Changelog

Added

• ☎️ **Softphone interactive own-login mode (RCOWNLOGIN1), dark.** RingCentral ties an app to ONE auth method (JWT xor 3-legged OAuth — verified live 8/1), so the shared-JWT softphone app can never also do interactive Sign-In; per-user login rides a SEPARATE OAuth-configured RC app. New env RC_OWN_LOGIN_EMAILS (comma-sep AdminUser.email logins — Mary = belaluna44@gmail.com, same key-footgun as RC_STAFF_JWTS): for a listed caller /api/admin/rc/auth-token returns ownLoginMode:true and vends NO credential at all (jwt:null, token:null — the long-lived shared JWT stops travelling to that browser, a strict HIPAA-posture improvement), audited via new bounded action RC_OWN_LOGIN_MODE_SERVED. RcSoftphone then mounts the Embeddable iframe on NEXT_PUBLIC_RC_OWNLOGIN_CLIENT_ID (same .biz appServer, no &jwt=, pin-tested) so RingCentral's own Sign-In appears and the staffer lands on THEIR extension; widget persists its tokens in iframe storage across reloads. Composes with PHONEHEAL1 (auto-remount reuses own-login mode, never jwt-falls-back), SPFTLEADER (leader-election unchanged) and RCLINEVIS1 ('☎ Your line' shows). Half-configured-deploy guard on BOTH sides (server env check + client forceShared refetch) so a missing clientId falls back to the shared JWT instead of dead-ending the phone. The JWT-mode 'no password needed' copy is gated off in own-login mode. Non-listed staff: byte-identical to today. PHI-free (auth plumbing only); 16 new pin tests. [front-desk][softphone][reliability]

Added

• ☎️ **Softphone line-visibility indicator (RCLINEVIS1).** The per-staff RC-JWT path (PERSTAFFRC1) fails SAFE to the shared login, but that fallback was only observable in fresh-mint RC_AUTH_TOKEN_MINTED audit rows — cache hits are unaudited and the response omitted the flag, so a staffer whose personal JWT broke would silently drop back to shared-line contention. /api/admin/rc/auth-token now returns ownLogin + perStaffEnabled on BOTH the fresh and cache paths; RcSoftphone shows a sky '☎ Your line' chip when on the personal extension and an amber '⚠ Shared line' warning on fallback — gated on perStaffEnabled so it stays silent (no noise) while everyone's on the shared login today. Also hardened rc-staff-jwt.ts: added perStaffMappingEnabled() and documented the key footgun (the map key is AdminUser.email — Mary's is belaluna44@gmail.com, NOT her RC address — with verify-SQL). Independently confirmed by an adversarial hipaa-architect pass as the exact detectability fix; path is safe-to-arm. PHI-free; 5 pin tests. [front-desk][softphone][reliability]

Fixed

• 🕐 **Homepage clinic hours no longer show raw JSON (HOURSFMT1).** src/components/sections/Locations.tsx was rendering loc.hours as a plain string; the field is stored as a JSON blob ({"wed":{"open":"10:30 AM","close":"12:30 PM"},...}). Added parseHoursJson + HoursBlock (mirroring the identical helpers already in src/app/locations/[city]/page.tsx) so the homepage cards now display a formatted day-by-day schedule matching the city-detail pages. [website][hours][ui]

Fixed

• 📧 **Appointment confirmation email now links to Patient Portal (PORTALEML1).** Added a 'Patient Portal' link to bookingConfirmationEmail() in src/lib/emails.ts pointing to greenwellness.org/patient/portal, so patients can easily access document upload and account management after booking. The existing appointment-specific 'My Appointments' magic-link is unchanged. [patient-portal][email][front-desk]

Fixed

• 📊 **EOD now counts the real front-desk outcomes (EODWORK1).** The end-of-day staff-productivity section counts only actions listed in ACTION_LABELS (the query filters action IN (keys)), and that list was missing the highest-volume front-desk outcomes — so a staffer doing lots of calls/billing/forms/leads showed a near-empty EOD (everything floored to '<5'). Added the missing outcome actions: PATIENT_CALL_LOGGED (Logged a patient call), LEAD_CONTACTED (Contacted a lead), FORM_SENT_TO_PATIENT (Sent a form), MINT_PATIENT_PORTAL_LINK (Sent a portal link), PAY_LINK_EMAIL_SENT (Sent a payment link). Deliberately excluded the paired-duplicates (POYNT_INVOICE_CREATED↔pay-link, FORM_CREATED↔form-sent, LEAD_NOTE/LEAD_STATUS_CHANGED↔lead-contacted) so one outcome isn't counted twice, and views/searches (not outcomes). The n<5 safe-harbor floor is unchanged (non-BAA recipient). Surfaced by a productivity review where a staffer's genuine work — calls, invoices, forms — wasn't in the report at all. 4 pin tests. [eod][reporting][front-desk]

Added

• 💵 **Per-state visit-fee resolver (STATEPRICE1) — DARK, zero consumers.** New pure src/lib/state-pricing.ts: statePricingCents(state, isReturning) resolves cents from env pair STATE_PRICING__NEW_CENTS / STATE_PRICING__RENEWAL_CENTS, falling back to the WA PRICING baseline. Guardrails: WA NEVER overridable (published-surface consistency); integer-cents only within $20–$500 else fail-safe to baseline (a mis-set env can never produce a garbage charge); unknown/absent state → baseline. 16 pin tests. Consumers (booking-wizard fee, poynt invoice, booking-confirmation email, /telehealth pages) wire in a follow-up where the attested state exists — arming then = env values, no build. [expansion][pricing][dark]

Changed

• 📄 **Patient-portal invite email now names document upload (PORTALUP1, corrected in PORTALUP2).** portalMagicLinkEmail's 'Once you're in, you can' list gained a bullet: 'Upload your medical records and ID — a quick, secure way to send them to us.' The portal already supports patient record upload (/patient/portal/uploaded-records), and front desk already had a 'Send portal link' button (SCHEDULER-enabled) that emails it using the patient's address on file — but the invite didn't surface the upload capability. Small copy fix; no new flow. (PORTALUP2: removed an incorrect 'we don't accept faxes' phrase — GW DOES accept faxes; the portal is an additional channel, not a replacement.) [front-desk][patient-portal][records]

Fixed

• ☎️ **Softphone auto-recovery on an unexpected drop (PHONEHEAL1).** When the RC widget flips to signed-out after having been signed-in (the shared-login contention bump — another tab/staffer grabbed the extension), it now silently remounts the iframe to re-register with the same credential, on a 3s/6s/9s backoff, bounded to 3 attempts per drop episode (reset on a successful re-sign-in). Previously a bump left the phone stuck at 'Sign in to dial' until a manual Reset — the core 'flaky' complaint. Guards: only the phone-holding (leader) tab with a live credential heals; NEVER remounts mid-call (checked at both schedule AND fire time — a call can begin during the backoff window, per adversarial review); after 3 failed attempts it falls through to the manual Sign in / Reset controls (no loop). The complete fix for the contention is per-staff RC logins (PERSTAFFRC1 / RC_STAFF_JWTS). Pin-tested (5). [front-desk][softphone][reliability]

Added

• 📅 **'Fit someone in' walk-in squeeze-in for front desk (SQUEEZEIN1).** The New Appointment page (/admin/appointments/new) now has a 'Fit someone in →' control below the time list (leads with 'Schedule full?' when the day has zero open slots — the exact dead-end front desk hit). It mints a single ad-hoc slot at a chosen provider + time via /api/admin/slots/single (now SCHEDULER-allowed — creating ONE opening is low-risk, reversible, audited; bulk generation stays admin-only), then refetches + auto-selects it so the staffer books straight in. In-person requires a location first (walk-in lands at the right office). Booking still runs the double-book guard (DBLBOOK1 override). Providers come from a new lean /api/admin/providers/pick-list (id/name/title only — never NPI/license/email, unlike the ADMIN-gated credential route). Closes the Spokane/Ruth closure guards still apply. 8 pin tests. [front-desk][scheduling][walk-in]

Added

• ☎️ **'✓ Ready' badge on the softphone (PHONEREADY1).** The softphone header now shows a green '✓ Ready' chip when the widget is signed in + idle + this tab holds the line (loginStatus === signed-in && !authStuck && !hasIncoming && isLeader), giving front-desk staff at-a-glance confirmation the phone is live even when collapsed to the docked pill. Suppressed while ringing (the Incoming badge + guidance take over) and while stuck (the Sign in / Reset controls take over), so it never contradicts a louder state. Follows PHONEGUIDE1. PHI-free; pin-tested. [front-desk][softphone][ux]

Added

• ☎️ **Plain-language answer guidance on the softphone (PHONEGUIDE1).** The in-app RingCentral softphone panel now shows a state-aware guidance strip above the dialer: idle → "✓ Your phone is on. When someone calls, this box pops open — tap the green Answer button to pick up, red to hang up."; ringing (hasIncoming) → a green "📞 Incoming call — tap the green Answer button below to pick up." Narrates the RC widget's own Answer button (which lives inside its iframe and is easy to miss under stress) for non-technical front-desk staff who "don't know how to answer calls" (Mary 2026-07-31). Complements the existing auto-open + ring-pulse. Shown only on the open, signed-in leader tab (the follower/stuck states keep their own guidance). PHI-free static copy; pin-tested. [front-desk][softphone][ux]

Added

• ☎️ **Per-staff RingCentral softphone login (PERSTAFFRC1) — ships DARK.** The /api/admin/rc/auth-token endpoint now resolves the signed-in staffer's OWN RingCentral JWT (by their email, from a new RC_STAFF_JWTS map) and signs their softphone in as that extension — falling back to the shared RC_JWT_TOKEN for anyone not yet configured. Fixes the shared-login contention (RingCentral's ~5-registration-per-user cap) where concurrent staff/tabs bump each other off → 'can't send/answer calls' + a thrashing widget that can hang the page (Mary 2026-07-31: re-registered 12× in 12h, she + Kat both on the one login). Fail-safe: unset/empty/malformed RC_STAFF_JWTS → shared token (byte-identical to today); a DB hiccup resolving the email → shared token, never blocks the phone. The mint audit now records ownLogin=yes|no (booleans only) so the migration is observable. Incremental — enable one person at a time. **Arming (Doug-action):** mint each staffer's JWT in the RingCentral dashboard (Mary = ext 103) → set RC_STAFF_JWTS (Sensitive) → their phone becomes theirs. 8 pin tests. [voice][ringcentral][reliability][dark]

Fixed

• 📄 **Patient Forms hidden from the scheduler sidebar (FORMSNAV1).** /admin/forms — the queue for sending ROI / records-request / intake / consent / authorization forms to patients — had its nav entry gated to ADMIN/MANAGER, but the page and all its actions only require a valid admin session (no role guard), so schedulers could always use it directly. The nav gate was stricter than the page, hiding a surface front desk needs (surfaced by Mary's 'where do I find the authorization forms' email). Aligned the nav to the page's real permission (now visible to SCHEDULER) + added a nav-scheduler-page-parity assertion so it can't silently re-narrow. Companion note: email templates are sent via Email Composer (already scheduler-visible); the separate template *editor* stays admin-only by design. [front-desk][nav][access]

Added

• 🧭 **Front-desk role-clarity line on My Day (ROLECLARITY1).** The MyDayPlan card now restates the front-desk job in one line for SCHEDULER-role staff on every login — the five things they own (callbacks, booking confirmations, patient messages, phone-in bookings, today's visits) with 'start with the callbacks' as the anchor. Bridges the gap between the how-to training modules and today's live worklist: the job is always stated, the counts below say what's left. SCHEDULER-only (ADMIN/MANAGER already own the whole board); PHI-free static copy. Companion to the plain-English Front Desk Playbook one-pager. [front-desk][onboarding][clarity]

Fixed

• 🩺 **Provider new-encounter page crash on a slow picker query (PROVCRASH1).** /provider/portal/encounters/new threw a transient TimeoutError (caught by the route error boundary → 'Couldn't open this visit') when the recent-patients picker query — a some-filtered patient scan ordered by updatedAt, the heaviest load on the page — was briefly slow. That query and the active-templates load are non-essential to authoring, so both are now wrapped to DEGRADE to an empty list instead of crashing the whole page (catch logs err.name only — no PHI). The essential provider-identity + prefill loads are unchanged; the error boundary's Retry still covers anything else. Pin-tested. [provider][reliability][incident]

Added

• 📅 **Staff-only double-book override (DBLBOOK1) — for walk-in squeeze-ins.** The manual-booking page (/admin/appointments/new) now surfaces a deliberate 'Double-book anyway (override)' action when the provider double-book guard rejects a booking (409 PROVIDER_DOUBLE_BOOKED). It's contextual (only appears after a real overlap is detected, so it can't be left on accidentally), re-submits with allowDoubleBook:true, and the override is audited (APPOINTMENT_DOUBLE_BOOK_OVERRIDE, PHI-free: WHO + provider/slot ids only) for accountability. The guard stays ON by default; the public self-scheduling route NEVER honors the flag (patients can't double-book — pin-tested). Available to the same roles as manual booking (ADMIN/MANAGER/SCHEDULER, so front desk can use it). [scheduling][front-desk][walk-in]

Added

• ☎️ **Presence-aware warm-transfer routing (PRESXFER1) — ships DARK.** Isabella's live-handoff destination can now be chosen by whether a priority staffer's softphone is LOGGED IN, not just the time of day. isExtensionSoftphoneOnline(ext) (new, in ringcentral.ts) reads RC **device registration** status (the truthful signal — RC presenceStatus reads 'Available' even when every device is offline) and the pure resolvePresenceAwareDest() picks priority-when-online, else fallback. FAIL-SAFE: an RC error returns online=null which resolves to the FALLBACK — a patient is never routed to someone we can't confirm is logged in. Gated by VOICE_TRANSFER_PRESENCE_EXT (unset = byte-identical time-based behavior); business-hours window still enforced. The retell-transfer-dest enforcer cron now runs every 10 min (was 4×/day) so 'logged in' changes propagate quickly; still idempotent (PATCHes Retell only on change). Pin tests cover the fail-safe null path + the window. Enabling is a deliberate, tested flip (needs the priority staffer on a softphone whose presence identifies them). [voice][routing][presence][fail-safe]

Changed

• ☎️ **All-party-consent recording notice (RECDISCLOSE1) — ships DARK.** Isabella's opening disclosure changed from an AI-paraphrased "the call may be recorded for quality" to a deterministic, verbatim-every-call notice: "This call is recorded for quality and training." WA (RCW 9.73.030), IL (720 ILCS 5/14-2), and PA (18 Pa.C.S. §5703/5704) are all-party-consent states — the notice must ASSERT the recording (not hedge "may") and be a fixed phrase, not a paraphrase that can drift or drop call-to-call. Pin test (RECDISCLOSE1) locks the exact phrase present + "may be recorded" absent + the verbatim instruction. hipaa-architect + regulatory-research review 2026-07-31 (HIPAA storage side already clean — Retell/Neon/Bedrock all BAA-covered). NOT-LIVE: nothing auto-syncs the voice prompt; this reaches the phone only when the medical director blesses the wording and the Retell re-sync is run (Doug-gated arming). [voice][compliance][all-party-consent]

Added

• 🗓️ **Calendar color-by-booker (CALBOOKER1) — extends ISAYELLOW1.** /admin/calendar blocks now color by WHO BOOKED the visit: Isabella (AI channels) = yellow (unchanged), **Mariane = teal, Mary = pink**. The booker color overrides the per-provider block color so "who booked this" reads at a glance; any other booker (other staff / web self-schedule) falls back to the provider color, so Kat's per-provider key still works for everything else. Attribution: Isabella from originChannel (voice/chat/email/sms); Mariane-vs-Mary from a CREATE_APPOINTMENT audit-join on the acting staffer's name (new bookedByName on the calendar API — staff name, not PHI; best-effort, falls back to provider color on any miss). Works for existing appointments (audit history) — verified against live data (Mariane 98 / Mary 7 bookings in 30d). New pure src/lib/booker-colors.ts with resolveBooker (Mariane-before-Mary precedence guard) + 13 pin tests; extended legend + help copy. [calendar][scheduling][ux]

Added

• 🏷️ **Per-state certification pricing (STATEPRICE1) — Lane 2 of the expansion prep.** New src/lib/state-cert-pricing.ts is the single source of truth for the cert fee by state: stateCertFeeCents(isReturning, state?) returns a per-state override if one exists, else the WA PRICING baseline. **WA is unchanged** ($175/$145) — it's not in the override map, so it keeps the home-market baseline via fallback. **IL/OH/PA are priced $149 new / $129 renewal** (Doug 2026-07-31). Both live paid rails compute their server-authoritative amount through the resolver — the Poynt invoice route (self-scheduling) and Isabella's voice-booking pay-link path (voice-tools.ts). The omitted-state call defaults to WA, so every WA booking path is byte-identical to the legacy selfSchedFeeCents. Pin tests lock both the WA home-market invariant and the $149/$129 expansion number. **NOT-YET-LIVE:** the expansion prices only reach a patient once a state's go-live gate (enforcementActive) flips — the booking-location gate blocks non-WA bookings until then — and each state's PAIRED Doug-action (create Poynt fixed pay-links for $149 + $129, add to POYNT_FIXED_PAYLINKS) must be done before its paid path goes live. [expansion][pricing][seam]

Added

• 🛡️ **Provider-credential expiry watchdog (CREDWATCH1) — Lane 1 of the multi-state expansion safety net.** New daily cron /api/cron/credential-expiry-watchdog (0 15 * * * UTC ≈ 8am PT) scans every ProviderStateLicense and classifies each on a severity ladder: **blocking_live** (an ENFORCED state whose provider is no longer eligible — a live lane is down right now) > **expired** (a tracked date already past — the IL 2026-vs-2029 near-miss class, caught on the DATE even when the status flag still reads 'active') > **≤30d / ≤60d / ≤90d**. Emails a digest to the front-desk role mailbox only when something is at/above the send threshold (≤30d / expired / blocking) — quiet otherwise; heartbeats every run regardless. Reuses the exact evaluateStateLicense gate the runtime location-gate enforces (extracted to a db-free provider-state-eligibility-eval module) so the alert can never drift from what actually blocks a booking. Counts-only audit (CREDENTIAL_EXPIRY_WATCHDOG_RUN), NOT-PHI (provider licensure data, not patient data). Recipients overridable via CREDENTIAL_WATCHDOG_RECIPIENTS. [expansion][credentialing][compliance][safety-net]
• 🗺️ **Credential-expiry rollup on the Expansion cockpit.** /admin/expansion now leads with a fleet-wide credential-watch banner (same scanCredentials() brain as the cron) — one glance shows what's expired / expiring / blocking a live lane across every state, with a link straight to the credentialing tracker. All-clear renders a quiet green line. [expansion][cockpit]

Fixed

• 📋 **My Feedback sections expanded by default (MYFBOPEN1).** The 'Fixed' and 'Declined / removed' sections on /me/feedback were rendered inside collapsed
  with no open attribute — Mariane reported she could "only see items marked Needs Attention" and could not view past or fixed feedback. Both sections now start open so the full submission history is visible on page load; the user can still collapse them. No data-model or auth change. [feedback][staff][ux]

Fixed

• 📞 **Softphone leader-election zero-leader oscillation (SPFTLEADER2).** useSoftphoneLeader's onClaim stepped a leader tab down on *any* other tab's claim without consulting the lock — so two tabs mounting together both becomeLeader(), both broadcast, and both step down on each other's claim → ZERO leaders, then a recurring ~7s stale-lock reclaim→oscillation where no tab registers the RC iframe (a live regression of the exact 'Web phone unavailable' failure SPFTLEADER1 targeted). Fix makes step-down **lock-authoritative**: on a claim, re-read the localStorage lock and only yield if it's owned by another tab — so the last writer stays leader and the other yields, converging to exactly one leader (heartbeat then keeps the lock fresh so the poll never re-fires). Also covers the storage-event fallback path (Safari private mode). No PHI-path change; kill switch NEXT_PUBLIC_SOFTPHONE_SINGLE_TAB=off unchanged. Found by an adversarial code-review pass of the SPFTLEADER1 diff. [softphone][reliability][concurrency]

Fixed

• 📠 **Fax-poll cron now exports POST (FAXPOLLPOST1).** /api/cron/fax-poll exported only GET; Vercel Cron fires via POST, so the scheduler's invocations returned a 401/405 (an auth-looking silent failure in the logs) and the Notifyre received-fax poll never ran on schedule — inbound medical-records faxes could strand on the vendor portal. Added export async function POST(req) { return GET(req) } delegating to the existing handler; the verifyCronAuth gate inside GET still fail-closes on any unauthenticated call, and the route's per-fax dedup keeps re-polling idempotent. No PHI-path change (metadata-only route; content stays inside /api/inbound/fax). Clears the watchdog cron-route-http-method 🔴. [fax][cron][infra]

Fixed

• 📞 **One-phone-per-browser leader election (SPFTLEADER1).** New useSoftphoneLeader hook (src/components/useSoftphoneLeader.ts): a localStorage lock + heartbeat + BroadcastChannel elects one leader tab per browser; only the leader mounts the RC Embeddable iframe (holds the SIP registration), cutting registrations from (people × tabs) toward (people) so the shared-extension cap (SPFTJWT1) stops bumping staff offline. Followers show a 'Use the phone here' takeover panel; rcSoftphoneDial from a follower claims leadership + queues the dial (flushed on the widget's next signed-in). Leader death → a follower reclaims within ~7s (stale-lock poll) or instantly on tab close (lock release). Wired into BOTH the admin RcSoftphone and provider RcSoftphoneProvider sisters. Default ON; kill switch NEXT_PUBLIC_SOFTPHONE_SINGLE_TAB=off reverts to every-tab-registers. Degrades safe (no BroadcastChannel → storage-event + poll; localStorage failure → every-tab-leader). Does NOT replace the per-staff RC credentials root fix (Doug-gated). [softphone][reliability][ringcentral]

Changed

• 🟢 **One-click Send reply ARMED (SENDLIVE1) — DRAFT_ONE_CLICK_SEND_ENABLED=true on green-wellness prod (Doug-authorized 2026-07-30).** No code change vs DRAFTSEND1; this entry rebakes HEAD so the deployment picks up the flag (env-flip alone doesn't update an existing Vercel build — the known GW rebake pattern). The action:"send" path in /api/admin/messages/[id]/draft-suggestion now sends instead of 403-ing; the Draft queue shows the primary 'Send reply' button. hipaa-architect follow-up (non-blocking): add a per-admin/per-message rate-limit before any BROAD rollout. [front-desk][email][isabella][hipaa]

Added

• 📞 **Live Callbacks count badge in the admin nav (CBBADGE1).** New GET /api/admin/callbacks/count returns open needs-human callbacks/escalations (PatientMessage needsHumanAt set, resolvedAt null, inbound) — same worklist as /admin/isabella-today. Wired into AdminNav's existing badge system (state + refreshBadgeCounts fetch + pathname/visibilitychange refresh) as badge: "callbacks" (rose pill) on the Callbacks item. Adoption nudge for a queue that was rotting (17 stale, oldest 48d, found 2026-07-30) despite the dashboard worklist. No new surface — makes an existing one impossible to miss. [front-desk][callbacks][adoption]

Added

• ✉️ **One-click Send reply in the Isabella Draft queue (DRAFTSEND1) — DARK behind DRAFT_ONE_CLICK_SEND_ENABLED.** New action:"send" on /api/admin/messages/[id]/draft-suggestion emails aiSuggestedReply verbatim from admin@ via the same M365/sendEmail rail as the canonical messages/send EMAIL branch (gated: provider≠none, patient has real email, isPlaceholderEmail reject, emailUnsubscribed reject, patientId required), creates the threaded OUT PatientMessage row (aiDrafted, editDistance:0), stamps aiSuggestedReplyUsedAt+resolvedAt+resolvedById on success (no stamp on failed send — draft stays), audits BULK_SEND + PATIENT_AI_DRAFT_ACTIONED (actioned-send, PHI-free counts only). Fail-closed flag check server-side AND in the page prop. UI: flag-gated primary 'Send reply' button in DraftActions; 'use'(copy)/'dismiss' unchanged. hipaa-architect: SHIP-DARK-OK; **arming DRAFT_ONE_CLICK_SEND_ENABLED=true is a Doug-only PHI-boundary flip.** [front-desk][email][isabella][hipaa]

Added

• ✉️ **Email-domain typo nudge on booking + patient-edit (EMAILTYPO1).** New pure detectEmailTypo() (curated high-confidence typos of gmail/yahoo/hotmail/outlook/icloud/aol — e.g. gamil.com, gmail.con, gmai.com, gmaill.com, gmail.comk, gmail.com.com, yahoo.con) returns a suggestion; NEVER auto-applies (silently 'fixing' a wrong address = §164.502 PHI-misdirection risk — staff/patient confirm). Wired into StepAboutYou (public booking — prevents at source) + PatientEditForm (staff fix). Conservative: legitimate domains (yahoo.ca, company domains) never flagged. 6 pin tests. Addresses the bounce audit's root cause: ~50 patients silently missing every automated email. [front-desk][deliverability][patients]

