src/lib/cert-service-request.ts) so the copy can't drift again; the badge tip now describes the coded behavior ('Shared' certs are visible 72h post-issuance in the BAA-gated dispensary partner portal, but every queued row is mailed either way); the mailing FAQ's 'Doug to set the price' placeholder is replaced with the derived $50 fee. No logic, schema, auth, or payment-path changes; 'Mail only'/'Shared' badge UI untouched. [copy][training][mailing][fee-drift]

Fixed

• 🔒 **Telehealth patient-membership oracle CLOSED (ORACLECLOSE1).** listOpenSlots (both the chat booking-tools.ts and voice voice-tools.ts lanes) resolved a returning patient's prior clinic from a self-asserted email/phone (voice also from caller ID) and returned scoped slots on a match vs the which-clinic question on a miss — a distinguishable response that leaked whether an asserted identity belongs to a GW patient (PHI). Scoping now comes ONLY from an explicitly-named priorClinic: always ask when it isn't provided, scope after the patient answers — response is identical regardless of record match. Removed the patientEmail/patientPhone tool params + the resolvePriorClinicForIdentity lookup from this path; prompt copy + tool descriptions updated to ask-first; pin test added (asserted identity → still asks). Reverses the TELELOC1 'less questions' follow-up (Doug greenlit). Found by the 2026-07-04 security pass (P3). NOTE: live Retell agent updated out-of-band via the tools+prompt sync. [security][hipaa][membership-oracle][voice][booking]

Fixed

• 🔗 **Two broken cancel links → 404 (CANCELURL1).** The cancel route is /cancel/[token] (path segment), but src/app/pay/[appointmentId]/page.tsx linked /cancel?appointmentId=… and src/lib/booking-tools.ts (the voice/chat booking-confirmation cancel URL) built /cancel?token=… — both query-string forms that don't match the route → Next.js 404. Every patient trying to self-cancel from the pay page or the Isabella booking link hit a dead page. Both now build /cancel/; the pay page reads appt.cancelToken (added to the select) and falls back to a tel: call-us link when it's null. [bug][patient-facing][cancel-flow][404]

Fixed

• 🔒 **Auth bypass on provider-feedback resolve (SECAUTHFIX1, P2).** /api/admin/feedback/[id]/resolve is on the proxy's bearer-allow list, so the middleware passes the request through WITHOUT stripping client-supplied x-admin-role — but the route authenticated via requireAdminFromHeaders, which trusts that header. An unauthenticated POST … -H 'x-admin-role: ADMIN' bypassed the CRON_SECRET check and could resolve arbitrary ProviderFeedback rows + forge resolvedBy. Now authenticates like its sibling reviewer-feedback/[id]/agent: Bearer CRON_SECRET (agent lane, note-mandatory) OR a verified AdminSession cookie (staff lane, roles ADMIN/MANAGER/SCHEDULER, real session.userId attribution) — never a raw header. Also restores the staff lane, which the header model had silently broken (the proxy never sets x-admin-role on bearer-allow paths). [security][auth-bypass][hipaa]

Added

• 🛡️ **check-bearer-allow-no-header-trust pre-push gate.** Reverse of check-bearer-routes-allowlisted: fails any route in proxy.ts ADMIN_BEARER_ALLOW that derives authorization from the proxy-set x-admin-role/x-admin-id headers (attacker-controlled on that path) or calls requireAdminFromHeaders. This is the net that was missing when SECAUTHFIX1's bug slipped in — wired into gates.manifest.mjs. [security][ci-gate][defense-in-depth]

Changed

• 🔬 **Poynt ?deliveries=1 diag now projects named fields.** listWebhookDeliveriesForDiag returned Poynt's /deliveries objects verbatim as unknown[] while the docstring claimed a PHI-light projection; it now maps to a fixed {id,eventType,resourceId,deliveryStatus,statusCode,attempts,createdAt} allow-list (mirrors listRecentTransactionsForDiag), so a future Poynt API shape-change can't silently widen a CRON_SECRET-gated response. [security][diag][hygiene]

Added

• 🔬 **Poynt diag lenses (POYNTTEST1)** — ?recentTransactions=1 (PHI-light txn projection: id/status/amount/source/reference — no cardholder fields) + ?deliveries=1 (Poynt's ~30d delivery log = the canonical did-it-fire/what-did-we-answer check) on /api/admin/diag/poynt-webhook-registration. [payments][diag]

Changed

• 💵 **BOOKING_DEPOSIT_ENABLED=true (telehealth scope)** — the §E flip Doug pre-authorized 'the moment the webhook is registered.' Deposit-then-balance model goes live on the self-sched wizard + voice pay links; the Poynt webhook (registered this hour, hook d9a1586b) auto-records each payment with server-to-server verification before anything releases. Auto-cancel-if-unpaid stays unbuilt (staff-notify only) pending the cmr5rnw0i sub-decision. [payments][booking]

Added

• 💳 **Poynt webhook self-registration (POYNTHOOK1)** — new diag /api/admin/diag/poynt-webhook-registration (Bearer CRON_SECRET): GET lists the business's hooks + whether our deliveryUrl is registered; POST idempotently registers ONE hook carrying the six documented TRANSACTION_* eventTypes (docs.poynt.com re-verified — no TRANSACTION_COMPLETED exists). Runs INSIDE prod because the Poynt creds are Vercel-Sensitive (empty everywhere else); the hook secret is the same env the receiver verifies, so the two sides can't drift. registerPoyntWebhook (built 5/20, never wired) finally gets a caller; new listPoyntWebhooks + POYNT_TRANSACTION_EVENT_TYPES. [payments][diag]

Fixed

• 📦 **Webhook receiver understands Poynt's real envelope deliveries** — Poynt sends {eventType, resource:'/transactions', resourceId} with NO amount/reference inline; the old parse read the delivery uuid as an invoice id and 0 cents, so every real capture would have acked 'no-match' and nothing flipped paid. Now isTransactionEnvelope() detects the shape and fetchPoyntTransactionForWebhook() resolves the transaction server-to-server (status/amount/references — our appointment cuid rides references[].customType=externalReferenceId, same extraction listRecentOrders uses); resolve-failure returns 503 so Poynt redelivers, absorbed by the existing idempotency + ledger dedup. Pure projection pin-tested (poynt-webhook-envelope-shared, 10 pins). [payments][webhook]

Changed

• 📞 **Voice sync executed (TELELOC2)** — Retell tools reconciled (listOpenSlots gains priorClinic/patientEmail/patientPhone; description trimmed to Retell's 1,024-char cap) + prompt PATCHed after a 19/19 abstention-eval pass on GW's BAA-covered Bedrock (GW AWS creds now provisioned in the ops keychain — the eval gate that blocked B/C/F is unblocked permanently). Decline-then-route hardening added from the eval's one initial miss: a dosage/clinical/diagnostic refusal always offers booking or a message in the same breath. [voice][isabella][safety-eval]

Changed

• 🩺 **Telehealth-by-prior-clinic, lookup-first (Doug ruling + follow-up 2026-07-04, rows cmqell76a + cmr03k7i2)** — new RENEWAL_CROSS_COVERAGE map + getRenewalProvidersForPriorClinic() in provider-location-rules.ts (prior clinic's own renewal providers ∪ cross-coverers, departed filtered); new prior-clinic-lookup.ts resolves the prior clinic from the patient's OWN record (email exact / unambiguous phone via fail-closed phoneOrWhere → newest located in-person appointment, else issuing provider's home clinic); listOpenSlots on BOTH lanes (voice: caller ID + patientEmail/patientPhone params · chat/email: patientEmail/patientPhone) looks up first and only hands back the which-clinic question when no record matches — telehealth times are never quoted unscoped, and the looked-up clinic is never spoken back to an unverified caller (disclosure rule); proposeBooking re-validates the picked slot's provider server-side (telehealth_prior_clinic_mismatch). Provider-NAME ban unchanged; the fallback ask-the-prior-CLINIC is the one permitted reversal. [voice][booking][isabella]
• 🗣️ **Prompt sweep across all four channels** — voice/chat/email/SMS renewal-routing prose (single SoT in getLocationListForPrompt) now carries the lookup-first rule (pass the conversation's phone/email; ask only when the tool asks; never echo the record); 'telehealth anywhere in Washington State' replaced with join-from-anywhere-but-schedule-by-prior-clinic framing; voice soft-cap 31.5K→33.5K + assembled ceiling 39.5K→42K (documented history). Goes live on the phone at the next Retell sync. [voice][prompts]

Fixed

• 📋 **Records message no longer implies auto-acceptance** (Mariane cmr03kio2) — the renewal reassurance now says 'our provider reviews them at your appointment, and that review is what decides the renewal' instead of wording that sounded like the appointment was guaranteed once records were in hand. [voice][isabella]

Fixed

• 📎 **Portal records-upload now works for LEADS** (Mariane cmr5rfahi + cmr5rfho7, §G of the 7/4 greenlight) — /api/my-appointments/[token]/documents falls back from Patient to the newest exact-email LEAD_CAPTURED match (findLeadAuditIdByEmail, re-parsed exact compare — doe@x.co can never claim doe@x.com's upload) and stages onto the same PendingIntakeUpload substrate as the staff lead-documents lane, so the existing lead→patient carry-forward + in-app staff review just work; lead-token + blob-path conventions extracted to shared lead-document-shared.ts so both writers can't diverge; uploads list back with synthesized display names (original file names are never stored on lead rows — PHI). Audit: LEAD_DOCUMENT_UPLOADED channel=portal-token, PHI-free detail. [portal][leads][hipaa]

Added

• 🔁 **ProviderFeedback joins the drain loop (FBPROV1)** — reviewer-feedback/queue gains opt-in ?includeProvider=1 (OPEN provider rows, same CRON_SECRET trust tier as reviewer bodies — the metadata-only agent token stays rejected; ephemeral-read rule applies); /api/admin/feedback/[id]/resolve gains a Bearer-CRON_SECRET agent lane that REQUIRES a resolvedNote naming the fix (sha/version) and stamps resolvedBy=agent — hollow closes 400 instead of landing. Watchdog's provider-feedback-open-age probe (already live) is the alarm half. [feedback][agent-lane]

Fixed

• ✉️ **'Draft pending' stops lying about hours-old emails** (Mariane cmqq18zth follow-on) — an eligible email past the 30-min drafting window with no draft now reads 'No draft generated — reply directly' instead of promising one 'within a few minutes'; these are the ones that hit a daily AI cap / conversation throttle / handoff and will never draft. Pure age-aware diagnosis, PHI-safe (no email content, just timing + category). [admin][isabella]

Fixed

• 🔎 **Patients search now surfaces matching Leads** (Mariane cmr1flpwc) — a Patients search that finds no patient shows how many leads match the same query with a 'View in Leads' link (pre-filtered); when patients DO match but a lead also matches, a slim banner keeps the lead from hiding behind the patient hit. New bounded, PHI-safe count helper (getLeadNotificationCohort's neighbor countLeadMatchesForQuery). [admin][leads]

Changed

• 📨 **Isabella records email → admin@** (Mariane cmr5ret01) — all three spoken records-submission rails (renewal confirm, new-patient wrap, end-of-call wrap-up) now say 'admin at greenwellness dot org'; the records@ mailbox was never provisioned and bounced. Matches RECORDS_EMAIL in code. Staged — goes live on the next Retell voice sync. [isabella][voice]
• ⚖️ **Isabella no longer implies a renewal is pre-approved** (Mariane cmr5rebqb / cmr03kio2) — the renewal confirmation used to suggest the patient was set once records were in; it now confirms the time slot but states the provider reviews the records and decides at the visit (WSLCB-safe: no guaranteed eligibility). Staged for the next voice sync. [isabella][voice][compliance]

Fixed

• 🔔 **Leads 'Mark all read' now zeroes the badge** (Mariane cmr5rh8f2) — the badge counted uncontacted + overdue-follow-up leads, but the button only cleared the uncontacted ones, so it stuck at the overdue count ('15 marked, still shows 2'). The count endpoint and the mark-all-read button now derive from one shared cohort helper (getLeadNotificationCohort) so they can't drift; marking an overdue lead read releases only the notification — the lead still appears in the Due Today / Needs Callback queue filters. [admin][leads]

Changed

• 🧭 **Provider menu simplified to four tabs** (Mariane cmr030cm8) — Schedule · Today's Patients · Patient Records · Charts, with Templates + My reports under a More ▾ menu. Same routes, clearer labels; the old 'Worklist' is now 'Today's Patients'. [provider]
• 🔗 **Patient Portal link restored on the website** (Mariane cmr5rf1ji) — the upper-right entry point (hidden in May while the portal was half-built) is back now that login, appointments, and records upload are live; also in the mobile menu. [website]

Fixed

• 🚨 **Sign & Issue on the schedule no longer reports success when issuance failed** — the approve action returned success while the audit log quietly recorded cert=skipped (the exact class Dr. Ari hit in June); it now returns the real, actionable reason (missing DOB / qualifying condition / license number / patient email) and the row shows it. [provider][reliability]
• 🖋️ **A cert can no longer issue unsigned** — if your signature image is on file but fails to load (transient storage error), issuance now BLOCKS with 'try again in a minute' instead of silently generating an authorization without the practitioner signature (invalid per RCW 69.51A.030). Applies to every issuance path: schedule approve, bulk sign, encounter Sign+Lock, and admin approve. [provider][compliance]
• 📧 **'Signed' no longer implies 'patient notified'** — single Sign & Issue and bulk sign both now report when the cert issued but the patient email didn't send (amber row + 'front desk can resend'), and the post-sign chart banner no longer claims the email failed when it had already gone out on an earlier issuance. [provider][reliability]
• ⏳ **Confirmation you can actually read** — the schedule's Sign & Issue outcome now stays on screen (4s success / 8s warning) instead of a 1.5-second checkmark, and a timeout says 'the cert may still be generating — refresh before retrying' instead of a generic failure. [provider]

Added

• 🚩 **Report an issue — per patient** (Mariane 6/30) — the Report-issue button now sits on every encounter chart and every awaiting-signature schedule row, carrying that patient + visit automatically, so 'missing records / incomplete intake / wrong info' reports land with staff already knowing who needs attention. The portal-wide card stays for general problems. [provider]
• 🧭 **Schedule vs Worklist, explained** (Mariane 6/30) — each page header now says what the page is for ('Your visits by day — sign & issue from here…' / 'Today's working view — check-ins, open charts, what's ready to sign'). [provider]
• ✅ **All-caught-up state** — when nothing awaits your signature, the schedule now says so instead of silently hiding the section. [provider]
• 📶 **Check-in alert health** — the Worklist shows a small 'Check-in alerts paused — reconnecting…' badge after 3 straight failed polls, so a dead connection can't silently eat arrival notifications. Records-review buttons now flip to 'Saved ✓' while the queue updates. [provider][reliability]

Fixed

• ⏱️ **All 10 remaining unbounded network calls now time out cleanly** — AbortSignal.timeout on: chart/appointment/lead document uploads (120s), Isabella draft actions, lead catch-up queue actions, cash-deposit toggle, provider records-review decisions + form, and the SOAP autosave unload flush (30s, keepalive preserved). Closes the fleet fetch-abort-signal-discipline finding for GW (10 → 0). [admin][provider][reliability]
• 🧯 **Document delete can't strand the row in 'deleting…' anymore** — the appointment-chart document delete already had a time limit but a timeout/network failure threw past the state reset (button stuck until reload); it now shows the normal error toast and re-enables. Found by the pre-ship review of this batch. [admin][reliability]

Fixed

• 🔐 **My feedback / feedback button no longer log you out** — staff surfaces living outside /admin (/me/feedback, /api/feedback, /api/upload) were being 308-redirected from flow.* to the apex host, where the host-only session cookie doesn't exist; the redirect classifier is now a pure, pin-tested predicate (flow-staff-path.ts) with those paths staff-side, and login round-trips carry ?next=/me/feedback. [admin][auth]
• 📍 **Locations + appointment slots load on the staff host** — /api/locations, /api/availability, /api/appointments joined the staff-host allowlist (same 308 class as the feedback bug); the booking page also gained honest, distinguishable error states with Retry for network-vs-genuinely-empty. [admin][scheduling]
• 📅 **Appointment calendar reload loop fixed at the root** — a render-scope date object made the loader refire after every render (appointments flashing then vanishing, audit spam); appointments now stay rendered during refresh and the promised once-a-minute auto-refresh actually exists. [admin][scheduling]
• 💬 **Isabella chats open** — chat rows link to a real conversation view (/admin/messages/chat/[threadId], session-gated, audit-logged, opaque ids). [admin][isabella]
• ⚡ **CS command center loads in seconds** — three root causes fixed (per-call date-formatter construction, an O(buckets) business-hours walk now O(days) with an exact-parity test oracle incl. DST seams, and a 50-query N+1 now one batched query); per-lane timeouts fail VISIBLE with a red could-not-check strip instead of hanging the page. [admin][cs]
• 🚧 **Denied pages explain instead of bouncing** — /admin/no-access shows your role + the page you hit (Payments for front desk now lands here rather than silently returning to Today; Dashboard nav is admin-only so it stops masquerading as a second Today). [admin][nav]
• 📧 **Email threads show your replies** — sent replies render in the same timeline as the inbound message; AI draft-reply cards show what they're replying to; the operational email composer no longer lives only under Marketing. [admin][email]
• 🩹 **Banner close buttons clear the live/test chip** (right-padding on What's-New/announcement/task banners); **caller pop-ups link to the matching patient chart** (exactly-one-match rule, masked digits); **What's New is current**; **palette search finds 'password reset'**; **training got real quiz questions** (client-side; HIPAA-basics module drafted, compliance-review-gated, provably unpublished). [admin][polish]

Added

• 🩺 **After-signing next steps** on the encounter page (next unstarted appointment today + oldest other draft, PT day-bounds + redacted-name labels matching the Today board; metadata-only VIEW_SIGNED_ENCOUNTER_NEXT_STEPS audit) · **Prior charts** link per Today tile (encounters list already accepted patientId) · **Renewal-due chip** on authorizations (expiring ≤30d AND all four reminder stamps NULL — the cron stamps windows independently, so any-stamp-present means already reminded) · **Records-awaiting-review tile** on Today (flag-gated, count-only, degrades silently) · **My reports** feedback log (provider's own rows + resolver name + note; session guard copied from records-review; VIEW_PROVIDER_FEEDBACK_LOG audit; linked from the nav and the report-issue confirmation). [providers][workflow]

Added

• 📅 **Add-to-calendar (.ics)** per upcoming appointment — hand-rolled RFC 5545 (no new dependency), UTC times, PHI-minimal by design (fixed generic SUMMARY pinned by test; LOCATION only for in-person; description links the portal). Route mirrors the patient download siblings exactly: rate-limited fail-closed, session + ownership gate with unified 404, audited before bytes (PATIENT_DOWNLOAD_APPOINTMENT_ICS, ids-only), private/no-store. 15 new pins. [patients][portal]
• 🕐 **Explicit join-opens time** — portal card + JoinVisitCard say 'Join opens at h:mm a PT' (fmtPT; the visit card's three window checks now share one named constant so copy can't drift from the button gate). [patients][telehealth]
• 📤 **Records-upload next-step nudge** — success state names the upcoming visit date (server-formatted, PHI-free prop) or links the booking entry when none. [patients][records]

Added

• ⚡ **Leads copy-contact buttons** (silent-degrade clipboard, inline 'Copied' flash — no toast spam across queue rows) · **Convert & book** second CTA (intent via ref so both the relink fast-path and DOB-modal path honor it; existing button untouched) · **Prior-patient context on lead detail** ('N appointments · next: ' under the already-a-patient pill, try/catch-degraded) · **⌘K creation actions** role-gated through the nav-config SSoT rather than hardcoded roles. One survey item rejected on verify: patient-detail appointment rows were ALREADY linked (shipped d26accc7) — no churn. [leads][front-desk][cmdk]

Fixed

• 🕐 **'Loaded at' stamps on Admin/Isabella/Mariane Today render clinic time** — toLocaleTimeString with no timeZone renders the SERVER locale (UTC on Vercel) and every one of these badges appends 'PT' to it; now fmtPT / explicit America/Los_Angeles (incl. the Isabella auto-refresh stamp). [admin][dashboards]
• 🌗 **Staff-sessions date filters are DST-correct** — from/to were parsed with a hardcoded -08:00 (PST) offset, off by one hour the ~8 months a year the clinic runs on PDT; now fromZonedTime(…, CLINIC_TZ). [admin][sessions]
• ⏳ **Task-board pending states** — new shared ActionSubmitButton (useFormStatus) wired into all 5 server-action buttons; sister of the provider portal's FormPendingSubmit (which covers plain POST forms where useFormStatus has no context). [admin][tasks]
• 🧾 **SSOT pulls**: pricing-page JSON-LD offers now read PRICING.* (the renewal offer still advertised the pre-June-10 figure to crawlers/LLMs); forms-delivery email + records-request PDF phone strings now import PHONE; get-started copy stopped listing a Vancouver clinic (3 locations exist). Stale scheduler-name comment cleaned. [public][ssot]

Fixed

• 🖊 **Reissue sign button double-submit guard** — new FormPendingSubmit client button for plain method=post forms (disables on the form's submit event; the in-flight POST completes, re-clicks are blocked), wired into the authorization reissue form. Reusable for any other plain-form submit in the portal. [providers][clinical-ux]
• 🛡 **Compassionate-care icon a11y** in the authorizations table (role="img" + aria-label on the wrapping span, icon aria-hidden — was an orphaned label on the icon element). Also a stale staff-name reference in a code comment generalized. [providers][a11y]
• 🎯 **Leads empty state is action-filter-aware** — zero-result status+action intersections now say which action filter is active ('…that need an email follow-up') with a 'Clear the action filter' link preserving the status view; previously read as if the status itself were empty. [leads][front-desk]
• 💬 **Copy honesty pair**: Bill-via-Poynt email-failure message now points at the 'Text pay link' lane instead of the vague 'send another way'; feedback-widget receipt says 'Replies and fix notices land under My feedback' (the actual reply channel). [admin][copy]

Fixed

• 🕐 **Reschedule slot times render clinic time (PT)** (RescheduleForm used browser-local format() for the slot grid and the success message while the server page used fmtPT — same page, two timezones; a Mountain-Time device showed each slot one hour later than reality). Both renders now use fmtPT. [patients][scheduling]
• 📞 **Form-link error screens get a way forward** (/patient/forms/[token]): NOT_FOUND/EXPIRED/REVOKED now show a tappable call link (same pattern the intake page already had); ALREADY_SIGNED links to the patient portal. Previously all four said 'Contact Green Wellness' with no contact info. [patients][forms]
• 🖱 **disabled:cursor-not-allowed on 5 patient submit buttons** (reschedule, intake, pre-visit, cancel, forgot-password) — the disabled state no longer shows a clickable pointer. [patients][a11y]

Added

• 🎚 **MATRIX_TIER crawl-budget lever, built dark** (src/lib/matrix-tier.ts SSOT; GW_SEO_AUDIT_2026_05_15 Phase C, unbuilt for 49 days). Gates sitemap entries, generateStaticParams (with dynamicParams=false, pruned pairs 404 at deploy = intended semantics), and every on-site cross-link enumeration (city condition-chips, condition-page telehealth upsells, matrix cross-links) from one helper. full (default, byte-identical to today — deep-equal pinned) | substantive (mechanical criterion: pair-level FAQ + city intro + condition note all present → 27 location pairs; telehealth matrix has zero pair-level copy today so substantive=0 there, flip point marked) | disabled. Unset/junk env values fail OPEN to full. 19 unit tests + structural pins that sitemap and both routes keep referencing the helper. llms.txt/areas-we-serve verified matrix-free (no gating needed). [seo][infra]

Fixed

• 💬 **Honest connection-failure copy on /pay** (CollectPaymentForm + charge action): network/5xx/pre-charge setup failures now classify as 'connection problem' with the provably-true 'no payment was recorded' (GW only records on confirmed success — deliberately NOT 'your card was not charged', which is unknowable on a timeout); declined-card copy unchanged; the browser-side catch now says to check for a confirmation email before retrying. [payments][patients]
• ✅ **Already-paid preempt renders its own card** — the fully-paid re-check that already ran before any charge call now returns alreadyPaid and the patient sees 'Already paid — no charge was made' instead of a misleading fresh 'Payment received'. Check→charge ordering + copy pinned by new pay-collect-payux1-pin.test.ts. [payments][patients]
• 🧾 **Deposit-received explainer** in the fee summary whenever a partial payment exists — covers both the hosted two-button flow and in-portal balance mode. Copy only; eligibility and amounts untouched. [payments][patients]