Fixed

• 🩺 **Health-check SMS readiness hint now names Notifyre, not retired Twilio (HEALTHSMS1).** /api/health readinessHint said smsReady=false (Twilio creds — TWILIO_ACCOUNT_SID...) on every read — stale since SMSRAIL1 retired Twilio/RC for Notifyre-only. The smsReady computation was already correct (notifyreSmsActive()); only the hint string lied, sending anyone debugging to the wrong provider. Now: smsReady=false (Notifyre SMS not armed — needs NOTIFYRE_SMS_ENABLED=true + NOTIFYRE_SMS_FROM + NOTIFYRE_API_KEY). Rest of health is green (db connected, 0 schema drift, 0 dead-letter, AI circuit fine, all other rails ready; crons 0-stale by threshold). [observability][sms][hygiene]

Added

• 📮 **Inline mailing-address capture in the To-mail queue (MAILADDR1, Kat).** A queue row with no address (blank Patient.address + no per-mailing override) now renders an inline address input + Save instead of only a 'go add it on the patient card' warning. POSTs to new /api/admin/mailing/set-address (SCHEDULER-eligible — mailing is receptionist work per DP0005; mirrors the PATCH /api/admin/patients address edit) which sets Patient.address (durable — next cert mails cleanly) and audits UPDATE_PATIENT (field-name + source only, never the address value). Keeps the 'optional to save, easy to capture at mail-time' model — no policy change, no re-blocking the lead→patient conversions address-optional unblocked. Resolves the 'address CANNOT be optional / we need to mail the auth form' friction without the detour. [front-desk][mailing][authorization]

Added

• 🪪 **Returning-patient fast entry by Account ID (RETURNPT1, Mariane).** New ReturningPatientJump box on the admin dashboard: enter a GW-XXXXXX account ID → routes to /admin/patients?accountId=, which 308-redirects straight to the patient's record hub on an exact match (0/2+ → actionable banner + list). Mirrors the existing ?sfId= redirect branch. The hub already exposes Book appointment (?type=returning, skips intake), TakePaymentInline, and consent/portal/records send buttons — so this is the missing one-step front door onto an existing flow, not a new surface. publicId resolved via the shared normalizePatientPublicIdQuery; the patient page emits its own VIEW_PATIENT audit on load. [front-desk][returning-patient][workflow]

Added

• 🔎 **Daily schema-drift probe (SCHEMADRIFT1).** New /api/cron/schema-drift-check (0 7 * * * UTC) diffs the Prisma-DMMF expected schema against the live DB's information_schema and, on NEW drift, writes a SCHEMA_DRIFT_DETECTED audit row + emails SCHEMA_DRIFT_ALERT_EMAIL||URGENT_ALERT_EMAIL||doug@ with the exact missing tables/columns. Signature-deduped so a known/dark drift doesn't re-spam daily. Root fix for the by-hand-migration gap that 500'd /admin/amendments + threw the email-AI bus-factor throttle OFF for weeks (doug_oversight_acks missing). Pure diff logic unit-tested (5 pins); PHI-free (table/column NAMES only). Gotcha baked in: information_schema columns are pg name type → ::text cast required or the Prisma driver throws on deserialize. [ops][safety-net][infra]

Fixed

• 🛡️ **Two ungated automated SMS paths now route through the approval queue (SMSGATE1) — gate-before-arm.** (1) renewals' email-bounce SMS fallback called sendSms() directly; now queueAutomatedSms (purpose renewal-reminder), sharing the same per-run stage cap as the primary rail. (2) review-request cron's Google-review SMS called sendSms() directly; now queueAutomatedSms under a NEW closed-set purpose 'review-request' (the most discretionary automated text). Audit of all cron lanes confirms the ONLY remaining direct cron sendSms is patient-email-urgent-alert (transactional clinical page, notifyreSmsActive-guarded, email fallback — correctly NOT gated). Staff-triggered sends (sendManualAppointmentReminder via per-item + bulk remind) stay direct per Doug's 'staff-clicked untouched' rule. Net: when Notifyre arms, 100% of automated promotional/reminder texts stage for necessity-review. [sms][approval-gate][pre-arm]

Added

• 🧹 **'Stuck authorizations' drain tool (APPTDRAIN1, Mary).** New /admin/appointments/stuck (ADMIN/MANAGER) lists every PENDING_APPROVAL appointment, flags deactivated-provider rows in red, and offers three per-appointment dispositions via POST /api/admin/appointments/[id]/resolve-stuck: **reassign** to an active provider (status stays PENDING_APPROVAL so the NEW provider makes the RCW 69.51A call — the endpoint never authorizes), **cancel** (→ CANCELLED, reopens the slot), **no-show** (→ NO_SHOW). Purpose-built + SILENT: unlike the normal cancel/no-show routes it sends NO patient email (these appts are weeks old — a stale 'you missed it' note would confuse). Guarded to status===PENDING_APPROVAL so it can't re-flip a finalized appt or touch a live visit; reassign target must be active (can't re-strand). Audited as APPOINTMENT_STUCK_RESOLVED (metadata only — disposition + provider ids, no PHI). Linked from the dashboard pending-authorization banner. [front-desk][appointments][ops-cleanup]

Fixed

• 🔇 **Dark SMS rail no longer logs phantom SMS_INTEGRATION_FAILURE (SMSNOISE1).** workflow.ts sendSmsAudited() logged an ERROR-class SMS_INTEGRATION_FAILURE on EVERY send while Notifyre is unarmed — ~60/hr of red rows into the append-only AuditLog during the inbound-email flood (transactional urgent pages / auto-replies / crisis pages, all with an email fallback). The audit was redundant (armed-but-failed sends are recorded by the Notifyre adapter's sms-error-cache, not here) so it only ever fired in the intentional dark-rail state = pure noise reading as an ongoing incident. Now silent on the dark-rail skip; a real failure only logs once Notifyre is armed and a send genuinely throws. Removed the now-dead maskPhone helper. Diagnosis: the storm traced to the 5-min patient-email-urgent-alert cron + concurrent inbound-email auto-reply senders, NOT one loop. SMS BAA-isolation gate still green (sendSms remains the single SoT). [sms][hygiene][append-only-forward-fix]

Changed

• 🔃 **Default Leads (All) view sorted as a priority worklist (LEADSORT1, Mary).** Replaces newest-capture-first with priority-band ordering: urgent (status new/lm/no_answer AND ≥7d old) → new → other unresolved → resolved, oldest-first within each band. Pure in-process re-sort of the already-parsed leads; the per-status filter views keep their existing sort (active-queue filters stay oldest-first). [leads][front-desk]

Added

• 📝 **Personal 'Notes' scratchpad, top-right of every admin page (SCRATCHPAD1, Mary).** Floating 'Notes' launcher opens a per-staff writing pad that autosaves (debounced) to a new StaffScratchpad row keyed by your admin user. Server-persisted in the BAA-covered DB — deliberately NOT browser localStorage — so PHI never sits unencrypted on the device and the note follows you across sessions/devices. Private by construction: never emailed, logged, exported, or read by any cron or other user. Gated to PHI-scoped roles (Bookkeepers excluded), same as the softphone. Backed by prod-migration-129 (additive table, expand-only). [front-desk][productivity]

Changed

• 🧹 **Already-seen patients hidden from the default Leads view (Mary).** The 'All' Leads view now excludes leads that re-matched to a booked patient (LEADBOOKED1 stamps existingPatientId on email OR last-10-digit phone match against a Patient with ≥1 appointment). They live under the '✓ Already a patient' chip — same exclusion the 'New' view already applied. The All chip count + in-view action counts reflect the working set. [leads][front-desk]
• 🔀 **Lead detail: 'View patient record' replaces 'Convert to Patient' when already a patient (Mary).** The lead detail page now re-derives the already-a-patient match at render time (email OR phone vs booked patients — the same logic the queue uses), not just the email-only stamp frozen at capture. When it matches, the two Convert buttons are swapped for a 'View patient record →' link + a one-click 'Book appointment' link, so staff never start a duplicate-creating conversion on someone who's already in the system. [leads][front-desk]

Added

• 🦓 **Alternate row shading on the Leads list (Mary).** Subtle zebra striping on the leads table so each patient row is easier to follow across the wide layout. Frustrated-caller (red) and contacted (grey) row states still take precedence over the stripe. [leads][front-desk][polish]

Added

• 🚩 **Urgent clinical pings file into the Feedback queue (URGENTFB1, Doug).** patient-email-urgent-alert now creates a ReviewerFeedback row (status=open, title '⚠️ URGENT — may need clinical attention', pagePath deep-linked to the patient) alongside the email/SMS + Isabella Today band. Fired ONCE per message (right after urgentAlertSentAt stamps, so re-runs never re-file). Filed from a NON-trusted system submitter with status=open ⇒ it shows in the queue but NEVER auto-promotes to approved-autofix (verified: promotion is trusted-submitter-only + feedback-cleanup never promotes), so the autofix agents leave the clinical item alone. Body min-necessary (first name + last initial + patient link) — BAA-covered at rest, no message subject/clinical detail echoed. Best-effort (never blocks the alert). [clinical-triage][feedback][patient-safety]

Fixed

• 🧹 **Urgent-alert cron skips SMS when the rail isn't armed (URGENTHYGIENE1).** patient-email-urgent-alert now guards the SMS attempt on notifyreSmsActive() — with Notifyre unarmed it goes straight to the email fallback instead of logging a phantom SMS_INTEGRATION_FAILURE on every urgent page. Removes the false 'something's broken' signal until texting is on. [voice→clinical-triage][hygiene]
• 🩹 **SMS queue self-heals orphaned 'approving' rows.** The approve→send path claims a draft (pending_review → approving) before sending; a crash in that window would strand it invisible + un-sendable. getSmsQueueForReview now reverts any 'approving' row older than 5 min back to pending_review on load. Hardening before the queue goes live. [sms][robustness]

Fixed

• 🔁 **Self-reinforcing urgent-alert loop closed (SELFLOOP1).** URGENTMAIL1's email fallback pages admin@ (a triaged mailbox); email-triage reclassified the '⚠️ GW URGENT' self-notification as clinical-urgent → new PatientMessage row → the urgent-alert cron paged again → loop (compounding ~5/5min, 118 phantom rows + a matching SMS_INTEGRATION_FAILURE storm to Doug's cell). Fix: all inbound-email ingestion paths (M365 webhook processNotification, the M365 poll's ingestInboundEmail, and the SES webhook) now drop any message whose fromAddr ends @greenwellness.org — patients email from external addresses, so a self-domain inbound is a system self-notification or staff-internal note, never a patient message. Structurally prevents any future self-send loop. The 118 phantom clinical-urgent rows were suppressed (aiCategory=system-loop-suppressed + resolved); 0 real urgent items touched. [email][patient-safety][loop-guard]

Added

• 📨 **Final 2 SMS lanes gated — 8 of 8 (SMSQUEUE3).** deposit-reminder + payment-chase route through queueAutomatedSms. Their externalId dedup (a status=SENT PatientMessage row the cron owns) can't be honestly written for a not-yet-sent draft, so queueAutomatedSms gained an optional dedupeExternalId: on a queued send, the approve→send path writes a MINIMAL externalId dedup marker so the owning cron won't re-stage (idempotent; skip-if-exists). On a direct (queue-off) send the lane's rich summary row + audit fire exactly as before — byte-identical. dedupeExternalId column added to the (still-unapplied) StagedSms migration + model. [sms][approval][dark]
• ✅ **All automated patient texting is now approval-gated.** renewals, appointment reminders (2h + 48h/24h), intake reminders, authorization-renewal reminders, follow-up acks, deposit reminders, payment-chase — every automated lane stages for review. The arming order stands: apply prod-migration-128 → SMS_APPROVAL_QUEUE_ENABLED=true → then arm Notifyre. Staff-clicked sends remain direct (a human already chose). [sms][sequencing]

Added

• 📨 **5 more automated SMS lanes routed through the approval queue (SMSQUEUE2).** reminders-2h, reminders (48h/24h), intake-reminder, authorization-renewal-reminders, and stale-transfer-sla now call queueAutomatedSms instead of sendSms. Idempotency preserved per category: workflow-event lanes (appointment/intake reminders) log the event only on real send (the queue logs it at approve time; its dedupe prevents re-staging meanwhile); column-marker lanes (auth-renewal reminderSentAtd, stale-transfer staleTransferAckAt) stamp their marker on send-or-stage so a queued draft can't re-fire. Each lane's queue-OFF path is byte-identical to before (adversarially reviewed, all 5 idempotency-verified). Now 6 of 8 automated lanes gated. [sms][approval][dark]
• 🚧 **Arming dependency (top of the checklist):** deposit-reminder + payment-chase are NOT yet queued — their dedup writes a status=SENT message row the cron owns, which can't honestly be written for a not-yet-sent draft; the queue's approve-send needs to write that row instead (next ship). Until they're wired, do NOT arm Notifyre SMS, or those two payment-reminder lanes would text patients bypassing the approval queue. [sms][sequencing]

Added

• 📨 **SMS approval + necessity review queue (SMSQUEUE1, Doug) — DARK.** New StagedSms table (prod-migration-128, staged-not-applied) + /admin/sms-queue review page + approve/dismiss API + queueAutomatedSms() router. AUTOMATED crons call queueAutomatedSms instead of sending directly: when armed (SMS_APPROVAL_QUEUE_ENABLED=true + table applied) it NECESSITY-gates (decideStageSms: drop if a pending draft exists, already sent this purpose in-window, or a same-type WorkflowEvent already reached them — i.e. contacted another way) and stages pending_review; staff approve → the SAME body sends via the one sendSms entry point + the workflow event logs at approve time; per-run stage cap throttles (SMS_STAGE_RUN_CAP, default 25). DEFAULT OFF → byte-identical passthrough to today (and Notifyre-unarmed makes that a no-op). Renewals cron wired as the reference integration (respects the existing renewal-SMS BAA gate); the other automated SMS lanes follow. Staff-clicked sends untouched. 13 necessity-engine pins; PHI-safe (body/phone never logged — audits are purpose/actor/admin-id only). ARMING ORDER: apply migration → SMS_APPROVAL_QUEUE_ENABLED=true → then arm Notifyre SMS. [sms][approval][hipaa][dark]

Fixed

• 🚑 **Urgent clinical-flag paging now reaches staff via email fallback (URGENTMAIL1).** The patient-email-urgent-alert cron (fires every 5 min on clinical-urgent inbound) paged only via SMS; with the Notifyre rail unarmed those pages reached no one AND — because the row only stamps urgentAlertSentAt on send SUCCESS — it re-paged the same items every 5 min (a real ~60/hr storm, surfaced when SMSRAIL1 made the failures visible). Now: SMS attempted first (when a phone recipient is configured), then EMAIL fallback to URGENT_ALERT_EMAIL (default the shared front-desk mailbox, BAA M365) with the same page + urgent-queue link; the row is stamped the moment EITHER channel lands, stopping the storm; a missing phone recipient no longer disables the cron (email carries it). [voice→clinical-triage][patient-safety]
• 🔒 **SMS-failure audit no longer records message bodies (URGENTMAIL1 correction).** The SMSRAIL1 SMS_INTEGRATION_FAILURE audit detail included an 80-char body slice — and SMS bodies can carry patient first names (the urgent pages: "GW URGENT: …"). Detail is now maskPhone + bodyLen only. (Existing rows are immutable per the append-only audit-log integrity trigger — forward-fixed; they remain inside the BAA boundary.) [phi][audit-hygiene]

Fixed

• 📋 **Staged-email queue self-reconciles dead rows (STAGERECON1).** Diagnosis: the renewals cron marks a StagedEmail row 'sent' only on a successful send; a patient filtered out upstream (unsubscribed / bounced / already-renewed / no-longer-due) is skipped WITHOUT resolving the row, so it dangles 'staged past-due' forever (prod: 4 corpses among 88, e.g. 2 unsubscribed). The nightly stage-emails cron now sweeps 'staged' rows whose scheduledFor is STRICTLY before today into 'skipped' — a non-blocking terminal status (only held/cancelled gate a send, so this can never affect delivery), copyOverride rows preserved (staff edits kept), same-day rows untouched (no race with that day's not-yet-run renewals cron). Drops out of the /admin/email-queue review surface immediately (it lists staged/held only). Heartbeat gains skippedStale=N. [renewals][queue-hygiene]

Added

• ✅ **Encounter sign → appointment auto-completes (CODE-S).** New encounter-sign-autocomplete: on sign/lock, a PAID pre-terminal (CONFIRMED/PENDING_APPROVAL) appointment flips to COMPLETED + stamps completedAt — even when cert issuance skipped (condition/dob/signature/email), because the visit-happened fact and cert-issued fact are separate. Race-safe (status re-asserted in the UPDATE), unpaid NEVER flips (held-payment lane owns that), cert retry preserved (the already-issued short-circuit is now certPdfUrl-based, not status-based). APPOINTMENT_AUTO_COMPLETED_ON_SIGN audit (PHI-free). Prod case that motivated it: a $145-paid locked visit stuck CONFIRMED 6 days, invisible to provider pay. 9 pins. [provider][accounting]
• 📇 **Fresh-lead booking-nudge cron (ops-plan, DARK).** /api/cron/lead-booking-nudge nightly ~02:20 PT: leads captured 1-4 days ago that are uncontacted (not converted/patient/unsubscribed/staff-touched/recently-emailed) get a static, claim-clean "still want to book?" DRAFT into the existing LeadCatchupDraft queue (cohort=fresh_booking_nudge) for human approve/dismiss — NEVER auto-sends. ≤30/run, one-per-lead (unique leadRef), default-OFF behind LEAD_BOOKING_NUDGE_ENABLED. 25 pins. [leads]
• 📠 **Inbound-fax self-test button (FAXTEST1).** One click on /admin/inbound-fax sends a non-PHI test fax from our Notifyre account to our own DID; it should land in the queue within ~10 min — proves the receiving rail end-to-end while the 888 port drags on. [fax]

Fixed

• 📨 **M365 real-time email push restored (M365WATCH1).** Graph mail change-notifications identify the mailbox by user-GUID, not the SMTP address in our watch list, so EVERY push 401'd "resource-no-watched-mailbox" from 7/13-7/28 (the 5-min poll silently carried ingestion; real-time auto-ack never fired). Added a secret-binding fallback: when address-matching misses, bind the notification to a mailbox by constant-time-comparing its clientState secret against every watched mailbox, requiring exactly one match — the SECRET chooses the pipeline, so cross-mailbox injection still needs the other mailbox's secret (same privilege the address path already grants). Fail-closed on zero/ambiguous matches; reject audits now name the claimed mailbox. 13 new pins (43 total on the module). [email][security]

Added

• 🏠 **Mailing address auto-captured from chart records (ADDRCAPTURE1, Doug/Kat).** RecordsReviewSchema gains patientMailingAddress (nullable, default null — back-compat) with the SAME mechanical grounding contract as findings: the quote must appear verbatim in the transcribed source or it's dropped, never surfaced, never written. On a grounded extraction the provider records-review route fills an EMPTY Patient.address only (guarded updateMany, INTAKEADDR1 convention — model can never overwrite), audits PATIENT_ADDRESS_FILLED_FROM_RECORDS (ids+flags only, never the address bytes), and returns addressFilled so the panel can say so. Explicit prompt guard: patient's OWN demographics address only — never clinic/provider/pharmacy. 74,250 of 83,992 patients have no address; renewals' addresses live in their imported PF paperwork, so this closes the gap with zero patient effort. [provider-portal][mailing][phi-grounded]
• 📬 **Mailing queue refuses to be silent about missing addresses.** Blank-address rows in the To-mail queue now show a red '⚠ No address on file' with the two capture paths, instead of rendering an empty line above a printable blank label. [mailing][staff]

Added

• 📵📧 **Missed-call follow-up button (VMFOLLOWUP1, Doug).** New POST /api/admin/patients/[id]/followup-email (ADMIN/MANAGER/SCHEDULER) sends missedCallFollowUpEmail (first-name-only, no clinical content) through sendEmailToPatient (unsubscribe/bounce/placeholder gates hold), writes an OUT PatientMessage row (so callbacks-owed + unanswered derivations count the touch) + OUTREACH_CALL workflow event + SEND_VM_FOLLOWUP_EMAIL audit (flags-only). Idempotent: 1-per-4h dedupe + 3/day ceiling per patient via checkRateLimit. Amber button on the patient card's Communication panel. [staff][email]
• 🧲 **Leads queue excludes booked patients (LEADBOOKED1, Kat).** Render-time rematch: visible leads' emails + last-10 phone digits are matched (JS-normalized — storage formats vary) against patients with ≥1 appointment; matches get the '✓ Already a patient' pill/chip and drop out of the actionable New queue. Closes both gaps in the capture-time stamp (email-only + frozen — anyone who booked AFTER the lead came in stayed a 'new lead' forever). Fail-soft on DB blips. [leads][staff]

Fixed

• 🩺 **Qualifying-condition staging works end-to-end (CONDSTAGE1, Abby live-blocked + Kat report).** Four defects, one flow: (1) stagedConditions lived ONLY in client state — save()/autosave never sent them and nothing ever wrote appointment.conditions, so the sign gate could never be satisfied from the portal; both save channels now send them and the PATCH route unions validated canonical RCW slugs into appointment.conditions (additive — can never clear intake/admin-staged ones; fail-closed provider scoping; count-only in responses). (2) NEW direct 'Stage qualifying condition' picker in the Assessment section — the provider is the clinical authority and no longer needs an AI records finding to stage what she determined; feeds the same removable-chips state. (3) The checklist's 'Review conditions' fix-link pointed at the ENCOUNTERS LIST (dead end) — now anchors in-page to the staging area. (4) recordCount counted only patient-uploaded records, hiding the Records Review card on staff-uploaded charts (RECSYNC1 read-union parity applied). [provider-portal][sign-gate]
• 📧 **EOD submit is idempotent + drafts survive (EODDEDUPE1).** 5 rapid submits sent 10 duplicate emails; an atomic claim on StaffEod.emailedAt (2-min window, conditional updateMany — exactly one concurrent winner) gates the sends, notes still saved on every submit, suppressed submits audited. Submit button disables in flight; post-submit stale drafts stop resurrecting cleared fields. 14 pins. [staff][email]
• 🧲 **LEAD_CONVERTED writes once per lead (LEADDEDUPE1).** The records-reminder backfill re-wrote the same conversion daily (prod: 296 rows / 47 leads, 10 dups each) because it checked a key no writer uses; conversion lookup now joins on leadAuditId with check-before-write. Converted leads also correctly stop getting Day-3/5/7 reminders. 12 pins + 22 existing green. [leads][audit-hygiene]
• 📼 **Voicemail-reconcile can finally match (VMRECON1).** Root cause of 3,327 orphans found + fixed (matcher input format mismatch); heartbeat now reports matched/orphan counts honestly. Forward-going; backlog sweep is a separate op. [voice]
• 🧾 **Poynt alignment cron stops crying wolf (ALIGNHONEST1).** The 44 all-false orphan_payment alarms now recognize MANUAL:POYNT sentinels + /pay reserves as matched; REAL drift finally flags: refunds with no local refund state and paid-then-cancelled appointments. [payments][observability]
• 📊 **Leads morning metric is honest (LEADMETRIC1).** Contact-attempt derivation now counts outbound messages on any channel, conversions, and outreach workflow rows; the email reports truly-zero-contact AND total-open. [leads][metrics-honesty]
• 🔐 **NULL portal-token expiry fails closed + CI failures alert (TOKENEXP2/CIALERT1).** Token-based provider auth treats NULL expiry as expired (verified no active provider depended on one); the two autofix GitHub workflows open a GitHub issue on failure instead of dying silently 23 times. [security][ci]

Fixed

• 📞 **Transfer availability is presence-first (XFERPRESENCE1, Doug live incident).** checkDemiAvailability() dropped its isAfterHours() hard-gate — it refused warm transfers at 5:00pm sharp with staff heartbeats seconds old (patients asking for a human got the message script while Kat + Mary were both active). Presence (15-min tab-visibility heartbeat, message-handling roles, isActive) is now the sole signal; no-presence still fails closed to message-taking at any hour. flagForHuman tool + crisis/urgent tiers inherit the fix; prompt unchanged (it already defers to the tool). 9/9 transfer pins green. [voice][isabella]

Fixed

• 💸 **Refund rail repaired end-to-end (REFMATCH1-3).** New src/lib/poynt-sentinel-shared.ts (22 pins) extracts + matches the staff-typed MANUAL:POYNT: sentinels. Webhook refunds falling through invoiceId/externalRef now match uniquely against sentinel refs (unique-or-nothing — 2+ candidates keeps no-match, candidateCount in audit); refund-poynt route refunds by transaction id when no invoiceId exists (new refundTransaction in poynt.ts; partial refs get an honest portal-manual 409 + webhook reconciles); RefundPoyntButton no longer hidden by the always-NULL poyntInvoiceId gate; POYNT_UNMATCHED_PAID rows (last 14d, id+amount+date only) prefill the Link-Poynt-invoice control. Webhook records — never initiates — money movement. 98/98 existing Poynt pins + tsc green. Backfill of the 3 already-missed refunds ($240) is a separate prod-data decision. [payments]
• 📱 **Notifyre-only SMS rail (SMSRAIL1, Doug).** workflow.ts router drops the RC→Twilio fallback chain (RC: no A2P 10DLC; Twilio: never configured — the audit found crisis paging failing 5/5 forever, silently). patient-email-urgent-alert + stale-transfer-sla crons rerouted from the dead bare-Twilio import to the router; page-on-call + sms-auto-reply moved to the Notifyre adapter; /api/health smsProvider now reports notifyre|none. Unarmed rail → sendSms false + SMS_INTEGRATION_FAILURE audit naming the real cause. Arming still gated on: executed text-scope BAA pinned, SMS-capable NOTIFYRE_SMS_FROM, non-PHI test send. [sms][hipaa]
• 🔐 **Deactivated-provider access closed (PROVACT1).** 14 provider routes did their own portal-token/session Provider lookups WITHOUT isActive — an offboarded provider with a live token retained PHI document download + portal APIs until token expiry (HIPAA 164.308(a)(3)(ii)(C)). Every lookup now requires isActive:true (fail-closed as unauthenticated). [phi][provider-portal]

Added

• 🚨📞 **Urgent-call classification at webhook time (CALLURG1, Kat cms3o4yx2).** New deterministic classifier (src/lib/call-urgency-shared.ts, 13 pin tests) runs over the Bedrock call summary + Retell sentiment on call_analyzed and stamps aiCategory=clinical-urgent on the canonical CALL row — which flows into the EXISTING clinical-urgent surfaces (isabella-today urgent band, any-age per URGAGE1) with zero new query paths. Two tiers: hard phrases (911/emergency/urgent/crisis/suicid*/chest pain/severe reaction/ER…) fire regardless of sentiment; softer distress phrases (ran out of meds, getting worse, can't breathe…) require Negative sentiment. Set-only (never clears), EMAIL triage lane untouched, hot-path safe (no model call). [voice][isabella-today]
• 💵 **Unpaid-only = past-due worklist (UNPAIDPAST1).** ?unpaid=1 on /admin/appointments now widens the date window to ±365d (same mechanism as the PENDING_APPROVAL widen) — past never-paid visits were invisible under the default today→+30d window. Oldest-first, existing paid/partial chip math unchanged. [payments][staff]

Fixed

• 🚨 **Urgent-unreplied emails surface at ANY age (URGAGE1).** The isabella-today urgent band filtered occurredAt > NOW()-24h, so unresolved clinical-urgent emails vanished after a day — prod had 5 invisible rows (oldest ~37 days, all aiCategory=clinical-urgent, resolvedAt NULL). Window removed; the band now mirrors the open-escalation band (resolvedAt IS NULL, any age). [phi-safe][isabella-today]
• 📟 **Callbacks-owed digest: retry + owner failure-alert (DIGRETRY1).** The 7/28 digest hit a transient vendor rejection (count=19 delivered=0) and exited silently — a red buried in a green heartbeat. Now: one 5s-backoff retry per failed recipient, and if NOTHING delivers while callbacks are owed, a count-only no-PHI alert goes to ADMIN_NOTIFY_EMAIL (fallback: shared role mailbox) with the in-app list link. Audit detail gains ownerAlerted=yes. [cron][email]
• 📬 **M365 outbox import weekly → daily (OBXDAILY1).** Replies staff send from Outlook only reconciled into PatientMessage Mondays (0 11 * * 1), so unanswered counts + SLO tiles overstated all week. Now daily (0 11 * * *); health-check staleness 14d → 3d. [cron][metrics-honesty]
• 📠 **Fax poll names skipped faxes (FAXSKIP1).** Poll filtered to status=completed and dropped the rest invisibly (7/28: listed=8 completed=3 — 5 unexplained). Skipped vendor-ids+statuses now ride the heartbeat + did-work summary audit (id:status only — no numbers, no content, no per-run audit spam). [fax][observability]

Fixed

• 💵 **Minted-but-not-sent pay links now visible on Bill via Poynt (SPFTBILL1, Kat cms4tk17t).** The TRUTHFULNESS rule (cme7gsiaz6m60llti5wv1ssal) keys the green ✓ on a CONFIRMED email send only — correct, but it left a minted-yet-unsent link (portal-manual / read-over-phone) rendering as a blank rose button, indistinguishable from never-billed, so staff got re-prompted with no memory of the earlier bill. BillViaPoyntButton gains a third state seeded from poyntInvoiceUrl (and set locally on a successful mint): amber “Billed earlier — bill again” trigger + “pay link created — not emailed” caption + an in-modal heads-up banner (emailed vs merely-minted copy) so a second bill is deliberate. Confirmed-send semantics untouched. Wired on /admin/clinic-day and the appointment detail page (the surfaces that load poyntInvoiceUrl). [payments][staff]

Fixed

• 📞 **Softphone auto-sign-in rebuilt on the widget's real auth mechanism (SPFTJWT1).** Root cause of the 7/27-28 outage: the RC Embeddable widget does not honor the rc-adapter-set-token postMessage both softphones injected tokens through since May — and adversarial verification showed it NEVER did (the widget dispatches inbound messages via a literal type switch; the string appears in zero inspectable CDN builds back to 1.8.7 and zero RingCentral sources). The injection was always a no-op; softphones actually stayed signed in on the widget's own persisted session, which expired/evicted ~7/27 → everyone went dark at once, injection retries could never succeed, and the ladders kept re-minting until staff hit the auth endpoint's 10/hr rate cap (the storms RCFIX2 mitigated). Verified in an isolated harness: valid injected token → zero widget network activity, loggedIn stayed false on latest AND pinned versions; the SAME credential via the widget's documented jwt URL param signed straight in (so version-pinning would NOT have fixed it). Both widgets (RcSoftphone + RcSoftphoneProvider) now use the documented jwt URL-param auto-login: the auth-gated endpoints return the JWT credential (runtime fetch — never in the public JS bundle; also on the RCFIX2 cache path, a pre-ship-review catch) and the iframe mounts only once it's in hand, booting directly into signed-in; the widget refreshes its own tokens thereafter. need-login-credentials now triggers an iframe remount (ref-based 10s debounce, 3-per-mount cap, reset by the Retry/Reset controls) instead of a mint — a dead credential parks visibly instead of looping the rate limit — and a 2-min long-tail refetch keeps the honest 429 copy true. Fetch failures now surface the retry/error UI even though the widget never mounted (new authStuck gate), and the provider portal gains the same clickable retry the admin side got in RCVISIBLE1. Server routes keep the audited access-token exchange as a live credential health-check. [softphone][admin][provider][vendor-behavior]

Fixed

• 📠 **Notifyre download envelope decode (FAXBYTES1).** /fax/received/{id}/download returns {payload:{base64Str,type}} (probed live; head decodes to %PDF-) — never raw bytes. fetchNotifyreFaxContent now decodes the envelope (raw path kept as fallback; fail-quiet null on malformed). Pre-fix rows stored application/json blobs — unreadable by the staff download AND Bedrock OCR. 9/9 notifyre pins green. Backlog re-ingest + OCR re-run follow the deploy. [gw][fax][bug]

Fixed

• 🔍 **OCR pre-match lookback 7→14 days (FAXOCR14).** OCR_LOOKBACK_DAYS constant bump so poll-ingested backlogs one cycle deep stay eligible; spend rails (per-call cap + daily hard-cap + spend ledger) unchanged as the true cost bound. 118/118 OCR pins green. [gw][fax][records]

Added

• ✅ **'Your appointment is secured' on payment receipts (SECURED1, Mariane cmr4dg9j ask 4).** renderPaymentReceiptEmail gains securedLine (rendered only for an upcoming, non-terminal visit — CANCELLED/NO_SHOW/COMPLETED excluded); payment-receipt-send derives it from the appointment. One template, every payment rail; 23/23 receipt pins green incl. anti-divergence. [gw][billing]

Added

• 📮 **Intake-form fill-the-gap mailing address (INTAKEADDR1, Mariane cms4306e).** Intake page passes needsAddress (patient.address empty — the non-nullable R6-5b convention); client renders the card only then; API zod mailingAddress max 500 → guarded updateMany({where:{id, address:""}}) fills ONLY an empty address (token-gated public surface can never overwrite), PHI-free kind=address-gap-filled audit on count=1. [gw][booking][records]

Added

• 🧾 **RECEIPT1 — receipt email for synchronous Collect charges.** sendReceiptEmailIdempotent extracted from the Poynt webhook route into shared src/lib/payment-receipt-send.ts (webhook now imports it; the send now rides the workflow.ts sendEmail wrapper — a strict superset that additionally audits provider-outage failures); the patient /pay chargeViaCollect and the staff terminal chargeTerminal (appointment mode) now fire it post-success. Deterministic dedup ids collect: / terminal: — NEVER time-salted (verify-pass catch: a Date.now() salt would defeat the PoyntReceiptEmailLog UNIQUE(poyntInvoiceId) dedup); the Poynt transactionId is stable across retries because the deterministic Poynt-Request-Id collapses them upstream. Webhook receipts can't double-fire for these (an in-portal Collect SALE has no Poynt invoice). Consent gates unchanged (unsubscribed/bouncing/no-email recorded, not sent). Closes the confirmed gap from reviewer-feedback cmr4dg9jj. [gw][payments][email]
• 📬 **MAILGATE1 — unpaid visits block the authorization mail-out (Doug 2026-07-28).** Unpaid authorizations CAN exist (Manager+ authorize-override lane), so the MAIL layer now re-enforces the payment gate: mailing-queue rows carry a server-computed fullyPaid (raw payment fields stripped via stripPaymentInputs); mark_mailed refuses unpaid with 409 + blocked-unpaid audit row unless overrideUnpaid from ADMIN/MANAGER (SCHEDULER's override refused server-side; overrides audit-flagged override=unpaid); bulk mark-mailed silently skips unpaid (blockedUnpaid count in response + audit — deliberately NO bulk override); the all=true Avery label batch never prints an unpaid row (explicit ids= keeps them for the override lane) + gained the reprint-idempotency id tiebreaker. UI: red "Unpaid — don't mail" badge + 409→manager-confirm→override retry. [gw][payments][mailing][compliance]
• 📊 **Payment-automation visibility trio.** /admin/payments "Auto-reminders" tile (today's DEPOSIT_REMINDER_SENT + PAYMENT_CHASE_SENT result=sent counts — counts only, per the verify pass); appointment-detail Payment section shows the last auto-reminder ("sent Xh ago (r2 · email)" parsed from the PatientMessage externalId); My Day shows a payment-automation armed/off badge reading the env flags directly and branching deposit-mode vs balance-mode wording so it can never claim the wrong ladder. [gw][payments][visibility]
• 🔗 **Terminal shortcuts + stale-runbook fix.** Invoice-queue rows (PENDING + known-patient only) link to /admin/take-payment?patientId=… with helper copy that a custom terminal charge does NOT auto-flip the queue row (still Mark paid after); workflow guide links the terminal and now correctly says in-app terminal charges record themselves — the old copy would have had staff double-recording. [gw][front-desk][polish]

Added

• 🔑 **Logged-in self-serve password change (MYACCOUNT1).** New /admin/my-account (every role; session-gated; renders own name+role only) + AdminChangePasswordCard (patient-portal mirror) + POST /api/admin/change-password (bcrypt.compare then cost-12 hash, keyed to guard.adminId only, rate limit 5/15min ip+adminId failClosed, audits ADMIN_PASSWORD_CHANGE kind=self-change AND kind=self-change-wrong-current, consumes any outstanding reset token on success). Nav: Help group, ALL_ADMIN; proxy BOOKKEEPER carve-out for page+API (the KATFIX1 dead-link class). Known limitation (same as reset flow): JWT sessions aren't revoked on change. nav-scheduler-page-parity 6/6 green. [gw][auth]

Fixed

• 🗣️ **Message-flow last-name collection (VOICELASTNAME1, Kat cms3jhoi).** voice-prompt.ts messageDetails: 'name' → 'FIRST and LAST name' with the natural follow-up + the why (first-name-only defeats patient matching). The booking flow already required full name — this closes the message/callback gap (the Patrick case). Requires post-deploy retell-sync to reach the live agent. [gw][isabella][voice]

Added

• ⚡ **Next-day-offer flag (NEXTDAY1, Kat cms3ludo).** Pure next-day-offer-heuristic.ts (three signals: literal tomorrow/next-day OR explicit Month-D date == callDate+1 in America/Los_Angeles (year-rollover safe) + offer/booking verb + phrase-level existing-appointment guard — corpus-validated 789 summaries: 10 candidates → 2 flagged, both genuine, 8/8 rejections correct; thin-n caveat honest). VoiceCallRow.nextDayOffer computed at the query layer (raw summary never reaches the client) + amber chip; /admin/today amber strip mirrors the cms3o4yx rose-strip pattern (last-24h calls, JS filter, defensive empty). Recall-upgrade path documented: Retell custom_analysis_data boolean at the webhook parse point. [gw][front-desk][isabella]

Added

• 📋 **Call-summary card on the Isabella detail page (CALLSUM1, Kat cms3n4gm).** getContactDetail now returns focusSummary (aiCallSummary scrub-then-truncate 1200 chars server-side — same render-boundary discipline as the list views); renders as a green card above the work-this-call actions, only when a summary exists. [gw][front-desk][isabella]

Added

• 📮 **Mailing address on the provider authorization page (AUTHADDR1, Mariane cms4306e — safe half).** address added to the patient select (query already scoped to issuingProviderId — own patients only; minimum-necessary for the mailing step; address already renders for admin + on the encounter chart per the Dr. Ari ships) + header line with honest empty state. Booking wizard already REQUIRES address on the direct path (BookingSchema min(5)); known gap flagged to Doug: the Poynt pay-to-confirm path drops the wizard-typed address. [gw][providers]

Added

• 📞 **Messages Calls-tab cockpit parity (CALLPARITY1, Kat cms3jjn2).** kind/status/summary derivation extracted VERBATIM from getVoiceCallLog into pure voice-call-breakdown-shared.ts (scrub-then-trim preserved; cockpit swapped to the shared helper — behavior-neutral, 25/25 pin tests green). Messages API enriches CALL rows server-side (callKind/callStatus — deliberately NOT status, which is delivery-state and drives unread/markAllRead — plus callOutcome, scrubbed callSummaryPreview, patientClinic from the latest appointment's location); raw needsHumanAt/resolvedAt/aiCallSummary never reach the client. Calls tab keys rows by message id (per-call log) while every other tab keeps per-patient grouping. Junk-call exclusion untouched. [gw][front-desk][isabella]

Fixed

• 🩹 **FAXPOLL1 gate unblock (FAXPOLL1B).** /api/cron/fax-poll shipped without heartbeat wiring → check-cron-heartbeat gate red on main. Added the canary heartbeat after auth (fires even while the provider gate is dark) + completion heartbeat with listed/completed summary, registered fax-poll in health's EXPECTED_CRON_ACTORS (staleAfterDays 0.1 for the */10 cadence), lifted the inlined 60_000 → MINUTE_MS (check-time-constants-inline), and re-synced changelog-current.ts (CONFPORTAL1/RETSHADOW1 shipped without the bump — the same drift-gate trap twice tonight). Full run-gates --env=ci suite verified green locally before push. [gw][cron][gates]

Added

• 🚪 **Booking-confirmation portal CTA (CONFPORTAL1, Mariane cmrsg799 — rebuilt; prior fix 2c01741 was swept pre-merge in the 7/25 git cleanup).** StepConfirmation gains a portal card under the email/fax expedite card, routed via /my-appointments (self-serve magic-link request) — deliberately NO portal token in the unauthenticated wizard; the PORTAL_WELCOME email carries the direct secure link. [gw][booking]

Added

• 📊 **Returning-patient shadow telemetry + arming-evidence tile (RETSHADOW1, cmq1rlrg).** New RETURNING_PATIENT_SHADOW_MATCH audit literal (String column — no migration); booking route captures pre-upsert email-match inside the tx (closure-hoisted) and fires a PHI-free post-tx row (flag=on|off selfReported=0|1 channel=…) — fire-and-forget, can never disturb a committed booking. AdminTodayTiles gains a count-only 7d tile (flag=off rows). Expert audit verdict on the dark feature: email lane fail-closed end-to-end (constant-response + on-file-address-only OTP + narrow 30-min prefill token, conditions never selected); known inert wire: routedProviderId never reaches the booking POST (silent same-provider routing is a no-op — de-scoped from the arming pitch). Keep RETURNING_PATIENT_SMS_VERIFY_ENABLED dark: first-match-wins phone lookup vs 3,518 patients sharing 1,688 numbers. Arming = both env flags + redeploy (NEXT_PUBLIC mirror is build-time). [gw][booking][evidence]

Added

• 💰 **Pre-visit payment reminders for the FULL visit fee (PAYAUTO1 — reviewer-feedback cmr5rn8f1, Doug greenlight 2026-07-28).** The existing deposit-reminder ladder (/api/cron/deposit-reminder, hourly, r1 booking+20h → r2 T-72h → r3 T-26h → staff-notify T-10h, DEPREMIND2 quiet hours, once-ever per stage via PatientMessage externalId dedupe) now runs in TWO modes: deposit model ON = original $50-deposit lane, byte-identical; deposit model OFF = chases the REMAINING visit fee (expected − collected, skip < $1) behind its own NEW flag PREVISIT_PAY_REMINDER_ENABLED — flipping the deposit model off can never silently re-purpose the ladder, arming is explicit. All copy branches per mode (no "deposit" wording on a full-fee nudge); audit rows carry mode=deposit|balance amountCents=N. **First-arm flood control:** balance mode caps at 25 patient sends per hourly tick so the 30-day unpaid backlog drains over a day instead of one blast; staff cutoff alerts are exempt from the cap and from quiet hours (unchanged). Consent gates unchanged (email: unsubscribed/bounced; SMS: dual smsConsent + preferred-contact-method narrowing). No new send rails, no schema, NO auto-cancel (Doug §E stands). With this armed the requested workflow is complete end-to-end: book → confirmation w/ pay link → pre-visit ladder → day-of payment-chase → /pay records + auto-releases the authorization. +4 pins (24 green in deposit-reminder.test.ts). **Armed at deploy:** PREVISIT_PAY_REMINDER_ENABLED=true set on prod with this ship. [gw][payments][cron][automation]

Changed

• 💳 **Closed-set custom-charge reasons (TERMINAL3 — hipaa-architect recommended hardening, DOUG_GATES 2026-07-28 default-with-override).** TERMINAL_CUSTOM_REASONS enum (replacement-card-fee / no-show-fee / records-fee / other) in terminal-charge-shared.ts; the action schema now takes the enum + an optional ≤120-char reasonNote (required when reason=other). The §164.502(b) minimum-necessary control goes from label-based (a "billing copy only" caption on a free-text field) to STRUCTURAL: audit detail carries reason= noteLen= — the note's bytes are never interpolated into an audit row, pin-tested (only ${reasonNote.length} is permitted; raw ${reasonNote} fails CI). Widget swaps the text input for dropdown + note field. 23 pins green. Closes the check-pii-in-audit-detail blind-spot concern for this field by making a clinical slip structurally unloggable. [gw][payments][hipaa][terminal]

Added

• 📠 **Poll-based inbound-fax ingest (FAXPOLL1).** Notifyre webhook registration is portal-only and was never completed, while the provisioned number was live and accumulating real PHI faxes vendor-side. New /api/cron/fax-poll (every 10 min, CRON_SECRET-gated) lists received faxes via the Notifyre API and SELF-POSTS each completed fax to /api/inbound/fax as a synthesized fax_received envelope — exercising the exact production chain (signature gate honored via HMAC when NOTIFYRE_WEBHOOK_SECRET is set · runtime BAA gate stays enforced IN the route · dedup on fax id makes polling idempotent · lead phone-match · private persist · PHI-free audits). Zero new PHI logic in the cron (metadata only; bytes fetched inside the route). PHI-free poll_summary audit row per productive run. Coexists safely with a future real webhook registration. [gw][fax][records]

Added

• 🟡 **Isabella-booked = yellow on the calendar + list badge (ISAYELLOW1, Kat cms3jfo2).** No migration needed — Appointment.originChannel existed since mig-38 (indexed, default 'web') but only the voice pay-link path ever stamped it (self-sched-confirm). Now: /api/appointments verifies the AI bots' x-internal-secret (timingSafeEqual vs CHAT_BOT_INTERNAL_SECRET, fail-closed — an unverified caller can NOT forge the Isabella stamp) and maps x-internal-source → chat/email/sms; the staff manual route stamps admin. Calendar API + grid render yellow fill (overrides provider color; tele left-edge kept) + 🤖 label + tooltip + legend; appointments table gets a row tint + '🤖 Isabella · channel' badge. Voice-callback→staff-booked appointments stamp 'admin' (Isabella's live voice flow creates callback leads, not bookings — flagged as a known limitation). [gw][front-desk][isabella]

Fixed

• 📞 **Softphone sign-in storm killed (RCFIX2, Mary cms3k68r — but Kat + Mariane were hit too).** The RCHARDEN1 (7/24) enabled:false env-heal (700ms×15s interval + on every need-credentials) RACED injectToken's enabled:true — the widget env flip-flopped, each flip re-emitted need-credentials, the mint endpoint saw 5 requests in 3s, and every softphone user saturated the 10/hr cap → 429-locked hourly (audit-verified for all three on 7/27-28). Fix: ONE canonical {server, enabled:true} environment message everywhere (idempotent; overwrites a persisted devtest override by repointing, not toggling), heal interval deleted, widget-triggered re-injects debounced (5s floor), /api/admin/rc/auth-token now serves a per-admin cached token while ≥5min TTL remains (rate cap counts FRESH RC exchanges only — 429 lockout structurally impossible), and 429 copy is honest. Provider-portal sister verified clean (no heal loop). [gw][softphone][bug]

Added

• 💳 **Terminal polish batch (TERMINAL2).** (1) **Partial payments** — per-balance-row Partial… input in TerminalWidget; client validates $1.00 ≤ amount ≤ remaining, the server's existing recomputed cap (+$1 slack) remains the authority; charges accumulate into amountCollectedCents exactly as before so the visit's remaining balance stays truthful. (2) **Take another payment reset** on the success/already-paid cards (onReset prop on AdminCollectPaymentForm) — returns to the picker and RE-FETCHES balances (the charge that just ran changes what's owed); a fresh form mount mints a fresh attemptId, so the idempotency contract is untouched by construction. (3) **Recent terminal charges strip** — new GET /api/admin/take-payment/recent (same TERMINAL_CHARGE_ROLES gate) reads the last 15 PAY_COLLECT_CHARGED/_FAILED audit rows scoped to via=terminal and returns amount/outcome/mode/staff-name/time; PHI-free by construction (audit metadata only — pin-tested no db.patient/db.appointment reads; appointment-mode rows deep-link to the visit, custom-mode rows deliberately unlinked since their resourceId may be a patient id). Renders under the terminal with manual refresh; quietly absent on error (aid, not a gate — Payments page stays authoritative). +3 pin tests (22 total in terminal-charge.test.ts). [gw][payments][front-desk][terminal]

Added

• 📝 **EOD drafts persist until submission (EODDRAFT1, Mary cms3hgay).** New EodDraftFields client island mirrors both textareas to localStorage (debounced 400ms) under a per-user/per-day key; restores only into empty fields on mount; other days' keys swept; server value (submitted EOD) always wins. name= attrs preserved — submitEod's FormData path unchanged. Draft lives only in the staffer's own browser (same exposure class as browser form-restore; first-name+last-initial guidance unchanged). [gw][front-desk]

Fixed

• 🔑 **Admin forgot-password actually works for Kat (KATQ1, cms3j7ff).** Root cause (DB-verified): her AdminUser had no secondaryEmail, so typing kat@greenwellness.org hit the anti-enumeration silent no-op forever — success UI, nothing minted, nothing audited, since Jul 2. Fixed three ways: (a) data — secondaryEmail set (ALTLOGIN1 parity with Mary, applied live pre-deploy); (b) fail-silent send killed — sendEmail() returns false without throwing on vendor failure and the route ignored it; now audits kind=forgot-send-failed either way (anti-enumeration response unchanged); (c) rate-limit keyed ip+sha256(email)[:12] instead of bare IP — 3/hr against the shared office NAT let one staffer's attempts exhaust everyone's. [gw][auth][bug]
• 📇 **Patient card: address no longer required to save other edits (cms3pxc0).** The WA-address input's required blocked saving ANY change (e.g. a phone fix) for patients without an address on file; the PATCH route already accepted empty (R6 5b). Client requirement dropped + label says where address IS collected (booking). [gw][front-desk][bug]
• 🔔 **Expiring-this-week banner is booked-aware (cms3pp9w).** Each row now checks the patient's upcoming SCHEDULED/CONFIRMED appointment and COMPLETED visits in the last 14d (one filtered relation): '✓ booked M/d' (emerald) / 'seen M/d — cert update pending' (amber) / Book renewal link only when genuinely unhandled. [gw][front-desk]
• 🪪 **Isabella voice log: matched patient name + home clinic chip (cms3n2j5 + cms3nbvw).** VoiceCallRow gains patientLabel ('Jane S.' — house PHI-minimal shape) + patientClinic (most-recent appointment's location, 'Spokane'), one batched absence-tolerant lookup; rendered under the caller number as a link to the patient card. Kat's 'SHOULD SAY HES A SPOKANE PATIENT' — now it does. [gw][isabella]
• ✅ **Closed with receipts:** cms3me52 (isabella-today links to patient card — shipped earlier tonight as CBLINK1 fc7e872, was filed pre-fix) · cms3pnsi ('still says demi' — the isabella-today code tree + OpsTaskState data verified ZERO user-visible Demi strings; the July copy-sweep landed; stale cached bundle, hard-refresh clears). [gw][receipts]