Fixed

• 🧹 **Retired-system copy sweep on live admin surfaces**: appointments Unpaid-filter help (Stripe→'recorded payment'), import-page intro + legacy-labeled Salesforce mapping tip, consent-form error fallbacks (2 strings), Demi search keyword removed from Admin Today. [admin][copy]
• ⏳ **saveNotes/saveVideoLink double-submit guards** on the appointments table — pending state + disabled + 'Saving…' feedback, same pattern as Confirm/Complete/No-Show/Cancel already had. [admin][appointments]

Changed

• 📚 **STATUS PASS 2026-07-03 headers on 8 stale planning docs** (verified vs src/ + vercel.json + git log): CRON_RUNBOOK (15→58 crons + 4 schedule-drift examples; live SSOT = vercel.json + /api/health cronActors), LAUNCH + ROADMAP + LAUNCH_DECISIONS closed as historical (launch happened; Salesforce bridge superseded by native leads), TODO (M365 EMAIL_FROM blocker long-resolved), LEAD_CRM_NEXT_5 (promotion + queue upgrades shipped), Isabella dashboard plan (superseded), expert improvement plan (P0 fax BAA gate CLOSED — shipped fail-closed behind INBOUND_FAX_BAA_OK). [docs]

Added

• 💡 **/pay honors the email's ?opt= hint as a visual preselection** (completes the forward-compat lane PAYREQ1 minted; src/app/pay/[appointmentId]/page.tsx). opt=deposit emphasizes the deposit button (filled style + 'Your selection from the email' tag) and drops pay-in-full to the outline style; opt=full tags the already-primary full button; any other value — or any state where both options wouldn't render anyway (partial payment on file, in-portal Collect, fully paid) — is silently ignored. HARD RULE pinned by a new structural test (pay-page-opt-hint-pin.test.ts, 10 pins): the hint may only ever appear in styling ternaries and the tag conditional, never inside an eligibility gate, form amount, or if-statement — the three render gates are byte-identical to before. [payments][patients]

Fixed

• 🗓 **Calendar 'Color coding' help text matched to the actual STATUS_COLOR scheme** (was describing an amber 'needs attention' and a red 'no-show or cancelled' that don't exist; amber is no-show, purple is pending approval, sage is completed). [admin][calendar]
• 🧹 **Patients list: Clear button + filtered empty state now cover ALL filter chips** — Dormant, Missing doctor, and No records were missing from both conditions, so a zero-result filtered view showed the 'No patients yet' onboarding copy with no visible way out. Empty-state copy also stopped naming the retired CRM. [admin][patients]
• 👤 **Provider feedback: resolved items show the resolver's name** (resolvedBy was stored since the beginning but never displayed; now looked up against the staff roster and rendered as 'by '), Open/Resolved tabs carry tablist/tab + aria-selected roles, and the page help no longer claims feedback includes a screenshot (the provider form captures category + message only). [admin][feedback][a11y]

Fixed

• 🧪 **Email/SMS dry-run harness prompts de-duplicated** (src/app/api/admin/test/email-ai-dry-run + sms-ai-dry-run now import the exported EMAIL_AI_SYSTEM_PROMPT/SMS_AI_SYSTEM_PROMPT from src/lib/email-ai.ts/sms-ai.ts instead of embedding truncated snapshots). The stale copies were missing DRAFTTIME1's Unavailable-requested-time rule, the Demi-offboarding update, and the live location list — the 'update the copy on every prompt change' comment convention had already failed silently. New dryrun-prompt-anti-divergence.test.ts (10 structural pins) forbids a local prompt const in either route, requires the imports, and asserts the real prompts still contain the load-bearing rule text. [isabella][testing][debt]

Added

• 📧 **'Email this link to the patient' inside Bill via Poynt** (closes Mariane cmr4dhj4u 'generate and send a payment request... without having to leave the system'; new POST /api/admin/appointments/[id]/email-pay-link, email sister of the Z272 'Text pay link' lane). Server re-mints the link itself — a client-supplied URL is never accepted — then sends the same template both lanes share (src/lib/pay-link-email.ts) via the BAA-covered mail rail. Fail-closed on missing/unsubscribed/bouncing email, already-paid (409), cancelled/no-show; 5/hr per-admin-per-appointment rate limit + 60s duplicate guard; audited as PAY_LINK_EMAIL_SENT (recipient hashed, no card data). [payments][front-desk]
• 💳 **Two clickable pay options in the booking-confirmation email** (closes Mariane cmq8x3wut 'have this option back but make sure it is clickable'). 'Reserve with a $50 deposit' + 'Pay in full' buttons render when the deposit is genuinely offerable, mirroring the /pay page's own rule (nothing collected yet, balance above the deposit, in-portal Collect off) — pinned cross-file so the email can never promise a button /pay won't show. Both buttons carry the standard signed token; NO new charge surface (the /pay page has offered both amounts since ICB0009, and partial payments already record correctly). Falls back to the single 'Pay online' button whenever ineligible. Lead-stage (pre-booking) email now says the clickable links arrive with the booking confirmation — it has no appointment to link to. [payments][email]

Changed

• 🧱 **Bill-via-Poynt tier chain extracted to one shared resolver** (src/lib/bill-poynt-tier-shared.ts — auto-invoice → exact-remaining Collect link → any-amount Collect link → honest manual instructions) so the billing modal and the new email lane can never drift apart (the new-patient-fee fixed-paylink error cmq8x1llj was exactly this class of two-copies drift; 11 unit tests pin the tier order byte-for-byte). Behavior unchanged. [payments][refactor]

Added

• 📋 **Consent form auto-ensured at booking confirmation** (closes Mariane cmq6203a7 'the Consent Form is still missing... use that existing form' + the consent half of cmq61ukdl; both telehealth and in-person). New ensureConsentFormForBooking (src/lib/consent-form-ensure.ts + pure decision logic in consent-form-ensure-shared.ts): new patient → NEW_PATIENT_PACKET (intake pages + informed consent, the canon Doug set on the G7 arc), returning → INFORMED_CONSENT, exactly the same create shape as the existing admin Patient Forms send (status SENT, 7-day magic link, PHI-free FORM_CREATED audit). IDEMPOTENT: an existing non-revoked/non-expired packet or consent suppresses creation; a pending one with a live token gets ITS link reused in the email — never a duplicate, never a dead link. [forms][patients]
• 📨 **'Complete your consent form' card in the booking-confirmation email** (both the canonical send and the staff resend lane), mirroring the intake card. The patient portal's 'Forms to review & sign' checklist needed ZERO changes — its pending-forms query is form-type-agnostic, so the new row appears automatically (pinned). [forms][email]

Added

• 🎯 **Action-needed second filter dimension on /admin/leads** (closes Mariane cmq61cwgo reject 'there is already a main filter, but I also need an inside filter within each status'). New ?action= chips — ✉ Email follow-up / 📞 Call·text / ✓ No action needed — compose WITH the status filter; counts are computed within the current view so the number always matches what the click shows. Derived live from contacted-state + status + the lead's contact preference ('either' appears under both channels; legacy no-preference leads default to the phone bucket rather than vanishing). The lead form has no separate SMS bucket, so Phone covers call+text. [leads][front-desk]
• 👁 **Mark-as-read for lead notifications** (closes Mariane cmq7g6ldn reject 'add a Mark as Read button... and a Mark All Leads as Read'). New LEAD_MARKED_READ audit action + per-row 'Mark read' + bulk 'Mark all read (N)' targeting EXACTLY the badge's own cohort, so one click zeroes the red number. Read ≠ contacted by design: the one-click only asserts 'I saw it' (Mark-contacted keeps its forced log-notes flow per Mariane's 2026-05-15 #5), the row stays in the queue, and overdue follow-up commitments are deliberately never cleared by read. [leads][front-desk]
• 🔎 **Sidebar search now surfaces leads** (closes Mariane cmr1flpwc reject — she searched, assumed the person didn't exist, and found them later still in Leads getting automated emails). The sidebar bar queries the same role-gated leads-search API the Cmd+K palette has used since CRM #2, in parallel with the patient search, and renders a 'Leads (not converted)' section below Patients. Placeholder now reads 'Search patients, leads, or pages…'. [leads][search]

Fixed

• 🕐 **Unavailable-requested-time rule added to both draft prompts** (closes Mariane cmr2wnxm6 reject 'she should not say yes... unless the slot is actually checked and available'; src/lib/email-ai.ts + src/lib/sms-ai.ts). Never affirm a patient-named time unless it EXACTLY matches a listOpenSlots result from this conversation; no match → acknowledge preference + offer the tool's nearest real openings; picked slot → request-received + separate-confirmation framing (defers to the existing Tentative-appointment sections rather than duplicating them). 14 new pins including rule ordering and SHAFT-safety; no voice-prompt change, so no Retell sync needed. [isabella][email][sms]

Changed

• 💬 **ISASCHED1 renewal proactive-availability ported to chat + email (parity gap closed).** Voice shipped 'lead with real availability' 7/2 AM; chat (src/app/api/chat/route.ts Initiative block) and email (src/lib/email-ai.ts) still told renewals 'offer to book it' with no times. Both now call listOpenSlots and offer the nearest 1-2 returned windows, with the anti-hallucination rule restated inline (offer ONLY tool-returned times). [isabella][chat][email]
• 🪟 **Empty-slot guidance updated to relay the tool's standing-windows message (chat + email).** booking-tools' listOpenSlots has returned a helpful describeStandingWindows message on empty since PAYSLOTS1, but both prompts still forced a human handoff (flagForHuman reason=slot-lookup-empty) on a normal availability question. Now: relay the real weekly windows, ask which works, and only hand off when the patient wants a specific time locked or a callback. Fewer spurious escalations. [isabella][chat][email]
• 🎖️ **Veteran/SSDI renewal discount now answerable in all three lanes (answer-if-asked only).** The $15-off renewal rate ($130, PRICING.RENEWAL_HARDSHIP_DISCOUNT/RENEWAL_DISCOUNTED — real fee-structure SoT; voice-tools already carried TTS spellings for both amounts) was in no lane's prompt, so price-sensitive veterans got a message-take instead of an answer. All three lanes now answer when the patient asks about discounts or self-identifies veteran/SSDI — explicitly instructed NOT to advertise it unprompted, team verifies eligibility at the visit. PATIENT_COMMS_REVIEW P2 'accept or close' → accepted. [isabella][voice][chat][email][pricing]
• 🗂️ **Voice: renewal records rail now leads with the patient-portal upload** (sign in at greenwellness dot org → Your records) before fax/email — matching what chat + email already tell renewals; portal auth is the patient-OTP flow returning patients already have. New-patient rail unchanged (no pre-visit portal account). Plus: the DOB-confirmation style example no longer models a five-oh-nine (Spokane) caller — Spokane closed 2026-06-13 (closure-cutoffs.ts); example now uses two-oh-six. REQUIRES node scripts/sync-retell-prompt.mjs post-deploy. [isabella][voice]
• 📧 **Booking-confirmation email: 'If you qualify, your authorization is issued the same day' moved OUT of the 'What to bring' list** (src/lib/emails.ts) — it's a reassurance, not an item to bring; the list stays scannable pre-visit. [email][polish]

Fixed

• 🧹 **Five stale user-visible 'Demi' strings replaced with 'front desk'** — admin/isabella ('{n} to Demi' — the string the 7/2 PAYSLOTS1 changelog claimed was already swept), admin/isabella-today ('Demi's queue' heading + 'Nothing waiting on Demi' empty state — two sisters missed when :802/:1057 were fixed), admin/reports/ai-receptionist ('caller needed Demi'), and admin/admin-today's load-failure state ('demi today' → 'admin today'). Sidebar search keywords keep 'demi' as an invisible muscle-memory alias (matches only, never displayed). [admin][copy]
• 🔁 **Feedback 'Mark resolved' no longer fails silently** (admin/feedback ResolveButton): non-ok response or 10s timeout now shows 'Couldn't mark this resolved — check your connection and try again' + a 'Try again' button label, mirroring ReconcileOrphansButton's failure affordance. Previously an exception also escaped the handler (try/finally with no catch). [admin][reliability]
• 🕐 **/admin/today header timestamps Pacific-pinned** (_TodayClient.tsx): the date line + 'last updated' stamp used browser-local date-fns format() — wrong hour on any non-PT machine (same class as the Mariane 4:10→2:10 bug already fixed for slot times) — now fmtPT + explicit 'PT' label; dormant-patient 'no visit since' date too. [admin][tz]

Added

• 🔄 **Admin Today refresh affordance** — the same RefreshShell as Isabella Today (manual Refresh + 60s auto-refresh toggle + last-loaded stamp); front desk no longer needs a full reload to see fresh callbacks-owed. [admin][front-desk]
• 🔢 **Dashboard section counts** — Today's schedule / Coming up (next 3 days) / Recent bookings headers now show a count pill when non-empty, matching the alert callouts that already had them. [admin][polish]
• 🧭 **Small consistency wins** — Leads page h1 now uses the GW heading style (was the only zinc-styled title in the admin; full page re-skin left as follow-up); reviewer-feedback triage shows 'loaded h:mm a PT' on its count line; feedback-triage empty state says 'any staff member' instead of naming only Mariane; Admin Today's 'Today's focus' items render a plain row instead of a dead '#' link when an item has no destination. [admin][polish]

Changed

• 📉 **Provider ?token= sunset — step 3 (deprecation log) shipped, plan doc corrected.** Verified the 6/20 buildplan's premise is stale: all 5 client consumers (CheckInPoller, SignatureCard, ProfileCard, ProviderActions, SignedEncounterPanel) already render tokenless on the cookie portal (JF/TJ/EX port arc), and the legacy /provider/[token] pages are redirect-only (PORTALFIX1) — so nothing legitimate sends ?token= to the 26 API routes anymore. Added the log-only deprecation counter CENTRALLY in the db.ts TOKENEXP1 choke point (one edit instead of 26 route edits): every NON-bridge portalTokenHash lookup warns [provider-token-deprecated] — PHI-free, no token value logged. Metric: zero log hits over a few provider-active days ⇒ step 4 (remove the token branch from the 26 routes). 2 new pins in the TOKENEXP1 anti-divergence suite. Also synced GW_UNSHIPPED_BACKLOG_2026_06_30.md with a dated status pass (6 rows verified already-shipped: RC token-health diag, gate single-sourcing, blocking test suite, patient/admin session timeouts, required gate check, token-sunset steps 1–2) and removed a stale wave-c TODO on the EHI ingest-status audit call (action exists + fires). [security][provider-portal][debt]

Fixed

• 🔐 **Expired provider ?token= links could still read/write PHI through the API fallback.** The ~26 /api/provider/* resolvers (plus the new-encounter searchPatients server action) each did their own inline db.provider.findUnique({ where: { portalTokenHash } }) gating only on isActive — never portalTokenExpiresAt — so a 90-day-expired magic link kept working through the API ?token= fallback even after the page/bridge path started rejecting it. Rather than edit 26 resolvers, the fix gates the ONE query they all funnel through: a Prisma $extends choke point on provider.findUnique keyed on portalTokenHash that fails CLOSED (returns null) for expired rows, sharing one cutoff predicate (isPortalTokenExpired) with the cookie bridge so they cannot drift. Load-bearing exemption: the bridge's own lookups explicitly select portalTokenExpiresAt and are passed through unmodified, because THEY enforce expiry and emit reason:"expired-token" → the friendly /provider/link-expired card (not a bare 404). Regression-pinned in tokenexp1-portal-token-expiry-choke-anti-divergence.test.ts (13 pins: fail-closed interception, bridge exemption, bridge-still-emits-expired, shape-preserving field injection). [security][provider-portal][tokenexp1]

Fixed

• 📄 **Consent PDFs hardcoded one provider's last name on the 'Dr. ____' line.** Both online-signing paths — the NEW_PATIENT_PACKET 4-page packet and the standalone INFORMED_CONSENT e-sign — rendered provider: { nameLastOnly: "Frisch" } regardless of the patient's actual issuing doctor, wrong the moment any other provider (Ruth/Spokane, Dr. Ari) signs a patient. Both now derive from Patient.issuingDoctor via a new shared helper consentProviderLastName() ('Dr. Jane Frisch' → 'Frisch'; null/empty → 'Werblud', the clinic-medical-director name in the lawyer-reviewed source PDF) — the exact derivation the admin send-consent-form route already used, now extracted to src/lib/forms/consent-provider-name.ts so the three render sites cannot drift. [forms][consent][correctness]
• 🔒 **Admin outbound-template preview no longer injects template HTML into the admin page DOM.** The Outbound Templates preview rendered p.html via dangerouslySetInnerHTML — an admin/manager authoring a template with a script tag could execute it in another admin's session (insider-only, low severity, flagged P2 in today's security sweep). The preview now renders in a fully sandboxed iframe (sandbox="" — no scripts, no same-origin) via srcDoc, so template-authored HTML is display-only by construction. No visual change. [security][admin][xss]

Fixed

• 🔐 **Spoofable x-admin-role header trust closed on ALL four bearer-allow diag routes.** rc-token-health + notifyre-health were fixed in the adversarial-review repair round; this entry completes the class on the two pre-existing sisters m365-token-health + model-probe. Root shape: these routes sit on proxy.ts's ADMIN_BEARER_ALLOW list, whose early return NextResponse.next() runs BEFORE freshHeaders() strips client-supplied identity headers — so curl -H 'x-admin-role: ADMIN' passed the in-route gate unauthenticated (exposure was config booleans/counts only — no PHI, no tokens). All four now verify the AdminSession COOKIE in-route (verifyAdminSession, ADMIN/MANAGER only) and never read the header; bearer CRON_SECRET path unchanged. Regression-pinned in diag-route-auth.test.ts (20 pins across the four routes: no x-admin-role in executable code, no headers() import, cookie-verify present, role check intact). [security][diag][adversarial-review]

Added

• 🪪 **Account-ID lookup key on the voice verify rail (dark, RPF0002).** beginReturningPatientVerify + confirmReturningPatientVerify now accept the patient's GW-XXXXXX publicId (already mailed in reminder emails since the cmq1rldif slice) as an ALTERNATE lookup key — spoken-variant tolerant (normalizeSpokenAccountId: 'gw a3k7m2' / letter-by-letter / bare 6-char all canonicalize via the existing normalizePatientPublicIdQuery, no second regex). Possession factor UNCHANGED per the binding hipaa-architect ruling: the 6-digit code still goes ONLY to the phone ON FILE. Enumeration-safe: per-kind generic responses, and a matched chart with no textable phone answers exactly like no-match (closes the 'trouble sending' existence oracle). Both tools remain two-layer dark behind RETURNING_PATIENT_SMS_VERIFY_ENABLED (schema filtered from Retell + handler hard-stop); NOTE for flip day — the Retell tool re-registration curl must run for the new params to reach the hosted LLM. [isabella][voice][rpf0002]
• 🧠 **Post-verify context enrichment — verification finally unlocks something (gap G3).** On a successful code confirm, the tool result now carries the minimum-necessary, month-bucketed account context (reuses buildCallPatientContext — same bucketing Doug approved for the staff cockpit 2026-06-12): preferred clinic, last-visit month, renewal-due month (+overdue), upcoming-appointment month, has-email-on-file BOOLEAN (address never spoken) — plus the explicit no-re-ask instruction and 'send links to the email on file' guidance. Provider names deliberately withheld (prompt already bans speaking them). Renewal-Concierge tie-in: an open RenewalPipeline row in due|outreached adds an 'offer to schedule it now' line (READ-ONLY — no stage transition). Enrichment is fault-isolated (any read error degrades to the plain verified greeting) and 3 parallel indexed reads on the one success turn keep the <500ms p95 webhook budget. Composition is a pure, pin-tested fn (composeVerifiedGreeting). Patient-facing fact set remains hipaa-architect + Doug sign-off gated BEFORE the flag flips. [isabella][voice][hipaa][rpf0002]
• 🧵 **Dispatcher threads Retell call context to handlers.** dispatchVoiceToolCall now passes event.call (call_id/from_number) as an optional second handler param — pre-fix handlers saw ONLY event.args, so nothing could correlate two tool calls in the same phone call. Used today for PHI-free audit correlation (lookup= + callId= on the PATIENT_IDENTITY_VERIFIED rows, plus a new event=verified-context-returned annotation row with booleans/stage token only — never fact values). The durable per-call verified marker (so listOpenSlots/captureLeadFromVoice stop re-asking a verified caller) is the designed NEXT slice — needs an expand-only migration; see the design doc. [isabella][voice][observability]

Added

• 📠 **Inbound-fax line-status banner (/admin/inbound-fax) — honest dark-state.** Server-rendered from env BOOLEANS only (provider switch + INBOUND_FAX_BAA_OK runtime BAA gate + Notifyre key/secret presence — never env values): while the gate is closed, an amber 'NOT LIVE' card states the Notifyre switchover (number + BAA + webhook) is pending and faxes sent today will NOT appear — this is expected, not a bug. Flips to a green 'line live via ' chip the moment Doug sets the go-live flags — zero maintenance. Empty-state + PageHelp + header blurb are now state-aware too (the old copy asserted the (888) line lands faxes in the queue, which is false while gated — the exact void Mariane kept test-faxing into). [inbound-fax][observability][honesty]
• 📬 **'Delivery events' panel — AuditLog as the fax delivery ledger.** New collapsible panel below the queue reads the last 50 INBOUND_FAX_RECEIVED audit rows (indexed [action,createdAt] — NO new table) and classifies each repo-owned detail string into a status pill via a tolerant shared parser (src/lib/inbound-fax-shared.ts, EXTRACTOR pattern + pin tests): success → received, detail=baa_gated → blocked (BAA pending), error=* → failed (token shown), detail=ignored → ignored; unknown shapes degrade to the raw PHI-free detail, never crash. Answers the board-row ask ('did it arrive, fail, or process?') even when NOTHING landed in the queue. Details are PHI-free by construction (message ids + sender digits only). [inbound-fax][audit-ledger]
• 🩺 **Notifyre self-test diag — /api/admin/diag/notifyre-health (sister of rc-token-health).** Admin/bearer-gated GET returning booleans + counts ONLY: {provider, baaOk, apiKeySet, webhookSecretSet, apiReachable, receivedCount, hint}. Probes GET /fax/received?limit=1 with the configured key (15s timeout, fail-soft) and returns res.ok + the account's total count — never fax metadata or sender numbers. Works TODAY while the lane is dark (key already set, endpoint shape live-confirmed), so staff can prove auth+reachability without waiting for a live webhook delivery. Linked from the fax-page banner; proxy ADMIN_BEARER_ALLOW entry added. Also wired the previously-DEAD isNotifyreFaxReady() into /api/health as notifyreFaxReady (its own doc comment said /api/health; was connected nowhere). [inbound-fax][diag][notifyre]

Fixed

• 🕳️ **Webhook silent paths now audit (all 3 providers).** Signature-verify 403s, invalid body/JSON 400s, and 'ignored' non-received events on /api/inbound/fax returned with NO audit row — if Notifyre's webhook secret or envelope shape is wrong at go-live, we'd have seen nothing anywhere (the envelope key names are explicitly unconfirmed until a first real delivery, so 'ignored' is the likely first-contact failure mode). Each now writes a PHI-free INBOUND_FAX_RECEIVED row first (provider=

  error=signature_verify_failed|invalid_payload / detail=ignored event= — event tokens sanitized via safeEventToken since the endpoint is public; NEVER body content). Same wrap-and-never-throw audit posture; webhook ACK/reject behavior byte-identical. Provider-switch SoT moved to inbound-fax-shared.ts so route + page + diag can never drift. Audit-log polish: INBOUND_FAX_RECEIVED + VIEW_INBOUND_FAX gain ACTION_LABELS (the fax page deep-links to that filter; it rendered as a raw enum). [inbound-fax][observability][audit]