Added

• 💸 **Auto payment-request email on held authorization (PAYFLOW1, Mariane cmrsi0que).** New src/lib/held-auth-payment-email.ts fires from BOTH held-pending-payment branches (encounter sign route + /api/provider/action): derives the balance + signed /pay URL via the proven deriveAppointmentPayLink rail (same math as booking-confirmation + reminder emails), renders the new renderHeldAuthPaymentEmail template (first-name + balance + link only — zero clinical detail), sends via the BAA email rail. Fail-closed gates: paid/cancelled/no-show, no-email/unsubscribed/hard-bounced, no mintable pay URL, balance ≤ 0 or > $5,000 (fee-sentinel guard). Deduped one-per-appointment via new PAYMENT_REQUEST_AUTO WorkflowEvent (mig-127, expand-only, applied to prod pre-deploy); marker written ONLY on confirmed send. Audit PAY_LINK_EMAIL_SENT mode=auto-held-auth with sha256 recipient hash. Kill switch POSTENC_PAYMENT_EMAIL_DISABLED=true. Payment landing then rides the EXISTING releaseGatedAuthForAppointment → cert issue + patient email chain — Mariane's steps 2–6 now fully automated. [gw][providers][billing]
• 🗣️ **Provider banner + 402 copy tell the truth about the closed loop.** The post-sign 'HELD until payment' banner and the Sign & Issue 402 now say the patient was emailed a payment request and the authorization will issue + email automatically on payment (or, when the email couldn't send, the honest front-desk fallback instruction). held-pending-payment outcome carries paymentEmailed. [gw][providers]

Added

• 💳 **Staff phone terminal (TERMINAL1, brief TAKE_PAYMENT_TERMINAL_BUILD_BRIEF_2026_07_27.md).** Two surfaces, ONE engine — deliberately no second money path. (A) /admin/take-payment: debounced patient search (existing sidebar-search API) → open visit balances with server-computed remaining (new /api/admin/take-payment/context, same role gate, PHI-light: names/times/amounts, never birth dates or clinical fields, PATIENT_SEARCH-audited) → Poynt Collect iframe → charge. (B) TakePaymentInline island on /admin/patients/[id] mounts the same TerminalWidget without leaving the page. **Engine:** new chargeTerminal server action — the admin sibling of the patient /pay chargeViaCollect, reusing chargeCollectCard + the full idempotency ladder: fresh already-paid preempt (card never touched on a webhook race), insert-first single-flight reserve on the PoyntWebhookDelivery unique constraint (one client-minted attemptId ⇒ at most one charge ever; re-submitting a settled attempt returns "already went through", never a second charge), and a deterministic Poynt-Request-Id anchored on (resource, attemptId, mode, amount) so a timeout retry collapses at Poynt — while the client rotates the attemptId on a definitive decline so a corrected card gets a fresh key. Appointment mode records payment exactly like the patient flow (accumulated amountCollectedCents + MANUAL:POYNT: sentinel + the same cert/auth release cascade via releaseGatedAuthForAppointment); custom mode (requires an admin-typed ≤120-char billing reason, labeled billing-copy-only) deliberately never touches visit accounting. **Gates:** requireAdminFromHeaders([ADMIN, MANAGER, SCHEDULER]) at the action AND the context route (BOOKKEEPER excluded from moving money), per-staffer (20/10min) + per-patient (10/10min) rate limits, server-recomputed balance cap with the same +$1 rounding slack as /pay. **PCI SAQ-A unchanged:** the card enters Poynt's iframe (collect.commerce.godaddy.com, already CSP-allowlisted); GW only ever sees the one-time nonce, which is never logged. **HIPAA:** Poynt receives nonce + amount + the cardholder name typed into Poynt's own iframe; audit rows carry ids/amounts/enums + the sanitized billing reason — pin-tested that the card nonce never reaches an audit detail. Audit reuses the PAY_COLLECT_CHARGED/_FAILED/_REJECTED taxonomy with via=terminal by= (no new AuditAction). **Tests:** 19 pins in src/lib/__tests__/terminal-charge.test.ts (roles, amount envelope, reserve-key identity, request-id anchor, plus source-order pins: gate→already-paid-preempt→nothing-owed-guard→reserve→charge, failure releases the reserve, no receiptEmail). Reviewed pre-merge by code-reviewer + payments-compliance (both PASS; the nothing-owed guard closes the reviewer's phantom-$1 edge on legacy collected-but-unsentineled rows). New shared substrate src/lib/terminal-charge-shared.ts; nav: Finance → "Take a payment". [gw][payments][front-desk][pci][terminal]

Fixed

• 📄 **Patient-chart large-PDF uploads (PDFLANE1, Mariane 2026-07-27).** Ported the BLOBUP1 direct-to-blob client-upload lane from lead documents to the patient chart: new /api/blob/patient-documents token issuer (admin-session-checked inside onBeforeGenerateToken — the route lives outside the proxy admin gate by necessity, same as the lead sibling) + /api/admin/patients/[id]/documents/register (server-side magic-byte %PDF- confirm on the fetched bytes, 25 MB cap, MedicalDocument row with canonical head().url blobUrl, PHI-free ADMIN_DOCUMENT_UPLOADED audit with via=client-upload, spoofed blobs deleted). DocumentsList routes >4 MB ≤25 MB PDFs through the lane; everything else keeps the existing pre-flight (photo downscale / honest error). Prod evidence: across 259 MedicalDocuments the largest ever accepted was 3.8 MB — the platform's ~4.5 MB serverless body cap made the route's 25 MB check unreachable. [gw][front-desk][records]

Fixed

• 🩺 **Staff-uploaded medical records now sync to the Provider Portal (RECSYNC1, Mariane 2026-07-28 — urgent, pre-visit).** Provider-side reads scoped documents through the *appointment* relation and filtered uploadedBy to patient-only, so admin/staff uploads (uploadedBy:"admin", and — the real killer — a **null appointmentId**) were invisible by construction. Re-scoped to the **patient**: a provider sees a patient's live MedicalDocuments when they have an appointment with that patient (same boundary as the new-encounter patient picker). Fixed on all provider surfaces: new-encounter screen, encounter chart's "uploaded records & ID" card (which read a *separate* table and missed these entirely), portal-home awaiting-signature list, and the **document-open/download endpoint** (/api/provider/documents/[id]) — which had the identical appointment-scoped guard and would have 404'd every staff-uploaded record even if listed. New shared src/lib/provider-documents.ts. Verified against prod: Abby's full tomorrow roster (Loren B 13 records, Toni K, Stephen P/W, …) now resolves; patients she doesn't treat still correctly denied. [gw][providers][records][bug]

Fixed

• 🔗 **Callbacks rows deep-link to the patient card when linked** (/admin/isabella-today, CBLINK1 — Kat feedback). The row deep-link was hardcoded to /admin/messages?id=… (which lands on the queue, not a specific patient); now it's /admin/patients/{id} whenever the row has a patientId, with the message view as the fallback for unlinked callers. Both callback bands fixed. [gw][front-desk][bug]
• 🏷️ **Callbacks page title** "Isabella — today's queue" → **"Callbacks"** to match the sidebar label. [gw][front-desk]

Fixed

• 🛑 **Hard-stopped Olympia + Seattle booking (OLYCLOSE1, Doug 2026-07-27).** (1) DB: Location loc-olympia set isActive=false (Seattle already was); deleted 84 open/unbooked future AvailabilitySlots at Olympia (rows referenced by real appointments left intact). (2) Code: added Olympia + Seattle to shouldSkipForClosure in src/lib/closure-cutoffs.ts with an immediate past-dated default cutoff, so the slot generator (slot-generation-shared.ts) skips them permanently and can't regenerate — env-reversible via OLYMPIA_CLOSURE_AT / SEATTLE_CLOSURE_AT if a location reopens. This closes the live leak where the self-scheduling site + Isabella could offer Olympia slots that no longer exist. [gw][booking][patient-safety]

Fixed

• 📞 **Voice booking-leads now surface on the Callbacks queue (CALLBACKVIS1 — the flow-review #1 root cause).** captureLeadFromVoice (src/lib/voice-tools.ts) previously wrote ONLY a LEAD_CAPTURED audit row + a leads email — nothing with needsHumanAt, so it never appeared on /admin/isabella-today (which selects needsHumanAt IS NOT NULL, resolvedAt IS NULL). Now it ALSO creates a PatientMessage (channel=CALL, direction=IN, needsHumanAt, aiCategory=booking, fromAddr=caller phone) so every captured call becomes a visible callback. Fail-soft (try/catch — never breaks the live call); the post-call transcript row is written separately by the webhook. This is what left ~200 calls with no visible callback. [gw][patient-flow][front-desk]

Changed

• 🧹 **One authoritative worklist:** removed the full upset-callers panel from My Day (kept on the Front Desk Board / admin-today); restored the "Isabella Cockpit" label (manager reference page, admin-only). NOTE: a "callbacks owed" My Day checklist tile was held back — the three existing "callbacks owed" definitions (isabella-today union, the digest, and the raw call count) disagree, so a checklist number would have contradicted the page it links to; unifying them into one shared count is the follow-up. [gw][simplify]

Changed

• 🧭 **Nav renames for clarity (SIMPLIFY1, Doug "GW needs simplified"):** /admin/today "Today"→"My Day" (the one home), /admin/isabella-today "Isabella Today"→"Callbacks" (PhoneCall icon), /admin/isabella "Isabella Cockpit"→"Isabella Analytics", /admin/admin-today "Admin Today"→"Front Desk Board". Labels + keywords only — hrefs, roles, and access unchanged. Kills the four-way "which *Today* page is my workspace" collision that had Kat + Mary landing on the wrong (or empty) surface. [gw][front-desk][simplify]

Added

• 🔴 **"Upset callers — follow up today" panel at the top of /admin/admin-today** (src/components/admin/UpsetCallersPanel.tsx, UPSETCALLERS1). Lists inbound CALLs from the last 14 days that Isabella's line flagged aiCallSentiment='Negative', unresolved-first, with the caller's name (first + last initial), fromAddr phone (tel: link), the aiCallSummary, and the timestamp; plus a count of all still-unresolved inbound calls linking to /admin/messages. Built after Isabella's booking was found offering unreal slots — this makes sure anyone she left unhappy gets a callback. PHI: staff worklist in the BAA app, minimum-necessary (initial + number + summary for the callback); each query self-shields to empty on failure. [gw][front-desk][service-recovery]

Changed

• 🧭 **Promoted /admin/isabella-today into the always-open top nav group** (nav-config.ts, ISATODAYNAV1). It's the callback / who-needs-an-appointment worklist (Doug's own morning page) but lived in the collapsed "Isabella" section, so the front desk (Kat + Mary) couldn't find it. Moved to the top "Operate" group and removed from the Isabella group (a duplicated href double-highlights). Keywords widened (callbacks / who needs an appointment / call log / calls) so the sidebar search surfaces it. Same href + roles (ADMIN/MANAGER/SCHEDULER) — no access change. [gw][scheduler-ux][discoverability]

Added

• 👁 **"Preview as" role toggle for ADMIN/MANAGER** (VIEWAS1 — src/lib/admin-view-as.ts pure helper + ViewAsRoleToggle chip in the admin layout). Sets a gw_view_as_role cookie; the sidebar (AdminNav) renders the previewed role's items and the /admin landing router routes to that role's home (scheduler → /admin/today, etc.). **DISPLAY-ONLY, never an auth boundary:** every API/route still authorizes on the REAL role via the proxy's x-admin-role header — the helper can only DOWN-LEVEL (ADMIN excluded from the previewable set; a lower role can't preview at all), so it can neither escalate nor restrict actual access. Server action re-verifies the caller is a real ADMIN/MANAGER before persisting, and rejects any non-down-level target. Requested by Doug so Kat (a GW admin) can preview the scheduler experience without giving up admin. [gw][admin][testing]

Added

• 🩺 **Structured Subjective slots in the intake pre-fill engine, dark behind PROVIDER_SOAP_AUTODRAFT_ENABLED** (SOAPDRAFT1). IntakePrefillSchema gains a nullable subjectiveSections (HPI / current cannabis use / therapies tried / prior-auth status, each a Sourced value+verbatim-quote); the system prompt instructs faithful, DESCRIPTIVE transcription only (no assessment/plan/efficacy). flattenPrefill emits one Accept card per populated slot (target = Subjective) and skips the single-skeleton card when slots are present, else falls back to today's skeleton. The intake-prefill route strips subjectiveSections unless the flag is armed, so dark = byte-identical behavior. Additive: subjectiveSkeleton kept; same Bedrock-BAA extractor pass (no new model call), same temp-0, same PHI-free audit. Control model unchanged — no AI module reaches the signing path (control-model pin still green); every slot is a human Accept into the editable SoapEditor. +6 display tests, engine-schema fixtures updated; 28/28 green. **Arming is a clinician + Doug review (WSLCB claim-class + HIPAA) — filed as a Doug-gate.** [gw][provider][ai][dark]

Added

• ✅ **One-click "Confirm all tomorrow" on the My Day card** (src/components/admin/MyDayActions.tsx client island wired into MyDayPlan.tsx, MYDAYACT1). The card's tomorrow-confirm target now fetches the appointment IDs (was a bare count) and renders a bulk-confirm button when any are unconfirmed; it POSTs to the existing SCHEDULER-allowed /api/admin/appointments/bulk-confirm (race-safe conditional updateMany on status=SCHEDULED), toasts the confirmed count, and refreshes. No new authority, no schema, IDs only (no PHI on the card). [gw][scheduler-ux]

Fixed

• 🛡️ **Promo-code toggle + delete now guard on res.ok** (src/app/admin/promo-codes/page.tsx, PROMOGUARD1). Both toggleActive and deleteCode applied their optimistic UI mutation unconditionally — a failed PATCH/DELETE left split-brain (UI and server disagree, so staff hand out a dead link or think a live one is gone). Now the state change only applies on res.ok; on failure it toasts + resyncs via load(). Network errors caught to null. [gw][reliability]
• ↩️ **Provider Earnings back-link uses a left-pointing chevron** (src/app/provider/portal/earnings/page.tsx, was ChevronRight) — matches back-navigation convention on a daily-use page. [gw][provider][polish]

Added

• 💤 **/admin/today now has a loading skeleton** (src/app/admin/today/loading.tsx, TODAYLOAD1). The highest-traffic admin surface ran five parallel force-dynamic DB aggregations that blocked the whole shell (incl. the sidebar) on a slow render, with no loading.tsx (unlike /admin/leads + /admin/cs-command-center). Instant skeleton of the My Day card + appointment list. UI only — no data, no PHI. [gw][perf]
• 💵 **Provider portal "Earnings" is now in the nav's More ▾ menu** (ProviderPortalNav.tsx, EARNNAV1, both v1 + v2). The pay-visibility page (PROVEARN1) was only reachable from a home quick-link card — invisible from the persistent nav. Homed under More ▾ so it's one click from anywhere without adding a 7th top-level tab (keeps Mariane's 6-tab structure). [gw][provider][discoverability]

Fixed

• 🔒 **redactName() on /admin/amendments now returns initials-only** (src/app/admin/amendments/page.tsx). The helper computed the first initial fi but the return template interpolated the full firstName, so the "redacted" queue rendered Jonathan D. instead of the intended J. D. — a minimum-necessary (§164.502(b)) slip on a staff worklist. One-line fix honoring the helper's evident intent; surfaced + adversarially verified by the cross-portal improvement workflow. [gw][hipaa][minimum-necessary]

Changed

• 🗓️ **Poynt invoice due date now = the appointment's exam date** (appointment.startsAt) instead of the generic +7-day default. Threaded an optional dueAt through the shared resolveBillPayLink tier resolver (src/lib/bill-poynt-tier-shared.ts) into createInvoiceLink (which already accepted dueAt), and both mint routes — bill-poynt and email-pay-link — now pass dueAt: appointment.startsAt, so the modal link and the emailed link stay identical (parity pin honored). dueAt is forwarded to the dynamic-invoice tier ONLY; the fixed-link + in-portal /pay Collect tiers have no per-invoice due-date field and are untouched. Forwarded CONDITIONALLY (only when a date is supplied) so the existing bill-poynt-tier-shared deepEqual parity test stays green; added two tests — one asserting the exam date threads through, one asserting no dueAt key is added when unset (preserving the +7-day default). No PHI added to the Poynt payload (a due date is not an identifier); no schema, no new API. [gw][payments][poynt]

Added

• 🌅 **New "Your day" plan card at the top of /admin/today** (src/components/admin/MyDayPlan.tsx, wired in src/app/admin/today/page.tsx). A forward-looking daily-target checklist that consolidates the day-plan previously scattered across /admin/today, /admin/admin-today, /admin/clinic-day, and /admin/tasks into one glanceable answer to "what do I need to do today?". Targets are the cleanly-ownable get-to-zero queues: telehealth links missing for the next 48h, tomorrow's unconfirmed appointments, unread SMS/email, new/due-back leads, unprocessed inbound faxes (30d), and — when the task board is on — the staffer's own open tasks. Live progress bar (cleared of total) + a priority-ranked "Do this next" pointer. [gw][ops][scheduler-ux]
• 📊 **Daily-target productivity model (Doug 2026-07-27)** — a fixed "clear to zero" checklist the operator sees for themselves, NOT a staff-vs-staff ranking or a time-based "you're behind" guilt trip. The comparative manager scorecard stays where it is (/admin/staff-scorecard, ADMIN/MANAGER-only). When STAFF_EOD_ENABLED is on, the card also shows the staffer's own live "patients moved forward today" momentum (from computeDailySnapshot) and a "Wrap up your day" link to /admin/my-eod. [gw][ops]
• 🪶 **Yesterday's carry-over resurfaced** — if the signed-in staffer left a carry-over note on their most recent end-of-day, it shows at the top of the card so they pick up where they left off (their OWN staffEod row only, scoped to session.userId). [gw][ops]

Changed

• 🔒 **PHI posture unchanged (self-reviewed, minimum-necessary):** every queue value on the card is a COUNT with a deep-link — no patient name, DOB, id, or clinical detail is rendered. The one free-text element (yesterday's carry-over) is the staffer's own BAA-in-app EOD note, exactly as /admin/my-eod already displays it. Each count query is independently .catch(() => null) (renders "—", excluded from progress) so one failing query degrades a single row instead of 500ing the landing page. The card renders only for ADMIN/MANAGER/SCHEDULER (BOOKKEEPER excluded — no patient-queue work). No new schema, no new audit surface, no new egress. [gw][hipaa][resilience]

Changed

• 🔗 **Cross-link from /admin/slots/manage to Manage Providers.** Mariane's feedback-queue request: "add an option under Manage Providers to deactivate or mark a provider inactive." The Active/Inactive toggle already exists on /admin/providers; the Manage Slots page subtitle now surfaces that with a direct link. UI-only change; no schema, no API, no auth changes. [gw][ux][discoverability][MY0006]

Removed

• 🧭 **Removed the unlicensed coming-soon states MO / VA / MN from MMJ_STATES** (src/lib/states-content.ts) and from the STATE_NAV_LINKS menu duplicate (src/lib/states-nav.ts). Dr. Turner is NOT licensed in Missouri, Virginia, or Minnesota, so their comingSoon teaser pages overstated GW's reach — a marketing-truthfulness fix. The approved public set is now WA (live, served off /qualify/washington, never an MMJ_STATES entry) + PA / OH / IL / MD (coming-soon). comingSoon governs teaser copy ONLY; per-state bookability was and remains fail-closed via isStateLive() / ProviderStateLicense — so this touches nothing in the release-gate / booking path. The /telehealth/[city] route enumerates MMJ_STATES in generateStaticParams with dynamicParams=false, so the three slugs simply stop being generated. All downstream consumers (sitemap.ts, admin/expansion, the /api/state-interest allowlists, StateLandingPage siblings, state-platform-readiness) derive from MMJ_STATES via map/filter/Set/Map and degrade cleanly; any historical StateInterest DB rows for MO/VA/MN are harmless orphans (admin panel falls back to showing the raw abbr) — NO migration. [gw][compliance][marketing-truthfulness]
• 🔁 **301 redirects for the retired /telehealth/{missouri,virginia,minnesota} URLs** (next.config.ts redirects()), plus their deep /:rest* state/city paths, → /telehealth so inbound links and any cached SERP entries don't hard-404. Redirects run before routing, so they fire even though the dynamic route no longer emits those slugs. Mirrors the established Vancouver-clinic-removal redirect idiom. [gw][seo][redirects]
• 🛡️ **New CI guard pin** in src/lib/__tests__/states-content.test.ts asserting MMJ_STATES contains EXACTLY {PA, OH, IL, MD} (and that MO/VA/MN are absent, and WA is never present). A future edit can no longer silently re-introduce a state Dr. Turner isn't licensed in without failing the pre-deploy gate — the allowlist must be updated in the SAME commit that intentionally changes the set. The existing states-nav-anti-divergence pin already forces the nav menu to stay in lockstep with MMJ_STATES. [gw][gate][compliance]

Changed

• 🔒 **Go-forward audit-log detail-strip — LEAD_CAPTURED detail no longer carries identity (Step 4a).** Both web lead-capture writers (/api/leads/book-now and /api/leads get-started) now DROP firstName/lastName/email/phone from the LEAD_CAPTURED audit_log.detail template and emit a PHI-free leadRef=sidecar pointer + counts/consent-flags only. Identity lives ONLY in the BAA-covered LeadIntake sidecar (dual-written + read-preferred since Part A / v2.97.LEADIDSIDECAR1 / PR#92, all historical sidecars backfilled). The read paths are unchanged — resolveLeadIdentity(sidecar, detail) still prefers the sidecar and keeps the parseLeadDetail(detail) fallback for any not-yet-backfilled edge row, so pre-strip + legacy rows render exactly as before. Book-now's OWN inline detail-contains duplicate query was replaced with the shared computeLeadDuplicateFlags() helper (searchKeyHash match OR'd with the legacy detail-contains fallback) so the returning / already-a-patient pills stay accurate once identity leaves the detail. NO migration (schema unchanged from Part A). Historical-row redaction of the old detail text remains a SEPARATE, counsel-gated ship (Part B) — NOT in this PR. [gw][hipaa][lead-sidecar][detail-strip][go-forward]
• 🛡️ **Audit-detail PHI gate extended + flipped to a POSITIVE ASSERTION for the web capture routes (Step 4a).** scripts/check-pii-in-audit-detail.mjs now ALSO scans the raw db.auditLog.create({ detail }) entry point (not just the audit() wrapper) — the get-started + book-now routes emit LEAD_CAPTURED via the raw create to get the row id for the sidecar, so a leak there previously slipped the audit(-only patterns (per the standing hipaa-architect finding). And the LEAD_CAPTURED handling for those two files FLIPS from the old sanctioned negative-lookahead EXEMPTION to a POSITIVE ASSERTION: the gate now FAILS if any firstName=/lastName=/email=/phone= template token appears in those two files at all. The other LEAD_CAPTURED writers that don't yet dual-write a sidecar (voice-tools phone capture, admin-manual create) keep the exemption pending a later migration, and the append-only LEAD_CONTACT_UPDATED contact-edit overlay (which the read path parses for corrections) is untouched. Pins in lead-identity-sidecar.test.ts prove neither route writes identity tokens, that the extended gate FAILS on a synthetic db.auditLog.create LEAD_CAPTURED detail containing email=, and that the read path still renders identity from the sidecar. [gw][hipaa][gate][positive-assertion][phi-defense]

Changed

• 🔐 **Token rate-limit on the pre-visit check-in GET.** /api/previsit/[token] GET is a PHI disclosure that writes a PREVISIT_FORM_VIEWED audit row on every hit; it now runs the same checkRateLimit('previsit:'+token, 10, 300, { failClosed: true }) its sibling POST uses (same 429 shape, token-keyed so cellular patients roaming IPs aren't blocked). failClosed — applied to BOTH the GET and its mirrored POST — means a rate-limit backend outage BLOCKS rather than admits the read/write, per the library's PHI/intake-token guidance. Closes the unbounded-read-from-leaked-URL gap. [gw][hipaa][rate-limit]
• 🔐 **Token rate-limit on the intake documents GET.** /api/intake/[token]/documents GET (returns medicalDocument fileName/fileSize/mimeType) now runs checkRateLimit('intake-doc:'+token, 5, 300, { failClosed: true }) mirroring its POST — same key/pattern, same 429 shape, and fail-closed on both (a backend blip blocks the PHI-disclosure read + the paid-blob upload rather than admitting them). [gw][hipaa][rate-limit]
• 📊 **No-show & cancellation split by cohort on the Booking funnel report.** /admin/reports/funnel gains an in-memory cross-tab of cancellation rate (over that cohort's total bookings) and no-show rate (over its active bookings) for new vs returning patients, rendered in the page's existing text-bar idiom. AGGREGATE COUNTS ONLY — no new query, no PHI, no migration. [gw][reports]
• 🧭 **Lead funnel report discoverability.** Added the missing lead-funnel link to the reports index and to the Practice health / CRM / Calls tab navs so it matches the canonical 7-tab set the funnel page already renders. Nav/link-only, same role gating. [gw][reports][nav]

Fixed

• 📝 **Flow-neutral copy on the shared expired-link (404) page.** not-found.tsx serves all ten patient token flows but its body copy only named cancellation links; reworded to flow-neutral "appointment links work for a limited time." No PHI, no medical claim, no inducement — the existing Book / My-appointments CTAs are unchanged. [gw][copy]
• 🔁 **Rebook CTA on the completed/past cancel screen.** /cancel/[token] completed-or-past branch used to dead-end with only a phone number; it now carries the same "Book a new appointment" button (/?book=true) the already-cancelled branch has, reusing the in-file pattern. [gw][copy]

Changed

• 🔐 **Lead identity moved into the BAA-covered LeadIntake sidecar (Part A — go-forward half).** Both lead-capture routes (/api/leads/book-now and /api/leads get-started) now DUAL-WRITE firstName/lastName/email/phone + a non-reversible searchKeyHash = sha256(normalized-email)|sha256(last-10-of-phone) onto the LeadIntake sidecar (keyed to the LEAD_CAPTURED audit row via the existing auditLogId). The get-started path was promoted from a fire-and-forget audit() to the book-now pattern (explicit auditLog.create({select:{id:true}}) → leadIntake.create) with a **fall-back to the old audit() on any sidecar-write failure so a capture is NEVER lost**. The audit_log.detail template is UNCHANGED this deploy (identity still dual-written to detail) so a code-only rollback stays safe. prod-migration-126 (EXPAND-ONLY: nullable columns + a searchKeyHash index, apply to Neon UNPOOLED before deploy). [gw][hipaa][lead-sidecar][expand-only][dual-write]
• 👁️ **Read paths now PREFER the sidecar (with legacy fallback).** The lead queue (/admin/leads) LEFT-JOINs LeadIntake by auditLogId in one batched query and the lead detail page (/admin/leads/[leadAuditId]) fetches the sidecar up-front; a shared pure resolveLeadIdentity(sidecar, detail) helper renders name/email/phone from the sidecar per-field when present, else parseLeadDetail(detail) — so pre-Part-A leads and any fallback-captured lead still render correctly. The append-only LEAD_CONTACT_UPDATED name-correction overlay still rides on top. Duplicate/returning-lead detection (findPossibleDuplicates, computeLeadDuplicateFlags, findLeadAuditIdByEmail) now matches on LeadIntake.searchKeyHash OR the legacy detail contains email= clause (fallback until backfill completes). [gw][hipaa][lead-sidecar][read-prefers-sidecar]
• 🧹 **Backfill script (script-only, NOT run this ship).** scripts/backfill-lead-identity-to-sidecar.mjs (sister of the patient-public-id backfill): idempotent (skips rows whose sidecar already has a searchKeyHash), dry-run by default, parses each historical LEAD_CAPTURED detail → upserts identity + searchKeyHash, writes ONE counts-only summary audit row (BACKFILL_LEAD_IDENTITY_TO_SIDECAR, actor system:backfill_lead_identity_to_sidecar:v1). The go-forward detail-strip + historical redaction are a SEPARATE, LATER, counsel-gated contract ship (Part B) — NOT in this PR. [gw][hipaa][backfill][script-only]

Added

• ⏱️ **Time-to-first-touch SLO tile on /admin/reports/lead-follow-up (Item A).** New aggregate panel computing median + p90 HOURS from the LEAD_CAPTURED audit timestamp to the first real (non-system, staffUserId != null) LEAD_CONTACTED/LEAD_STATUS_CHANGED/LEAD_NOTE/LEAD_FOLLOWUP_SET touch on that capture (linked via resourceId = captureId, the existing linkage). Nearest-rank percentile helper over the latency sample; amber when median > 24h (p90 > 48h). Adds a 14-day per-capture-day median-latency trend aligned to the page's existing captures-vs-touches trend window. AGGREGATE ONLY — latency hours, never a lead row; untouched leads are excluded from the sample (the zero-contact headline already covers that gap). Reuses the page's single-round-trip query + rollup style. [gw][hipaa][reports][lead-slo]
• 🧭 **Per-channel lead funnel report at /admin/reports/lead-funnel (Item B).** New report joining LEAD_CAPTURED (channel derived from the capture route's staffUserName + source= tag) → LEAD_CONVERTED (join key leadAuditId=; appointmentId= when present) → Appointment.status, rendered as a per-channel table of captured / touched / booked / completed counts + booked-rate + completed-rate, with an all-channels total row. **The ~34k legacy Salesforce-import backlog is EXCLUDED BY CONSTRUCTION** (it lives in the separate Lead Prisma table, unqueryable without the SF API) and is loudly LABELED in a banner + footnote so the channel rates are never silently deflated by the un-worked import; any source=salesforce-import-tagged capture in-window is also filtered and counted. Manual convert-to-patient (no appointmentId stamp) counts as booked but completion-unknown, so it under-counts (never over-counts) the completed rate. .catch() degrades to SectionUnavailable (err.name only, no PHI). Added the tab to the funnel + lead-follow-up navs. AGGREGATE COUNTS ONLY. [gw][hipaa][reports][lead-funnel]
• 📩 **Instant lead-capture acknowledgment auto-reply — BUILT DARK, default OFF (Item C).** On the /get-started web lead path (/api/leads, the route that writes LEAD_CAPTURED), an optional immediate acknowledgment email ("Got it, {firstName} — a real person from Green Wellness reaches out within 1–2 business days") can be sent on the existing M365 BAA rail via sendM365 + the shared renderOutboundEmailShell (so it carries the exact CAN-SPAM physical-postal-address footer + per-recipient unsubscribe link every campaign template uses). Administrative content ONLY — no medical/therapeutic claim, no price/fee, no qualification statement. GATED behind a NEW env flag that defaults OFF (isLeadAutoreplyEnabled() returns true only when the flag === 'true'); until Doug flips it, maybeSendLeadAutoreply() no-ops and NOTHING sends — intentional. Best-effort inside after() (never affects form-submit latency or the load-bearing LEAD_CAPTURED row); skipped for phone-only leads. **Honor-the-opt-out pre-send gate** (review fix): before composing/sending, maybeSendLeadAutoreply() now mirrors the catchup send path — it short-circuits to a suppressed outcome (no send) when the email is on the OutboundSuppression ledger (sha256), or any Lead row for it has emailUnsubscribed=true or marketingConsent="opted_out", so a resubmitting prospect who previously opted out is never re-emailed once the flag is armed (fail-closed on a DB error → send-failed, never a silent send). New PHI-free LEAD_AUTOREPLY_SENT audit action (outcome= source=lead-autoreply; a suppressed outcome is not audited — nothing sent). Pure body-builder + flag helper split into lead-autoreply-shared.ts (no server-only) with unit pins for the default-OFF flag + the no-claim/no-price compliance shape. [gw][hipaa][lead-autoreply][flag-off][dark-ship]

Fixed

• 🚑 **Voice crisis flags now labeled crisis end-to-end so /admin/isabella + the ai-receptionist report count phone crises (VOICECRISIS1).** mapVoiceFlagReasonToAiCategory("crisis") returned "clinical-urgent" (a documented Ship #1 fold), so a phone flagForHuman(reason="crisis") wrote aiCategory='clinical-urgent' onto the CALL PatientMessage row — indistinguishable from an ordinary email-triage clinical-urgent row. The /admin/isabella "Crisis flags" tile (isabella-cockpit-queries.getTodayCounters, where aiCategory='crisis') and the /admin/reports/ai-receptionist crisis-fires count (same literal) therefore NEVER counted phone crises. Honest fix = distinct label, NOT a widened counter (widening to IN (crisis, clinical-urgent) would OVERcount every routine clinical-urgent email as a crisis). Now the voice mapping emits "crisis". Blast-radius verified before the change: every clinical-urgent-keyed PRIORITY/DISPLAY reader ALSO already accepts crisis (isabella-today band-0, admin-today, todays-three-queries), the escalations feed pulls voice-flag rows by needsHumanAt not by category, and the patient-email-urgent-alert SMS-to-Mariane cron gates on aiCategoryConfidence (which voice flagging never sets) so it was never a consumer of voice rows — no routing regresses; a phone crisis stays in Needs-Attention exactly as before. Pins updated in voice-flag-mapping.test.ts (crisis → 'crisis' + crisis-lane regression). PHI-free (a short enum label only; no patient data touched). [gw][hipaa][oversight-accuracy][isabella][crisis-counter]

Fixed

• 💳 **Patient self-pay (/pay) retry double-charge KILLED via a deterministic Poynt-Request-Id (PAYIDEMPOTENT1).** chargeCollectCard sent a fresh random Poynt-Request-Id on every attempt, so a charge that TIMED OUT / 5xx'd but actually SUCCEEDED at Poynt reported failed to the app → the patient retried → a real SECOND charge (same class we just killed on RadVeo). Now both Collect charge paths (custom admin-minted fee + visit-fee deposit/balance/full) derive a stable key from the anchor sha256(appointmentId|pay-link-nonce|kind|chargeCents|declineSalt) and pass it as the idempotency header, so Poynt collapses a repeat of the SAME charge to the one original transaction. The declineSalt = count of prior DEFINITIVE declines for that exact anchor (read from the PAY_COLLECT_CHARGE_FAILED audit rows, now stamped with nonce=): a timeout/network/5xx (outcome UNKNOWN) does NOT bump it → the retry reuses the key and cannot double-charge; a hard decline (Poynt moved no money) DOES bump it → the patient's retry with a corrected card gets a fresh key and is actually charged, never replaying a stale decline. Also added the missing ATOMIC single-flight reserve on the non-custom path (mirrors the custom path's insert-first PoyntWebhookDelivery guard, invoiceId=collect:: so deposit≠balance never collide; P2002 → refuse without charging; deleted on failure so retries are unblocked). Money-only, PHI-free (only ids + amount feed the hash). New PAYIDEMPOTENT1 pins in pay-collect-payux1-pin.test.ts. [gw][money][idempotency][double-charge][fleet-class:retry-double-charge]

Fixed

• 🩹 **Public patient surfaces self-heal from stale-deployment failures instead of freezing (STALEGUARD1).** Hardened the fleet "unguarded client await → frozen button" class (inv-App incident 2026-07-16): a rare-visit user on an old cached deployment taps submit → the request 503s / throws against a retired deployment id → the un-caught rejection skips the loading-state reset → the button hangs forever with zero server trace. Wrapped the unguarded await fetch(...) submit handlers on the genuinely public rare-visit surfaces — dispensary partner login, appointment-confirm token page, both reschedule forms (token + secure), and the patient-portal logout — in try/catch with a shared recoverFromStaleDeploy helper (one-time sessionStorage-guarded hard reload → fresh HTML = current deployment = the call works; if already reloaded or storage is blocked, human "refresh and try again" copy + button re-enabled). Availability-slot fetches on the reschedule forms also now clear their skeleton on failure instead of spinning. Pure client-side UX resilience — no API, auth, or data-flow change. [gw][resilience][patient-surface][fleet-class]

Added

• 🤖 **Auto-fix agent queue + outcome-log endpoints (AGENTLOOP1) — activates the previously-inert autonomous fix loop.** The agent-auto-fix GitHub Actions workflow reads GET /api/admin/errors/queue and logs to POST /api/admin/auto-fix/log, but per .github/agent-auto-fix-protocol.md GW never had either endpoint, so every scheduled run 404'd and no-op'd. Added both. The QUEUE endpoint SOURCES FROM the existing AuditLog SERVER_REQUEST_ERROR rows (captured + PHI-scrubbed at write time by src/instrumentation.ts onRequestError) — recent 7-day window, parsed into the queue-item shape the agent expects, grouped by error-class + scrubbed-message signature with occurrences/firstSeen/lastSeen, benign deploy-skew ("Failed to find Server Action") excluded, all severity high. The LOG endpoint writes a PHI-free AGENT_AUTO_FIX_LOGGED audit row (outcome enum + counts + git SHAs only — the agent's free-text hypothesis/notes/title/filenames are dropped, defense-in-depth). Auth mirrors the diag routes EXACTLY: bearer (CRON_SECRET for queue; AGENT_LOG_TOKEN||CRON_SECRET for log, constant-time, fail-closed) OR admin session verified against the AdminSession COOKIE in-route (never the spoofable x-admin-role header); both paths added to proxy.ts ADMIN_BEARER_ALLOW. No new table, no migration (reuses AuditLog); both routes force-dynamic. [gw][hipaa][observability][auto-fix][phi-scrubbed][version-letter:AGENTLOOP1]

Changed

• 🗒️ **Documented the owner vendor map + removed the unused Documo fax vendor (FAXVENDOR1).** Added an authoritative header to inbound-fax-shared.ts recording the live vendors (Phone = AT&T + RingCentral · Fax = Notifyre · SMS = Notifyre) and that the RingCentral inbound-fax default is a legacy fail-safe only — prod routes inbound fax through Notifyre. Deleted src/lib/documo-fax.ts and its provider === "documo" branch in the inbound-fax webhook, dropped "documo" from the InboundFaxProvider type/selector/labels, and refreshed the route header + BAA-gate comments (Notifyre BAA executed ~2026-07-06). An unknown/legacy INBOUND_FAX_PROVIDER value now fails safe to RingCentral. No behavior change to the live Notifyre or RC paths. [gw][fax][vendor-map][cleanup]

Added

• 🗂️ **Records-review enqueue now also sweeps the real upload table (RECREVSRC2 — dark/off).** The nightly provider records-review enqueue sweep only scanned PatientUploadedRecord (a surface only the dark self-cert intake writes), so it would have missed every real portal/staff/provider/intake/booking upload — those all land in MedicalDocument. Added a second pass in the same cron that sweeps recent, non-deleted MedicalDocument rows and enqueues each as a "Front desk" (ADMIN-source) review item, deduped on its own source key and sharing the same per-run cap. Still fully behind RECORDS_REVIEW_QUEUE_ENABLED (default OFF) + the staged migration guard — no behavior change until Doug enables the feature. Counts-only audit; no PHI in the sweep. [providers][records-review][dark]

Added

• 📠 **Notifyre outbound self-test (FAXSELFTEST1).** Added sendNotifyreFax() (a minimal, defensive outbound-fax adapter) and an admin/cron-gated POST /api/admin/diag/fax-selftest route that sends a FIXED, PHI-free one-page test document to our OWN Notifyre number (NOTIFYRE_FAX_NUMBER) — proving the account can both send and receive before the lane goes live, instead of waiting for a live inbound webhook. Dark-ready: returns not_configured and makes no network call until the fax number + API key are set. Auth mirrors the notifyre-health probe exactly (CRON_SECRET bearer OR ADMIN/MANAGER session cookie verified in-route; always 200 when authorized; booleans/counts + PHI-free error classes only). Not wired into any patient-facing outbound path. New PHI-free audit action FAX_SELFTEST_SENT (sent=0|1 err=). ⚠️ The send-API shape is best-effort/defensive (not yet exercised against a live send) — any mismatch surfaces as a clean failed self-test, never an exception. [fax][notifyre][diag][dark]

Fixed

• 🔗 **Patient-portal login now guides new patients (PTLGUIDE1 — Mariane, reviewer-feedback cmrmyj85i).** When a new or prospective patient entered an email with no account on file at /my-appointments, the server correctly returns success (deliberate account-enumeration protection — we never confirm whether an email exists) and the UI showed "Check your email", but nothing arrived and there was no next step. Added a follow-up line on that screen: "Didn't receive anything? You may not have an account on file yet. Call us at [PHONE] to get started." Pure UI copy; no change to the sign-in-link behavior or any auth/data flow. Closes reviewer-feedback cmrmyj85i. [portal][ux][feedback-close]

Added

• 🔗 **Footer state links** — the shared footer lists Washington + every expansion state, each linking its /telehealth page (site-wide internal linking → SEO crawl path + interest funnel). Non-claim. [gw][seo][growth]
• 🛠️ **Unblocked the changelog build ceiling** — the 1,950-entry CHANGELOG array hit TypeScript's union-complexity limit (TS2590), which would have blocked every future ship. Split it into two concatenated arrays (recent + older), each under the limit, with full type-safety preserved. No content changed; every entry still renders. [gw][build-fix]

Added

• 🗺️ **"Where we serve" section on /telehealth** — links Washington + every coming-soon state to its page (internal-linking + SEO discoverability + funnels visitors to the interest forms). Non-claim, neutral labels. [gw][seo][growth]
• 📞 **Per-state local phone plumbing** — expansion state pages show a per-state number when set (localPhone), else the main line. Ready to drop call-tracking numbers into per market. [gw][growth]
• 🏢 **Local-presence checklist on the Expansion cockpit** — GBP + directory setup steps per market, admin-only, operational-only. [gw][expansion][growth]
• ⏱️ **Public page request timeouts** — AbortSignal on the providers / locations / stats fetches so a slow network fails cleanly instead of hanging. [gw][reliability]

Added

• 📣 **Notify-on-launch for expansion states** — the Expansion cockpit (/admin/expansion) now lists interest signups per state with a "Notify list" blast: emails the people who joined a state's coming-soon list that it's now open (book link included), stamps each row so no one is emailed twice, honors patient unsubscribes, and double-confirms with a live count before sending. Announcement copy is availability-only (no medical/efficacy claim). Admin-only. [gw][expansion]
• 📥 **Interest-list CSV export** — per-state and export-all CSV of the expansion interest signups on the cockpit, so the demand signal is usable outside the app. Admin-only, noindex, contact data never logged. [gw][expansion]

Changed

• 🔧 **Isabella booking-write failures are logged** — the voice booking-proposal DB write no longer swallows a failure silently; it records a PHI-free audit row (error name + call context only, no patient data) so a booking-write outage is visible on /admin, while the graceful "team will follow up" fallback continues unchanged. [gw][isabella][reliability]
• 🔒 **Settings page is admin-only** — added a server-side ADMIN guard (the page holds Isabella's transfer numbers; the write API was already admin-only, now the page render is too). Non-admins are redirected. [gw][rbac-tighten]
• ⏱️ **Timesheet schedule save has a request timeout** — added a 10s AbortSignal so a hung network fails cleanly instead of spinning. [gw][reliability]
• 📞 **Voicemail-on-no-answer wired to the carrier model** — Retell can't forward an unanswered transfer to a separate line, so the "3 rings → Green Wellness voicemail" is owned by RingCentral (the destination rings the cell, then rolls to the clinic voicemail on no-answer). The transfer cron now records the voicemail line (masked) as the verification anchor and the Settings help text explains the RingCentral setup. Retell ring cap stays below the carrier timeout so the voicemail answers, not dead air. [gw][isabella][voice]

Changed

• 📞 **Transfer ring cap (~3 rings)** — the Isabella transfer tool now sets Retell's transfer_ring_duration_ms (~18s, sourced from the Settings ring-seconds field) so a live transfer stops ringing an unattended cell instead of ringing forever; the retell-transfer-dest cron re-enforces it on every scheduled destination swap. Set live on the tool immediately (all 9 voice tools preserved). NOTE: cold_transfer has no native failover-number, so a literal no-answer→GW-voicemail handoff is a flagged follow-up (needs a GW-VM number + a prompt-driven second transfer). [gw][isabella][voice][version-letter:XFERRING1]

Added

• 📞 **In-app editing for Isabella's call-transfer routing** (Settings → "Isabella call transfers", admin only). Edit Kat's cell (8 AM–2 PM), Doug's cell (2 PM–5 PM), the voicemail fallback line, and the ring-seconds-before-voicemail — all validated to a real phone-number shape. Backed by an opt-in toggle: OFF = the transfer cron keeps using today's server settings (byte-identical); ON = it uses what you entered. Expand-only DB change; degrades safely to the server settings if the config can't be read. [gw][isabella][voice][version-letter:XFERROUTE1]

Changed

• 🗣️ **Isabella voice + chat polish (consolidates three reviewer-feedback fixes):** (1) upfront booking disclaimer — she states at the start of a booking that the call captures a preference only, nothing is confirmed/held, and to wait for the confirmation email before coming in (VOICEDISCLAIM1); (2) consistent pace/energy instruction across the whole call, no speeding up through booking steps (VOICCONS1); (3) replaced all remaining "lock in" phrasing with "confirm" in the chat prompts so nothing reads as a secured booking (ISALOCKIN1 — the voice side was already corrected). [gw][isabella][voice][version-letter:VOICEBATCH1]
• 🔑 **Patient-portal sign-in guidance** — the View-my-appointments page now shows new patients with no account a "Call us and we'll send you a portal invite" line instead of a dead end (PORTALACCESS1). [gw][portal]

Changed

• 🔒 **Armed intake consent capture on the live Book Now form** (flag NEXT_PUBLIC_INTAKE_CONSENT_ENABLED on) — two required-to-submit checkboxes (Notice-of-Privacy-Practices receipt acknowledgement + telehealth informed consent) now render, with a durable timestamped versioned consent record saved on submit and server-side enforcement. Closes the intake P0 (PHI submitted with zero recorded consent). Doug-approved reg-standard wording. [gw][hipaa][intake][consent][version-letter:ARMINTAKE1]

Fixed

• 🧪 **Re-aligned the pre-deploy gate with shipped reality** — 4 stale/brittle test assertions repaired to match already-shipped intent: NAVTRIM1 Isabella-cockpit + contact-detail RBAC (now ADMIN/MANAGER-only, redirect to /admin/no-access), CALLBACKSLA1 chat callback-SLA phrasing ('within one business day'), staffSummary length cap recalibrated 800→1300 for GW's regulated-change notes, and the bill-poynt↔email-pay-link resolver-key parity check made formatting-robust (the old parser overshot into the next function's args — a false divergence; both routes verified to pass byte-identical tier inputs). [gw][ci][tests][version-letter:GATEGREEN1]
• ✅ **Zero behavior/route change** — tests + one changelog wording edit only. Restores automatic pre-push verification so GW ships no longer need a manual gate bypass. [gw][ci]

Fixed

• 📚 **Training accuracy — no-show vs. cancellation waitlist behavior** — corrected the 'Handle no-shows' + 'Manage the waitlist' steps to match the live system: a no-show does NOT release the slot to the waitlist; only a cancellation reopens a future time. Resolves Kat's feedback that the old wording was counterintuitive/wrong. [gw][training][copy][version-letter:NOSHOWWAIT1]

Fixed

• 🗓️ **Reconciled the authorization-delivery timing across all four Isabella/patient surfaces** — voice, chat, and both confirmation emails now say the same accurate thing: authorization valid as of the appointment date; in-person = written authorization in hand the same day; telehealth renewal = mailed, arriving in about 3-5 business days. Retires the conflicting universal 'mailed 3-5 days' (voice) vs 'same-day' (chat/email) statements. [gw][voice][chat][email][version-letter:AUTHTIMING1]
• 🎙️ **Re-synced Isabella's live voice prompt** from the corrected source of truth. [gw][voice]

Added

• 🩺 **Leads: added a 'Not Qualified' status** so reviewed-but-not-qualifying leads are marked resolved and stop getting records-reminder emails (Mariane). [gw][leads][version-letter:FBFIX1]
• 📄 **Leads: added a 'Medical Records Received' filter** so you can see which leads have uploaded their records (a records-received mark OR a matched inbound records fax). [gw][leads]

Changed

• 🗓️ **Clarified the no-show/waitlist wording** — marking a no-show releases that appointment's time for the next waitlisted patient. [gw][training]

Changed

• 📞 **Standardized Isabella's plain-callback promise to 'within one business day'** across the chat prompt, matching the lead-capture confirmation copy (the outlier 'by 11am next business day' phrasing is retired); records-review booking confirmations keep 'within 1-2 business days.' [gw][chat][voice][version-letter:CALLBACKSLA1]

Changed

• 🧹 **Scheduler nav trimmed to day-to-day front-desk tools** — the manager/oversight dashboards (CS Command Center, Command Center, Isabella Cockpit, Renewal Pipeline, Leads Catchup) are now manager/admin-only, so a receptionist isn't handed five monitoring dashboards they don't use. [gw][admin-nav][rbac][version-letter:NAVTRIM1]
• 🔒 **Enforced at the nav + page level** (proxy edge gate + in-page role guard → /admin/no-access, not just a hidden nav link); Isabella Today + Draft Replies stay on the scheduler nav (operational). [gw][admin-nav][rbac]