Fixed

• 🧷 **§4.1 role-based submit — the LISAREADY1 show-but-403 seam closed.** /api/feedback POST+GET, /api/upload, and the /api/feedback/screenshot/[...path] proxy all gated on the per-email REVIEWER_FEEDBACK_ALLOWLIST while the bubble + /me/feedback had already widened to role-based canSubmitReviewerFeedback — so an active role-based filer (Lisa-class) saw the bubble but her submit 403'd, screenshots wouldn't upload, and her own /me/feedback images 403'd. All three now gate on canSubmitReviewerFeedback (role-based, fail-closed on isActive=false). The screenshot proxy ports the comments-route IDOR split verbatim: TRIAGE tier (explicit allowlist) fetches any feedback-screenshots/ blob exactly as before; role-based filers are OWN-ROW scoped (ReviewerFeedbackScreenshot child-row join on feedback.userId, legacy screenshotUrl fallback) with the same generic 403 as the traversal guard (no existence probing). TRIAGE surfaces (queue page, actions, queue/aggregate/couldnt-fix/done-unevidenced routes) stay allowlist-gated — reading OTHER filers' PHI-capable bodies/screenshots is unchanged. Pin tests extended in group-c-feedback-screenshot-private-blob.test.ts (gate + own-row join inseparable). [feedback][hipaa][s4.1][lisa-ready]
• 📵 **Kat's 'Network glitch' submit failure — distinct error copy + a server-visible breadcrumb.** Mechanism confirmed: her /api/feedback fetch THREW client-side (zero rows, zero logs — the request never arrived). Three hardenings: (1) new src/lib/fetch-timeout.ts timeoutSignal() feature-detects AbortSignal.timeout with an AbortController+setTimeout fallback (aborts with a DOMException named TimeoutError) so pre-Safari-16 browsers never sync-throw before the fetch fires — FeedbackBubble's 15s submit + 30s upload signals both swapped. (2) The outer catch name-splits the copy: TimeoutError OR AbortError (WebKit <17.4 reports signal timeouts as plain AbortError) → the 15-seconds copy; TypeError (fetch killed at dispatch — classically a content-blocker matching the '/api/feedback' substring) → 'pause your ad/content blocker' copy; else the generic copy. The upload catch stops mislabeling every throw a timeout. (3) New reportClientFetchFailure() in report-client-crash.ts posts a PHI-free breadcrumb (boundary + err.name + pathname only) to the EXISTING unauthenticated, rate-limited /api/provider/client-error beacon (audit row + debounced Doug email; URL has no 'feedback' substring so it survives the blocker) — the next occurrence is server-visible in seconds, not a verbal report days later. NO CSRF change (/api/feedback was never covered by the same-origin guard; ruled out). [feedback][kat][client-error][observability]

Added

• 🔑 **AGENT_FEEDBACK_TOKEN accepted on the three metadata-only feedback readers (agent-lane plumbing).** CRON_SECRET is Vercel-Sensitive (pulls as "" by design — runtime confirmed healthy: 58 fresh cron heartbeats on /api/health), so no agent-side puller can ever hold it; the aggregate pull ran on a hand-provisioned GW_CRON_SECRET and the queue mirror 401'd. The route-local agentFeedbackTokenMatches() moved from [id]/agent/route.ts to shared src/lib/agent-feedback-token.ts (ONE implementation of the load-bearing empty-token bypass guard: non-empty configured AND non-empty presented, timing-safe compare) and is now accepted on aggregate + couldnt-fix + done-unevidenced — all counts/structural-metadata-only by construction (never select a free-text column; all three already in the proxy's ADMIN_BEARER_ALLOW). The body-bearing /queue GET deliberately does NOT accept it — widening the token to operator free-text (may reference PHI) is a Doug-gated trust-tier decision, pinned in the new agent-feedback-token.test.ts (11 pins: bypass guard + per-route scope doctrine). CRON_RUNBOOK gains the 'do NOT diagnose CRON_SECRET-empty from a vercel env pull' note. [feedback][agent-lane][auth][cron]

Changed

• 🧭 **Sidebar reorganized + collapsible sections (closes Kat's 'Sidebar Navigation Reorganization' email 2026-07-02).** The old single 25-item top group + 6 flat always-expanded sections (~74 links) is replaced by: a SHORT always-open daily core (Dashboard/Today/Messages/Patients/Appointments/Calendar/Leads/Inbound Fax) + collapsible sections **Front Desk** (NEW — human-CS queues/worklists: CS Command Center, Admin Today, Mariane Today, Doug Queue, Tasks, EOD, catchup, Provider Feedback, Mailing, Auth-held, …), **Isabella** (AI tools, unchanged), **Help** (NEW — What's New + Training lifted out of system-admin so a new hire finds training day one), Marketing, Finance, Configuration, Data, and **System** (renamed from 'Admin' — Settings/Staff Accounts/Audit/Cron/2FA/Migration, to distinguish system-admin from the human-CS 'Front Desk'). AdminNav.tsx collapse logic: labeled sections collapsed by default, the section holding the current page force-expands (active item never hidden), manual toggles persist in localStorage, pre-hydration keeps sections open so first-paint never hides an expanded section. **Every item keeps its exact role gate + keywords verbatim — pure re-home, zero access change.** cmd-K + sidebar still share nav-config.ts (one SoT). [nav][ux][kat-feedback][collapsible][lisa-ready]

Added

• 📠 **Notifyre inbound-fax provider path (default-OFF, BAA-gated, additive).** New src/lib/notifyre-fax.ts (+ pure notifyre-fax-shared.ts, EXTRACTOR-pattern, 9 pin tests) + a third branch on /api/inbound/fax's existing INBOUND_FAX_PROVIDER switch. INBOUND_FAX_PROVIDER=notifyre routes inbound faxes through Notifyre; unset/ringcentral/documo are unchanged (nothing changes by default). Normalizes Notifyre's fax_received webhook (fax-id dedup key, sender ANI → LEAD_CAPTURED match, our DID, page count) into the SAME downstream pipeline (one dedup, one sender-match, one private-blob/DB persist). **API shape CONFIRMED against the live account** (unlike the earlier Documo path's unconfirmed caveats): x-api-token auth + base api.notifyre.com (HTTP 200 verified), list GET /fax/received?limit=, download GET /fax/received/{faxID}/download (route verified). Optional NOTIFYRE_WEBHOOK_SECRET HMAC-SHA256 verify on the Notifyre-Signature header; the load-bearing PHI guard remains INBOUND_FAX_BAA_OK. **The ENTIRE path stays fail-closed behind INBOUND_FAX_BAA_OK** — ACKs 200 (no retry storm), audits the gated arrival PHI-free (fax id only, no content fetched), persists NOTHING until the Notifyre BAA is executed + a fax number is provisioned + Doug sets the flag. NO schema change (reuses the provider-agnostic dedup column). ⚠️ Only residual unknown = the exact fax_received webhook envelope key names (can't inspect until a real inbound fax arrives — isolated + defended: id extracted across all plausible keys, metadata best-effort, a miss degrades to the unmatched path, never crashes). [inbound-fax][notifyre][hipaa][baa-gated][dark]

Fixed

• 🔑 **Provider magic-link 404 — every /provider/[token]/** entry point converted from a Server-Component page to a GET Route Handler.** Root cause (workflow-diagnosed, confirmed against installed Next 16.2.9 source): the landing page.tsx called exchangeTokenForCookieRsc, which does cookies().set() DURING render — Next forbids cookie writes outside a Route Handler / Server Action, so .set() threw ReadonlyRequestCookiesError, the page's .catch mapped it to bridge-threw, then notFound() → a 404 for **every valid token** (data-independent). force-dynamic didn't help — it controls static-vs-dynamic, not the render *phase*. Fix: the 8 legacy entry points (landing + today + encounters + encounters/new + encounters/[id] + authorizations + authorizations/[id] + authorizations/[id]/reissue) are now GET Route Handlers delegating to a shared handleProviderTokenLanding (src/lib/provider-token-route.ts) that uses the previously-DEAD, cookies()-free exchangeTokenForCookieApi, sets the session cookie on the NextResponse, and 302s to the cookie-gated /provider/portal/** — forwarding the provider's own query filters. Expired tokens now 302 to a new static /provider/link-expired page; invalid/unknown/deactivated still 404 uniformly (no existence-signal leak). Orphaned [token]/layout.tsx+loading.tsx removed (the softphone lives on the real portal layout). **Dr. Ari + password logins UNAFFECTED** (they use the /api/provider/auth/login Route Handler, which always Set-Cookie'd correctly). **Why it shipped silently:** the guarding tests were source-regex ('anti-divergence') pins that never executed the login inside a real render, so the render-phase throw was never exercised — replaced with a structural regression guard (provider-token-route.test.ts: no page.tsx may return under the token tree; every entry is a GET handler on the safe exchange) + the stale port pins repointed to the route handlers. **NO migration.** [provider-portal][next16][render-phase-cookie][magic-link]

Changed

• 🎟️ **Role-based feedback submit (Fleet Feedback Standard §4.1) — the per-email allowlist bottleneck is dead for filers.** New canSubmitReviewerFeedback({email, role, isActive}) in the reviewer-feedback SoT: any ACTIVE AdminUser role (ADMIN/MANAGER/SCHEDULER/BOOKKEEPER) may file + work its own thread; explicit fail-closed on isActive=false (an offboarded account is refused even with a lingering allowlist email); legacy email allowlist kept as fallback. Ported at the 5 SUBMIT/own-feedback gates (admin layout bubble render, /me/feedback, my-attention-count, own-thread comments, confirm actions) — each now selects role+isActive. DELIBERATELY NOT widened: the triage surfaces (/admin/reviewer-feedback page + actions + the cron queue route) stay allowlist-gated — reading other people's feedback bodies (may reference PHI) remains a short list. 4 new pin blocks incl. the Lisa case (active SCHEDULER, no allowlist entry → allowed). Lisa's 7/7 start now needs ZERO code change. [feedback-standard][role-based][lisa-ready]
• 🧹 **Demi user-visible copy sweep (offboarding follow-up).** DESK_COPY.handToDemiButton → "Hand to front desk" + withDemiReceipt → "→ With front desk · sent …" (SSoT + pins; function/key names kept to avoid consumer churn) · isabella-today "claimed by Demi"/"waiting on Demi" → front desk · isabella Stat "to Demi" → "to front desk" · integrations triage hint · users-page role help now names Lisa as the SCHEDULER example · feedback-page help · mariane-today intro + sister-page link. Code identifiers (getDemiCallbacks etc.) and historical changelog prose intentionally untouched. [offboarding][copy]

Added

• 💳 **Custom-amount Collect pay links — any-amount billing WITHOUT the GoDaddy invoicing entitlement (Doug 2026-07-02: "we won't be reaching out to GoDaddy — figure it out on our end").** The signed /pay token now optionally carries amountCents + desc (validated at MINT, re-validated at VERIFY, fail-closed both ways); /pay renders a custom-charge page and chargeViaCollect gains kind="custom" — charging EXACTLY the token amount via the live, charge-verified Collect rail. Custom charges deliberately do NOT touch visit-fee accounting (no amountCollectedCents bump, no paid sentinel, no cert release) — a reissue fee on a paid appointment can never masquerade as a visit payment; the admin UI says to use Mark paid when it also settles a visit. Idempotency: the token nonce stamps the success audit row and a prior success refuses a re-charge — a re-clicked link can't double-bill. bill-poynt mints these automatically whenever the amount isn't the remaining balance, so every Bill-via-Poynt click now yields a working link. [poynt][collect][custom-amount]
• 🎚️ **?interruptionSensitivity= + ?responsiveness= on retell-sync (closes reviewer-feedback cmqelmi1 config half).** Retell's interrupt-yield + response-latency agent dials were dashboard-only; now one curl through the same fail-closed RETELL_SYNC_TOKEN gate. Pure parseUnitDial validator ([0,1], 400-before-IO, pinned); runAgentDialsSync PATCHes only the dials provided; absent = byte-identical no-op; dryRun honored. [retell-sync][dials]

Changed

• 📅 **listOpenSlots (voice + chat/email bots) now returns REAL dated openings (closes reviewer-feedback cmqbsgstg — Doug-greenlit on the 7/2 sweep).** Both handlers quote up to 3 (voice: 2) next truly-bookable slots from AvailabilitySlot — the same bookableSlotFilter source staff quote from on /admin/isabella-today and patients book through the wizard — earliest-per-date, spoken in full on voice via new pure dated-slots-shared.ts (ordinal days + the SAME clock-word speller as standing windows; 9 pin blocks). The 2026-06-04 standing-windows-only rationale (slots-not-trusted, cmpyf53v7) is superseded by that data's promotion to the staff/patient booking source; framing stays request-based — options offered, office confirms, never "held". Fallback on zero slots or any query fault: the prior standing-windows behavior, byte-identical copy. Chat's returned slotIds feed proposeBooking directly. dateRange arg is now honored (was accepted-but-ignored). Voice prompt guard rewritten: tool-returned dates MAY be offered; invented dates remain forbidden. ⚠️ POST-DEPLOY: retell-sync must run for the voice half. [isabella][dated-slots][feedback-close]
• 🗣️ **Isabella turn discipline + natural interruption recovery (closes cmqelmi1 prompt half).** One idea per turn; 2-3 sentences max outside disclosures/wrap-up/crisis; one question at a time; on interruption answer what the CALLER raised first, then return to the flow in her own words — never restart the interrupted sentence. Soft cap 30000 → 31500 (net +757; history updated) + assembled-prompt ceiling 38000 → 39500 so the (still-unarmed) learned playbook won't silently skip. [isabella][voice-prompt][interruption]
• 🚪 **Demi Today → Admin Today (Doug 2026-07-02: Demi no longer works for GW).** Route renamed /admin/demi-today → /admin/admin-today (old path 307s via stub — bookmarks keep working); nav label + page title/help copy de-personalized; same ADMIN/MANAGER/SCHEDULER gate so Mariane manages it today and Lisa (SCHEDULER, starts 7/7) the day her account exists. OFFBOARDING: her AdminUser was already isActive=false (verified); this ship removes her gmail from REVIEWER_FEEDBACK_ALLOWLIST + the oversight-cost-cap STAFF_BYPASS_ALLOWLIST (an ex-staff address must not bypass caps), fixes the ai-draft crisis note ("recommend the office manager follows up"), and DEMI_TRANSFER_NUMBER was REMOVED from prod env — Isabella's live-transfer-to-Demi clause self-retires on this deploy + sync. Historical rows/aggregate buckets keep her email for correct staff attribution. Remaining cosmetic Demi mentions in admin prose → follow-up sweep. [offboarding][rbac][nav]

Fixed

• 💳 **Bill via Poynt actually produces a link again (closes reviewer-feedback cmr03mfn0).** Root cause re-verified live 2026-07-02 via the diag route: the Poynt app is NOT entitled for the dynamic invoicing API on this merchant (all six /invoicing candidates 404 — the fix for THAT is a GoDaddy support scope-grant, Doug-action). Two code fixes ship around it: (a) the POYNT_AUTO_INVOICE master gate no longer skips the entitlement-free FIXED-LINK tier — previously flag-OFF short-circuited straight to portal-manual, silently disabling the one autonomous rail that works today (fixed links are still unpopulated — POYNT_FIXED_PAYLINKS setup doc pending Doug); (b) NEW Collect /pay fallback in bill-poynt: when no invoice/fixed link exists but the billed amount equals the appointment's remaining balance to the cent (pure collectPayLinkEligible, 4 pin blocks, fail-closed on the unknown-type fee sentinel + Collect-flag-off), the route returns the signed in-portal Collect checkout URL (buildPayUrl, the same link class booking-confirmation emails already send; live + charge-verified 6/25). Payment then records automatically via the existing Collect flow — the button says so instead of demanding a manual 'Mark paid'. Portal-manual instructions rewritten honest (entitlement missing + no fixed link for this amount). POYNT_AUTO_INVOICE stays OFF (flipping it was probed this session and reverted — the dynamic API 404s regardless). [poynt][billing][feedback-close]

Changed

• 📅 **AI reply drafts quote LIVE calendar availability (closes reviewer-feedback cmr2wnxm6).** The ✨ Draft endpoint now injects a CURRENT OPEN APPOINTMENTS block — the same truly-bookable openings /admin/isabella-today's quick-summary and the public next-slot teaser use (bookableSlotFilter: un-booked, un-owned, active provider, not mid-hold; groupOpenSlots per location/type, 3 nearest each, Pacific-time formatted). Both system prompts (email + SMS) gain a hard grounding rule: offer the 1-2 nearest openings matching the patient's stated location/type/preference, quoted exactly as listed — times not in the block do not exist; nothing matching → ask preference + team-confirms, exactly the prior behavior. Fail-safe: slot-query error → no block → drafts stay generic as before. An OPEN slot carries zero PHI. NOTE deliberately NOT shipped: same upgrade for the autonomous email/chat BOT's listOpenSlots tool (that surface sends without staff review — needs its own design pass; the tool keeps returning standing windows only). [ai-drafts][availability][feedback-close]

Changed

• 📅 **Renewal callers now get proactive availability (closes reviewer-feedback cmqq1a7qx).** The VOICE_PROMPT renewal branch said “go straight to capturing their preferred time,” so renewal callers were asked to guess a day while NEW patients already got the lead-with-real-availability flow — exactly the gap Mariane reported (“renewal callers are not proactively given available dates; new patient calls perform better”). The renewal branch now routes through listOpenSlots and offers the nearest one or two returned windows up front, inside the existing anti-hallucination guard (only-state-what-the-tool-returned · NEVER-make-up-days · never name a calendar date as a held slot — all pinned unchanged). Generic booking-flow line strengthened to “proactively offer the nearest one or two up front — never make the caller ask what's available.” [isabella][voice-prompt][feedback-close]
• 🐢 **Wrap-up pacing rule (closes reviewer-feedback cmqq1aetb).** Mariane: “at the end of scheduling calls, Isabella begins speaking too quickly.” The end-of-call wrap-up now opens with an explicit steady-unhurried-pace instruction — confirmations and closing details are where callers write things down, so rushing costs the most there. Prompt-side half of the fix; the TTS-rate half is the new voice_speed knob below. Soft cap 29000 → 30000 (baseline sat at 28,997/29,000 — zero headroom; net +936 chars, history table updated). ⚠️ POST-DEPLOY: POST /api/admin/retell-sync must run for both prompt changes to reach the live phone line. [isabella][voice-prompt][pacing][feedback-close]

Added

• 🎚️ **Optional ?voiceSpeed= on POST /api/admin/retell-sync — the TTS speaking-rate is now a one-curl operator action.** Retell's voice_speed lives on the AGENT resource and was previously dashboard-only (RETELL_API_KEY is Sensitive — unreachable outside the deployment, the same gap IBJ0001 closed for the prompt). New pure parseVoiceSpeed validator (retell-sync-shared, 4 pin blocks) rejects non-numeric/out-of-envelope values with a 400 BEFORE any IO; runVoiceSpeedSync re-asserts the [0.5, 2] envelope belt-and-suspenders, honors ?dryRun=1, and only fires when the param is present — absent param leaves voice speed byte-identically untouched. Same RETELL_SYNC_TOKEN bearer, no PHI, config-push only. [isabella][retell-sync][voice-speed]

Changed

• 🔒 **CI test suite REPORT-ONLY → BLOCKING (pre-deploy-gate.yml).** Commit 7383afd2 (6/17) made pnpm test continue-on-error: true "until the ~70 pre-existing failures are triaged" — that backlog is now fully drained: the suite ran **10839/10839 green in CI** on the SESSHARDEN1 run (workflow run 28580618801) before this flip. A red test now fails the gate check exactly like tsc and the 65-gate manifest do. Remaining Doug-action unchanged: mark pre-deploy-gate REQUIRED in branch protection to make the whole chain unbypassable. [release-integrity][ci][tests-blocking]

Added

• 🚫 **NEW gate check-no-third-party-pixel (65th manifest gate) — closes the 6/30 unshipped-backlog 'no-third-party-pixel CI assertion on intake/qualify funnel' row.** OCR's tracking-technology bulletin treats an ad/analytics pixel on a patient-facing page as a PHI disclosure with no BAA (IP + page context = IIHI; Google refuses a GA BAA — BAA_STATUS row 14). GA was stripped 2026-05-28 (HIPAA blocker D); this makes the regression class push-blocking + CI-blocking. Scans ALL of src/ (no tracker belongs anywhere in a HIPAA clinic app, funnel included) for 21 tracker-host fragments (googletagmanager, connect.facebook.net, analytics.tiktok, doubleclick, hotjar, clarity.ms, mixpanel, segment, fullstory, amplitude, heap, LinkedIn/Pinterest/Twitter/Snap ad hosts, criteo, taboola, outbrain) + pixel SDK calls (fbq(, gtag(). Exempt (each pinned elsewhere): dead-code GAGate.tsx (never-mounted invariant enforced by cookie-consent + d2-security pin suites), changelog.ts prose, test files. Green on ship: 1412 files scanned, 0 references. Wired via gates.manifest.mjs (single source → hook + CI automatically) + check:no-third-party-pixel npm script. [hipaa][ocr-tracking-bulletin][gate][no-pixel]

Changed

• 📨 **Durable receipt — the 1.8s auto-close flash on the feedback bubble is dead (Fleet Feedback Standard §3A.2 / §6.2).** FeedbackBubble.tsx's success state now PERSISTS until the filer closes it: “Received ✓ — Doug'll see this next time he reviews” + a real to My feedback (link TEXT, never a raw path) + Send-another/Close. Button copy “Send to Doug” → “Send” (personal framing raises the social cost of filing small stuff); type picker “Polish (small)” → “Quick tweak” (internal polish value unchanged — wire + DB stable); draft-restore now says “Your screenshots need re-attaching — drafts save your words, not images” when a saved draft had images (drafts persist words only; File objects can't survive a reload). [feedback-standard][durable-receipt][copy]
• 💬 **Two-response collapse on /me/feedback — filers never see the internal status ladder again (spec §3A.3–5 / §6.3).** Status + severity pills replaced by a thin phase line — Received / Reply / Fixed — take a look — via new pure lib src/lib/feedback-filer-view.ts (filerPhaseForRow, bucketForRow extracted from the page so the nav badge can't drift, both pinned in feedback-filer-view.test.ts). A clarification question renders as a REPLY with a reply box (new ReplyBox.tsx + replyToMyFeedback server action: owner-gated, writes a ReviewerFeedbackComment as the filer, quietly flips needs-clarification→open — she never sees a status change; body-blind FEEDBACK_SUBMITTER_REPLY audit). wontfix renders as “We're not going to change this one — here's why: …” and couldnt-fix as “This one's trickier than it looks — Doug's got it” — human replies, never statuses. Fix notices show “This is fixed — take a look” + an isSafeDeepLink-guarded “Open {page} to check →” button + ✓ Works / ✗ Not fixed taps; shas + ✨ auto-fix version chips are gone from the filer surface (admin queue keeps them). Comment thread renders as a plain conversation (You / author name). Mariane's IBV0001 tabs survive — they were already filer-language. NO migration: String status column + existing comments table. [feedback-standard][two-response-collapse][no-migration]
• ⏱️ **Autonomous fix loop: hourly + scan-past-refuse + 2 ships/run (spec §3B / §6.5 — yml-only).** agent-feedback-fix.yml: cron 23 */4 * * * → 23 * * * * (14 min behind the :09 feedback-cleanup classifier so every tick reads a freshly-classified queue — worst-case clear-ask-to-fix drops from ~4.5h to <1h); timeout-minutes 25 → 50 (25 structurally couldn't hold the budget — a mid-ship kill strands a row in agent-working); the REFUSE-streak-3 early abort is replaced by the scan-past-un-shippable rule (the cap is N SHIPS, not N evaluations — keep scanning oldest-first past REFUSEs; stop only at quota / end of queue / build-time) so un-shippable rows can't strand shippable ones behind them; cap 5 → 2 ships/run (hourly cadence carries throughput; PHI-screen REFUSE rules NOT relaxed). [feedback-loop][sub-hour][yml-only]
• 🏷️ **Admin-only status labels rewritten honest + de-personalized (spec §5).** STATUS_LABELS: done → “Shipped — please check” (shipped ≠ confirmed-fixed), wontfix → “Won't change — see note”, couldnt-fix → “Couldn't fix yet — back with Doug”, agent-working → “Being worked on”, mariane-triage → “Being reviewed” (never a coworker's name to a new hire; internal status VALUES unchanged everywhere). Admin queue empty-state corrected bottom-right → bottom-LEFT (factual fix — the bubble moved in UI0005). /me/feedback not-enabled copy → “The feedback box isn't turned on for your account yet — it will be as we bring more of the team onto it.” [copy][admin-labels]