Changed

• 💬 **Synced the call-center-cliche ban list across Isabella's chat and email prompts** so both channels forbid the same phrases — email picked up the five chat-only bans ('happy to help,' 'How can I help you today,' 'Thank you for reaching out,' 'I'd be happy to,' 'Is there anything else I can help you with') and chat picked up the email-only ban ('It's my pleasure'). Copy/tone consistency only. [gw][isabella][voice][version-letter:CLICHEPARITY1]

Changed

• 📞 **Added a 15-second timeout to the two provider calls in the Isabella warm-transfer-destination sync cron** so a hung socket can't stall the job; already covered by the existing error handling (timeout becomes a caught, reported failure). Additive, no success-path behavior change. [gw][voice][cron][version-letter:RETELLXFERTIMEOUT1]

Fixed

• 💬 **Fixed low-contrast grey text in the feedback widget so submitted feedback is easy to read** (Mary flagged: hard to see because it was grey). Bumped the page indicator + optional-field / screenshot hints to a readable tone; no change to how feedback is filed. [gw][feedback][a11y][version-letter:POLISH1]

Added

• 🛠️ **Admin errors now self-report their page + digest server-side, so a vague 'error' report is diagnosable instead of a mystery.** When an admin page throws, the error boundary posts the error name + Next.js digest + page path to a new audit-logged endpoint — privacy-safe by construction (never the full message/stack, never patient info). [gw][admin][observability][version-letter:POLISH1]
• 📅 **This deploy also activates the already-set provider self-scheduling flag.** [gw][provider][version-letter:POLISH1]

Changed

• 🧑‍💼 **Added diagnostic logging around the hiring AI judge** (candidate-data-only, no protected info) so a judging failure surfaces the real cause instead of a generic error. [gw][admin][hiring][version-letter:HIRINGJUDGEFIX2]

Fixed

• 🧑‍💼 **The hiring test's AI judge was silently failing on submit** (the structured-output path was incompatible with the BAA model), so candidates got a raw score but no AI recommendation — judging now runs reliably and populates the recommendation + per-dimension scores + reasoning. [gw][admin][hiring][version-letter:HIRINGJUDGEFIX1]
• 🔁 **If the model ever errors, the candidate is flagged for re-judge instead of showing blank**, and the admin 'Run AI judge' re-judge action works. [gw][admin][hiring][version-letter:HIRINGJUDGEFIX1]

Added

• 🧑‍💼 **AI-judged hiring aptitude test.** Candidates take a short scenario-based test grounded in real Green Wellness situations; the objective items are auto-scored and an AI evaluates the written answers against a job-related rubric, producing a ranked recommendation (strong / consider / not a fit) with reasoning to hire from. [gw][admin][hiring][version-letter:HIRINGTEST1]
• 🔗 **Tokenized candidate links + a Hiring dashboard.** Invite a candidate to generate a private, per-candidate test link to send; review each candidate's full answers, writing samples, per-dimension AI scores, and reasoning side by side on the new /admin/hiring page (Doug + Mariane). [gw][admin][hiring][version-letter:HIRINGTEST1]
• ⚖️ **Decision-support only — the human decides.** The AI recommends; a person (you or Mariane) advances or rejects the candidate and that decision is what's recorded. The judge scores job-related competencies only — never protected characteristics (age, race, sex, health, etc.) — and no protected information is collected. [gw][admin][hiring][compliance][version-letter:HIRINGTEST1]

Added

• 🗓️ **Providers set their OWN schedule + time off from the provider portal.** A plain “Your weekly availability” editor on the Schedule page — recurring weekly hours (Telehealth / In-person per office) plus time-off blocks — so a provider self-serves an hours change instead of emailing a request for staff to enter by hand. A live read-back shows exactly what patients will be able to book. [gw][provider-portal][scheduling][version-letter:PROVSCHED1]
• ♻️ **Saving your availability regenerates open booking slots immediately** (instead of waiting for the weekly generator), and time off you set suppresses new openings on those dates. [gw][provider-portal][scheduling][version-letter:PROVSCHED1]

Changed

• 🛡️ **Changing availability never disturbs an already-booked appointment.** Regeneration only ever adds or removes OPEN openings — a booked patient visit is never moved, cancelled, or orphaned. If a schedule change would fall over a booked visit, that visit is kept intact and the provider is warned. The four slot generators now share one generation path so they can’t drift. [gw][provider-portal][scheduling][safety][version-letter:PROVSCHED1]

Added

• 💬 **Patients can leave feedback right in the on-page chat.** A clear, always-visible “Share your experience — good or bad” button opens a short form (a message, plus optional name/email/phone — never required, never asking for ID). The assistant also recognizes when a patient is giving feedback vs asking a question or booking, and captures it either way. Everything is filed as a support ticket. [gw][chat][patient-feedback][version-letter:PTFEEDBACK1]
• 🎫 **New “Patient Feedback” review page (separate from staff Provider Feedback).** Every piece of feedback is a ticket tracked to closure — open → acknowledged → in progress → resolved — with a spot for an internal note and how you closed the loop. Negative feedback is flagged “Needs follow-up” at the top for fast service recovery, and a heads-up email goes to the team so someone can reach the patient quickly. [gw][admin][patient-feedback][version-letter:PTFEEDBACK1]
• 🛡️ **All existing chat safety is unchanged.** The crisis-safety help (988), the no-medical-claims rule, and the privacy protections all still work exactly as before and still take precedence — the feedback capture is added alongside them, never in place of them. [gw][chat][safety][version-letter:PTFEEDBACK1]

Fixed

• ☎️ **Softphone self-heals a stuck RingCentral ‘devtest’ sandbox setting automatically — the bug that stranded a scheduler all day on 7/24.** Root cause: a persisted developer “environment” override in the widget's partitioned iframe storage pointed at the dead platform.devtest.ringcentral.com sandbox (DNS NXDOMAIN), so every auto-login was rejected and the OAuth popup 404'd; the prior 2-shot disable (at 800ms + 3000ms) never cleared it and she was only unblocked by wiping all Chrome cookies. Hardened three ways: (1) the disable now posts BOTH message variants to the iframe to cover widget-version differences — rc-adapter-set-environment {enabled:false} (no server = full reset) AND {server: , enabled:false} (repoint + disable); (2) it fires immediately on iframe load and then on a ~700ms interval for the first ~15 seconds WHILE not signed-in (stops the instant it signs in, at the cap, or on unmount), maximizing the chance the disable lands before the widget commits to the stale OAuth environment; (3) it also re-fires on every need-credentials / signed-out event right before re-injecting the token. All prior behavior (clickable retry chip, on-screen failure reason, token retry ladder, ring screen-pop, drag) is intact. [gw][softphone][ringcentral][self-heal][version-letter:RCHARDEN1]
• 🛟 **Added a one-click ‘Reset phone’ with in-app fix-it guidance if it'''s ever still stuck — no more clearing cookies blind.** Next to the sign-in chip, a new secondary “Trouble? Reset phone” control re-fires the environment self-heal + token injection AND force-remounts the dialer iframe (destroy + recreate = a fresh widget init at a clean t=0 so the sustained disable loop restarts). If the dialer is still signed-out ~8 seconds after a reset, an inline non-technical panel reveals the exact ~20-second cookie-clear steps (Chrome ⋮ → Delete browsing data → All time → Cookies and other site data → Delete data → reload) that actually unblocked the 7/24 incident, with an explicit note that no RingCentral password is needed. The timer clears on sign-in / unmount. [gw][softphone][ringcentral][self-serve][version-letter:RCHARDEN1]
• 🔎 **Clarified it signs in automatically (no RingCentral password needed).** A small always-visible muted hint under the signed-out chip now reads “Signs in automatically — no password needed,” so staff stop hunting for a login that doesn't exist — the source of much of the “nothing happens when I click sign in” confusion. Display-only. [gw][softphone][ringcentral][clarity][version-letter:RCHARDEN1]

Added

• ✨ **Ask AI search — staff type any question, get an answer grounded in Green Wellness's own training + org materials, with the source shown.** A dedicated "Ask AI" row sits ABOVE the normal Cmd+K results: on submit it retrieves the most relevant PHI-free knowledge chunks (from the vetted training modules + a new curated src/lib/org-knowledge.ts facts file — contact info, locations/hours, pricing, referenced policies, scheduler FAQs), builds a grounded prompt, and answers via the BAA/Bedrock model. The existing page/patient/lead search stays intact underneath — one search, an AI answer on top. [gw][askai][onboarding][version-letter:ASKAI1]
• 🙋 **Honest when it doesn't know — unanswered questions are captured to a Staff Questions list for Doug/Kat.** When our materials don't cover the question (retrieval miss OR the model abstains), the assistant says "I don't have that in our materials yet" and persists the question to a new PHI-capable StaffQuestion table for review at /admin/staff-questions (ADMIN/MANAGER only). Doug/Kat answer or dismiss each one, closing the loop so nothing is silently dropped. [gw][askai][gap-capture][version-letter:ASKAI1]
• 🔒 **Runs on BAA/Bedrock; no medical advice; PHI-safe (slice 1 grounds on process knowledge only).** The endpoint (POST /api/admin/assistant/ask, role-gated to ADMIN/MANAGER/SCHEDULER so a new scheduler can use it) calls the same Bedrock BAA path as the SMS/email AI. HARD RULES in the system prompt: answer ONLY from the provided Green Wellness context, abstain honestly when it can't, and never give clinical/dosing advice (refuse + redirect to a provider). Slice 1 grounds ONLY on PHI-free process/org knowledge — no live patient or operational data. The audit trail is counts/flags only (the staffer's question is treated as PHI-capable). Expand-only migration prod-migration-122 creates the StaffQuestion table. [gw][askai][hipaa][bedrock][version-letter:ASKAI1]

Added

• 🔐 **HIPAA & Patient Privacy training module is now LIVE (owner/Privacy-Official signed) — the hipaa-privacy slot flipped from draft-gated to ready.** Doug approved the content as the designated HIPAA Privacy Official (45 CFR §164.530(a)(1)), which is the one gate on publishing workforce privacy training under §164.530(b)(1). The module now carries six teaching steps ported verbatim from the signed content (What PHI is · Minimum necessary · No PHI over personal channels · Screen lock & clean desk · Report incidents fast · Patient rights basics) plus an 8-scenario completion quiz whose correct answers are scored server-authoritatively; completion is recorded automatically. Authored inline in src/lib/training-modules.ts + TRAINING_QUIZZES["hipaa-privacy"] (the unpublished training-hipaa-draft.ts remains NEVER imported — pinned). A matching HIPAA reference section was added to /admin/training. No PHI, no migration, no env change. [gw][hipaa][training][§164.530][version-letter:HIPAATRAIN1]
• 🎓 **Unlocks the last required module for new-hire onboarding (Mary).** HIPAA sits at chain slot 2 (right after Day One); with it published, the required-module chain for every role is fully completable — closing Mary's §164.530 workforce-training gap. [gw][onboarding][training][version-letter:HIPAATRAIN1]

Fixed

• ☎️ **The "Sign in to dial" chip is now a real button — clicking it re-fires the RingCentral sign-in (previously it was an inert label and clicking did nothing).** Mary was stuck all day with "nothing happens when I click sign in to dial": the signed-out Badge was a non-interactive label, so the JWT auto-login never re-fired on click. Converted it to a that bumps a retryNonce state, and added retryNonce to the auto-login effect's dependency array so a click re-runs injectToken. [gw][softphone][ringcentral][version-letter:RCVISIBLE1]
• ☎️ **Sign-in failures now show the reason on-screen (e.g. "sign-in service error 503", "sign-in timed out") instead of only in the browser console, so a stuck softphone names its own cause.** Added an authError state that injectToken sets on failure and clears on success; the signed-out chip surfaces it. No change when already signed in. [gw][softphone][ringcentral][version-letter:RCVISIBLE1]

Added

• ↩️ **'← Back' control on the /changelog page (Doug).** The changelog (reached by clicking the version badge) was a dead-end — no navigation back to the page you came from. Added a small client ChangelogBackButton component rendered in the navy page header that calls router.back(), styled text-[#7fa98f] → white-on-hover to sit legibly on the #0f2744 header, with an accessible label. Fallback: when there's no history to return to (fresh tab / direct link / bookmark, window.history.length <= 1), it routes to / (the public home) — the changelog is linked from the admin shell AND the patient/provider surfaces, so home is the destination that's safe for every origin. [gw][ux][changelog][version-letter:CHANGELOGBACK1]

Changed

• 🪪 **Uploaded photo IDs on Today's Schedule are now collapse-by-default with a label + View/Hide toggle (Mary feedback).** The /admin/today 'Photo IDs uploaded' panel used to render patient government-ID thumbnails inline, forced-open, with no dismiss control and no explanation of why they were there — a scheduler saw PHI/PII (ID images) sitting on screen. Now the panel header carries a plain-language label ('ID on file for verification · N patients') plus a short note that the IDs confirm Washington residency, and the thumbnails are hidden behind a View IDs / Hide IDs toggle (showIdPhotos local state, default off). Nothing renders an ID image until a staff member explicitly opens it, and one press collapses it again. The images remain fully accessible for residency verification (same signed document route, opens in a new tab) — this is a display-only change that reduces PHI-on-screen; RBAC and who may view IDs are unchanged. [gw][phi-reduction][admin-today][version-letter:IDPRIVACY1]

Added

• 🔑 **Transitional dual-login for staff accounts — sign in with the primary OR an alternate email during onboarding (Doug).** A new secondaryEmail on each staff account (prod-migration-111, additive + nullable) is an optional alternate login address. Admin login (/api/admin/login) and the forgot-password rail (/api/admin/forgot-password) now resolve a staff member by EITHER their primary email OR their secondaryEmail, case-insensitively, both mapping to the SAME account — so a new hire whose GW mailbox isn't provisioned yet can still log in with their personal email. Forgot-password sends the reset link to whichever address was typed. Set/clear the alternate on the Staff Accounts edit screen. Anti-confusion safety: an address is rejected on save if it's already used by another account, and the login resolver fails CLOSED (no login) if an address ever matched more than one account — so a single login address always maps to exactly one person. Reset-by-token and all activity/audit attribution stay keyed on the account id (unchanged). ⚠️ Migration 111 is applied to Neon out-of-band by Doug. [gw][auth][onboarding][expand-only][version-letter:ALTLOGIN1]

Fixed

• 🧾 **'Bill via Poynt' can no longer auto-send the invoice on the first click — explicit review → send (Kat c065523275489f78066895bcd).** Root cause: the create modal carried an 'email the patient' checkbox that was posted on the very first (mint) request, so a staff member who clicked only to REVIEW an invoice, saw a wrong total, and clicked away could still have emailed the wrong invoice. Fix: the create step is now MINT-ONLY (the notifyPatient flag is never sent) — it opens a review screen showing the amount + description, and the patient is emailed ONLY via a separate explicit 'Send to patient' button (the existing /email-pay-link route, which re-mints server-side and stamps the confirmed-send timestamp per BILLTRUTH1). No auto-send path remains from this button; BILLTRUTH1's confirmed-send truthfulness is preserved. Also (part 2 of the same row): the Bill modal now pre-fills the CORRECT expected fee — visit-fee context (apptType/isNew/discountCents) is passed on the appointment-detail, Clinic-day, and auth-gated-unpaid call sites — so a $145 renewal no longer opens the modal pre-filled at the hardcoded $175 new-patient default (Kat's '$145 flipped to $175 with no explanation'); the chip and the modal now agree, and the review screen shows the amount before anything is sent. [gw][billing][review-before-send][no-auto-send][version-letter:BILLTRUTH2]
• 💳 **Confirmed Poynt payments that miss the webhook now auto-reconcile onto the chart (Kat c8be6718c68eaedd06c3e833f).** A completed Poynt payment (7/13) never synced back to Flow — the chart read UNPAID for 10 days until staff caught it by hand, a double-collect risk. Investigation (PHI-safe, txn-id only): the webhook DID receive the capture but the payment carried no reference matching that appointment (the appointment had no linked Poynt invoice id at all), so it fell through 'no-match' — and the daily alignment cron, which only scans appointments that already have a Poynt invoice id, couldn't catch it either. Two code fixes: (a) the daily poynt-alignment-audit cron now AUTO-APPLIES missing_payment drifts — when Poynt's own authoritative re-read confirms an invoice is paid but the chart says unpaid, it writes the paid sentinel (compare-and-swap guarded, identical to the webhook + the manual Resync route) and releases any gated authorization, instead of only leaving a finding for someone to click; (b) a confirmed-paid webhook that matches NO appointment now records a high-severity, greppable POYNT_UNMATCHED_PAID audit row carrying the transaction + invoice ids + amount (replacing the old silent no-match) so staff can find the payment in the Poynt portal and link it to the right chart. Note for Doug: the specific 7/13 transaction (#0cf60a22, $145) was already reconciled manually by Kat on 7/23 — no data change needed; these fixes prevent the next one. [gw][billing][poynt-sync][auto-reconcile][version-letter:BILLTRUTH2]

Fixed

• 🧾 **'Bill via Poynt' no longer lies 'Invoice sent' on a timeout or a copy-only link (Kat cme7gsiaz6m60llti5wv1ssal).** Root cause: the appointment's poyntInvoiceSentAt/poyntInvoiceUrl were stamped from the *notify* checkbox (and even in portal-manual mode, where nothing is autonomously sent), and the UI + Clinic-day chip treated a merely-*minted* link as 'sent'. On a client timeout the server may already have persisted those fields, so closing the error popup re-rendered the button as '✓ Invoice sent'. Now: the server (bill-poynt + email-pay-link routes) attempts the send FIRST and stamps poyntInvoiceSentAt ONLY on a confirmed email delivery; the URL/id are still persisted (a real artifact) but do not imply 'sent'. BillViaPoyntButton flips green only on the server's sentConfirmed flag, shows an honest amber 'Status unknown — verify' on a timeout, and re-reads server state via router.refresh(). The Clinic-day roll-call 'Invoice sent' chip + the appointment-detail line key on the confirmed-send stamp only (a minted-but-unsent link now reads 'link created — not sent yet'). No billing amount/logic change — truthfulness only. Pins updated: clinic-day-shared.test.ts. [gw][billing][truthfulness][no-logic-change][version-letter:BILLTRUTH1]

Changed

• 🧭 **Scheduler-core pages lead the sidebar (Kat cmkkrc3rznkdeiu2ov927gs9j, training Mary).** The always-open top group now leads with the daily scheduler workflow — Today → Clinic day → Appointments → Calendar → My End of Day — with Clinic day + My End of Day promoted up out of the collapsed 'Front Desk' section (moved, not duplicated; same hrefs/roles/icons/keywords, so nobody's access changed). Dashboard/Messages/Patients/Leads/Inbound Fax follow below. [gw][nav][low-risk][version-letter:BILLTRUTH1]

Added

• 🗂️ **Records-reviewer P1.4 — each candidate condition is tagged 'maps to a WA qualifying condition' vs 'does NOT map — your judgment' at DISPLAY time (before Accept).** DARK feature (behind RECORDS_REVIEWER_ENABLED, default OFF) — zero live behavior change. Builds on the RECARM1 safe-arm slice. The proposal panel now computes each finding's WA mapping with the SAME normalizeQualifyingCondition the client Accept gate runs, so the on-card tag and the slug that gets staged for the cert can never diverge. A non-qualifying candidate (e.g. anxiety) shows a neutral 'Does not map to a WA qualifying condition on its own — your judgment' pill and can never render as cert-eligible; a qualifying one shows 'Maps to a WA qualifying condition: '. Pure/additive: new mapsToWaCondition field on FlatRecordsFinding (src/lib/records-review-display.ts), rendered in RecordsReviewPanel.tsx. Pin: src/lib/__tests__/records-review-display-mapping.test.ts (anxiety→null across variants; agrees-with-Accept-gate by construction). [ai-records-review][rcw-69.51a][dark-behind-flag][p1.4][no-live-change][version-letter:RECREVGUARD1]
• ⚠️ **Records-reviewer P1.3 — deterministic output-side claim-class guard flags (never drops) determination/efficacy language in the AI's OWN prose.** DARK feature (behind RECORDS_REVIEWER_ENABLED, default OFF). New pure module src/lib/records-review-claim-guard.ts scans each finding's candidateCondition + the records-summary prose for a fixed high-precision vocabulary of forbidden claim-class phrases (determination: 'qualifies for', 'determined', 'confirms', 'diagnosing', …; efficacy/treatment: 'effective for', 'recommend cannabis', 'treats', 'relieves', …) and surfaces a loud red 'Reads like a determination — the AI suggests, it doesn't decide who qualifies; check the source and reword' marker on the panel. Defense-in-depth on SPEC §12 (the model is instructed to suggest-not-determine; this makes it structural, not just prompt discipline). **Crucially it NEVER scans the verbatim quote** — a clinician's own record that reads 'diagnosed with X' is faithful source text, not a model claim, so flagging it would punish honest citation. Word-boundary matched, case-insensitive, PHI-free (fixed vocabulary only). Pure/additive, no migration. Pin: src/lib/__tests__/records-review-claim-guard.test.ts (clean-vs-claim split; verbatim-quote exemption; boundary + case tests). [ai-records-review][claim-class-guard][no-medical-claims][dark-behind-flag][p1.3][no-live-change][version-letter:RECREVGUARD1]

Fixed

• 🔁 **Two GW cron routes now accept the scheduler's POST call (PORTALHYG1; closes the watchdog cron-route-http-method red + Intake/Portals spec item).** api/cron/retell-transfer-dest (keeps Isabella's live warm-transfer destination pointed at the on-shift person) and api/cron/stage-emails (pre-stages the upcoming-renewal email preview queue) both exported only a GET handler; Vercel Cron fires via POST, so every scheduled run returned 401 (a method-not-exported reads as an auth failure in the logs) and the jobs silently drifted. Added export const POST = GET; to each — same logic, same verifyCronAuth bearer check (method-agnostic), no behavior change beyond the job now actually running on schedule. stage-emails stays dark behind EMAIL_QUEUE_ENABLED regardless. [reliability][cron][flag-safe][version-letter:PORTALHYG1]
• 🔒 **Patient cert magic-link download now fails closed on a non-unique email (PORTALHYG1; Portals-spec P1 #8, §164.312 access-control hardening).** The api/patient/cert/[id] magic-link path resolved the patient by a case-insensitive email findFirst — if two Patient rows ever shared an email (plausible on a merged/duplicate record), that could resolve to an ARBITRARY row and stream the wrong same-email patient's certificate. Now resolves with findMany(take:2) and only proceeds when exactly ONE patient owns that email; 0 or >1 refuses the token path (401). The password-session path (which carries a concrete patientId) is untouched, and this is a true no-op for the normal one-patient-per-email case. Rate-limit + per-appointment ownership check are unchanged. [hipaa][idor-fail-closed][patient-portal][version-letter:PORTALHYG1]
• 🧹 **Patient portal no longer writes an unredeemable referral code on every load (PORTALHYG1; Portals-spec P3 #13).** patient/portal used to promoCode.upsert a $25 referral code on every render even though the referral card is gated on FEATURE_REFERRALS_ENABLED (off — GW is on Poynt, the discount can't be honored at checkout), minting codes nobody could use. The write is now gated behind the same flag as the card, so a flag-off portal load does zero wasted DB work. No-op today (flag off ⇒ card already hidden). [efficiency][dead-write][flag-gated][version-letter:PORTALHYG1]

Changed

• 🩺 **ABBYLOC1 — re-arm Lynnwood for NEW patients (Abby Robertson ARNP) across the voice/chat + class-gated picker paths.** Adds abby: "prov-abby" to PROVIDER_SLUGS and prepends abby to lynnwood.providers in src/lib/provider-location-rules.ts. Departed slugs (dawn gone 2026-07-08, ruth gone 2026-06-12) stay in the list but remain filtered by isProviderDepartedAt, so getAllowedProvidersAt("lynnwood", "NEW") now returns ["abby"] — Lynnwood reappears in the NEW-patient picker and in Isabella's spoken NEW list (getLocationListForPrompt). NOTE: this is code-side only; Isabella's PHONE prompt is baked at Retell sync time and needs a re-sync to speak the updated NEW list (gated Doug/parent step). [provider-transition][provider-location-rules][booking-picker][isabella-prompt][version-letter:ABBYLOC1]
• 🧹 **ABBYLOC1 — public "Our providers" listing auto-drops a departed provider at their endsAt.** src/app/api/public/providers/route.ts findMany where-clause adds OR: [{ endsAt: null }, { endsAt: { gt: new Date() } }] alongside isActive: true, mirroring how the public locations route filters on Location.closesAt. Behavior-neutral today (the only provider with an endsAt is Dr. Morical, whose endsAt is 2026-07-25 = future); at 2026-07-25 she drops from the public listing automatically without a manual isActive flip. PHI: NONE (operational filter; no patient data). [provider-transition][public-providers][auto-drop-at-endsat][version-letter:ABBYLOC1]

Changed

• 🔒 **Public clinic STREET ADDRESSES + 'Get directions' removed from every public surface (ADDRPRIV1; Doug 2026-07-24).** GW offices are appointment-only / telehealth; a public street address invites walk-ins and stresses the providers (Dr. Leslie Morical / Seattle · Dr. Marnie Frisch / Olympia). Patients who need the address already have it OR receive it BY EMAIL — the post-booking confirmation + reminder emails (emails.ts bookingConfirmationEmail / reminderEmail) already render the full office address once an IN_PERSON appointment at a known location is booked (unchanged). New render-layer seam src/lib/public-address-visibility.ts (shouldShowPublicStreetAddress, default HIDE all, reversible per-clinic via env PUBLIC_SHOW_STREET_ADDRESS_LOCATION_IDS) — NO DB mutation, so email/calendar-invite/admin keep the real address. Surfaces scrubbed: homepage Locations.tsx (address line + 'Get directions' gone; city/region + 'address sent when you book' stays), /locations cards + MedicalOrganization/PostalAddress JSON-LD (streetAddress/postalCode dropped), /locations/[city] clinic-card + 'Get directions' + buildLocationLd PostalAddress (streetAddress/postalCode dropped when withheld) + the fallback meta-description (no longer embeds address), /about Lynnwood line, the BookNowFormModal NEW + RENEWAL lead-form chips, and the Step3Appointment booking picker (city + phone only; address still passed through to the confirmation email). Static locations-content.ts Lynnwood/Olympia intro + directions copy no longer name the street. City / region / telehealth-statewide / by-appointment framing / phone all KEPT. Note: llms.txt + llms-full.txt were already city/region-only — no address exposure there.
• 📞 **Seattle clinic phone now formats correctly (ADDRPRIV1).** The Seattle location row carried its phone as raw digits '8888859949', which rendered unformatted on the public card. New pure helper src/lib/format-phone.ts (formatPhoneForDisplay) normalizes any US phone shape to '(888) 885-9949' — wired into the homepage clinics card, the per-city clinic card, and the booking picker. 888-885-9949 is the confirmed correct number and matches the contact SSoT (constants.ts PHONE = 1-888-885-9949). Both new helpers are pure + pin-tested (format-phone.test.ts, public-address-visibility.test.ts).
• 🏷️ **Brand-name display fix (ADDRPRIV1): the site logo lockup now renders 'Green Wellness' (two words) not 'GreenWellness'.** Added the visible space to the Green + colored-Wellness lockup in SiteNav, SiteFooter, and the /locations/[city] inline header, per the canonical brand doctrine ('it's Green Wellness not GreenWellness').

Added

• 🛡️ **AI records-reviewer SAFE-ARM slice — the pre-arm guardrails (RECARM1; reviewer STAYS DARK behind RECORDS_REVIEWER_ENABLED, default OFF).** Builds the P0 'safe-arm' guardrails from AI_RECORDS_REVIEW_BUILD_SPEC so the reviewer can only ever be armed once they are all green — arming remains an ask-first Doug + clinician + counsel gate. **(1) Fail-closed Bedrock guard** — new pure module src/lib/records-review-arm-guard.ts (evaluateRecordsReviewerArmGuard): the reviewer route now 404s BEFORE reading a single record byte unless inference provably resolves to AWS Bedrock (BAA account 004730170375) — it rejects AI_PROVIDER=anthropic, rejects a set ANTHROPIC_BAA_CONFIRMED, and requires getCurrentAiProvider()==='bedrock'. /api/health now surfaces a PHI-free recordsReviewer.armReady readout so the boundary can be checked before any flip. **(2) Mechanical server-side quote-grounding** — new pure module src/lib/records-review-grounding.ts (groundRecordsReview): the extractor now also returns the verbatim source text it read per document; the server verifies every finding's quote is a normalized verbatim substring of its cited document and DROPS any finding that doesn't ground (never shown as fact). Drop count is recorded PHI-free in the audit. **(3) Records-specific Bedrock abstention eval** — scripts/records-review-abstention-eval.mjs (sibling of the Isabella eval): a fabricated/de-identified records harness (empty · sparse/illegible · anxiety-only · contradictory · no-date · efficacy-bait) that REFUSES to run off-Bedrock and asserts empty-when-empty, anxiety-never-staged, every-quote-grounds, and no diagnosis/efficacy/invented-date language. **(4) Provenance/abstention/completeness copy** — the proposal panel now carries a persistent 'Nothing here is confirmed until you Accept it — the AI does not decide who qualifies' header, a 'portal uploads only · faxed records are NOT included' line, an 'empty result is not a clearance' state, and an honest 'N findings held back — quote couldn't be verified' banner. Files NEW: src/lib/records-review-arm-guard.ts · src/lib/records-review-grounding.ts · scripts/records-review-abstention-eval.mjs · scripts/print-records-abstention-cases.mts · scripts/check-records-abstention-case.mts · scripts/print-records-review-prompt.mts · src/lib/__tests__/records-review-abstention-eval.fixtures.ts · src/lib/__tests__/records-review-safe-arm.test.ts · src/lib/__tests__/records-review-abstention-eval-harness.test.ts. Files MOD: src/lib/records-review-extract.ts (adds per-document sourceTexts for grounding + exports the system prompt) · src/app/api/provider/encounters/[id]/records-review/route.ts (arm-guard + grounding wired) · src/app/api/health/route.ts (arm-readiness readout) · src/app/provider/[token]/encounters/[id]/_components/RecordsReviewPanel.tsx + SoapEditor.tsx (copy + grounding tally). No schema change. Flag STILL OFF; PHI never to logs/disk/prompt-echo; audit rows PHI-free (err.name only). [hipaa][records-reviewer][safe-arm][bedrock-fail-closed][quote-grounding][abstention-eval][flag-off][version-letter:RECARM1]

Fixed

• 🔒 **Authorization ISSUANCE is now PROVIDER/ADMIN-only at the server (ISSUEGATE1 — HIPAA RBAC, Doug ruling 2026-07-24).** Issuing a WA DOH medical authorization is a CLINICAL act, so only the issuing provider (via the provider portal) or an ADMIN may mark an authorization issued. A SCHEDULER may schedule + prep + record payment but may NEVER trigger issuance. Fixes a split-brain where the admin issue routes admitted MANAGER and a SCHEDULER-recorded payment could indirectly fire issuance. **Single source of truth:** new pure module src/lib/authorization-issue-authority.ts (ADMIN_ISSUE_ROLES = ['ADMIN'] + canAdminRoleIssueAuthorization()), pin-tested. **Server gates (the real fix — reject before any write):** /api/admin/appointments/approve, /api/admin/appointments/authorize, /api/admin/appointments/authorize-override, and /api/admin/appointments/complete tightened from ['ADMIN','MANAGER'] → ADMIN-only; /api/admin/appointments/[id]/status keeps SCHEDULER for CONFIRMED/CANCELLED/NO_SHOW but its COMPLETED (issue) branch now 403s a non-ADMIN; /api/admin/appointments/mark-paid keeps SCHEDULER for payment RECORDING but only runs the auto-issue when the actor is an authorized issuer (a non-issuer's payment leaves the authorization held for an admin/provider). Provider issuance routes (/api/provider/action, /api/provider/bulk-approve, /api/provider/authorizations/[id]/reissue, /api/provider/encounters/[id]/sign) were already provider-session-gated and are unchanged. **UI defense-in-depth (hide the control):** the 'Authorize' button + the 'Mark Seen' action + the auth-gated-unpaid 'Send anyway' override render only for ADMIN. **No legitimate SCHEDULER workflow broken:** booking, reschedule, confirm, no-show, chart prep, and payment recording all preserved. Files NEW: src/lib/authorization-issue-authority.ts · src/lib/__tests__/authorization-issue-authority.test.ts. Files MOD: the 6 appointment routes above · src/app/admin/appointments/[id]/page.tsx · src/app/admin/patients/[id]/page.tsx · src/app/admin/patients/[id]/_components/AppointmentActions.tsx · src/app/admin/appointments/auth-gated-unpaid/page.tsx · scripts/check-admin-route-scheduler-coverage.mjs (exception reasons) · src/lib/__tests__/check-appointment-complete-no-show-routes.test.ts (policy pin updated to ADMIN-only) · changelog. Read gates (v2.97.AUDITGATE1) unchanged — this is the WRITE path. [security][rbac][hipaa][authorization-issuance][provider-admin-only][version-letter:ISSUEGATE1][cadence-override: live HIPAA RBAC gap — a scheduler could cause a clinical authorization to issue]

Added

• 🔒 **INTAKECONSENT1 — capture + persist NPP acknowledgement + telehealth consent on the LIVE booking form (BookNowFormModal), DARK behind NEXT_PUBLIC_INTAKE_CONSENT_ENABLED (default OFF).** Closes the HIPAA-audit P0: patients booking through the live front door submit DOB + a health narrative (PHI) with ZERO recorded HIPAA/NPP or telehealth-consent acknowledgement. **UI:** two required-to-submit checkboxes on the modal — (a) NPP acknowledgement (45 CFR §164.520(c)(2) receipt-ack model) with a link to /privacy, and (b) telehealth informed-consent (standard elements + WA telemedicine norms) — rendered ONLY when the flag is armed. **Persistence:** on submit /api/leads/book-now stamps nppAcknowledgedAt / telehealthConsentedAt + consentTextVersion (intake-v1) onto the BAA-covered LeadIntake sidecar (keyed to the LEAD_CAPTURED audit row) AND writes two immutable audit rows NPP_ACKNOWLEDGED + TELEHEALTH_CONSENTED (resourceId = the LEAD_CAPTURED row id; detail = consentVersion=intake-v1 — PHI-FREE). **Server gate:** when armed, the route rejects a submission missing either ack (mirrors the client gate; a direct API caller can't bypass). **Flag OFF = byte-unchanged live form:** the checkboxes don't render, the submit-gate is unmodified, and no consent columns/audit rows are written. **Migration:** prod-migration-121-intake-consent.sql — expand-only, additive nullable columns on LeadIntake (IF NOT EXISTS), safe under the auto-rollback doctrine. **DRAFT wording (with citations) pending Doug/clinician sign-off before arming:** CONSENT_LANGUAGE_DRAFT_FOR_APPROVAL_2026_07_24.md. Single source of truth for the copy: src/lib/intake-consent-copy.ts (versioned, same pattern as marketing-consent-copy.ts + the v2.97.RIGHTS1/MHMDA1 NPP fixes). Files NEW: src/lib/intake-consent-copy.ts · prod-migration-121-intake-consent.sql · CONSENT_LANGUAGE_DRAFT_FOR_APPROVAL_2026_07_24.md. Files MOD: src/components/booking/BookNowFormModal.tsx · src/app/api/leads/book-now/route.ts · src/lib/audit.ts (2 new actions) · prisma/schema.prisma (LeadIntake +3 nullable cols) · changelog. Decoupled from the dark self-scheduling wizard (Doug-gate Q33) — does NOT flip it. [hipaa][intake-consent][npp][telehealth][dark-behind-flag][expand-only-migration][draft-pending-signoff][version-letter:INTAKECONSENT1][cadence-override: HIPAA audit P0 on the patient-facing booking form, separate lane from the in-flight admin RBAC/provider-portal work]

Fixed

• 🔒 **Audit log locked to ADMIN-only, both layers (AUDITGATE1 — HIPAA §164.312(b)).** A portals security audit found /admin/audit-log — which renders the FULL practice-wide HIPAA audit trail (every VIEW_PATIENT / EXPORT_PATIENTS / PHI-egress event with staff attribution) — was reachable by the default SCHEDULER role (a brand-new receptionist just got that role). Reviewing the audit log is a Security-Officer / administrator function, not a scheduling one, so it now fails CLOSED for MANAGER/SCHEDULER/BOOKKEEPER, enforced BOTH at the proxy edge (src/proxy.ts, covering the page AND /api/admin/audit-log CSV export so a denied role can't curl the trail) AND in-page (server-side verifyAdminSession + session.role === 'ADMIN' check before any db read). Non-admins get the calm /admin/no-access explainer, not a raw 403. Mirrors the v2.97.TEAMFB1 pattern (ADMIN-only at proxy + in-page). §164.502(b) minimum-necessary. [security][rbac][hipaa][audit-log]
• 🔒 **Accounting (provider pay rates) locked to the FINANCE role set (AUDITGATE1).** The same sweep found /admin/accounting — which renders provider payPerVisitCents pay rates (editable inline via PayRateInput) + per-visit payout math — had NO role gate despite finance-role.ts's own SSoT documenting it as a FINANCE surface (ADMIN | MANAGER | BOOKKEEPER, 'a SCHEDULER has no treatment/payment/operations need'). Only /admin/payments was actually gated; accounting was reachable by SCHEDULER. Now gated on the SAME isFinanceRole SSoT at the proxy edge (page + /api/admin/accounting export) AND in-page, so provider compensation isn't a receptionist-visible surface. BOOKKEEPER still passes (accounting is their home); the gate only ever rejects SCHEDULER. Denied roles get /admin/no-access. §164.502(b) minimum-necessary. [security][rbac][accounting][pay-rates]

Added

• 🗂️ **Team Feedback by-submitter view — Kat 2026-07-23 (Mary's first day).** New ADMIN-only page /admin/reviewer-feedback/team (System nav → 'Team Feedback') that groups ALL staff feedback by submitter so Kat can pull up just Mary's rows + their status (open / in-progress / waiting-on-Doug / shipped) WITHOUT those rows cluttering her personal /me/feedback list. Reuses the EXISTING submitter attribution already captured at write-time (ReviewerFeedback.userId / userName / userEmail) — NO schema change. Roster is keyed on userId (stable across name edits), sorted open-work-first so the person actively filing floats to the top; ?submitter= filters to one person; each row deep-links into the main triage queue on its status tab. **Read-only monitoring layer** — the per-person default views are untouched: /me/feedback stays hard-scoped to the caller's own rows (where:{userId}) and the triage queue is unchanged. **RBAC:** ADMIN role ONLY — a stricter gate than the triage queue's allowlist because this reads every staffer's body by-person (supervisory read), enforced BOTH in-page and at the proxy edge (src/proxy.ts), plus the reviewer-feedback allowlist as belt-and-suspenders. §164.502(b) minimum-necessary. HIPAA: bodies may reference PHI (operator free-text), served only behind the ADMIN+allowlist gate on the BAA-covered Neon DB; screenshots are NOT rendered here (status-rollup surface). [feedback][team-view][rbac][hipaa-clean]

Added

• 🩺 **Provider Portal v2 — Mariane's redesign, built + staged DARK (rows cmrsi1ugs · cmrshzmdg · cmrsi007p · cmrsi0que).** Everything ships behind ONE flag PROVIDER_PORTAL_V2_ENABLED (default OFF) so the live portal is byte-for-byte unchanged until Doug/Mariane arm it. (1) **Six-item nav (cmrsi1ugs):** Dashboard · Today's Patients · Patient Records · Charts · Schedule · Provider Profile. (2) **Schedule page (cmrshzmdg):** new additive /provider/portal/schedule with Day / Week / Month appointment views (provider-scoped, patient names redacted to first-name + last-initial) plus a self-service time off / blocked-dates manager scoped hard to the provider's own session. (3) **Provider Profile page (cmrsi1ugs):** new additive /provider/portal/profile gathering the account/credential card + signature card. (4) **Awaiting-signature statuses (cmrsi007p):** the authorizations list + detail now show the five explicit states Not Viewed → Viewed → Pending Signature → Signed → Released, from a pure auth-signature-status-shared helper plus two expand-only nullable columns (providerViewedAt set-once on first provider view; releasedAt/releasedBy). Requires prod-migration-109-provider-portal-v2-auth-lifecycle.sql (additive nullable columns, applied to Neon). HIPAA: PHI-free columns; provider-scoped fence + per-load audit rows (VIEW_PROVIDER_SCHEDULE/VIEW_PROVIDER_PROFILE) on the new pages. Row cmrsi0que (post-encounter payment→sign→release automation) flagged for a Doug/Mariane policy decision. [provider-portal][schedule][authorizations][hipaa-clean]

Added

• 🏥 **Tag each call with the clinic the patient REQUESTED, then see + filter by it (RECLOC1).** Kat's ask; Doug's call: tag by the location the patient asked about, not the one offered or booked. New nullable requestedLocationId (+ requestedLocationSetBy = 'voice-tool' | 'staff') on PatientMessage via expand-only prod-migration-108-requested-clinic-tag.sql (additive columns + index, IF NOT EXISTS). Staff set/clear the tag from the 'Work this call' box on the /admin/isabella/[messageId] detail (POST …/requested-location, role-gated ADMIN/MANAGER/SCHEDULER, validated against the live active-clinic set, PHI-free SET_CALL_REQUESTED_LOCATION audit row). The /admin/isabella Voice call log renders a per-row clinic chip and a new 'Requested clinic' filter constrains the log to one clinic. The tag is read through a SEPARATE absence-tolerant overlay (same shape as the call-outcome overlay) so the cockpit and detail pages still render if the migration hasn't been applied yet. Relation-less id (no FK) — same choice as CallMatch.patientId — so a stale/renamed clinic id can never reject a call row. HIPAA: a clinic id is not patient data; the column is PHI-free by construction. [isabella][cockpit][calls][reclocation]

Fixed

• 📅 **Calendar shows provider AND visit-type at a glance (BOTHCOLOR1, Kat cmrexvu67 + cmrxvl42q).** The fill color keeps encoding the provider (deterministic palette + key); telehealth blocks add a sky-blue left border (border-l-4 border-l-sky-500), in-person have none. Doesn't collide with the dashed "open to book" style. Legend + PageHelp updated. Resolves the two-requests-one-color-axis conflict flagged in the done-verification pass. [calendar][staff]

Fixed

• 🗂️ **Cancelled/no-show separated on /admin/appointments (APPTCANCEL1, Kat cmrxphtxm).** The main appointments ledger mixed CANCELLED + NO_SHOW into the flat startsAt list; only a status-filter dropdown existed. When no status filter is applied, AppointmentsTable now partitions active rows first, then a labeled "Cancelled & No-show (N)" divider + those rows at 60% opacity (mirrors the clinic-day pattern). A status filter renders as-is. This row was wrongly closed earlier as a duplicate of the clinic-day fix (KATGW6) — the adversarial done-verification (Doug "go through each one") caught it and it's genuinely fixed now. [appointments][staff][verify-catch]

Fixed

• 🔍 **Patient full-name search fixed (NAMESEARCH1 — Kat: "someone in PF but not in Flow").** The patient search matched the whole typed query against firstName OR lastName as one chunk, so a full name like "James Minor" matched neither field and returned ZERO for an EXISTING patient (single-word "Minor" worked). Diagnosed live: the patient was in Flow the whole time (PF chart linked, EHI records ingested, appointment booked) — only the search couldn't surface him. New pure nameSearchClauses() adds cross-field AND combos for 2+ token queries ((firstName~a AND lastName~b) OR reverse), wired into /admin/patients + the search API; single-token search unchanged. [patients][search][kat]
• 📞 **Isabella live-transfer re-armed + no-offer refinement (XFERADMIN1).** ROOT CAUSE: TRANSFERS_ARMED() reads the transfer-number env at PROMPT-BUILD time; the 2026-07-23 REQONLY re-sync shell lacked it, so sync-retell-prompt.mjs baked the take-a-message-only escalation variant onto the live agent. Re-armed by re-syncing with the env present. Behavior change (Doug): the armed escalation no longer proactively OFFERS a transfer — it leads with a detailed message; the ask-triggered Live-transfer rule (caller explicitly asks for a person → flagForHuman → connect if present) is preserved. Env renamed DEMI_TRANSFER_NUMBER → ADMIN_TRANSFER_NUMBER (voice-prompt.ts + voice-tools.ts read ADMIN then fall back to DEMI — no runtime gap). Transfer-clause + escalation pins updated. FOLLOW-UP (filed, needs Mary's softphone number): make Mary the default transfer target M-F 8-4:30 + cascade Mary→Kat on no-answer. [voice][isabella][regression][hipaa]

Fixed

• 🔐 **Random mid-work sign-outs — cross-tab idle timer (KATGW6 cmrxwwax1, Kat 'keeps signing me out').** ROOT CAUSE: InactivityGuard was PER-TAB — every authed admin tab ran its own 30-minute idle countdown, and the first tab to hit 30 minutes without LOCAL mouse/keyboard input POSTed /api/admin/logout, destroying the shared session cookie for EVERY tab, including the one being actively typed in. Front desk works multi-tab, so a forgotten background tab kept ending the whole session (AuditLog 2026-07-23: ADMIN_LOGOUT rows at 09:53:32/12:00:32/12:31:18 each re-logged-in within 10-50s, and the 12:31:18 logout fired exactly 29:58 after the 12:01:20 login). FIX: activity is shared across tabs via a localStorage ledger (new pure lib src/lib/inactivity-shared.ts, node:test-covered incl. the exact regression) — the logout decision uses the freshest activity across ALL tabs. SECURITY POSTURE UNCHANGED-OR-BETTER: the 30-minute idle window and the server-side cookie idle/absolute timeouts are untouched (a pin test asserts client window === server window), and as an improvement the tab that logs out now BROADCASTS the logout so every other tab bounces to /admin/login instead of leaving PHI on screen against a dead session. Ruled out: deploy churn (stale Server Actions surface as the admin error boundary, never a logout; the sign-outs were literal /api/admin/logout calls) and the heartbeat (its failures are swallowed). [auth][staff][bugfix]
• 🧾 **Clinic Day payment chip shows 'Invoice sent' after refresh (KATGW6 cmrxwi8ts).** The Bill-via-Poynt button's green 'Invoice sent ✓' state was client-local, so a refresh reset it and the roll-call chip ignored the invoice entirely — the send looked like it never happened. The shared clinic-day derivation now carries the same poyntInvoiceUrl/poyntInvoiceSentAt signal the appointment detail shows: unpaid/partial rows get a sky 'Invoice sent (· time when emailed)' badge under the payment chip, and the Bill-via-Poynt button initializes to its confirmed state from the DB on both Clinic Day and the appointment page. Truthfulness fix on the button itself: closing the modal via Cancel no longer paints '✓ Invoice sent' when nothing was minted. [payments][staff][bugfix]

Added

• 🎨 **Per-provider calendar colors + key at the top (KATGW6 cmrxvl42q).** /admin/calendar blocks are now colored by PROVIDER — deterministic palette keyed on the provider id (new src/lib/provider-colors.ts, FNV-1a hash → 8 WCAG-AA-safe bg-*-100/text-*-900 Tailwind combos; node:test pins determinism, palette shape, and the banned low-contrast tones) — with a provider color key rendered at the top of the grid for the loaded week. Visit type stays readable in text ('tele' / 'in-person') on every block + tooltip; cancelled/no-show still wash out gray. The calendar API adds providerId (a cuid, not PHI) to rows. [calendar][staff]
• 📞 **Call button on every Clinic Day row — dials without showing the number (KATGW6 cmrxvoj7a).** Reuses the existing LogCallButton: visible text is just 'Call', the number lives only in the tel:/softphone dial (RC softphone when open, phone app otherwise), and saving the outcome logs the call. The page's PHI-minimal select widens by exactly patient id + phone for the dial; the pin test now asserts the phone appears ONLY in the render guard and the dial prop — never as visible text — and email/DOB stay banned from the surface. [clinic-day][staff]
• 📝 **Appointment notes on Clinic Day rows (KATGW6 cmrxw8sjr).** The EXISTING Appointment.notes field (editable via the appointment page's Internal-notes editor — no migration) now shows on the roll-call row as a small amber note line ('wants to wait to pay until day-of'), truncated with the full text in the hover tooltip. Staff operational text, in-admin only, and kept out of every audit detail. [clinic-day][staff]
• 💵 **Amount owed + patient info lead the appointment page (KATGW6 cmrxwvnkt + cmrxx50mk).** The appointment detail now opens with the patient's name (linked to the profile), the appointment time, status, and — when money is outstanding — a bold rose 'Owes $X' chip, plus a New/Renewal · visit-type · DOB · tap-to-call phone line. The balance REUSES the auth-gate derivation verbatim (paymentChipFor → expectedAppointmentFeeCents/isAppointmentFullyPaid — discount-, partial-, and float-tolerance-aware; never re-derived). Staff see what's owed the moment they open the page to call. [appointments][staff]
• ☎️ **'Calls made' on My End of Day — honestly counted (KATGW6 cmrxxa1lg).** New tile counts the staffer's ATTRIBUTABLE outbound-call work for the day: click-to-call dials (PATIENT_CALL_INITIATED), call outcomes logged via the Call/Log-call flow (NEW audit action PATIENT_CALL_LOGGED — before this, a desk-phone call logged through /api/admin/patients/log-call left no staff-attributable row at all), renewal-queue 'mark called' (RENEWAL_MARKED_CALLED), and called-back outcomes set on Isabella's line. A caption under the grid states exactly what's counted and that unlogged desk-phone calls aren't. Display-only (not part of the frozen EOD snapshot); the new audit detail is PHI-free (outcome enum + boolean). [staff][reports]