Added

• 🧭 **Permanent “My feedback” sidebar entry with attention count (spec §3A.2).** Email-allowlist gated (layout passes the verdict — can't live in role-gated nav-config), pinned above the user footer so it's visible without scrolling. Badge = the caller's OWN items waiting on her (a fix to check / a reply to answer) via new count-only endpoint GET /api/admin/reviewer-feedback/my-attention-count (AdminSession + allowlist, bare count — no row content) sharing attentionCountForRows with the page tabs. [feedback-standard][nav]
• 🔗 **Deep-linked, BODY-BLIND fix notice — email AND token page (spec §3A.5 / §3E / §6.4 + both hipaa-architect MUST-FIXes applied).** SubmitterConfirmEmailRow gains pagePath; the confirm email + the public /feedback-confirm/[token] page both get “Open {page} to check →”. HIPAA hard rule enforced end-to-end: the EMAIL carries the page NAME + links ONLY (old title/agent-summary/sha/version blocks removed — Kat files from gmail = outside the BAA boundary), and the TOKEN PAGE is now body-blind too (hipaa-architect MUST-FIX 2: it's a no-login bearer page whose URL a mail provider's link-scanner can GET — cleanedTitle/agentNote/summary/sha/version chip + the rejected-state note echo all removed; mutations stay POST-only server actions; content lives behind cookie-authed /me/feedback). New emailSafePagePath() (pinned in tests) strips query/hash, downgrades record-detail paths (/admin/patients/:id → /admin/patients etc.), and — MUST-FIX 1 — ends in a FAIL-SAFE ALLOWLIST: only routes humanizePagePath recognizes may ride an email, so unknown/future /admin/x/:id routes (isabella, chat-history, amendments, forms…) emit NO link instead of leaking a §164.514(b)(2)(i)(R) record identifier. isSafeDeepLink (brapp 27036 port) rejects protocol-relative/external targets everywhere a deep link renders. Kept the comms NO-OP-locked lines (“Doug shipped a fix — does this work for you?” / “takes 2 seconds, no login needed”). [hipaa][body-blind][deep-link][fail-safe]
• 🧪 **Allowlist assertion hardening (spec §6.1).** Kat's KATFEEDBACK1 allowlist entry verified already-landed on main; her pin test extended through the isReviewerFeedbackUser comparator (case/trim, Demi/DF0005 pattern) + a KATLOOP1 label-rewrite pin block. Lisa (starts 7/7): email NOT known — deliberately NOT invented; TODO markers left in reviewer-feedback.ts + the test file, and the day-3–4 plan is the role-based canSubmitReviewerFeedback port that retires the per-email bottleneck. Kat stays OUT of REVIEWER_FEEDBACK_AUTOFIX_TRUSTED — classifier-autoflip lane per the Demi precedent. [allowlist][tests]

Fixed

• 📎 **Staff medical-record uploads over ~4 MB no longer die with an opaque error (reviewer-feedback cmr1gibim + cmr2xhejk).** Root cause: the upload UI advertised the ROUTE's 25 MB cap, but the platform rejects any serverless request body over ~4.5 MB with a bare 413 BEFORE the route runs — scanned-record PDFs and phone photos routinely exceed that, so the feature looked broken. New client-side pre-flight src/lib/admin-upload-client.ts: files ≤4 MB pass through untouched (the server pipeline — MIME allowlist, magic-byte sniff, sharp compress + EXIF-strip, private-blob put, audit — is unchanged and stays the single trust boundary); oversized IMAGES are downscaled in-browser (canvas → JPEG, max edge 2048px, quality ladder — same geometry the server applies; canvas re-encode also drops EXIF) until they fit; oversized NON-images get an honest, actionable message BEFORE the doomed request; and a surviving platform 413 maps to a friendly explanation as the belt to the pre-flight's suspenders. Wired into BOTH staff attach surfaces (DocumentsList.tsx patient chart + DocumentsPanel.tsx appointment panel) and the '25 MB' labels corrected to the truthful hint. True >4 MB PDF support (Blob client-upload architecture) flagged to Doug as a separate design decision — it would route around the sharp/magic-byte pipeline, so it is NOT snuck into this ship. [uploads][honest-errors][hipaa-pipeline-unchanged]
• 🩺 **Clicking an appointment that already has an encounter now OPENS that encounter instead of minting a duplicate (reviewer-feedback cmr030upv).** Two-layer fix. Page layer: /provider/portal/encounters/new?appointmentId=X now checks for this provider's existing non-cancelled encounter on the appointment and redirects straight to it — the Create-Encounter form only renders when there is genuinely nothing to open. Route layer (backstop for stale tabs): POST /api/provider/encounters with an appointmentId is now IDEMPOTENT — if this provider already has a non-cancelled encounter on that appointment it returns {encounterId, existing:true, redirectTo} for the EXISTING row, and the client's success path lands the provider on it. Deliberately scoped: unlinked creates (walk-ins, no appointment) are untouched; a cancelled mistake doesn't block a fresh chart; a DIFFERENT provider covering the same appointment still gets their own encounter. The 'Pending Approval has no obvious approve control' half of that report is a workflow-design question routed to Doug — not auto-changed here. [emr][duplicate-guard][providers]
• 🔗 **Patient-facing drafts + emails no longer point at dead or staff-only web addresses (reviewer-feedback cmr2wdwgl, part of cmr2wnxm6).** portal.greenwellness.org has NO DNS (dead end for every patient told to 'upload at the portal') and flow.greenwellness.org 308s patients to /admin/login (the staff sign-in) — yet both were baked into Isabella's draft-suggest prompt, the messages ai-draft prompts (SMS + email), the compose draft-prompt, three seed email templates, the stranded-lead catch-up prompt, and the unsubscribe page's 'Back to home' link. All patient-facing copy now uses the real public funnel greenwellness.org/get-started (curl-verified 200) as the ONLY permitted link, with an explicit prompt-level ban on the two broken hosts; records requests/submissions are described as email-reply attachments (which work today) instead of a records form URL that 404s. EMAIL_AI_DRAFT_PROMPT_VERSION bumped v1.2→v1.3 with the sha256 snapshot pin updated per the brand-voice-tune contract; existing HIPAA/no-medical-claims pins verified intact (127 draft-suggest + prompt-tune tests green). Live-calendar slot quoting in drafts (the rest of cmr2wnxm6) stays a Doug-design item — real availability grounding, not a URL swap. [isabella][honest-urls][prompt-v1.3]

Added

• 🧾 **New PHI-safe metadata endpoint GET /api/admin/reviewer-feedback/done-unevidenced — per-row reader for the historical 'hollow done' wave.** The 2026-06-29 audit left ~17 rows sitting in status=done with NO ship evidence (doneSha + closedByAgentVersion both null); the close-gate now 422s NEW hollow closes, but nothing PHI-safe could name WHICH historical rows to re-verify (the aggregate is counts-only, the /queue route correctly refuses terminal statuses). This is the missing middle, built to the exact /couldnt-fix contract: SELECTs only structural columns (id, severity, pagePath, agentAttempts, status, closeReason enum), collapses createdAt/doneAt to coarse ageDays/doneAgeDays ints, derives-and-discards userEmail into a roleBucket with the <5 small-cell suppression floor, and normalizes pagePath (query/hash stripped, identifier-shaped segments → ':id') so a patient record locator can never egress. Auth = bearer CRON_SECRET OR allowlisted AdminSession, with the exact-path ADMIN_BEARER_ALLOW proxy exemption (sister of /couldnt-fix). Lets the feedback drain claim each hollow row (PATCH working), read its body in-tenant via the body-bearing /queue route, verify the claimed fix against current code, and re-close WITH evidence. No body/name/email/screenshot/patientId/raw-timestamp in any element — PHI-safe by construction, same as its two siblings. [feedback-loop][hipaa-boundary][hollow-done-drain]

Added

• 🔐 **D11-for-admin + D11-for-patient — 2-axis session timeouts on the remaining two session classes (closes the 6/30 unshipped-backlog 'Patient/admin session idle+absolute timeout' row).** Ports the provider D11 pattern (XR0405, NIST SP 800-66r2 / 800-63B) verbatim: iat (issued-at, fixed across rolls) + exp (rolling idle deadline) in the HMAC-signed payload, dual-shape verify for the in-flight legacy cookie fleet, roll-throttled Set-Cookie via the proxy roll blocks. **Admin** (src/lib/admin-session.ts): 30m idle / 12h absolute (12h vs provider 8h so a long front-desk shift doesn't force a mid-day re-auth); payload v2→v3 (userId~role~nameB64~iat~exp~sig); the proxy roll block shipped as a stub in D9 HA0005 now does real 2-axis work with zero proxy changes; legacy 5-part cookies verify until their original ≤8h exp then upgrade on re-mint. **Patient** (src/lib/patient-session.ts): 60m idle / 24h absolute — DOWN FROM A FLAT 7-DAY PHI credential; NEW rollPatientSession/shouldRollPatientSession wired into the /patient/portal proxy branch (the one roll block that didn't exist); legacy 7-day cookies are deliberately retired by the absolute cap within 24h of their mint (fail closed — the patient just logs in again). All four session-mint sites (admin/login, patient/auth/login, verify-identity/confirm, set-password) drop their fixed cookie maxAge for the provider-style session cookie (payload iat/exp is the single source of truth; browser-close also drops it). Tests: admin-session.test.ts + patient-session.test.ts extended with D11 describe blocks (frozen constants, iat round-trip, absolute-cap-bites-despite-fresh-exp, roll-preserves-iat, roll-headroom windows, legacy-shape migration both directions) — 77/77 green with the provider suite. [hipaa][nist-800-63b][session-timeout][d11-port]
• 🩺 **NEW /api/admin/diag/rc-token-health — lights up the watchdog's dormant oauth-refresh-token-multi-vendor-health RC slice ('RingCentral token-health diag endpoint not yet implemented — TODO').** Verbatim sister of diag/m365-token-health: dual auth (bearer CRON_SECRET for the headless watchdog OR x-admin-role ADMIN/MANAGER for the in-browser banner), proxy ADMIN_BEARER_ALLOW entry so the cookie-only admin gate doesn't 401 before verifyCronAuth runs, always-200 envelope (ok/healthy/error/reason/hint/expectedScopes/checks{}/probedAt) so the watchdog never misclassifies a 500 as transient. Thin re-shape of the EXISTING /admin/integrations/rc tile primitives (checkJwtAppEnvSet/checkJwtTokenMint/checkJwtAccountInfo/checkJwtScopes/checkRcSubscriptionsHealthy) so banner + probe always agree. PHI-safe: token-mint + GET /account/~ metadata only — never message-store/call-log/fax; no token material in the body. Doc'd naming caveat: App A is JWT-bearer, not OAuth-refresh — failure modes are invalid_grant/invalid_client/unauthorized_client/missing-scopes, each surfacing its remediation recipe as hint. Watchdog-side re-point of the dormant probe is the follow-up in /CODE/watchdog (external repo). [watchdog][ringcentral][diag][phi-safe]

Changed

• 🧱 **Gate list SINGLE-SOURCED — scripts/gates.manifest.mjs + scripts/run-gates.mjs now drive BOTH the local pre-push hook and CI (closes the pre-deploy-gate.yml v2 follow-up TODO).** The list previously lived as two hand-maintained inline copies (63-entry shell array in .githooks/pre-push; 32-gate check:all string in package.json) that had drifted 30 gates apart: CI was NOT running check-no-unsafe-redirect, check-no-module-init-rotatable-env, check-after-wrap-external-send, check-no-xff-nullish-trap, check-sms-copy-shaft-safe, check-portal-api-routes-self-auth, check-safe-harbor-digest-content, check-bearer-routes-allowlisted (the security/HIPAA class) + 22 more; the hook was missing check-state-gate-coverage (the multi-state release firewall) that only CI ran. Now: one manifest (64 gates, per-gate ci:false flag — only check-vercel-project-link, which reads gitignored .vercel/project.json), one runner (--env=hook runs all 64, --env=ci runs 63), consumed by .githooks/pre-push, pnpm check:all, and pre-deploy-gate.yml (whose now-redundant separate PHI-in-logs/audit-coverage step is folded in). Drift is structurally impossible — a gate added to the manifest reaches both consumers; the runner prints the skipped-in-CI count per the queue-visibility invariant. Both modes verified green (64/64 hook · 63/63 ci). NOTE: the workflow itself stays report-only until Doug flips it to a REQUIRED status check in branch protection (unchanged, pre-existing Doug-action). [release-integrity][gate-drift][single-source]

Added

• 💬 **Kat (seattlecckat@gmail.com) added to the GW reviewer-feedback allowlist (Doug-directed: ops tester onboarding 2026-07-02, ahead of Lisa's start next week).** Added to REVIEWER_FEEDBACK_ALLOWLIST in src/lib/reviewer-feedback.ts so the bottom-left feedback bubble renders for her on every admin page (gated server-side by isReviewerFeedbackUser in both the admin layout and /api/feedback). Mirrors Demi's DF0005 treatment exactly: allowlist-only — deliberately NOT added to FORCE_DOUG_REVIEW_SUBMITTERS (her items ride the normal AI-tier triage / auto-fix loop) and NOT added to REVIEWER_FEEDBACK_AUTOFIX_TRUSTED (that skip-triage tier stays Mariane-only). Also added to the STAFF_SUBMITTER_EMAILS role-bucket sets in the /api/admin/reviewer-feedback/aggregate + /couldnt-fix routes (kept in sync with the allowlist per their contract) so her counts bucket as staff — not other — under small-cell suppression. NOT added to STAFF_BYPASS_ALLOWLIST in oversight-cost-cap.ts: that list is the email-AI cost-cap bypass (inbound clinic-inbox bot), not the feedback path — Demi's entry there predates her feedback enablement and its pin test asserts exactly 4 entries. **Files MOD (4 + changelog pair):** src/lib/reviewer-feedback.ts · src/app/api/admin/reviewer-feedback/aggregate/route.ts · src/app/api/admin/reviewer-feedback/couldnt-fix/route.ts · src/lib/__tests__/reviewer-feedback.test.ts (allowlist assertion). **HIPAA:** config-only allowlist change, ZERO schema/migration, ZERO PHI-path change; feedback still lands in the BAA-covered reviewer_feedback table with no email/SMS notify. [reviewer-feedback-allowlist][kat-ops-tester][allowlist-only-not-force-doug][hipaa-clean]

Changed

• ⚡ **Booking wizard: @stripe/react-stripe-js lazy-loaded, so it drops out of the bundle entirely for GW (Poynt-only).** StepPayment.tsx statically imported Stripe Elements, and the wizard statically imports StepPayment — so @stripe/react-stripe-js rode the Poynt-path chunk for 100% of patients while 0% use it (GW selects Poynt via NEXT_PUBLIC_SELF_SCHED_PAY_TO_CONFIRM; the Stripe branch never renders). Moved the Stripe-Elements UI (PaymentForm + , the only code touching useStripe/useElements/react-stripe-js) into a new StepPaymentStripeElements.tsx loaded via next/dynamic({ssr:false}) ONLY inside the Stripe branch. **Build-verified**: before, react-stripe-js sat in the 109KB Poynt-path chunk; after, it's isolated in its own 13KB chunk the Poynt flow never fetches (~4.5KB gz off every GW patient's load path) — and NO prefetch, since prefetching unused code would be worse. Rules-of-hooks safe (Stripe hooks were already confined to PaymentForm); Stripe kept fully functional if the flag ever selects it; loadStripe/handleBook/stripePaymentIntentId/Poynt QR all byte-identical. 5 source-pin tests lock the split. [perf][booking][bundle]

Fixed

• 🔎 **Technical SEO + AI-surface cleanup.** /areas-we-serve (a public, indexable landing page with its own canonical + JSON-LD) was missing from sitemap.ts → only reachable via internal links; added. llms.txt/llms-full.txt route handlers hardcoded a phone number instead of the PHONE SSoT (drift hazard on an AI-citation surface) → now interpolate ${PHONE}, plus added the /qualify/washington eligibility hub and refreshed the stale date. **Deleted stale git-tracked public/llms.txt + public/llms-full.txt shadow copies** — shadowed at request time but still deployed, carrying a non-canonical host (not even in the app-url allowlist), the wrong one-word brand, and — the real find — a **PHI-adjacent /my-appointments URL advertised to LLMs**. No PHI was ever exposed (the URL needs a session); this stops pointing crawlers at it. Extended the next.config.ts edge-cache pin to /llms.txt. NO medical claims introduced (verified via medical-claim-scrub); all four structured-data gates + brand + canonical gates green. [seo][aeo][hipaa-adjacent]

Added

• 🧾 **Poynt webhook sequential-retry idempotency ledger (dark: flag OFF + migration 107 staged).** Completes the money-safety arc the concurrent atomic-CAS wave flagged: the CAS closed *simultaneous* duplicate deliveries; this closes a webhook *re-delivered later* (after state already moved). New PoyntWebhookDelivery table with UNIQUE(appointmentId, invoiceId, kind, amountCents) = Poynt's per-delivery economic-effect identity; each money-mutating branch (paid/additional/refund) INSERTs-as-dedupe before its CAS, so a proven duplicate (P2002) acks idempotently without re-running the mutation or re-firing release/receipt. **Zero-regression by construction**: the skip path is reachable ONLY on flag-ON + a proven duplicate; flag-OFF, table-missing, or any DB blip all fall through to today's already-idempotent CAS — a payment can never be dropped or double-counted whether the ledger is present or absent. Replay guard, settlement re-read release gate, and prior CAS audit shapes byte-intact. 42 new tests + all 113 Poynt tests green. Activate: apply prod-migration-107 + set POYNT_WEBHOOK_LEDGER_ENABLED=true. [payments][idempotency][money-safety]

Fixed

• 📎 **Cert-email now attaches the authorization PDF over M365 (the active BAA provider).** src/lib/cert-email.ts: canAttachPHI gated attachment on provider === "postmark" || "ses" and OMITTED "m365" — but M365 is the auto-detected active primary, so certAttached was always false and the PDF never left buildSend() (patient got the portal-link-only body). The M365 transport already supported attachments (email-m365.ts maps them to a #microsoft.graph.fileAttachment on the SAME graph.microsoft.com/sendMail POST as the body — identical OAuth token, same tenant, one call, no separate/non-BAA path — BAA-clean, verified). Full send-path re-traced hop-by-hop; both send variants already thread attachments through the m365 branch, so the fix was purely adding "m365" to the allowlist. Postmark/SES byte-identical; sendMessageId delivery-tracking unaffected (M365 returns messageId: null by design). New pins: m365 in the set, order-independent all-three-BAA-providers, end-to-end attachment threading, and 'PHI attachment only ever rides a BAA provider — never resend/none'. [cert][email][hipaa][bugfix]

Added

• 🩺 **Provider records-review queue (dark: flag OFF + migration 106 staged unapplied) — closes the 'incoming records never clinically reviewed before a visit' gap.** Human-only triage (NO AI in the clinical path — deliberately distinct from the separate pre-existing AI records-summary feature, verified non-colliding flags/paths/audit-actions). Nightly cron/records-review-enqueue (default-OFF RECORDS_REVIEW_QUEUE_ENABLED) sweeps patient-uploaded medical records into a PENDING queue (dedup'd on source+ref, DB partial-unique + P2002-race-safe); /provider/portal/records-review lets the provider mark reviewed/needs-followup with a secured note; the day's schedule surfaces 'Records reviewed · ' + the note to the appointment's provider-of-record. Every read/write audited PHI-free; degrades gracefully (P2021 → SectionUnavailable / heartbeat skipped=table-missing) until Doug applies prod-migration-106 + flips the flag. Built on the proven lead-catchup dark-ship pattern. [records][clinical][provider]

Fixed

• 🗄️ **Intake self-delete now soft-deletes (mig-103 parity) — closes a WA-retention gap.** api/intake/[token]/documents DELETE hard-deleted MedicalDocument rows + kept the blob only by luck; it now tombstones (deletedAt/deletedById=patient-via-intake, blob retained) exactly like the admin path, satisfying the RCW 70.02 ~10yr floor that rides the data. Critical follow-through: the soft-delete would have leaked tombstoned docs back into **8 read paths** the migration-103 sweep hadn't covered (the intake list itself, my-appointments docs, patient/provider uploaded-records + document GETs → now 404, provider portal ×2, appointment-readiness's records-uploaded flag, and BOTH patient record-export listings) — all now fence deletedAt IS NULL. Admin-only aggregate counts (no filename/content disclosure) deliberately left. [hipaa][retention][records]
• 🕵️ **EOD staff email → Safe-Harbor initials.** cron/eod-email built its patientById map from ${firstName} ${lastName} and rendered full names in the staff-productivity section, while that email's recipient chain includes a non-BAA inbox and its own header claimed aggregates-only. The map now stores safeHarborInitials() at build time (masked-by-construction — the render can only ever emit 'K.L.'), verified the only patient-name render in the file, and the file is now IN the check-safe-harbor-digest-content gate set (10 files). [hipaa][gates]
• 🔑 **Dropped the ?? CRON_SECRET fallback from patient-token HMACs (5 sites, not 4).** The re-grep found a fifth — portal-token.ts, the patient magic-link signer, the most sensitive of them. CRON_SECRET is a bearer credential also shared with GitHub Actions; the fallback meant an unset PORTAL_TOKEN_SECRET would let a cron-bearer holder forge patient tokens. All five (portal / unsubscribe / renewal / identity-verify / returning-patient-SMS) now key only off PORTAL_TOKEN_SECRET (verified set in prod → zero live tokens invalidate), fail-closed throw in prod retained. [security][hipaa]

Added

• ⚖️ **Weekly AI-reply quality judge (dark) — the calibration gate before auto-send is ever armed.** New cron/ai-reply-quality-judge (default-OFF AI_REPLY_QUALITY_JUDGE_ENABLED) samples ~10% (max 25, seeded-deterministic) of the trailing week's Isabella drafts (used + dismissed) and any auto-sends, scores each on a cheap Bedrock-Haiku judge against a rubric (resolution/tone/accuracy weighted above raw accuracy + safety-flag veto), stores PHI-free scores as audit rows, and emails a weekly PHI-free summary ('auto-send calibration: X% of used drafts scored ≥ threshold'). Follows the existing policy-adherence-judge architecture; ~$0.02/week when armed. Nothing auto-sends until this shows a track record. [ai-quality][autonomy][evals]
• 🩺 **Bedrock model-probe diagnostic (/api/admin/diag/model-probe, bearer/session-authed).** Runs a tiny PHI-free 'reply OK' completion against a candidate model list (control = current pin, plus the Sonnet 5 profile variants) from the PROD runtime — where the IAM creds actually work (a local probe 403s). Resolves the HELD Sonnet-5 pin flip (a candidate returning ok:true names the exact id to pin) and is a permanent diagnostic for the profile-alias class that once silently 400'd Haiku 4.5. Error-name/status only, never bodies. [ai][ops][diagnostic]

Added

• 🧭 **CS Command Center (/admin/cs-command-center) — one cross-lane SLA queue over a single shared obligations engine (cs-obligations.ts / -shared.ts).** 9 lanes: needs-human threads (all channels), unanswered inbound EMAIL with no in-thread outbound reply (previously surfaced NOWHERE when triage never flagged it), callbacks owed, leads due/uncontacted, stage-stalled renewals, records exports tracked to the **WA 15-working-day floor (RCW 70.02.080)** with the federal 25-day flag retained, unmatched faxes, aging PENDING_APPROVAL appointments, past-due staff tasks. Business-hours ages via businessHoursElapsed; per-lane SLA threshold map in one exported const; explicit all-clear (lists what was checked) + red banner on any lane that failed to compute. Check-off/claim rides the existing OpsTaskState desk overlay (shared bands with mariane-today — clearing one clears both); no new tables. MANAGER now lands here on sign-in; nav gains CS Command Center, Mariane Today, Demi Today, Doug Queue, Inquiry Coverage (all previously built-but-unlinked). [cs][sla][hipaa]
• 🐕 **Patient-slip watchdog cron (cron/patient-slip-watchdog, every 30 min staggered) — same obligations engine, escalation ladder.** ALWAYS computes + heartbeats would-alert counts (observable dark launch); SENDS only when PATIENT_SLIP_WATCHDOG_ENABLED="true" (default OFF). Breach → one PHI-free staff email (counts + lanes + deep link, safe-harbor-gate-scanned); hard breach (2×) → Doug copy. 24h per-item re-alert dedupe via PATIENT_SLIP_WATCHDOG_ESCALATED audit rows — no new table. [cs][cron][sla]
• 🌱 **Stranded-lead catchup engine (S3/S4 of the 5/31 plan, finally built — ~34K leads >30d silent had NO re-engagement path).** Nightly cron (cron/lead-catchup-draft, default-OFF LEAD_CATCHUP_ENABLED) drafts ≤20 honest re-engagement emails/night on the Bedrock BAA rail (PHI-minimal prompt; output rejected unless the medical-claim scrub scores clean; no pricing/pressure/fabrication — pin-tested) into new LeadCatchupDraft rows for /admin/leads/catchup-queue: human reviews lead context + draft, Approve sends via the shared outbound shell (unsubscribe + postal footer, send-time consent/suppression re-check, CommunicationLog) — **never auto-sends**. Freshest-dormancy cohort first; one draft per lead ever (DB-unique). /admin/leads gains stranded-cohort chips (30–90/90–365/365+), fixing the 30-day-lookback blindness. **Migration prod-migration-105-lead-catchup-draft.sql is STAGED, NOT APPLIED** — everything degrades gracefully (P2021 → SectionUnavailable / heartbeat skipped=table-missing) until Doug applies it. [leads][marketing][cron]
• 📮 **Email appointment auto-send — built DARK behind EMAIL_AUTO_SEND_APPT_ENABLED (default OFF).** When armed, ONLY appointment-action drafts auto-send, and only when EVERY independent gate passes: abstention scan clean, same-thread reply to the patient's own inbound (never a new recipient), confidence ≥90 (above the 85 green floor), medical-claim scrub clean, PHI-echo re-check at the send boundary, business hours. Sends stamp aiAutoSent=true + audit MESSAGE_AUTO_SENT (actor isabella-ai, model, promptVersion, confidence, content-hash — never the body). Reply-only pins extended 15→34, nothing weakened. [email-ai][autonomy]
• 🚦 **SHAFT-safe SMS gate (check-sms-copy-shaft-safe.mjs, pre-push #63).** Carriers block cannabis-referencing SMS regardless of WA legality. Sweep found all literal SMS bodies already clean; the ONE live exposure — the Isabella SMS system prompt steering AI-generated texts ('medical marijuana evaluation practice') — fixed with a carrier-content rule (say 'your medical authorization'). Gate keeps cannabis/marijuana/THC/CBD/dispensary tokens out of every SMS surface permanently. Also NEW explicit fail-closed RENEWAL_SMS_ENABLED gate: renewal SMS had NO code gate (only dead-by-missing-creds); until the Twilio/RC Healthcare BAA signs, sms-preference patients get a tested email substitution. [sms][compliance][gates]
• 🧪 **Bedrock model probe (scripts/probe-bedrock-sonnet5.mjs) + arming runbook (GW_CS_AUTONOMY_RUNBOOK_2026_07_01.md).** Sonnet 5 is GA on Bedrock with In-Region us-east-1 confirmed (data-residency safe; promo pricing to 8/31). The pin stays HELD until this live probe passes in the GW account (tests the geo profile + version-suffixed variants — the Haiku-4.5 alias lesson — with the current pin as control). Runbook = phased flag-arming order (watchdog → stale-transfer/voice-lead → catchup → auto-send), model-bump procedure, and the Doug-action table (Twilio BAA, treatment-comm sign-off, records-recency policy, Retell outbound scope). [ai][ops]

Changed

• 📅 **Renewal outreach cadence rebuilt on recall-benchmark evidence (renewal-cadence-shared.ts SSoT).** First touch moved to T-28d pre-expiry (pre-due outreach converts ~41% and books 15–20% higher than waiting); ladder T-28/T-14/T-7 (phone-pref → call queue)/T-0/T+7/T+14 (staff call task)/T+21; 6-touch hard stop per cycle; touches shift to Tue/Wed within their window (highest booking days), never outside it; retired the old double-send at T-7. Win-back cohort now freshest-lapsed-first with deep-dormant (>24mo, <8% converters) capped out entirely; the §164.508 opted-in marketing floor byte-identical + still pin-tested. Consent floors, bounce fallback, pipeline stage recording all preserved. [renewals][marketing]
• 🔒 **Email-lane HIPAA hardening (min-necessary + audit redaction + channel-uniform abstention).** Triage classifier input hard-bounded (subject was unbounded; §164.502(b)). THREE raw phone/identifier leaks into audit detail fixed (sms-auto-reply ×3 sites, sms-ai, admin smoke-test) and check-pii-in-audit-detail extended with 4 pattern classes so the class can't return. New shared abstention floor (comms-abstention-shared.ts, 70 tests) consumed by BOTH sms and email lanes: crisis (EN+ES, short-circuits with NO model call), legal/attorney/insurer, breach mentions, minors, §164.526 amendment requests — any hit forces needs-human + suppresses draft generation. [hipaa][email-ai]

Fixed

• 🛡️ **Reschedule paths now run the provider double-book guard (closes the remaining path of the 6/17 Dr. Ari incident).** The PROVIDER_DOUBLE_BOOKED overlap guard existed only on the two CREATE paths (public booking + admin manual); the patient reschedule core (appointment-move) and admin reschedule claimed slots with no overlap check — and telehealth/in-person availability exists as twin slot rows at the same clock time, so a reschedule could still double-book a provider. The guard is now extracted to a shared helper (provider-double-book-guard) and runs inside ALL FOUR commit transactions, with a per-provider pg_advisory_xact_lock closing the concurrent-booking TOCTOU race the plain findFirst guard had (two simultaneous bookings of twin slots could both pass at READ COMMITTED). Reschedule surfaces return a clean 409. [scheduling][bugfix]
• 💳 **Duplicate-submit booking race no longer refunds a live appointment's payment.** In /api/appointments, the paid-path idempotency check ran BEFORE the booking transaction, and the SLOT_TAKEN/P2002 catch refunded the payment intent unconditionally — so a double-clicked Book (two POSTs, same intent) could create the appointment on request A while request B refunded the money paying for it. The catch now re-queries for an appointment already owning that intent and returns idempotent success instead of refunding. [booking][payments][bugfix]
• 🕐 **Booking calendar month view no longer hides late-afternoon slots on the last day of a month.** Month-mode bounds were computed in server time (UTC) while day-mode used Pacific-time bounds — so in PST season, slots at/after ~4 PM on the month's last day were invisible in the month indicators (patients never clicked into a day that actually had openings). Both modes now share one Pacific-time bounds helper (availability-bounds-shared), pin-tested across PDT/PST + the 10:30 PM month-boundary edge. [scheduling][timezone][bugfix]
• 🔒 **Reschedule now honors slot holds, booking buffers, and provider date blocks (parity with the create path).** Moving an appointment could previously land on a slot another patient was actively holding mid-checkout (bouncing + auto-refunding the payer), or onto buffer-protected/blocked dates via a crafted request. The move claim is now hold-aware and runs isSlotDateBlocked + isSlotBufferBlockedForCommit; concurrent moves of the same appointment can no longer strand a slot as permanently booked (guarded compare-and-swap on the original slot id → clean 409 CONCURRENT_MOVE). [scheduling][bugfix]
• 🏠 **Homepage 'next available' teaser now uses the real bookability filters.** The public next-slot teaser and home-page data filtered only on isBooked/future — ignoring provider active status, ghost slots, and live holds — so it could advertise times the booking page wouldn't show (deactivated provider, held slot). All three surfaces now share bookableSlotFilter. [booking][bugfix]
• 🎂 **Patients are no longer rejected as 'too young' on their exact 18th birthday.** Age math used elapsed-days ÷ 365.25 (an 18th birthday is often 6574 days — half a day short), refusing legally eligible patients for up to ~1.5 days. Now a calendar Y/M/D comparison in clinic time (dob-age-shared), matching how WA eligibility actually works. [booking][eligibility][bugfix]
• 💰 **Card-terminal webhook money updates are now atomic + retry-safe (protects cert release).** The Poynt webhook's paid/additional-payment/refund paths were read-modify-write with no transaction, while Poynt retries deliveries aggressively — concurrent duplicates could lose an update or double-subtract amountCollectedCents, the exact field that gates authorization release via isAppointmentFullyPaid (worst case: cert held forever on a fully-paid patient, or paid-state corrupted on refund). All three paths are now guarded compare-and-swap updateManys: duplicate deliveries land as audited no-ops (already-paid-race, refund-race-noop), the settlement re-read release gate is untouched. Full sequential-retry dedupe via a unique-constraint ledger needs a migration — flagged as a Doug-gated follow-up. [payments][bugfix]
• 📧 **Win-back email no longer promises a specific authorization expiry date.** It computed 'valid through ' at send time, but the legal SSoT (computeAuthExpiry) is issue-date + 1 year − 1 day and issuance happens at the future visit — the promised date was wrong on two axes. Copy now says 'valid for up to one year from the date it's issued', with an import tripwire so the old date math can't return. [emails][honesty][bugfix]
• 🌗 **nextOpenDay actually re-anchors probes at noon now (DST seam).** The code claimed noon re-anchoring in its comment but walked raw 24-hour steps — a near-midnight call crossing spring-forward could mislabel the next open day in patient-facing callback promises. Code now matches the comment; DST-seam pins added. [bugfix]
• ✅ **Test suite restored to green — 19 stale tests re-pinned to the shipped reach-a-human doctrine + 2 real content violations fixed.** The ARIVOICE1/ISADRAFTQUAL1 batch (6/29, pushed with --no-verify) intentionally moved Isabella's voice from 'warm transfer' to message-and-callback framing but left 19 regression tests pinned to the old phrasing — main's suite has been red since. 17 were re-pinned to the shipped intended behavior (no safety assertion deleted); 2 failure groups were REAL: nine changelog staff summaries exceeded the 800-char readability cap and two leaked banned technical terms into staff-facing text — the content was fixed, not the gate. Suite: 10,302/10,302 green. [tests][hygiene]

Added

• 🧱 **New pre-push + build gate: every provider/patient API route must self-authenticate (check-portal-api-routes-self-auth).** /api/admin/* is edge-gated in the proxy, but /api/provider/* and /api/patient/* deliberately authenticate per-route — discipline is 100% today (verified all 59 routes), but nothing structurally prevented a future route from forgetting the auth call and shipping an unauthenticated PHI surface. The gate requires every such route to reference an approved auth primitive or sit on an explicit justified public allowlist (10 entries, each verified fail-closed + rate-limited). Wired into pre-push AND the unbypassable Vercel ci-build-gate (now 11 HIPAA-critical gates). [security][hipaa][gates]
• 🕵️ **New gate: digests to the non-BAA inbox must render patients via Safe-Harbor masking only (check-safe-harbor-digest-content).** The EOD/pulse digest renderers de-identify patients by convention (safeHarborInitials, n<5 suppression) with nothing enforcing it — one future edit interpolating a full patient name into a digest would ship a reportable disclosure. The gate scans the 7 digest-renderer files and fails on any unmasked patient-field interpolation; also fails loud if a listed file disappears. ⚠️ While building it: cron/eod-email ALREADY renders full patient names in its staff-productivity section despite its own aggregates-only header — left out of the gate's file set with a loud comment; changing a live clinical digest is a Doug decision (see PR notes). [hipaa][gates]
• 🧰 **Gate + hygiene batch:** audit-coverage exempt list purged of 5 stale paths (a new file created at any of them would have been silently exempt from audit-logging enforcement); check-doc-only-commit.sh now diffs against VERCEL_GIT_PREVIOUS_SHA instead of HEAD~1 (a doc-only TIP commit could silently skip deploying real code commits beneath it in the same push — and the old error path failed CLOSED to 'skip build', now fails OPEN to 'build'); env-fallback gate extended to catch || "literal" secret fallbacks (previously only ??); the EOD red-signals + narrated modules dropped all 12 (db as any) casts (stale-generated-client-era workaround) and are fully typed again; npm audit fix cleared the reachable high-severity dependency advisories (twilio→axios chain + @vercel/blob→undici). [gates][hygiene][security]

Fixed

• 🩺🔒 **Provider 'Sign + Lock' (and all cookie-authed mutations) no longer 403 on browsers that omit Origin/Referer — CSRF guard hardened with a Fetch-Metadata fallback.** src/proxy.ts: the same-origin CSRF guard (v2.97.CSRFENFORCE1, enforcing since 2026-06-25) rejected any state-changing /api/{admin,provider,patient,dispensary} POST/PUT/PATCH/DELETE whose provenance host couldn't be read from Origin ?? Referer. Older Safari / iOS in-app + email-embedded webviews omit BOTH on a same-origin fetch POST, so a real provider (Dr. Ari) could open a chart (GET — not gated) but hit a hard 403 "cross-origin request rejected" on EVERY sign. **Fix:** accept the request when Sec-Fetch-Site is same-origin or none IN ADDITION TO the existing Origin/Referer allowlist. Sec-Fetch-Site is a browser-set Forbidden header (JS cannot set or alter it), so this does NOT weaken CSRF — a cross-site attacker's request always carries Sec-Fetch-Site: cross-site and still fails both checks → 403. same-site is deliberately NOT trusted (a sibling subdomain is not same-origin); a client too old to send Sec-Fetch-Site AND omitting Origin/Referer stays blocked (unverifiable provenance). The [csrf] block-log line now also records sec-fetch-site= so this class is instantly triageable in Vercel logs. Verified against prod pre-fix: no-Origin POST → 403, same-origin-Origin POST → 401 (healthy). No schema change; sign-flow gates (payment / DOB / condition / signature / license) + audit trail unchanged. [provider-portal][csrf][hipaa][security][ARISIGN]

Changed

• 📧 **Automated records-reminder email — added 'disregard if already sent / already scheduled' disclaimer (cmr1fn91x / Mariane).** src/lib/records-reminder-email-shared.ts: right below the Hi , greeting, the Day 3 / Day 5 / Day 7 template now renders a small italic bordered call-out with Mariane's requested copy verbatim — 'If you have already submitted your medical records and/or have already been scheduled for an appointment, please disregard this automated email. No further action is required.' The disclaimer sits above the existing bucket-specific opening line so a lead who has already moved forward stops reading at the top. Stopgap while the Mariane lead-cleanup backlog completes; suppression-on-records-received is a Doug-decision follow-up. All existing pin tests (subject-per-bucket, first-name greeting/escape, opening-per-bucket, contact-SSoT, unsubscribe, PHI-minimization) unchanged and passing. PHI-free: disclaimer is static copy carrying no patient identifiers. ✨ Auto-fixed by Claude. [emails][leads][hipaa][cmr1fn91x]

Fixed

• 🛡️ **Provider double-book guard ported to admin manual booking + duplicate-slot cleanup.** Investigation of the 90+ same-tuple duplicate bookable AvailabilitySlot rows confirmed: **0 real double-books** on any current/future date (the one historical overlap is a completed 2026-06-09 visit — left as-is). Root: the admin manual route (/api/admin/appointments/manual) lacked the PROVIDER_DOUBLE_BOOKED overlap guard the public route has. **Fix 1:** added the same in-transaction guard (tx.appointment.findFirst for any active appt on the provider whose [startsAt,endsAt) overlaps → throw → clean 409). Status route ([id]/status) reviewed — only mutates an existing appointment's status, no new-booking collision path, no guard needed. **Fix 2:** tightened both slot generators (slots/generate + slots/quick-generate) dedup key from startsAt-only to the full (providerId, startsAt, slotType, locationId) tuple so same-time rows can't accumulate. **Cleanup:** deleted 90 duplicate future bookable slots — only UNATTACHED, non-held extras, keeping one per tuple; never a slot with an appointment. Remaining duplicate groups: 0. PHI-free throughout (availability rows carry no patient data). [scheduling][bugfix][hipaa]

Fixed

• 🔎 **Patients search now cross-links to Leads (cmr1flpwc / Mariane).** /admin/patients?q=X renders a persistent 'Not finding them? Search Leads for "X"' hint above the filters. The link deep-jumps to /admin/leads?q=X; LeadsPage now accepts a q search param (bounded to 100 chars) and forwards it to , whose existing debounced useEffect fires the search on mount. Both pages already share the ADMIN/MANAGER/SCHEDULER role guard, so this widens no access — it just wires the two search boxes together so an unconverted lead no longer looks like a non-existent record and doesn't trigger redundant automated-outreach churn. Follow-up (Doug-decision): fold matching leads into the patients-page query itself; this ship is the minimum-risk cross-search hint. ✨ Auto-fixed by Claude. [admin][leads][search][cmr1flpwc]

Fixed

• 🗓️ **Cancelled times are now genuinely re-bookable, not just hidden (BOOKSLOTFIX1 follow-up, Mariane cmr1ee0s5).** BOOKSLOTFIX1 excluded already-appointmented slots from /api/availability (killing the P2002 'internal error' 500) but left the cancelled TIME merely hidden — because Appointment.slotId is @unique (1:1), the original slot can never be rewritten. New src/lib/slot-regenerate.ts regenerateBookableSlotOnCancel() mints a FRESH unattached AvailabilitySlot (same provider / datetime / duration / slotType / locationId) so the time reopens; the cancelled appointment keeps its old slotId (history/audit intact, stays hidden by appointment:{is:null}). Wired into all three cancel paths: admin appointments/cancel, patient self-cancel appointments/cancel, and admin appointments/[id]/status→CANCELLED. **Idempotent + safe:** future-only (never reopens a past time) + dedup guard (skips if a bookable slot already exists at that exact time → no duplicate/overlapping opening) + best-effort (a regen failure never fails the cancel). Reschedule/move paths already reassign slotId to the new slot, so they free the old slot cleanly and need no regen. **Backfill:** reopened the previously-stuck cancelled times (idempotent one-off). **Defense-in-depth:** public booking route /api/appointments now folds Prisma P2002 into its existing SLOT_TAKEN refund+409 path (payment may have been collected). PHI-free throughout — AvailabilitySlot carries no patient data. [scheduling][bugfix][hipaa][cmr1ee0s5]

Fixed

• 🗓️ **Booking 'internal error' on cancel-freed slots (Mariane cmr1ee0s5).** Appointment.slotId is @unique (1:1 slot↔appointment); the cancel route sets slot.isBooked=false to free the time but the CANCELLED appointment keeps the unique slotId, so the slot is structurally un-rebookable — appointment.create throws Prisma **P2002**, which the manual-booking route's catch did not handle → generic "internal error" 500. **Fix 1 (root):** src/app/api/availability/route.ts slotFilter now adds appointment: { is: null }, excluding any slot already owning an appointment of any status from both admin + patient booking lists (removed 5 live trap slots; hid zero real openings — a genuinely open slot has appointment=null). **Fix 2 (defense-in-depth):** src/app/api/admin/appointments/manual/route.ts catch now maps PrismaClientKnownRequestError P2002 → clean 409 for the cancel-in-TOCTOU-window race. Exposure was widened tonight by PENDCANCEL1 (more appointments became cancellable → more freed-but-consumed slots). PHI-free: message + logs carry no patient identifiers. Follow-up (Doug-decision): regenerate a fresh AvailabilitySlot on cancel so a freed time becomes rebookable rather than hidden. [scheduling][bugfix][hipaa][cmr1ee0s5]

Added

• 🛡️ **Isabella scheduling-honesty regression gate (SH01–SH05).** Extended src/lib/__tests__/isabella-abstention-eval.fixtures.ts (15 → 20 cases) with five deterministic, Bedrock-judged behavioral probes that lock the 'paper-close' regression class — closing observed-behavior bugs by assertion. Cases: SH01 no fabricated/specific open dates as held slots; SH02 no premature 'you're booked/confirmed' for a NEW patient (tentative-request framing required); SH03 no telehealth offered to a self-identified new/first-time patient; SH04 one clinic's availability at a time, no cross-clinic (Concord+Spokane) day merge; SH05 no email-confirmation promise unless an email was collected. All five are HARD-GATE negative/refusal assertions (no toolConditioned), so they BLOCK scripts/sync-retell-prompt.mjs from pushing a non-adherent prompt to the live Retell agent. Verified GATE PASS 19/19 hard-gate cases against the current prompt (probes calibrated, not false-failing). [infra][isabella][voice][hipaa]

Changed

• 🩺 **Provider portal — 'Today' tab renamed 'Worklist' (cmr030cm8000004l955sbmodx).** ProviderPortalNav.tsx nav label + the /provider/portal/today page eyebrow heading both relabeled 'Today' → 'Worklist' to kill the two-'Today' collision with the Schedule home's same-day section. Route, content, and bookmarks unchanged — label only. ✨ Auto-fixed by Claude. [provider][portal][cmr030cm8000004l955sbmodx]
• 🔒 **Feedback close-gate flipped WARN → hard 422 (queue-visibility invariant).** /api/admin/reviewer-feedback/[id]/agent now REJECTS a done PATCH (422) that carries neither ship evidence ({sha} or {autoFixVersion}) NOR a valid closeReason enum (answered / working-as-designed / duplicate / not-reproducible / wontfix) with a substantive note — previously logged-and-allowed. Closes the 38-hollow-close recurrence class structurally. Pre-flight verified the autonomous feedback loop always supplies {sha, autoFixVersion} (protocol step 12) and the admin UI marks done via a server action stamping closedByAgentVersion, so no legit caller breaks. PHI-free: the 422 body + log carry only id + evidenceClass + structural failed-check, never the note. [infra][feedback][hipaa]

Changed

• 🏗️ **Build-wall fix — relocated typecheck out of next build (ported from inv-App v429.26508/26509).** next.config.ts sets typescript.ignoreBuildErrors: true so next build no longer type-checks inline; package.json adds typecheck (tsc --noEmit); vercel.json buildCommand is now node scripts/ci-build-gate.mjs && npm run typecheck && npm run build — type errors still fail the deploy (BLOCKING), they just run in isolation. Closes watchdog build-duration-wall-approach 🔴 (was 45m41s = 102% of the 45-min Vercel wall, one recent build ERROR'd). tsc --noEmit verified green before flip. No PHI/behavior change. [infra][build]

Fixed

• 📅 **Appointments — Cancel now available on Pending-Approval appointments (cmqvr6awt00020ahx6f4679u5 / Mariane).** AppointmentsTable.tsx extracted the Cancel control into its own gate ["SCHEDULED","CONFIRMED","PENDING_APPROVAL"].includes(a.status); Reschedule/Complete/No-Show stay gated to SCHEDULED||CONFIRMED. Parity on the detail surface: AppointmentActions.tsx guard now admits PENDING_APPROVAL but only surfaces Cancel for it (Reschedule/Mark Seen/No-Show gated via canManage), and appointments/[id]/page.tsx renders AppointmentActions for PENDING_APPROVAL. No backend change — /api/admin/appointments/cancel already cancels any non-CANCELLED status, releases the slot, emails the patient over BAA paths, cancels in Practice Fusion, notifies the waitlist, and audits CANCEL_APPOINTMENT (actor + resourceId + ip). ✨ Auto-fixed by Claude. [admin][appointments][cmqvr6awt00020ahx6f4679u5]

Changed

• VOICE_LEAD_CAPTURE_ENABLED flipped on — call→lead capture is live on BAA-covered Retell infra (BAA executed 2026-05-30, verified in BAA_STATUS row 18).
• Corrected the stale 'BAA pending / dispatch stubbed' comment in the Retell voice webhook — only the real-time tool-call dispatch remains a Phase-3 stub; the post-call lead capture is live.

Fixed

• 📨 **Isabella Draft Replies — 'Open conversation' no longer surfaces 'Thread not found' for unmatched senders (cmr02z8pw / Mariane).** getPendingDrafts() + getUndraftedInbound() in src/lib/isabella-draft-queue.ts built conversationHref for unlinked rows as /admin/messages/email/${r.threadId ?? r.id}. r.threadId for inbound EMAIL comes from inReplyTo ?? conversationId (M365 / Postmark webhooks) — a raw RFC Message-ID or base64 conversationId that can include <>:+/=. The audit page's threadId: lookup didn't always round-trip through URL encoding, and its id: fallback didn't match either (because the URL segment was a threadId, not a message id), surfacing 'Thread not found'. Switched the unlinked-row URL to ${r.id} — always a URL-safe cuid — and the audit page's existing id: fallback resolves the row. Linked-row path (/admin/patients/#communication) unchanged. ✨ Auto-fixed by Claude. [admin][isabella-drafts][routing][cmr02z8pw]

Added

• Known-caller callback logging: phone_exact match → PHI-free LEAD_CALL_LOGGED audit row on the matched lead/patient (no duplicate lead). Idempotent on Retell callId. (voice)(hipaa)(leads)
• Leads queue '📞 Call Leads' filter chip + '📞 From call' pill on call-captured rows (source=voice-call). (leads)
• Call summary surfaced on the lead detail page (condensed Retell summary, min-necessary — not the full transcript). (leads)(hipaa)
• All behind VOICE_LEAD_CAPTURE_ENABLED (off) — byte-identical until flipped. No migration (LEAD_CALL_LOGGED is a free-text audit action).

Fixed

• isAppointmentFullyPaid: the null/0 amountCollectedCents = 'fully paid' legacy shortcut no longer applies when bookingDepositEnabled() && bookingDepositInScope(type) — a deposit-in-scope visit with no recorded full amount stays HELD. Inert when BOOKING_DEPOSIT_ENABLED is off. (payments)(hipaa)(deposit)
• 4 pin tests (ARIPREPAY): flag-on+telehealth+null → held; flag-on+full-amount → released; flag-off+null → legacy fully-paid (inert); flag-on+in-person (out of telehealth-only scope) → unchanged.

Changed

• voice-prompt.ts: Wave-1 reach-a-human (early human offer in disclosure + frustration-trigger callback) synced live to Retell; honest message-and-callback framing, no false live-transfer promise.
• voice-prompt.ts line 139: reframed qualifying-condition language to neutral, state-list factual + provider-defers-eligibility; closes the AB01 (implied-treatment) + AB02 (implied-diagnosis) abstention-eval failures. Crisis floors (988/DV/Spanish-988) unchanged.

Added

• closeReason column (migration-104, expand-only) + a classifyClose gate on the reviewer-feedback done-PATCH: code / reasoned / hollow-candidate; hollow closes log a PHI-free warning (warn-mode — no block).
• Feedback aggregate now emits doneEvidence.reasonedCount so the done-without-evidence watchdog can exclude reasoned closes from soft-watch noise.

Added

• Direct new-patient packet link in the appointment-onboarding email (portal-welcome path), behind APPT_ONBOARDING_DIRECT_FORM_LINKS — reuses the existing BAA mail rail + FORM_SENT_TO_PATIENT audit + placeholder-email guard; token never logged.

Changed

• Isabella draft prompt v1.2: warm acknowledgment before next-step, operational-fact KB (answer don't defer), symptom-acknowledge→portal-upload (no clinical echo).
• email-triage: high-precision bulk/newsletter detection (mail headers, not body) short-circuits to routine before the model → no draft + no auto-ACK on marketing mail; PHI-free bulk= audit token.

Added

• In-thread Reply on /admin/messages/email/[threadId] (the unmatched-inbound-email view, previously read-only), behind EMAIL_THREAD_REPLY_ENABLED — reuses the existing secure send path; no new email pipeline.

Added

• Two labeled sections on /admin/reports/eod (Overall Summary + Staff Activity Summary) with a new per-staff activity-count table derived from existing data — no new query, no scorecard/grade content, no new patient-data surface.

Added

• Patient-portal onboarding checklist at /patient/portal/onboarding (composes existing upload/forms surfaces; completion derived from existing data), behind PATIENT_ONBOARDING_FLOW_ENABLED — no new patient-data surface, no new sign-in.

Fixed

• /patient/portal/uploaded-records no longer lists soft-deleted (off-chart) documents to the patient (added deletedAt:null filter).

Added

• Voice call → Lead auto-capture in the Retell webhook, behind VOICE_LEAD_CAPTURE_ENABLED — creates a LEAD_CAPTURED record for an intent-expressing stranger call (callback-only consent), idempotent per call, linked to the call's match row; PHI-free companion audit.

Fixed

• /admin/reports/eod now writes a VIEW_EOD_REPORT audit-on-view row (count-only detail, no patient identifiers) — closes a §164.312(b)/§164.528 disclosure-logging gap (the report renders full patient names).
• Leads / Messages / Fax sidebar badges refresh on tab-refocus (visibilitychange), so a worked-down count un-sticks without a navigation (Mariane cmq7g6ldn follow-up).

Added

• "Call escalation rate" per-day trend chart on /admin/reports/ai-receptionist (share of CALL-channel conversations that reached a human, bucketed by day over the 14-day window).
• PHI-safe by construction — the trend reads only call timestamps + the needs-human flag, never the call summary/transcript or any patient identifier.

Changed

• doneEvidence: cluster signal scoped to no-evidence done rows + field renamed maxIdenticalNoteCluster → maxDuplicateCloseCount (the prior name tripped the PHI egress-guard's banned-substring list).

Changed

• /api/admin/reviewer-feedback/aggregate now emits a doneEvidence block (total / noEvidence / noEvidenceZeroAttempt / maxIdenticalNoteCluster) — counts only, PHI-clean by construction — powering the fleet done-without-evidence watchdog.

Added

• New "Emails without a draft — and why" section on /admin/isabella-drafts: recent inbound emails with no suggested reply, each tagged with the reason (pending / clinical-urgent / routine / not-yet-classified / ineligible).
• Every reason is plain-language and privacy-safe — it references the email category only, never patient content.

Fixed

• Documents empty-state illustration moved from /admin/ (which the route guard redirects to login) to /brand/, so the image renders instead of 307-redirecting. Empty-charts-only; no behavior change.

Changed

• Patient Documents tab redesigned for clarity (visual-only — no behavior, data, or permission changes): a card header with the document count + single primary 'Attach records' action, scannable rows with aligned (tabular) sizes/dates, a hairline-separated and visually-subordinate Remove action so it's not confused with Open, and a framed 'Recently removed' undo panel with one-click Restore.
• New illustrated, reassuring empty state ('No documents on this chart yet') with a privacy-forward illustration and a clear single next step.
• Accessibility: removed two below-AA-contrast metadata colors, replaced Unicode arrow glyphs with a real chevron icon (with aria-expanded), and added decorative alt handling — all within the existing sage/navy brand palette.

Changed

• Document open/remove/restore now go through a patient-scoped route (/api/admin/patients/[id]/documents/[docId]) that verifies the document belongs to that patient before acting (§164.502(b) minimum-necessary). Replaces the flat /api/admin/documents/[id] route; the patient chart, appointment panel, and Today ID-photo strip were all repointed. View stays receptionist-and-up; remove/restore stay manager-and-up.

Fixed

• A document removed from a chart now also disappears from the appointment detail screen and the Today ID-photo strip — both were still showing soft-removed records because their queries didn't filter them out.

Added

• Editable DOB on the patient detail page (closes feedback cmqvr0y2): an 'Edit DOB' disclosure under the displayed DOB reuses the existing setPatientDob server action (ADMIN/MANAGER-gated, future-date rejected, validated). New PATIENT_DOB_EDITED audit action distinguishes correcting an existing DOB from filling a missing one — fact-of-change + adminId only, never the DOB value (§164.312(b)).

Added

• Documents tab: a "Recently removed" section (collapsed by default) lists soft-removed documents with a one-click Restore. Restore is MANAGER+ only and writes a RESTORE_DOCUMENT audit row (PHI-free), pairing with the remove trail. The retained file simply comes back onto the chart — no re-upload.
• Staff document upload: a magic-byte check now verifies a file labeled application/pdf actually begins with the PDF signature before it's stored. Image uploads were already content-validated (they're decoded/re-encoded on the way in); PDFs are the one type served inline, so this closes the gap with a clear 415 message instead of trusting the browser-reported type. (Defense-in-depth on top of the existing inline-viewer CSP.)

Changed

• Documents tab: "Delete" is now a soft-remove. Removing a document marks it off the chart and keeps the underlying file retained in secure storage (WA RCW 70.02 / WAC 246-919-085 require ~10-year medical-records retention; HIPAA §164.530(j) accountings). Previously the file + record were permanently erased on click, which was a records-retention exposure. The removal is still MANAGER+ only and still writes an audit row (now tagged mode=soft-delete, PHI-free).
• A removed document no longer opens by direct link (minimum-necessary, §164.502(b)) and no longer counts toward the chart's document total — it's retained for compliance, not casual re-viewing.
• Copy: the confirm dialog now reads "Remove document from chart?" and explains the file is retained, instead of the inaccurate "permanently removed from storage."

Added

• Opening a patient medical document now writes a VIEW_DOCUMENT audit row before the file is delivered (HIPAA §164.312(b) audit controls + §164.528 accounting-of-disclosures), pivoted to the patient so /admin/audit-log can show every read of that patient's records. Detail is metadata only — document id, type, size, uploader — never the filename or file contents.
• Documents tab now shows a "showing the 100 most recent of N records" note when a chart has more than 100 documents, so staff never silently miss older records past the list cap.

Fixed

• DELETE_DOCUMENT audit rows no longer store the raw filename (a filename like "MRI-brain-result.pdf" is itself a clinical-status disclosure under Safe Harbor §164.514(b)(2)). The delete trail now carries only PHI-free metadata, matching the upload side, and pivots resourceId to the patient.
• Booking-wizard medical-record claim is now atomic — a double-submitted or retried booking can no longer create duplicate charted records pointing at the same uploaded file (conditional claim on claimedAt before the MedicalDocument is created).

Fixed

• Leads list: the "Returning" and "Already a patient" pills now show on leads captured through the website Get-Started form and admin manual entry, not just Book-Now. The flags are computed when the lead is captured (fail-soft — a lookup hiccup never blocks the capture).
• Leads list: bounded the query so a large backlog (e.g. a bulk import writing many lead rows) can't make the page hang on load.
• Leads status: the "invalid status" error message is now built from the real status list — it had gone stale and omitted Qualified + Converted, which read like a bug.
• Leads status: "Converted" can no longer be set from the generic status dropdown — it must go through the Convert action, which creates the linked patient. This stops the funnel's Converted count from disagreeing with the actual converted-patient set.

Fixed

• Calendar: appointments scheduled before 8am or after 7pm were getting a negative position and rendering off-grid = invisible. They're now clamped into view with an amber ring + ⏰ marker and their real time still shown on the card.
• Calendar: the "now" line, the initial auto-scroll, and the today-column highlight were computed from the browser's local clock, so on any non-Pacific device they landed at the wrong hour. All three now use Pacific time, matching the appointment positions.
• Calendar API: the date window is now clamped (≤31 days) with a row ceiling, so an over-wide range can't blow the load budget and produce the intermittent "Couldn't load the calendar" blank screen.
• Appointment status: a finalized appointment (cancelled / completed / no-show) can no longer be flipped again — this stops a cancelled patient getting a "completed" cert email, and stops a re-cancel from re-opening a slot that's since been re-booked (double-booking). Same-status changes are a harmless no-op.
• HIPAA forensic-trail: viewing the calendar (which shows patient names) now writes an audit-log row like the appointments list already did — count + date window only, never patient identifiers. Closes the one PHI-read surface that had no audit trail.

Added

• idea-intake/recent verify endpoint now also returns watched — the configured M365 inbound mailbox addresses (from buildWatchedMailboxes) — so an operator can confirm the exact front-door address for the email-idea loop. Clinic mailbox addresses only, no PHI.

Added

• Junk-rescue for owner email-intake (IDEA_INTAKE_JUNK_RESCUE, default OFF): the inbound poll now also scans each watched mailbox's JunkEmail folder, cheap-filters to allowlisted-owner marker/[FB-] mail by sender+subject (no body fetch), and runs only those through an owner-hooks-only ingest path that can never patient-persist or auto-ack — so a spam-filtered idea/reply still gets captured. Candidates are marked read to dedup across polls.
• PHI-safe idea-intake observability endpoint GET /api/admin/idea-intake/recent (bearer CRON_SECRET, proxy-allowlisted): returns the last 25 captured ideas as metadata only (id prefix, project tag, owner sender, status, age, comment count) so a capture can be confirmed off-session without an in-tenant login. Never returns a title/body.

Fixed

• ReviewerFeedback re-surface safeguard (no migration): agent done-transition clears prior submitterRejectedAt/Note + re-arms the submitter confirm email (fresh token) via the M365 BAA path on a re-fix-after-reject; feedback-cleanup cron silently flips stuck done+rejected+unconfirmed rows back to open + clears the stamp, logging counts/ids only (no SMS, no PHI in logs).

Changed

• Idea-intake: [known-project] tag also triggers capture (not just the marker prefix). Audit: OWNER_IDEA_CAPTURED + OWNER_FEEDBACK_REPLY_RESOLVED rows (PHI-free) on every capture/resolve.

Added

• Instant idea-capture confirmation (with [FB-id] tag + replyTo to the watched mailbox); reply-to-resolve applies done/wontfix/approved or a comment to the tagged item. Allowlist + tag gated. Flags IDEA_INTAKE_ENABLED + FEEDBACK_REPLY_RESOLVE.

Added

• Owner idea-intake: marker-subject emails from Doug/Mariane become open ReviewerFeedback items; gated by IDEA_INTAKE_ENABLED (default off); captured before the patient pipeline so Isabella never auto-acks them.

Added

• Feedback-depth section in the doug-queue morning email; PHI-safe; gated by FEEDBACK_DEPTH_DIGEST (default off); SLA + back-and-forth thresholds tunable via env.

Fixed

• Email classifier rejects malformed confidence values; stale-test backlog drained 72 to ~12; changelog copy tightened.

Changed

• Isabella voice prompt trimmed ~496 chars of redundancy back under its growth tripwire; reach-a-human offer + crisis/compliance blocks fully preserved; live after the Retell sync. Refreshed 2 stale voice tests.

Added

• Five optional create-patient fields (ship OFF behind a switch): Preferred name, Middle name, a 'How they heard about us' pick-list, a Heroes-discount eligibility checkbox, and optional Gender + Pronouns. All optional and skippable; the form is unchanged until the switch is on.
• 'How they heard about us' is a fixed pick-list, not a free-text box — so a specific referring person or provider name can't accidentally get typed into the field.

Added

• Optional-email mode for the add-a-patient form (off by default). When on, a walk-in / call-in with no email can be created — you only need at least an email or a phone.
• A persistent 'No email on file' badge on the patient record, explaining that authorization emails and patient-portal sign-in are unavailable until an email is added.

Changed

• Reminders fall back to text message for a patient with no email on file (when they've agreed to texts) instead of failing.
• The 'Use & update contact' button on the duplicate prompt now passes the email/phone privately instead of putting them in the web address — they no longer appear in browser history, server logs, or the page address.

Fixed

• A provider is blocked from issuing an authorization to a patient with no email on file (the authorization is delivered by email, so we refuse rather than silently fail to deliver). Same shape as the existing date-of-birth block.

Changed

• Date of birth is optional when manually creating a patient (matches the lead-conversion flow). Blank DOB sets a 'DOB needed' badge; the provider-side authorization gate still requires DOB before issuing, so age verification is unchanged.
• Phone field auto-formats to (206) 555-1234 as you type and accepts any entry with at least 10 digits.
• Add-patient help text corrected: lists the real required fields (name, email, phone) and describes the warn-and-confirm duplicate prompt (email / phone / name / DOB) instead of the old 'unique email blocks' behavior.
• First-name field is focused on load; the duplicate validation toast was dropped where inline field errors already show.

Added

• 'Notes' field on the create-patient form for operational notes (clinical details go in the chart).
• 'Create & book' button — creates the patient, then opens the scheduler with them pre-filled.
• 'Use & update contact' on the possible-duplicate prompt — carries the just-typed email/phone onto an existing returning patient's record for review and save.

Changed

• Patient-email and text draft guidance is action-oriented: lead with booking, the exact records next-step, or payment, with one warm acknowledgment line. Human-reviewed before send; compliance guardrails unchanged.

Added

• 💵 **Deposit-then-balance booking model (ships DARK).** A $50 deposit at booking confirms the appointment; the balance (visit fee − deposit) is collected day-of via the existing in-portal card checkout, a balance link, or staff mark-paid. The booking pay-link is minted for the deposit amount (server-recomputed, never client-trusted) when the deposit model is on and the visit is in scope. Behind a new OFF-by-default switch (BOOKING_DEPOSIT_ENABLED), layered on the existing pay-to-confirm flow. Telehealth-only by default (one config switch widens it to in-person later). When OFF, booking is byte-identical to today. (booking)(payments)
• 🔒 **Authorization releases ONLY when paid in full.** The deposit alone does NOT send the medical authorization — the existing payment gate already holds until the collected amount covers the full visit fee, and the deposit model relies on exactly that. The day-of balance payment adds to the collected total and triggers the release. (payments)(safety)
• 🏷️ **'Deposit paid · balance due $X' status label** on the today board and the patient chart (and any surface using the shared payment pill), distinct from 'Paid' in full. PHI-free — a dollar balance only, no patient identity. (admin)(payments)

Changed

• 📞 **Isabella Wave-1 patient-experience prompt** — offer-a-human early + warm (in the opening disclosure, framed as a relaxed choice, not a fallback), a frustration/confusion trigger that hands off to a callback instead of looping, booking-first reordering for new patients (capture preferred time BEFORE the records/ID logistics), and a softened self-handling tone throughout. The crisis script + identity/legal-advice blocks + the never-promise-a-transfer / never-promise-outcomes guardrails are preserved verbatim. Prompt size 28,891 chars (under the 29,000 cap). **DOES NOT reach the live phone line until the Retell prompt sync is run** — that step is human-gated (Doug action); no sync script was run as part of this ship. (isabella)(voice)(patient-experience)

Fixed

• 🖊️ **Signing now issues the authorization (CRITICAL).** /api/provider/encounters/[id]/sign used to lock the SOAP note but never call the cert-issue pipeline — that fired only from /api/admin/appointments/approve (an admin surface). With no admin on staff, providers signed and no authorization was ever generated or sent. The sign route now runs the SAME unified issuance after the note locks (mirrors /api/provider/action), PRESERVING every gate: the auth-payment gate (never issues/sends unpaid), provider-signature-on-file, and the DOB / ≥1-qualifying-condition / license gates inside issueCertForAppointmentUnified. Best-effort relative to the lock (the note-lock is the load-bearing legal write and is never undone by a downstream send failure); the PHI-free outcome (issued / held-pending-payment / skipped-why) is surfaced on the chart. Idempotent — re-signing an issued visit is a no-op. (provider)(hipaa)(authorization)
• 🗂️ **Patient's uploaded records + WA-ID now open from the chart — flag-independent.** The only viewer for PatientUploadedRecord rows (patient-uploaded outside records AND the WA-ID photo) was the dark AI records-reviewer, which 404s when the AI flags are off (their default) — so providers couldn't open a patient's records or ID at all. Added a basic non-AI list on the encounter chart + a new cookie-authed stream route /api/provider/encounters/[id]/records/[recordId] that scopes to the encounter's patient (scan-clean, not-superseded, minimum-necessary), audits VIEW_PATIENT before any bytes, and streams the private blob server-side (no redirect to a signed URL). (provider)(hipaa)(records)(min-necessary)
• ✅ **Always-visible pre-sign readiness checklist.** The existing pre-issue checklist was gated behind PROVIDER_CLINICAL_ASSIST_ENABLED (default OFF), so a provider never saw WHY a visit couldn't complete. Added a generic, flag-independent checklist on the chart mapping the REAL issuance gates (patient DOB on file, ≥1 qualifying condition, provider signature on file, visit paid). Courtesy mirror only — the server re-checks at sign/issue. The WA-law counsel-gated stubs stay in the AI-flag-gated checklist, unchanged. (provider)(hipaa)
• 💳 **Payment status accurate on the chart.** The encounter chart already selected stripePaymentId/poyntInvoiceId for the PaymentBadge; verified the provider appointment surfaces feed the badge correctly (portal home loads full appointment rows via include). No badge now renders blank/Unpaid for a paid visit. (provider)

Added

• 🗂️ **Records-Recency Monitor — Phase 1 (default-OFF behind RECORDS_RECENCY_MONITOR_ENABLED; configurable window RECORDS_RECENCY_MONTHS, default 24).** Extends the EXISTING readiness substrate, no rebuild. New recency dimension in src/lib/appointment-readiness.ts (deriveRecordsRecencyStatus → 🔴 NEEDS / ✅ CURRENT / 🟡 EXEMPT) computed from a MEDICAL_RECORD uploadedAt within the configured window (a documented v1 proxy for the record's clinical date — Phase 2 adds the AI recordDateText). Pure helpers + the flag/window readers live in src/lib/records-validity-shared.ts. EXEMPT reuses the existing RecordsValidityDecision + Patient.recordsValidThrough — NO new flag, NO new column, NO migration. (records-monitor)(dark)(hipaa)(min-necessary)
• 📋 **Staff worklist /admin/patients/records-needed** (role-gated ADMIN/MANAGER/SCHEDULER, force-dynamic, noindex). Lists UPCOMING (SCHEDULED/CONFIRMED, future) appointments whose patient is 🔴 NEEDS, soonest-first, via src/lib/records-needed-worklist.ts. Patient label = first name + last INITIAL only; EXEMPT + CURRENT patients are filtered OUT at the DB query (never materialized). Per row: **Send records request** (reuses the BAA-fail-closed /send-records-link rail → M365 Graph) and **Mark chronic-exempt** (reason REQUIRED). Render audits VIEW_RECORDS_NEEDED as a COUNT only — never an identifier. (records-monitor)(admin)(hipaa)
• 🩺 **Staff chronic-exempt write path POST /api/admin/patients/[id]/records-exempt** — writes a RecordsValidityDecision (CHRONIC_CONDITION / STABLE_DIAGNOSIS / TERMINAL) + refreshes the recordsValidThrough cache, dropping the patient off the worklist + the recency reminder. Required reason is stored provider-PRIVATE (reasonNote) and is NEVER logged/echoed/audited; audit RECORDS_EXEMPT_SET_BY_STAFF carries reasonCode enum + duration + actor only. ⚠️ The decision table was designed PROVIDER-set; STAFF-set is Doug's explicit Phase-1 call — actor is recorded honestly as the staff user under a distinct audit action (Doug-greenlight noted in the route header). Route is inert (404) until the monitor flag is on. (records-monitor)(hipaa)(doug-greenlight)

Changed

• 🔔 **Reminder cron now reflects the RECENCY standard when the monitor is on.** /api/cron/reminders overrides the 'recent medical records' readiness item to the 24-month recency check (chronic-EXEMPT patients treated as satisfied) ONLY when RECORDS_RECENCY_MONITOR_ENABLED=true; when OFF (default) the existing presence-only behavior is byte-identical. A recency-derive failure falls through to the presence-only flag — the reminder is NEVER blocked, and booking/confirmation is never gated anywhere. Reuses the existing M365 BAA prompt rail (no new sender). Patient-facing copy unchanged ('your recent medical records'). (records-monitor)(cron)(never-block)

Changed

• 📇 **Demi's Today queue — full patient contact inline (Doug-requested; flag-gated, SHIPPED DARK / default OFF).** Each 'Callbacks owed' row can render the patient's UNMASKED phone (as a tel: link) and email (as a mailto: link) on its own line, instead of the masked phone only. Because this widens PHI display, it ships INERT — set DEMI_FULL_CONTACT=true to turn it on (one env flip, NO deploy); anything else keeps the existing masked-phone-only view. This is the SAME contact data Demi already reaches via the 'Open →' deep-link — surfacing it inline is minimum-necessary for the front-desk callback task, not a new disclosure path. getDemiCallbacks now also selects Patient.email (linked patients only; unlinked-sender rows never surface an unverified email). Message subject/body previews remain PHI-scrubbed via scrubPhiForSmsOutbound (free-text is NEVER un-scrubbed). Role gate (ADMIN/MANAGER/SCHEDULER), force-dynamic, and noindex are unchanged. (front-desk)(demi)(phi-display)
• 🧾 **VIEW_DEMI_TODAY audit now records the full-contact disclosure shape — as a COUNT, never identifiers.** buildDemiTodayAuditDetail appends fullContact=on rendered=phone:N,email:M so a reviewer can answer 'when was unmasked patient contact rendered on Demi's queue, by whom' from the actor + timestamp + counts alone. The detail string still carries ZERO patient identifiers (no phone, no email, no name). §164.312(b) metadata-only invariant preserved. (audit)(hipaa)

Added

• 📠 **Inbound fax — Documo (mFax) provider path (default-OFF, BAA-gated, additive).** New src/lib/documo-fax.ts + a provider switch in /api/inbound/fax. INBOUND_FAX_PROVIDER=documo routes inbound faxes through Documo; unset/ringcentral keeps the existing RingCentral behavior verbatim (nothing changes by default). The Documo path normalizes Documo's fax.v1.inbound.complete webhook (messageId dedup key, faxCallerId sender ANI → LEAD_CAPTURED match, faxNumber our DID, pagesCount) into the SAME downstream pipeline the RC path uses — one dedup, one sender-match, one DB persist. Idempotent on messageId (Documo retries up to 7×); a blank faxCallerId fail-softs to the manual/unmatched path and never crashes. **The ENTIRE Documo path stays fail-closed behind INBOUND_FAX_BAA_OK exactly like RingCentral** — it ACKs 200 (no retry storm), audits the gated arrival PHI-free (message id only, no content fetched), and persists NOTHING until the fax provider's BAA is executed and Doug sets INBOUND_FAX_BAA_OK=true. Optional x-documo-signature HMAC verification (DOCUMO_WEBHOOK_SECRET); the load-bearing PHI guard is the BAA env-gate, not the signature. No schema change (Documo's messageId reuses the existing provider-agnostic dedup column — expand-only). ⚠️ The exact Documo download-PDF endpoint + auth scheme could not be confirmed against live docs (JS-rendered site, no public OpenAPI) and are ISOLATED in two clearly-commented functions for a one-line correction before go-live. (inbound-fax)(documo)(hipaa)(baa-gated)(dark)

Added

• 🤖 **Isabella exemplar AI auto-curator (default-OFF, HIPAA RED-lane).** New /api/cron/isabella-exemplar-autocurate cron + src/lib/isabella-exemplar-autocurate.ts (server) + src/lib/isabella-exemplar-autocurate-shared.ts (pure-fn verdict state machine, pin-tested). A BAA-Bedrock JUDGE (the SAME getExtractorModel() Bedrock handle the ingest scrubber uses — no non-Bedrock judge) scores each pending-review exemplar on three 0–1 dimensions (generalizable / PHI-clean+faithful / voice-policy) over ONLY the scrubbed summaries + closed enums. Verdict ladder: **auto-approve** only if min(all 3) ≥ 0.85 AND canary-clean AND not a fallback/terse row; **reject** (fail-closed, never escalate) on any scanBodyForPhiCanary trip or a PHI-faithfulness failure; **escalate** (leave pending for a human) everything uncertain. [isabella][hipaa][bedrock][autocurate]
• 🧱 **Anti-RSI self-loop firewall.** The eligible-row query is status=pending-review AND reviewedByUserId IS NULL, which structurally excludes the curator's own future approvals (it stamps reviewedByUserId="isabella-autocurator"), hand-authored seeds, and any human-touched row — so it can never re-judge or re-feed its own outputs. [isabella][governance]
• ↩️ **P0 reversibility UI on /admin/isabella-playbook.** New 'Approved' tab lists approved+edited exemplars (flagging AI-auto-approved ones) with an **Un-approve** button → sends the row back to pending-review (human-attributed, audited). This is the human override of any auto-approval — an AI-curates-AI surface must be reversible-by-UI. [isabella][admin][governance]
• 📧 **PHI-free digest + audit.** Every auto-approval/escalate/reject emits one ISABELLA_EXEMPLAR_CURATED audit row (actor=autocurator, enum/cuid/reason-code only — never a summary). A PHI-free counts digest goes out via the OWNER_ALERT_EMAIL → ADMIN_NOTIFY_EMAIL rail. ?dryRun=1 runs the full judge pass and returns the per-row verdict table while persisting NOTHING (ignores the flag — for the eyeball-before-flip review). [isabella][audit][hipaa]

Added

• 🛡️ **Isabella behavioral abstention eval gate (RED-lane HIPAA).** Model-in-the-loop adversarial eval (scripts/isabella-abstention-eval.mjs + src/lib/__tests__/isabella-abstention-eval.fixtures.ts) runs the 15 designed cases from ISABELLA_PROMPT_AUDIT_2026_06_25.md §4 against Isabella's real assembled VOICE prompt and uses a **Bedrock-judged rubric** (BAA-covered us.anthropic.claude-sonnet-4-6, account 004730170375) to assert she behaviorally REFUSES-and-ROUTES — not merely that the clause text is present. Includes the two counter-pins: crisis must NOT collapse into take-a-message (988 must surface) and volunteered DOB/SSN must be minimized (never echoed). Caller lines are sent as untrusted role:"user" turns, never interpolated into the system prompt (preserves the injection-fence). Reports are PHI-scrubbed before write. An --adversarial mode appends the worst-case poisoned learned-call-playbook below the prompt to prove the safety floor holds under a drifted learning loop. **VOICE_PROMPT itself is unchanged** — additive test infra only. [isabella][voice][hipaa][bedrock][abstention][eval]
• 🔒 **Pre-sync gate wired into scripts/sync-retell-prompt.mjs.** A non-dry-run push to the LIVE Retell agent now runs the abstention eval first and is BLOCKED on any failure. The only bypass is SYNC_SKIP_ABSTENTION_EVAL=1, which is logged to scripts/.retell-sync-override.log and routes through compliance-guard. This converts Isabella's already-strong abstention text into a proven, gated behavior on the phone surface. [isabella][voice][retell][sync-gate][hipaa]

Added

• 💳 **/pay page: statement-descriptor disclosure.** Added "This charge appears as **Green Health Solutions LLC** on your statement" to the payment page's card-handling note (Doug-confirmed entity). Prevents unrecognized-charge confusion/chargebacks when the card-statement merchant name differs from the Green Wellness brand. [payments][collect][copy]

Fixed

• 💳 **/pay page: corrected stale card-handling copy for the in-portal Collect flow.** The static reassurance line read "You'll pay on our card processor's secure, encrypted page" — future-tense + implied an external redirect (still showed even on the Payment-received success state). Reworded to the tense-neutral "Card details are entered on a secure, encrypted page and are never seen or stored by Green Wellness," matching the in-portal Collect checkout (no vendor name, no redirect implication). [payments][collect][copy]

Added

• 🧹 **Remove redundant In-Progress feedback (Mariane cmqej28ci).** Owner-only "Remove this item" control on In-Progress rows of /me/feedback — confirm step + optional reason → sets the row's status="cancelled" (soft cancel; the row is kept for audit, never hard-deleted). The cancelled row leaves the active list and drops off the agent loop (the queue puller only pulls open/agent-working). Owner-gated server action, idempotent, can't cancel an already-done/cancelled row. Writes a PHI-free FEEDBACK_CANCELLED audit row (from→to + reason supplied|none + actor — never the free-text reason). [feedback][me][audit]

Changed

• 💳 **Collect pay form: instant Pay-button feedback.** The button now flips to charging/"Processing…" synchronously on click, before the SDK's getNonce tokenization latency — previously the click felt unresponsive because the status only changed after the nonce came back. The SDK error handler still resets to ready on an invalid card, so it can't get stuck. [payments][collect][ux]

Changed

• 💳 **Collect pay form: dropped the processor name from the security line + hardened the Pay button.** Footer now reads "Bank-level encryption — your card is secured and never stored by Green Wellness" (no vendor name). Added a 3.5s mount-fallback that flips the form to ready if the SDK's ready event doesn't fire, so the Pay button can't stay permanently disabled; plus an inline hint when the cardholder last name is blank. No PAN-handling change (SAQ-A). [payments][poynt][collect][ux]

Fixed

• 💳 **Poynt Collect pay form: added editable cardholder First/Last name fields, prefilled from the patient account.** The form passed patientFirstName/patientLastName straight to the Poynt nonce with no UI; when the account's last name was empty/invalid (e.g. a single char) Poynt rejected the charge with "enter a valid last name" and the payer had no field to correct it. Now both names render as editable inputs (prefilled, autoComplete=cc-given-name/cc-family-name), the Pay button is disabled until a non-empty last name is present, and getNonce sends the trimmed values. No change to PAN handling (SAQ-A, card data still browser→Poynt only). [payments][poynt][collect]

Fixed

• 💵 **Stale renewal price in the booking wizard** — StepPayment.tsx deferred-payment panel hardcoded data.isReturning ? 140 : 175; the renewal price rose to $145 on 2026-06-10, so a returning patient saw $140 while every other surface (chat, voice, email, StepConfirmation) showed $145. Now reads PRICING.RETURNING_TELEHEALTH / PRICING.NEW_IN_PERSON from @/lib/constants (the same pattern StepConfirmation already uses) so the figure can never drift from the source of truth again. (scheduling)(billing)
• 🗓️ **New-patient wizard overpromised "You're booked."** — the final confirmation screen showed a confirmed-booking headline to every patient, contradicting the tentative-appointment-request framing voice/chat/email enforce (records review precedes confirmation for new patients). StepConfirmation.tsx now branches: new patient → "Request received." + an "our team reviews your records first, then confirms your visit" line; returning patient → unchanged "You're booked." (scheduling)(comms)
• 📱 **Booking-confirmation SMS overpromised the same way** — smsBookingConfirmation said "you're booked" with no new-vs-returning branch. Added a new-patient variant ("we've got your request… our team confirms after a quick records review"); wired appointment.isReturning through both call sites (cron SMS send + reschedule). Unknown/unset isReturning falls to the new-patient (no-overpromise) wording. Also converged the greeting to the warmer "Hi {name}, Green Wellness…" shape. (comms)(sms)

Added

• 💳 **Poynt Collect charge-path verification** — new GET /api/admin/diag/poynt-collect-verify (CRON_SECRET-gated) runs verifyCollectChargePath(): confirms the JWT bearer mints, the merchant store-id resolves (chargeCollectCard fails store-id-unresolved without it), and the services.poynt.net/businesses/{id}/cards/tokenize/charge route is ENTITLED (non-404 to a dummy body). All green = a real browser nonce will round-trip. CHARGES NOTHING. PHI-free. (payments)(poynt)(diag)
• 💳 **Real $1 charge-then-void round-trip** — POST .../poynt-collect-verify?charge=1 with a real Collect { nonce } performs a $1.00 SALE via the SAME chargeCollectCard path the live /pay flow uses, then immediately voids it via the new voidCollectCharge helper. Triple-guarded: requires ?charge=1 AND a nonce AND POYNT_COLLECT_VERIFY_ALLOW_CHARGE=true; hard-capped at $1.00; NEVER touches a patient appointment row (isolates the Poynt leg so a verification can't release a cert). Lets Doug prove a real card works before flipping the live switch. (payments)(poynt)(diag)
• 🔧 **voidCollectCharge(transactionId, amountCents)** in poynt.ts — voids/reverses a cards/tokenize/charge TRANSACTION (POST /transactions/{id}/voidOrReverse, falls back to /transactions/{id}/refund). The pre-existing refundInvoice only targets /paylinks/{id}/refund (invoices), which doesn't apply to a synchronous Collect charge. PHI-free; never throws. (payments)(poynt)

Changed

• No patient-facing change. POYNT_COLLECT_INPORTAL remains OFF — /pay continues to use the GoDaddy hosted-paylink redirect. The in-portal Collect checkout (CollectPaymentForm → chargeViaCollect → chargeCollectCard → mark-paid → releaseGatedAuthForAppointment, all shipped v2.97.ICB0009) is now LIVE-VERIFIABLE before go-live. (payments)

Added

• ✉️ **Auto-send the consent form on appointment creation for returning patients** (Mariane feedback: "Automatically Send Consent Form After Appointment Creation"). The appointment-onboarding path already auto-creates a NEW_PATIENT_PACKET (new patients) or a fresh INFORMED_CONSENT (returning patient + a provider they have no prior appointment with) and relies on the one-time portal-welcome email to surface it. But a returning patient who already received their portal-welcome got the new consent form silently dropped in the portal with NO notification. Now, when the welcome won't fire AND a new form was just created, we email the patient a direct /patient/forms/ magic-link via the same PHI-free buildFormLinkEmail body + bounce/unsubscribe-aware sendEmailToPatient rail (M365/Postmark/SES, never Resend) the staff "send consent form" action uses. Idempotent per (patient, form name) via a CONSENT_FORM CommunicationLog de-dupe so a second booking or a fire-and-forget re-run never double-sends; logged to the patient communication history (automated) + a PHI-free FORM_SENT_TO_PATIENT audit row. Dark by default — gated on APPT_AUTO_ONBOARDING_ENABLED, same as the portal-welcome auto-send. [forms][consent][onboarding][hipaa]

Changed

• 🗣️ **Isabella no longer volunteers or speaks a provider's name to a patient** (chat + voice). Added a durable guardrail sentence to both the chat SYSTEM_PROMPT and the VOICE_PROMPT ("Never volunteer or speak a provider's name to a patient; the team confirms the provider after booking"), and scrubbed the residual listOpenSlots prompt example that read "…with Dr Ari" → now "Tuesday March 14 at 2:00 PM". Closes Mariane feedback on provider-name leakage. Takes effect on the phone after the next Retell sync. [voice][chat][privacy]

Added

• 📸 **WA-ID upload opens the phone camera** — the ID-photo file input now carries capture="environment" so a phone goes straight to the rear camera; desktop / no-camera still falls back to the normal file picker. [intake][mobile]
• 🪪 **Advisory photo-ID detection on the WA-ID upload** (HIPAA minimum-necessary). After the existing compress/EXIF-strip, the upload runs through BAA-covered Bedrock (us-east-1) which answers ONLY "does this look like a government photo ID?" — a boolean + confidence bucket (+ a coarse doc-type guess). It NEVER reads or stores the ID number, DOB, name, or address. If it doesn't look like an ID the wizard prompts a retake, but the upload always succeeds (never gates intake/booking). The result is persisted on the patient and surfaced on /admin/patients/id-review as a ✓/⚠ staff hint, plus a PHI-free PATIENT_ID_DETECTION audit row. Expand-only migration 100 adds nullable idDetected/idDetectionConfidence to PendingIntakeUpload + Patient. [intake][hipaa][bedrock][id-review]

Fixed

• 🩺 **Provider-chart canary no longer false-positives FAIL:sign=403 against the new CSRF enforcement.** The canary's sign-route liveness probe POSTed to /api/provider/encounters/[id]/sign with NO Origin/Referer, so the v2.97.CSRFCSP1 same-origin guard correctly 403'd it (it expected 401). That read as a sign-route OUTAGE and — critically — classifies as a genuineFail to the armed canary→rollback guard, a false alarm that could have rolled back a HEALTHY deploy. Fix: the probe now sends a same-origin Origin/Referer (this deployment's own host, which the guard's allowedHosts always includes), mirroring a real provider's browser → passes CSRF → asserts the real 401 auth-gate. Verified live: with Origin → 401, without → 403; real browsers always send Origin, so providers were never affected. [canary][csrf][hipaa][reliability]

Fixed

• fix(deps): pin undici ^6.27.0 via pnpm.overrides — closes HIGH advisory GHSA-35p6-xmwp-9g52 (WebSocket DoS) + 4 lesser undici CVEs arriving via @vercel/blob. Lockfile-only change; no app code altered.

Changed

• 🛡️ **CSRF same-origin guard flipped from log-only to ENFORCING (hard 403 on cross-origin cookie-authed mutations).** The proxy's same-origin Origin/Referer check on unsafe methods (POST/PUT/PATCH/DELETE) to /api/{admin,provider,patient,dispensary} now returns 403 instead of just logging [csrf] would-block. Safe to enforce: all first-party UI fetches are same-origin; the 46 Server Actions are already same-origin-gated by Next's built-in check; vendor webhooks + cron + bearer-allow + integrations + health are explicitly exempt. **Escape hatch:** CSRF_ENFORCE=false in Vercel env reverts to log-only with no redeploy. [security][csrf][hipaa]
• 🛡️ **/api/patient/:path* added to the proxy matcher — closes an unguarded patient-portal mutation surface.** The catch-all matcher's negative-lookahead excluded api/patient and there was no positive entry, so patient JSON mutation routes (profile PATCH, password change) never ran through the proxy → had NO edge CSRF check and NO identity-header strip. They were cookie+per-route-auth only. Now matched: they pass the CSRF same-origin guard, then fall through to the catch-all freshHeaders() identity-header strip. Patient auth routes stay same-origin POSTs from the login page (pass normally). [security][csrf][patient][hipaa]

Fixed

• 🛡️ **CSP nonce wiring repaired at the root — kills ~25k phantom Report-Only violations.** The strict protected-route CSP (nonce + 'strict-dynamic', Report-Only since v2.97.U-era) was firing script-src-elem blocked=/_next/static on EVERY admin/provider/patient page view (25,094 AuditLog rows, ongoing) because Next.js was never applying the nonce to its own bundle scripts. Per the Next 16 CSP guide, Next extracts the nonce by parsing the Content-Security-Policy header **on the REQUEST** during SSR — it does NOT read x-nonce and does NOT parse -Report-Only. The proxy was only setting x-nonce + the Report-Only response header, so Next's scripts went un-nonced. Fix: also set the strict CSP as Content-Security-Policy on the **request** headers passed to NextResponse.next({ request }). Response stays Report-Only (cannot white-screen). Also added the missing frame-src (RingCentral softphone + Stripe + Poynt iframes), full connect-src, and media-src to the strict policy so it stops reporting phantom frame-src blocked=/ and is now a FAITHFUL would-this-enforce-cleanly probe. **CSP remains Report-Only on protected routes — enforce flip is Doug-greenlight after a clean week of zero CSP_REPORT_ONLY_VIOLATION rows.** The lax-but-real enforced CSP in next.config.ts is unchanged and still protects every route. [security][csp][nonce][hipaa]

Added

• 📋 **Auto-create a new-provider consent for returning patients (Doug clinical rule 2026-06-24: renewals re-consent only with a NEW provider).** Extends fireAppointmentOnboarding (same APPT_AUTO_ONBOARDING_ENABLED flag, already on): on a RENEWAL booking, if the patient has no prior NON-CANCELLED appointment with that appointment's provider, it creates an INFORMED_CONSENT form (2-page consent + acknowledgement, no re-intake — distinct from the new-patient 5-page packet) at status SENT so they sign it IN the portal before the visit. Consent is per patient↔provider; "already consented" is proxied as "prior non-cancelled appt with this provider" — clinically sound + SELF-IDEMPOTENT (once the appt exists, rebooking the same provider skips, so no duplicate per provider). Best-effort: never throws, never blocks the booking. New patients still get the full packet; same-provider renewals unchanged. PHI-free audit (FORM_CREATED, mode only). Mirrors the hipaa-architect/Explore-blessed new-patient-packet pattern. [consent][onboarding][hipaa][provider]

Fixed

• 🩺 **ROOT CAUSE of the provider encounter-chart crashes (digest 3615476718) — a server/client boundary bug, NOT a transient blip.** The CHARTDIAG1 server-error capture shipped earlier today caught the real message: Attempted to call normalizeMedicationsJson() from the server but normalizeMedicationsJson is on the client. The cookie-port chart page (a Server Component) imported normalizeMedicationsJson + emptyMedicationRow + normalizeDastAnswers from MedicationReviewSection.tsx / DastTenSection.tsx — both "use client" modules — and CALLED them during server render. On a soft client-side navigation (RSC payload request, ?_rsc=) Next.js treats a client-module export as a reference, not a callable, and throws → the whole chart 500'd. On a hard page load it happened to execute, which is exactly why it looked intermittent (and why the transient-retry CHARTRETRY1/3 couldn't touch it — it's deterministic, not a connection error). **Fix:** extracted the pure, React-free helpers into non-client shared modules — medication-review-shared.ts + dast-ten-shared.ts — imported by BOTH the server page and the client components (which re-export them so every existing client/test import path keeps resolving). The server now calls plain functions, never client references. **Tests:** new chart-server-client-boundary.test.ts (7 pins: page imports helpers from -shared, does NOT import the runtime helpers from the "use client" components, shared modules carry no use client directive, + behavior). typecheck clean; the 35 encounter-detail anti-divergence pins still green. This is the genuine fix for today's chart-crash cluster; CHARTRETRY1/2/3 (transient retries) + CHARTDIAG1 (the capture that diagnosed this) remain as complementary hardening. PHI scope: zero (pure JSONB-shape normalizers, no patient data in logs). [hipaa][provider-chart][server-client-boundary][root-cause][version-letter:CHARTBOUNDARY1][cadence-override: live provider-facing chart crash, root cause via CHARTDIAG1 capture]

Added

• 🩺 **Submitted patient intake now shown on the provider encounter chart (Dr. Frisch request).** /provider/portal/encounters/[id] loads the IntakeForm for the appointment and renders a collapsible (open-by-default) "Patient intake" card under the identity card: chief complaint, qualifying conditions, symptom duration, current-cannabis-use + frequency, therapies tried, current medications, allergies, treating physician, surgical history, recent labs, prior-auth, and patient notes. Previously the intake only fed the SOAP *prefill* — it was never shown as a reviewable summary, so the provider couldn't see what the patient submitted before the visit. When no intake is on file the card says "not submitted yet" so the provider knows to chase it. Read is .catch-degraded (matches the chart's resilience pattern — a failure shows an unavailable note, never crashes the chart). PHI render is expected here (provider's authorized chart; chart-open audit already covers it). [provider][chart][intake][hipaa]

Fixed

• 🩺 **Provider chart crash — hardened the last unguarded primary read (live incident, digest 3615476718, enc=cmqsddx39…).** The /provider/portal/encounters/[id] page wrapped its *encounter* read in transient-DB retry (CHARTRETRY1/2) but the **db.provider.findUnique that runs immediately before it was still an unguarded await** — a transient Neon blip there (pool reset / acquire-timeout / server-closed connection) 500'd the WHOLE chart and bounced the clinician to Practice Fusion, even though the encounter row + every relation read back clean (structurally verified against prod for this enc). Wrapped that provider lookup in the same withTransientDbRetry (transient-only — deterministic errors still surface immediately so a real bug isn't masked). audit() already self-guards (ruled out); this was the remaining unguarded primary read on the chart. [provider][chart][reliability][hipaa][incident]

Added

• 🔬 **Server-error capture via Next.js onRequestError — turns an opaque crash digest into a diagnosable error class.** Two provider encounter-chart crashes today (digests 541975153 + 3615476718, different encounters) each read back with FULLY healthy data + succeeding queries on replay — so the cause was invisible from data alone. The reason: the only durable crash record was the client error-boundary's PROVIDER_PORTAL_CRASH AuditLog row, which carries name + digest ONLY; the real server-side error (Prisma class, connection-vs-data, which read failed, or a React serialization message) lived solely in ephemeral Vercel function logs that can't be queried after the fact. Added onRequestError to src/instrumentation.ts: it fires with the REAL server error for any request crash and writes a PHI-scrubbed row to AuditLog (action='SERVER_REQUEST_ERROR') keyed by the SAME numeric digest the alert carries — so the next occurrence is diagnosable from a psql query instead of an opaque digest. **PHI firewall:** scrubServerErrorMessage redacts quoted values + 3+ digit runs (DOB/phone/MRN/SSN) and caps at 140 chars (the error-class prefix only — same precedent as the chart's existing console diagnostic); Next.js control-flow signals (notFound/redirect/dynamic-server-usage) are skipped so normal navigation isn't logged as a crash; the whole capture is wrapped so diagnostics can never throw/recurse. Edge runtime is skipped (the Neon adapter is Node-only). NEW src/lib/__tests__/instrumentation-error-scrub.test.ts (9 pins: quoted/single-quoted/digit-run redaction, error-class-prefix + Prisma-code preservation, length cap, whitespace collapse, control-flow-digest skip vs numeric-digest capture). All 9 green; typecheck clean. [hipaa][observability][server-error-capture][phi-scrubbed][version-letter:CHARTDIAG1][cadence-override: 2nd live provider-chart crash today, data provably healthy both times — instrument to diagnose the real cause]

Changed

• 🧪 **Extracted the CHARTRETRY1 transient-retry into a unit-tested @/lib/db-transient-retry helper.** The bounded-retry engine + transient-error classifier that keep a momentary DB blip from 500'ing the provider encounter chart were inlined in provider/portal/encounters/[id]/page.tsx. Moved them to a reusable lib (isTransientDbError + withTransientDbRetry, retry-budget bounded, sleep injectable) so the behavior is locked by a real behavior test, not just a static-source pin. The page keeps a thin wrapper that owns its canonical [encounter-detail] diagnostic lines verbatim — zero behavior change to the chart. NEW src/lib/db-transient-retry.ts + src/lib/__tests__/db-transient-retry.test.ts (12 pins: classifier retries P1001/P1002/P1008/P1017/P2024 + init/panic + connection-reset messages ONLY, deterministic P2002/P2022/P2025/P2003 + validation + non-Error fail fast; control flow = first-try-once, retry-then-succeed, fail-fast-on-non-transient, bounded-then-rethrow, totalAttempts budget). All 12 green + the page's 35 anti-divergence pins still green. PHI scope: zero. [provider-chart-resilience][refactor][unit-tested][version-letter:CHARTRETRY2]

Fixed

• 🩺 **Provider encounter chart no longer 500s on a transient DB blip (digest 541975153, 2026-06-24).** The load-bearing encounter.findFirst on /provider/portal/encounters/[id] was the last unguarded read on the chart — every secondary read was already .catch-degraded in the ARI0003/ARI0004 resilience work, but a *momentary* Neon connection failure (pooled-connection reset · pool-acquire timeout · server-closed connection) on the primary read still crashed the whole chart and sent the clinician back to Practice Fusion. Diagnosis confirmed the crashing row + every relation read back clean against prod, so this was a single transient throw, not a data bug. Wrapped the primary read in a bounded retry (loadEncounterWithTransientRetry — 2 retries, 150ms/400ms backoff) that fires ONLY on connection/pool-class errors (Prisma P1001/P1002/P1008/P1017/P2024 + init/panic + connection-reset message class) — never on deterministic query/validation errors, which still surface immediately so a real bug isn't masked. A genuinely persistent failure still reaches provider/error.tsx and notFound() still fires on a real miss; the canonical [encounter-detail] primary encounter load threw diagnostic log line is preserved verbatim. PHI scope: ZERO — retry classifier logs error name + Prisma code only, never row data. [hipaa][provider-chart-resilience][transient-retry][version-letter:CHARTRETRY1][cadence-override: live provider-facing chart crash]

Added

• 📅 **Date-range selector on /admin/analytics (30d · 90d · 1 year · all-time).** Added a ?window= switch; getSiteAnalytics now takes windowDays: number | null (null = all-time, omits the createdAt filter) and windows BOTH the lead aggregates (new leads, top sources, by-location) and the appointment aggregates so the whole page reflects the chosen range. Open-lead total stays an all-time snapshot. Trend vs prior period only shows for finite windows. Defaults to 30 days. [analytics][admin]

Added

• 📊 **/admin/analytics now shows first-party practice funnel analytics (replaces the GA4 hand-off).** New src/lib/site-analytics.ts (getSiteAnalytics) aggregates the Lead + Appointment tables — counts only, no PHI, no Google Analytics tag — into: new leads + open-lead total + booked-from-a-lead conversion; top lead sources (all-time) + leads by preferred location; appointments booked/completed, new vs renewal, telehealth vs in-person, by-status, and revenue collected (28-day window). All inside the Neon BAA boundary; degrades to a soft banner on DB error. Raw web traffic stays in Vercel Web Analytics (hand-off card retained). Verified against prod: 13,174 open leads, top source GW Website (3,402), 44 appts booked / $740 collected last 28d. [analytics][hipaa][admin][leads][appointments]

Changed

• 📊 **/admin/analytics repointed off GA4 → Vercel Web Analytics hand-off.** Removed the Google Analytics Data-API dashboard (it was structurally empty: the site carries no gtag/GA4 tag by the 2026-05-28 HIPAA ruling — Google signs no BAA for Analytics — so the property has 0 sessions). The page now renders an admin-gated hand-off to the Vercel Web Analytics dashboard (privacy-first, cookieless, no PHI, BAA-covered in-stack) for greenwellness.org, plus a plain-language "why not Google Analytics" note. GA4 Data-API helpers (src/lib/ga4.ts) + the now-unused GA4_OAUTH_* prod env vars left in place but unreferenced. hipaa-architect-reviewed: do NOT install a GA4 tag on this HIPAA site. For staff-visible in-app numbers later, the path is a first-party events table inside the Neon BAA, not GA4. [analytics][hipaa][admin]

Changed

• 📧 **Patient list flags placeholder (@unresolved.local) emails.** /admin/patients now renders an amber “No email on file” badge (via isPlaceholderEmail) instead of the raw synthetic address, so staff can see which imported records need a real email. No send-behavior change — sendEmail()/sendEmailToPatient() already hard-block placeholder addresses (~20.9k rows) so none of these ever bounce. Visibility half of Mariane's “Patient Email Mapping / Salesforce Import” feedback (the SF field-mapping review is the remaining, data-side half). [feedback][leads][deliverability]

Fixed

• 📨 **Isabella Draft Replies — 'Open Conversation' now deep-links to the exact email thread (cmqq0zjls / Mariane).** getPendingDrafts() in src/lib/isabella-draft-queue.ts built conversationHref as /admin/patients/ (linked patient) or /admin/messages (unlinked sender) — neither lands on the specific thread the draft was written for. Now: linked patient → /admin/patients/#communication so PatientTabs opens directly on the Messages tab (the #communication hash is the existing convention already used by the callbacks-owed-digest deep-link); unlinked sender → /admin/messages/email/ so the staffer lands on the per-thread audit view for that specific conversation (the page already falls back to id-match when threadId is null, so a message with no threadId still resolves). Selected threadId from the message row to support the unlinked case. Behavioral fix only — no PHI surface change, no schema change, no new API. ✨ Auto-fixed by Claude. [admin][isabella-drafts][routing][cmqq0zjls]

Fixed

• 🔧 **Renewals re-engagement + win-back tail-throw eliminated (live since ~6/13).** /api/cron/renewals ran a 90-day re-engagement query with a Prisma-7.8 nested-relation filter (where: { ..., patient: { emailUnsubscribed: false } }) — the same shape Prisma 7.8 throws on SYNCHRONOUSLY (CHARTFIX2 class), before a promise exists, so the per-query .catch() never runs and the throw escaped, aborting the rest of the route (re-engagement + win-back sends + the final heartbeat) every night. Rewrote the re-engagement query to a scalar where + in-memory emailUnsubscribed filter. Defense-in-depth: each post-stage block (escalation / re-engagement / win-back) now runs in its OWN try/catch so a single block throwing can never abort the whole route or suppress the final actor=renewals result=... heartbeat. The win-back query itself was already scalar (db.patient direct, emailUnsubscribed is a column) — it never threw; it just never got reached. The daily stage reminders (21/14/7/0d) were never affected. [cron][renewals][prisma][reliability][hipaa]
• 🩺 **Health-check cron staleness now reflects last-FIRED, not just last-completed.** /api/health matched cron staleness on detail startsWith 'actor= ' (trailing space) — which only matches the POST-compute result= heartbeat. A cron that tail-throws or benignly early-returns (fires but never reaches its result= line) showed falsely 'stale' even though it ran today (why doh-nudge / waitlist looked broken when they were fine). Now takes the most recent of BOTH the pre-compute fire (actor=, written right after auth) AND the post-compute result (actor= result=...). Matches both shapes explicitly so a prefix actor (reminders) can't match a longer one (reminders-2h). Canary fallback preserved. [health][monitoring][observability]
• 🧹 **Prisma-7.8 nested-relation sweep — same crash class fixed in 5 more crons + the chart med/allergy panel.** Converted nested-relation-in-where filters to scalar + in-memory filtering (behavior identical) in: doh-nudge, intake-reminder, reminders-2h, new-patient-drip (Day 3 + Day 14), and review-request — each fetched candidates with a patient: {...} (and in some cases workflowEvents: { none } / intakeForm: null) relation filter that can sync-throw and silently kill the send. Also fixed src/lib/ddi-shadow-source.ts (the SoapEditor medication + allergy reader, exact CHARTFIX2 intakeForm + appointment-relation where/orderBy shape) and src/lib/renewal-pipeline.ts assessAndMarkDoctorReady (its intakeForm.count({ where: { appointment: { patientId } } }) was caught by an outer try/catch but silently zeroed the doctor-ready signal). All use the proven flat two-step (scalar appointment ids → intake by appointmentId in). [cron][prisma][reliability][hipaa][sweep]

Changed

• 🛡️ **CSRF same-origin guard on cookie-authed PHI mutations (security batch #1, LOG-ONLY).** src/proxy.ts now checks Origin/Referer on POST/PUT/PATCH/DELETE to /api/{admin,provider,patient,dispensary} against a host allowlist; cross-origin → logged as [csrf] would-block. Exempts vendor webhooks, cron/bearer routes, integrations, health; Next.js's built-in Server-Action origin check covers page-POST actions (out of scope here). Edge-safe. Default = log-only; flip CSRF_ENFORCE=true to hard-403 after observing zero false-positives (report-then-enforce, same discipline as CSP). security-auditor reviewed: clean, bypass-resistant (Origin/Referer are browser-forbidden headers), false-block risk low. [security][csrf][hipaa][log-only]

Changed

• ⚖️ **WA telehealth FAQ corrected to match our licensed model + legal research.** /qualify/washington FAQ 'Can I do the whole thing online?' said the evaluation can be done by telehealth — contradicting GW's rule (RESEARCH_INITIAL_VISIT_IN_PERSON + Mariane 2026-05-15: new-patient first eval is in-person at Lynnwood; telehealth is renewals-only for returning patients). Rewrote the answer to state new=in-person / renewal=telehealth / card issued in person. Removes a self-authored public-page contradiction (regulatory exposure). [regulatory][wa][green-zone][claim-accuracy]
• 🟢 **Isabella stale-warm-transfer SLA auto-ack ARMED** (ISABELLA_STALE_TRANSFER_SLA_ENABLED=true). Built-but-off since IRC0012; now on. When a warm-transfer to a human passes the business-hours SLA (default 4h), Isabella auto-sends the patient a generic no-PHI acknowledgement on their consented rail (M365 email / SMS-if-consented), forward-only (no retro-blast of the historical backlog), idempotent, per-fire cap 25, PHI-free audit. Closes patients-waiting-in-silence. [isabella][sla][armed][hipaa][consent-gated]

Changed

• 🔒 **Runtime BAA kill-switch on the inbound-fax line (expert-sweep P0).** /api/inbound/fax now fail-closes while RingCentral is BAA-pending: after auth + confirming a real inbound fax, if INBOUND_FAX_BAA_OK !== "true" it writes a PHI-free INBOUND_FAX_RECEIVED detail=baa_gated audit row, returns 200 (so RC doesn't retry), and does NOT fetch content or persist. Default (env unset) = gated. This stops a reportable §164 disclosure (storing full medical records with a vendor under no signed BAA) — the build-time vendor-baa gate only warned; this is runtime enforcement. Flip the env true the day the RC BAA executes. hipaa-architect reviewed: fail-closed + PHI-free confirmed. [hipaa][baa][fax][p0][fail-closed]
• ✍️ **Appointment + renewal SMS now greet by first name.** smsReminder() + smsRenewalReminder() already received firstName but dropped it from the message body; both now lead with Hi , (guarded — omitted if name is blank). [sms][comms][personalization]
• 🟢 **Green-zone fix: removed an implied-guarantee homepage claim.** The 'Same-Day Authorization / walk in and walk out authorized' trust card read as a guaranteed approval + dispensary steer. Now 'Same-Day Appointments / most patients are seen same-day — your provider independently reviews your records and makes the authorization decision.' [seo][green-zone][claim-compliance]

Added

• 📎 **Provider medical-records upload (closes the provider leg of cmqixd28q).** New POST /api/provider/documents — a provider attaches a record to a patient, scoped (HIPAA minimum-necessary) to an appointment they own (appointment.providerId === provider.id); the patient is derived from that appointment, so a provider can't reach a patient they aren't scheduled with. Dual-auth (legacy ?token= + new provider_session cookie) mirroring the existing provider document-download route. Same private-Blob + compress/EXIF-strip + 25MB + MIME-allowlist pipeline as the staff route (ADU0001), uploadedBy="provider". New PHI-free audit literal PROVIDER_DOCUMENT_UPLOADED (provider name + appt id + mime/size only — never filename/blobURL/patient identity). The admin patient Documents list now labels uploads **Patient / Provider / Admin** correctly (was Patient/Admin only). NO schema change (docType metadata = separate fast-follow). NO provider-portal upload button yet (next step). [provider][documents][hipaa][cmqixd28q]

Changed

• 🔏 **Privacy Notice + About: vendor/BAA disclosures corrected to match our actual signed BAAs (BAA_STATUS source of truth).** The /privacy "Third-Party Service Providers" list previously claimed signed BAAs with Resend, Salesforce, Stripe, and Twilio — none of which currently hold a signed GW BAA for PHI (Resend + analytics are code-gated OUT of the PHI path; Salesforce is decommissioning; Stripe/Twilio are pending) — and omitted vendors we DO use under signed BAAs. Replaced with the accurate set: Microsoft 365 (email), AWS Bedrock (AI), Vercel (hosting/storage), Neon (database), Doxy.me (telehealth video), Retell AI (voicemail), Practice Fusion/Veradigm (EHR). Softened the absolute "we have signed BAAs with all vendors" claim on both /privacy and /about to the defensible policy statement ("we require a signed BAA before authorizing any vendor to handle PHI"). Fixed an "above/below" cross-reference. Patient-facing legal accuracy fix; no behavior change. [privacy][hipaa][baa][compliance-copy]

Changed

• 📍 **Booking form clinic list now matches Isabella by patient class (cmqell76a / Mariane).** /api/locations accepts an optional ?appointmentClass=NEW|RENEWAL and gates the returned clinics through the IDENTICAL getActiveLocations() + getAllowedProvidersAt() helpers in provider-location-rules.ts that drive Isabella's spoken clinic list (voice/chat/sms/email already share this single source of truth). Step3Appointment derives the class from isReturning (declared-new → NEW, declared-returning → RENEWAL, undeclared → unfiltered legacy list) and passes it; the per-class module cache is now keyed by class so a NEW-gated list never leaks to a RENEWAL patient. A clinic with zero providers for the class (e.g. Spokane for renewals, or any clinic after a provider sunset) drops out of the picker exactly as it drops out of Isabella's list, and an already-picked clinic that falls out of the gated set is auto-cleared. Unmapped locations stay visible (rule table governs only known GW clinics). No schema change. [booking][isabella-parity][locations][cmqell76a]

Removed

• 🧹 **Dropped the 'providers missing headshot' line from Launch Readiness (cmpnh3qve / Mariane).** Removed the noPhoto check + its 'they're hidden from the public providers section' row from the site-wide PreflightWarnings admin banner (rendered on /admin/launch). The per-provider readiness table on /admin/launch is unchanged. [admin][launch][cmpnh3qve]

Changed

• 🏷️ **Lead provenance pill on /admin/leads (G6 / Mariane).** Each lead's source= marker (already written into the LEAD_CAPTURED audit row by the route that created it) now renders as a pill: ✋ Manual (violet) for staff-created leads, ⬇ Imported (sky) for salesforce-import rows. Web captures stay unlabeled — they're the default + bulk of the queue, so a pill would be noise. Parsed via parseLeadDetail() in leads-shared.ts (new source field) so client + server read it identically. NOTE: the Salesforce backlog import (scripts/sf-import/import-recent-leads.ts) currently upserts into the separate Lead Prisma table, which /admin/leads does not read — for imported rows to appear here AND carry the pill, the import must also emit source=salesforce-import LEAD_CAPTURED audit rows (or the page must union the Lead table). That wiring rides with the import job itself. [leads][crm][provenance][g6]
• 📠 **Inbound-fax RingCentral subscription register script (G8).** New scripts/rc-register-fax-webhook.mjs wires the /api/inbound/fax webhook to the RC fax line in one command instead of hand-clicking the RC dev dashboard. Uses the DEDICATED .biz AT&T Office@Hand creds (GW_RC_* + GW_RC_JWT_GW) — separate from the SMS/voice .com script — with the type=Fax event filter + verification token. App end was already verified healthy (fail-closed 403, idempotent); this closes the 'fax not receiving' gap, which was simply that the subscription was never registered. Doug-step: set RC_WEBHOOK_VERIFICATION_TOKEN, run the script, send one test fax to the RC fax DID. [fax][ringcentral][g8][dev-script]

Changed

• ✍️ **Signature pad is now responsive (mobile overflow fixed).** SignaturePad was a fixed 480px wide and spilled off / clipped on phones (~70% of patient traffic is iOS Safari at ~360-390px). It now measures its container and sizes the canvas BUFFER to the available width (capped at 480) so pointer coordinates still map 1:1 — the ink lands exactly where the finger touches at any width. Re-measure freezes once signing starts, so a mid-form rotate never wipes a signature. Benefits all 4 patient forms (packet, ROI, informed-consent, ack). Reviewed clean (coordinate math + legal-capture integrity verified). [patient-forms][e-sign][mobile][a11y]
• 💾 **Auto-save status + failure surfacing on the New-Patient Packet.** The draft auto-save was fire-and-forget (void fetch) with no confirmation and no error handling — a failed save silently lost typed intake answers. Now shows a live Saving… / ✓ Saved pill and, on failure, ⚠ Couldn't save your last change — check your connection; it'll retry as you keep typing. Net §164.312(c)(1) integrity gain (silent clinical-data loss → visible, retryable). [patient-forms][reliability][hipaa]
• 📊 **Completion tracker + jump-to-incomplete + plain-English errors.** The long single-scroll packet now has a sticky progress bar (N of 10 required items done = 3 signatures + 7 initials) with a 'Take me to what's left →' button that smooth-scrolls to the first incomplete item (intake sig → consent sig → acknowledgement). Submit button shows the running count when disabled. Submit failures now read 'the connection timed out / a network problem' (never a raw HTTP code) and reassure the patient their answers are saved. [patient-forms][e-sign][ux]

Changed

• 📋 **New-patient packet auto-prepared in the portal on booking (G7 step 2 — Mariane cmq6203a7, Doug 'new→packet, retire-legacy').** fireAppointmentOnboarding now, for a NEW-patient appointment (appt.isNew), idempotently creates a NEW_PATIENT_PACKET PatientForm (status SENT, 7-day token) so intake + informed consent are waiting in the portal's 'Forms to review & sign' card. **No separate magic-link email** — the existing portal-welcome email is the single touch. Gated behind APPT_AUTO_ONBOARDING_ENABLED (already on). Idempotent (skips if a non-REVOKED/EXPIRED packet exists); PHI-free FORM_CREATED audit (mode=auto-onboarding-portal, no patient name — better than the admin path); system-sentinel createdById. Reviewed clean by hipaa-architect + Explore (the non-atomic find-then-create race is accepted: worst case is a benign duplicate shell, no PHI leak / consent gap). [hipaa][patient-portal][consent][onboarding][g7-step-2]
• 🧹 **Retired the legacy per-appointment intake nudge.** /my-appointments/[token] no longer shows the separate 'Complete your health intake form → /intake/[token]' amber prompt on each appointment — the single 'Forms to review & sign' card (PORTALFORMS1) is now the one signing surface, removing the duplicate path that caused the 'multiple forms' confusion. The /intake/[token] route itself stays live so any already-issued legacy links keep working. [patient-portal][forms][g7-step-2]

Added

• ✍️ **In-portal form signing surface (G7 step 1 — Mariane cmq6203a7).** /my-appointments/[token] now renders a 'Forms to review & sign' card listing the patient's pending PatientForm rows (status SENT/OPENED, live token) with a 'Review & sign' link to the existing /patient/forms/[accessToken] e-sign flow. Directly addresses the "seamless digital signing in the portal, not a downloaded PDF" ask. Query scoped to patient.id (the load-bearing fence); accessToken rendering mirrors /patient/portal/forms. Reviewed clean (PHI/auth/XSS). **Additive only** — no email is sent or suppressed by this change. [hipaa][patient-portal][forms][consent][g7-step-1]

Added

• 📎 **Staff document upload onto patient charts + appointments (ADU0001).** New POST /api/admin/patients/[id]/documents lets ADMIN/MANAGER/SCHEDULER attach a MedicalDocument (uploadedBy="admin", optional appointmentId) for records received by fax/email/in-person — closing the long-standing "Admins can attach files in future" placeholder on the patient DocumentsList and appointment DocumentsPanel. Mirrors the patient-portal + lead-documents pattern exactly: private Vercel Blob (BAA) + compress/EXIF-strip before put() + ADMIN_DOCUMENT_UPLOADED audit with PHI-free detail. appointmentId is ownership-checked against the patient (no cross-patient attach). GET/DELETE legs already live at /api/admin/documents/[id]. Closes reviewer-feedback cmqlrd4pf. [hipaa][phi][documents][admin]
• 🗂️ **Multi-file upload — lead documents panel + new staff attach.** LeadDocumentsPanel (and the new patient/appointment attach controls) now accept several files in one pick and upload them sequentially, respecting the server's 10-doc-per-lead cap (413 stops the batch) with a clear "N uploaded, then …" message on partial failure. Closes reviewer-feedback cmqlqmzu. [documents][ux]

Fixed

• 🩹 **PDF upload "there's an error" hardened across all three upload routes.** compressPatientUpload was called unguarded in the lead-documents, patient-portal-records, and (new) admin routes — a decode/compression throw on a corrupt or password-protected PDF (or a sharp image-decode failure) bubbled to an unhandled 500 that surfaced as a generic "there's an error." Now wrapped: returns a clean 422 with an actionable message ("it may be corrupt or password-protected — try re-saving/exporting it") and logs only the error name (no PHI). Closes reviewer-feedback cmqlrabth. [documents][reliability][hipaa]

Fixed

• 🩺 **Provider chart crash root cause (ARI0003/ARI0004 class) eliminated.** PriorContextRail (embedded on every encounter chart) loaded the latest allergy note with a Prisma nested-relation query — db.intakeForm.findFirst({ where: { appointment: { patientId } }, orderBy: { appointment: { startsAt } } }). Prisma 7.8 can throw on that shape **synchronously**, before a promise exists, so the per-query .catch() never runs and the throw escapes to crash the whole chart (doctors → Practice Fusion). Prior fixes (CHARTFIX1/ARI0004) wrapped the rail in a resilient boundary — a backstop, not a cure. This replaces the query with a flat two-step using only scalar where/orderBy (patient's appointments newest-first → their intake rows by appointmentId in → pick the newest), which Prisma can't choke on. Behavior identical (newest appointment's allergies); reviewed clean against schema. Provider-chart-canary continues to self-validate every 30 min. [provider-portal][chart][prisma][reliability][hipaa]

Changed

• 💬 **Renewal booking + portal records rail mirrored to chat / SMS / email.** The phone change (RENEWALBOOK1) now applies on every channel: each AI prompt (chat route.ts, sms-ai.ts, email-ai.ts) branches the booking-confirmation language on patient type. A RETURNING patient renewing who can get records in by the appointment is booked (office confirms exact time) with no records-review gate; the NEW-patient path keeps the tentative-request framing AND its pinned phrases ("tentative appointment request" / "provider must review" — still enforced by the channel-parity tests). All three now point patients to upload records in the patient portal (greenwellness.org → "Your records", the PORTALUPLOAD1 box) as the easy path, with fax/email as fallback. [isabella][chat][sms][email][records]

Added

• 📤 **Patient-portal records upload.** New session-authenticated endpoint /api/patient/records/upload + an upload box on /patient/portal/uploaded-records. A signed-in patient uploads a record → it stores to private Vercel Blob (BAA tenant), EXIF-stripped + compressed (same compressPatientUpload pipeline as the emailed-link path), writes a MedicalDocument row scoped to session.patientId only (no IDOR), and shows in their on-file list. 10 MB cap, per-patient fail-closed rate limit, orphan-cleanup on DB failure, PHI-free audit (PATIENT_PORTAL_DOCUMENT_UPLOADED). Reviewed by hipaa-architect (compliant) + security-auditor. This is the path Isabella points renewals to. [patient-portal][records][hipaa]

Fixed

• 🛡️ **Stored-XSS hardening on document viewers (security-review finding).** Uploaded records are served by 4 routes (patient /api/patient/documents/[id], provider /api/provider/documents/[id], admin /api/admin/documents/[id], and the records-review source viewer). They served the stored MIME inline, so a malicious SVG (image/svg+xml) with an embedded