Fixed

• 🎓 **Training modules open on the CONTENT, not the quiz (KATGW4, Kat cmrxtu17y).** Root cause: ModuleProgram rendered a module's teaching steps AND its quiz/acknowledgment gate as one tall pane with no ordering (the quiz was answerable without a single step viewed), and the sticky module list preserved window-scroll depth across module switches — so clicking a module while scrolled down (typically right after finishing the previous module's quiz at the bottom of the page) landed staff straight on the new module's quiz card. Now the pane sequence is explicit and pure (modulePaneStages: content FIRST, gate LAST — pinned by new node:test cases), opening a module always resets to the content pane scrolled to the top, and the gate lives on its own pane reached only via the 'Continue to the quiz/acknowledgment' button after the last step (with a 'Back to the module material' link). Completion logic and server-authoritative quiz scoring are untouched. [training][staff][bugfix]

Added

• 🚩 **'Needs immediate attention' patient flag + bucket (KATGW4, Kat cmrxtz90z).** New attention type on the EXISTING migration-108 account-flag substrate (flagType is a plain TEXT column — zero new migration; set/clear API, role gate ADMIN/MANAGER/SCHEDULER, metadata-only audit, 280-char staff note, and soft-clear trail all reused as-is). Three surfaces: (a) a header-level toggle on the patient profile — quiet 'Flag for immediate attention' affordance with an optional note; while flagged it becomes a red 'Needs attention' chip showing the flagged date, with ✕ to unflag; (b) a red 'Needs immediate attention' bucket pinned ABOVE search/filters on /admin/patients — flagged patients newest-first with the flagged date, who flagged them, and the note, linking through to each profile and to the full flagged-accounts worklist (absence-tolerant: renders nothing pre-migration-108); (c) the /admin/patients/flagged worklist and the profile's Account-flags control pick the new type up automatically from the shared registry. PHI posture unchanged: bucket rows are first name + last initial + GW id (same shape as the flagged worklist), the note stays out of every audit detail, and the LIST_PATIENTS audit row gains only a count. [patients][staff]

Fixed

• ⬅️ **Clinic Day → appointment → Back round-trip (KATGW5, Kat cmrxuzshh).** All three appointment links on /admin/clinic-day append back=clinic-day&bd=&bl=; the appointment detail's Back control honors back=clinic-day and rebuilds /admin/clinic-day?date=&loc= so the same day + location tab restores. The existing back=patient behavior and the default appointments-list fallback are unchanged. [staff][nav]

Fixed

• 🔑 **Password-reset flow reachable logged-out (RESETFIX1).** /admin/forgot-password, /api/admin/forgot-password, /admin/reset-password, /api/admin/reset-password added to the proxy ADMIN_PUBLIC allowlist — they 307'd to /admin/login for any session-less visitor, making self-service reset structurally impossible for ALL staff (found when Mary's day-1 reset link bounced). Token validation, expiry (1h), rate limits, and audit rows unchanged — this only lets the existing flow be reached. [auth][staff][bugfix]

Changed

• 🗂️ **My Feedback grouped into five scannable sections (KATGW3, Kat 7/23 8:37am, routed from the SCC queue).** /me/feedback drops the filter tabs for fixed-order visual bands: Needs your attention → In progress → Waiting on Doug's decision → Fixed (collapsed, count + distinct 'Fixed in vX' chips) → Declined / removed (collapsed). Grouping is a pure function over the REAL status fields (sectionForRow in feedback-filer-view.ts) — no aspirational copy layer; unknown/future statuses fail safe to In progress, never to a closed band. A parity pin guarantees the 'Needs your attention' band contains EXACTLY the items the nav badge counts, so the number on the nav and the first band on the page can never disagree. Within the attention band, the item waiting on the filer the longest sorts first. [feedback][staff]
• 🧭 **Honest-state meta line on every feedback card (KATGW3).** Each card now states who it's currently with — 'you — check the fix', 'the review team', 'the fix agent', or 'Doug' — plus a 'last moved Xh ago' stamp derived from the row's real lifecycle timestamps and newest comment. Shipped rows show a 'Fixed in vX' chip (closedByAgentVersion — the same version staff can see in the footer badge; shas and agent internals stay admin-only). 'Approved · Doug'll do' rows, which used to sit as a bare 'Received', now say plainly: 'Approved — Doug's going to make this change himself.' The two-response collapse is otherwise unchanged: replies stay human messages, never statuses. [feedback][staff]

Added

• 💬 **Submit feedback button ON the My Feedback page (KATGW3).** The page where Kat reviews her feedback had no way to file new feedback — the green launcher only floats on /admin/* pages (the old empty-state literally told her to go find it on 'any admin page'). The header now has a Submit feedback button that opens the EXISTING FeedbackBubble composer via a new programmatic-open event (OPEN_FEEDBACK_EVENT) — same draft persistence, same screenshot flow, same /api/feedback endpoint, zero forked submission path — and the familiar floating bubble is now mounted on /me/feedback too. Allowlist gating unchanged (the bubble still renders null for non-filers, making the event inert). [feedback][staff]

Changed

• 🗂️ **Clinic day promoted to the top of Front Desk (KATGW2, Kat cmrxs0u4a).** The nav entry moves from the bottom of the group to directly under the command centers — it's the daily driver, it shouldn't hide below Launch readiness. [nav][staff]
• 💛 **Clinic-day payment actions get money-state colors (KATGW2, Kat cmrxs4are).** Mark paid renders amber (money still to collect) via an optional buttonClassName override on the shared component — no fork — and once the payment lands the buttons drop away and a green ✓ Paid chip renders in their place. Bill via Poynt keeps the KATGW1 rose-until-sent behavior unchanged. [clinic-day][payments][staff]
• 🚫 **Cancelled appointments out of the active roll-call (KATGW2, Kat cmrxs5t6b).** /admin/clinic-day now filters CANCELLED rows out of the main table into their own muted 'Cancelled (N)' section below — no payment actions there (nothing to collect on a cancelled visit). Summary counts were already cancel-aware and are unchanged. [clinic-day][staff]
• 🔎 **SF reconcile shows the real comparison fields (KATGW2, Kat cmrxsenhj).** The reviewer page previously masked email and showed phone last-4 — on a page whose entire job is a human comparing identity, which made rows unmatchable. Full phone + email now render on both sides of the ADMIN/MANAGER-gated, audited compare card (minimum necessary FOR the matching task), and a row where Salesforce itself only carried a name gets an honest 'there is nothing to compare — Skip is safe' note. [sf-reconcile][staff]
• 📬 **Provider feedback emails the internal mailbox immediately (KATGW2, Kat cmrxrstzn).** Honest answer to 'are these getting emailed to Doug right away?': they weren't — feedback only sat in the queue. Now every new provider feedback fires an instant email to the BAA-internal admin@ mailbox (category + provider + message + queue link; never an external address because the free-text may reference a patient), fail-soft so a mail hiccup can't block the intake. The page help now states exactly this. [feedback][email][staff]
• 🧾 **Held-authorizations protocol in writing (KATGW2, Kat cmrxrzqnt).** /admin/appointments/auth-gated-unpaid now answers 'do we need to get payment from these people?' on the page: yes unless comped — bill/pay-link + call first, Mark as Paid for paid-elsewhere/comp, MANAGER+ Send-anyway for true exceptions, cancel if the visit never happened; when in doubt flag Doug/Mariane instead of letting it sit. [payments][staff]

Added

• 📞 **Full phone visibility on the Isabella call detail (KATGW2, Kat cmrxr7fnn).** The contact detail page now shows the caller's full number as a tap-to-call tel: link — populated ONLY under the same ISABELLA_FULL_CONTACT flag that already unmasks the cockpit voice log (ISAFONE1 pattern), on the same ADMIN/MANAGER/SCHEDULER-gated audited page; masked display otherwise. The matched patient's phone gets the same treatment. [isabella][voice][staff]
• ☎️ **Call + ✓ Called back actions inside the call detail (KATGW2, Kat cmrxrdyfj).** The exact CalledBackButton component + mark-contacted route from Admin Today now render in a 'Work this call' section on every contact detail — clearing a caller from the callbacks-owed queue + digest no longer requires bouncing back to Admin Today. [isabella][voice][staff]
• 🪣 **Call-outcome buckets (KATGW2, Kat cmrxrhsup).** A closed set — called back no answer · need to call again · doesn't want to book · converted to patient · booked · no action needed — settable as tap-chips on the call detail, shown as chips in the cockpit voice log, and filterable from the cockpit filter bar (including 'no outcome yet'). Closed-set enforced server-side (unknown values 400); writes audit ISABELLA_CALL_OUTCOME_SET with the token only. Schema: three nullable columns on PatientMessage via expand-only prod-migration-120; every read is overlay-style and absence-tolerant, so deploy order is safe in both directions. [isabella][voice][migration]
• 🧑‍⚕️ **Convert-to-patient from the cockpit (KATGW2, Kat cmrxs95i5).** When a call matches a Lead (CallMatch linkage first, then digit-normalized phone match), the contact detail mounts the SAME ConvertToPatientButton + API the Leads queue uses — dedupe + returning-patient recognition intact, deliberately NO new patient-create path. No match → honest guidance to add the lead first. [isabella][leads][staff]
• ↕️ **Oldest/newest sort on Admin Today callbacks (KATGW2, Kat cmrxresly).** ?sort=oldest flips the callbacks-owed list so the longest-waiting caller tops it; default stays newest-first. Pure in-memory reorder. [admin-today][staff]
• 📧 **Full EOD write-ups to the internal mailbox + on-page history (KATGW2, Kat cmrxrkgfz).** Submitting My EOD now ALSO sends the actual notes + carryover to the BAA-internal admin@ mailbox (the non-BAA summary email stays counts-and-link only, unchanged), and the page lists your own previous 14 EODs in collapsible cards. Fail-soft: a send failure never blocks the save. [eod][email][staff]
• 📋 **Forms queue: appointment + honest clock (KATGW2, Kat cmrxrpqjr + cmrxrr29m).** Each form row now shows the patient's next upcoming appointment (linked), how long the form has been sitting ('3d ago'), and the magic-link expiry ('link ok until / expired', red when dead). Page help now answers the deadline question honestly (the 7-day link expiry is the only hard deadline; the practical one is the visit) and describes exactly what the patient email looks like. [forms][staff]
• ✅ **Renewals worklist: phone + 'Mark called' check-off (KATGW2, Kat cmrxsakkl).** The worklist adds the patient's phone (tel: link under ISABELLA_FULL_CONTACT, masked last-4 otherwise) and a Called column — tap to mark called (tap again to undo), with the who/when shown under the badge. Audit-trail-as-state via RENEWAL_MARKED_CALLED rows (patient cuid + done bit only): zero schema change, full trail. [renewals][staff]
• 🤔 **Qualifying leads: honest 'why is this empty' (KATGW2, Kat cmrxrn4kw).** Root cause verified against prod: every condition-tagged lead came from the 2021 Salesforce import (newest 2021-06-24, outside the 400-day window) and the current website lead form doesn't capture conditions at all, so nothing new can ever appear. The empty state now states this with live counts, and ?window=all shows the old Salesforce cohort (bounded to condition-bearing rows). Adding condition capture to the lead form is the real fix and is flagged as follow-up work. [leads][staff]
• 💬 **'Already replied' badge on Isabella draft queue (KATGW2, Kat cmrxrbq09).** Each pending draft now checks for an OUTBOUND email on the same thread (or to the same patient) sent AFTER the inbound arrived, and badges '✓ already replied ' so nobody double-emails a patient Mariane answered by hand. Fail-soft overlay query; no badge when the read fails. [isabella][email][staff]

Changed

• 📅 **Calendar day columns widened (KATGW1, Kat cmrxppqvt).** /admin/calendar day columns go from 120px to 170px minimum with slightly larger entry text; the existing horizontal scroll takes over on narrow screens so entries stay readable instead of shrinking. [calendar][staff]
• 💳 **Unpaid = red, and visible on the Appointments LIST (KATGW1, Kat cmrxq7422).** The 'Bill via Poynt' button and the shared 'Unpaid' chip now render in the rose action-needed palette (the button flips green only once the payment request is sent), and every row on /admin/appointments now shows its payment chip — paid, partial-with-balance, invoice sent, or unpaid — using the exact same auth-payment-gate derivation (isAppointmentFullyPaid) as the auth-gated-unpaid queue. No money math was reimplemented; the list passes the raw fee fields into the existing shared boundary. Cancelled/no-show rows without a payment stay quiet. [appointments][payments][staff]

Added

• 🗣️ **Sender attribution on the patient Communication panel (KATGW1, Kat cmrxq35l1).** Every outbound message now carries a sender label: '✨ Isabella (AI)' when aiAutoSent, the staff member's name (resolved server-side from the recorded staffUserId — Mary/Kat/Mariane), or the honest 'GW team' fallback when an older row has no recorded sender. Names are never guessed. Both the server-rendered thread and the 30s auto-poll route return the attribution; the internal staff id itself is not shipped to the client. [messages][staff][isabella]
• 🔴 **Frustrated + repeat callers visible IN the Leads list (KATGW1, Kat cmrxqejdp).** A lead whose linked call carries the stored negative sentiment (PatientMessage.aiCallSentiment, written by the existing call-analysis webhook — no new AI calls) renders as a red row with a '⚠ Frustrated caller' chip, and a caller whose number appears on multiple call records gets a '📞 Called N×' chip — both visible without opening the lead. Derived from the CallMatch relation + one bounded group-by; failures degrade to the plain queue. [leads][staff][voice]
• 📜 **Full call transcript on lead detail (KATGW1, Kat cmrxqgwxv).** /admin/leads/[id] now renders EVERY linked call (not just the latest) with its date, duration, sentiment, summary — and the full verbatim transcript behind a collapsed-by-default 'Show full transcript' toggle (native details element, no truncation). PHI stays on the session-gated admin page; nothing goes to logs. [leads][voice][staff]

Fixed

• 🪪 **Voice lead-name extraction no longer captures pronouns — the 'my'-instead-of-Patrick bug (KATGW1, Kat cmrxq9m50).** Root cause: the transcript name-extractor's this is pattern ran case-insensitively, so its capitalized-name requirement matched ANY word and ordinary prose ('this is my second time calling') captured 'my' as the caller's first name. Fixed: capture groups genuinely require a capitalized token, a pronoun/stop-word blocklist rejects junk regardless of pattern, higher-signal patterns ('I have your name as X' / 'my name is X') run first and scan all occurrences, and no plausible name → an honest blank rather than junk. The same rejection now guards the mid-call captureLeadFromVoice/proposeBookingViaText tools (a junk model-supplied name triggers a spoken re-ask instead of a junk lead). The affected lead was corrected to Patrick after verifying the transcript on the row confirms it — via an APPENDED name-override audit row (AuditLog is append-only per HIPAA integrity; the queue + detail pages now resolve name corrections the same way they already resolve phone/email edits). New unit tests cover the 'my' case, pronoun rejection, and the recovery patterns. [voice][leads][bugfix]

Added

• 🔔 **New-appointment-assigned awareness for providers (A8).** Every place an appointment is created onto or moved onto a provider's schedule (patient booking wizard, staff manual booking, staff reschedule, patient self-serve move, voice self-scheduling) now writes an APPOINTMENT_ASSIGNED_TO_PROVIDER audit row — metadata only (appointment id + from/to provider ids + write site, never a patient identifier). The provider portal's 30s today-poller reads those rows and pops a distinct indigo 'New appointment' toast: redacted 'Firstname L.' + clinic-PT time + visit type, PHI-minimal by construction. A same-tick check-in toast for the same appointment suppresses the assignment twin so nothing double-pops. [provider][audit][polish]
• 🧾 **Batch send/print confirmation (A6).** The Provider Queue's sticky batch bar now routes both 'Send all' and 'Print all' through the shared ConfirmModal: it states the count and the earliest–latest visit dates in the selection, and requires an explicit 'Yes, send N' / 'Yes, print N'. Pre-fix a single stray click mass-emailed every selected authorization immediately. [provider][polish]
• 🧭 **Payments landing per-role hint (C3).** /admin/payments now tells the CURRENT role exactly which drill-downs it can open — finance viewers see 'full access', a SCHEDULER sees that ledger / alignment / cash / provider payouts are finance-only and hidden on purpose (not broken). Kills the KATFIX1-class 'is this page broken for me?' confusion for Mary's first week. [staff][payments]
• 🧪 **Role-router regression pins (C5).** New src/lib/__tests__/admin-role-router-regression.test.ts source-pins the /admin landing router: SCHEDULER → /admin/today and MANAGER → /admin/cs-command-center redirects must exist verbatim, both destination pages must exist on disk, and the role must come from the proxy-verified x-admin-role header. A silent retarget of a persona's landing page now fails the test suite instead of stranding Mary or Mariane. [tests][staff]

Changed

• 🔁 **Chart sign + autosave resilience (A5).** SignAndLockButton now retries the sign POST up to 2× on a 5xx with short backoff (1s / 2.5s) before showing an error, and a network failure now surfaces a clear 'the sign didn't complete' message instead of hanging the modal. Safe by design: the sign pipeline is idempotent end-to-end (already-signed returns alreadyIssued, cert issuance short-circuits on an existing cert, the cert email skips when one was already sent) so a retry can never double-issue an authorization. SoapEditor autosave failures now ALSO render a persistent role=alert 'Unsaved changes — your latest edits are NOT saved' banner with a Retry button — it never auto-dismisses and only clears when a save actually succeeds, so a provider can't chart for an hour on top of a dead autosave. [provider][charting]

Added

• 🪪 **ID-rejection reason surfaced to the patient (PATRECOV1, Mariane cmq61ukdl).** Staff rejections already captured a closed-set reason class; the patient now actually sees it. /patient/portal/id shows 'Reason: …' plus a per-reason 'What a good photo needs' guidance line; the NextStepsBanner rejected card names the reason; and the patient-id-reprompt nudge email includes the same reason + guidance lines. New cut_off reason class ('Part of the document is cut off') joins the staff reject select. Closed-set labels only — staff free-text notes never reach the patient; no schema change (reason column existed); legacy/unknown reason values degrade to the prior generic copy via the new absence-tolerant parseIdRejectionReasonClass helper. [patient-portal][id-verification][email]
• 💳 **Payment-step recovery when the payment system is unreachable (PATRECOV1).** The booking wizard's Poynt pay-to-confirm step previously showed only a red line + retry when /api/poynt/invoice errored or timed out. It now renders a recovery state: 'We're having trouble reaching our payment system' with a tap-to-call button (SSoT clinic phone), the existing Try again, and — only when the deferred-payment rail is enabled by env — a 'Reserve now, pay later' option that routes to the existing deferred booking panel (server re-checks its own flag on the booking POST). No amounts or eligibility logic touched; the wizard remains dark behind its flags, so this ships inert. [booking-wizard][payments]

Fixed

• 📨 **CS Command Center unmatched-contact click now lands on All tab (KATFIX8, Kat cmrxr06tq).** When a CS Command Center item has no linked patient and the Messages page resolves the msgId to an unmatched caller, the page now switches to the All tab (was: Unread) so the call or SMS row is actually visible. [cs-command-center][messages][staff][navigation]

Changed

• 📞 **One-click Call + Log in Renewal Call Queue (KATFIX7, Kat cmrxos5ch000804l6qvfo2ydr).** The 'Log call' button in each Renewal Call Queue row is now a 'Call' button when a phone number is on file. Clicking it initiates the dial (RingCentral softphone when mounted, OS tel: handler otherwise) and immediately opens the outcome log form so staff can record reached/no-answer/voicemail in the same action. [renewal-queue][staff][click-to-call]

Added

• 🚩 **Flag for priority callback on Isabella contact detail (KATFIX6, Kat cmrxisitw).** When a matched patient is shown on /admin/isabella/[contact], a toggle button now lets staff flag or un-flag that patient for priority human callback. Sets Patient.contactFlag (same field shown in /admin/patients 'Flagged' filter), writes an UPDATE_PATIENT audit row, and reloads the page. [isabella][staff][callbacks]

Changed

• 📞 **Longer call preview on the Isabella voice log (KATFIX5, Kat cmrxiq63e).** summaryPreview cap raised 120→400 chars (aiCallSummary path) and 70→200 chars (subject fallback) so call rows show ~2–3 summary sentences at a glance. Thread-context per-message cap on the detail page raised 500→2000 chars so sibling messages aren't cut off mid-transcript. [isabella][calls]

Added

• 🛗 **Request-only locations (REQONLY1 — Doug 7/23 "stop scheduling for Oly except when she's requested … same with Dr Leslie").** New env-driven lib src/lib/request-only-locations.ts: REQUEST_ONLY_LOCATION_IDS (comma-separated Location ids; DEFAULT unset = today's behavior everywhere, provably — 19 pin tests including byte-identical dark-output checks). Arm with loc-olympia,. PROACTIVE surfaces excluded when armed: persona location lists (voice/chat/email/SMS via getLocationListForPrompt, incl. the FRIWIN1 "new pts at our Seattle office" window copy → becomes "arranged by our office on request"), unscoped standing-window descriptions, chat listOpenSlots' unscoped dated-slot query, the public next-slot teaser, the wizard's clinic picker (/api/locations gains a requestOnly field; class-gated patient lists exclude), get-started LeadForm + BookNow modal chips (stay selectable with an honest "by request" note — submitting IS the request), and the /locations/ page's book CTAs (become call-us; page itself stays live). EXPLICIT-REQUEST paths untouched and source-pinned: a named locationId/priorClinic in listOpenSlots/proposeBooking, telehealth renewal scoping to a spoken prior clinic, and every admin/staff picker (unfiltered; /admin/appointments/new shows an amber request-only tag + context line). [scheduling][isabella][flag-dark]

Changed

• 📞 **Honesty note for the phone leg:** Isabella's spoken clinic list is baked into the Retell prompt at sync time — arming/disarming REQUEST_ONLY_LOCATION_IDS updates chat/email/SMS on the next deploy, but the voice prompt needs a re-sync (gated step for Doug). Her server-side TOOLS (getLocations / listOpenSlots) pick the env up on the same deploy. [isabella][voice]

Added

• 🗺️ **IL IDPH packet builder — the first real per-state issuance handler (ILPACKET1, master-plan B1/B5 — DARK).** New il-idph-packet.ts (pure render + validation) + il-idph-packet-issue.ts (server orchestration) plug into the CERTDISPATCH1 seam: IL's registry entry is now a real handler whose FIRST LINE is a hard IL_CERT_PACKET_ENABLED gate — anything but the literal "true" (the default: unset) returns the byte-identical legacy jurisdiction-cert-artifact-missing block, so live behavior is unchanged and IL stays fail-closed until Doug + counsel flip it. Flag-on path: renders a two-page GW-styled packet (physician instruction cover sheet + IDPH written-certification data worksheet: patient identifiers, IL-canonical 410 ILCS 130 conditions, telemedicine exam basis per P.A. 104-0463, IL medical license from the provider's ProviderStateLicense row, 1/2/3-yr registry term, wet-signature block), enforces data-completeness + the 90-day exam-window check, stores the PDF in its own private il-packets/ blob namespace, and creates the Authorization row via issueAuthorization with jurisdictionState:"IL" + packetWorkflowStatus:"packet-generated" (migration-116 columns get their first writer). Honest placeholders: the official IDPH AcroForm asset is NOT in the repo (the GW-styled render carries every required element; swapping in the official form is a follow-up asset task) and the IDPH mailing address is a MARKED placeholder — the cover sheet renders a "confirm address before mailing" warning and a pin test blocks it shipping as if real. [multi-state][dark][cert]
• 📬 **Provider-portal IL packet card (dark).** /provider/portal/authorizations/[id] shows an Illinois IDPH card ONLY when the flag is on AND the row is an IL packet: lifecycle stepper (packet-generated → physician-filed → patient-notified), packet download via the existing dual-auth PHI blob proxy, an audited "I mailed this to IDPH" action (the MARK_PACKET_FILED audit row is the mailing log: who/what/when of the physician's direct-mail chain-of-custody duty), and a record-only "patient notified" step (state-keyed IL patient emails are master-plan A3 — a separate build). Transitions route through the strictly-forward canTransitionCertPacketStatus guard; the actions re-derive the provider from the session cookie and scope to the issuing provider, fail-closed. [provider][multi-state][dark]

Changed

• 🛡️ **Assisted-packet patient-comms guard (inert for WA).** Non-WA packet issuances return assistedPacket: true and NEVER return pdfBytes or a patient-facing cert URL — the IL certification form legally never reaches the patient. All five issuance call sites (provider action, bulk-approve, encounter sign, admin approve, payment-release issue-cert) now skip the WA-copy cert email/SMS for assisted packets; every WA issuance is byte-identical (the flag is never set on the WA path, pin-tested). issueAuthorization gains optional packetWorkflowStatus (validated, NULL for all legacy callers) and jurisdiction-aware condition normalization (IL rows normalize against the 410 ILCS 130 list instead of WA's RCW slugs; WA path unchanged). PDMP posture pinned: IL is advisory — no issuance-path PDMP gate — while the dispatch still runs its PA/OH gate upstream of every handler, unchanged. [multi-state][dark][hipaa]

Added

• 🗓️ **Clinic Day roll-call at /admin/clinic-day (CLINICDAY1 — Doug 7/23 "dial that in for every clinic day").** Date picker (defaults to today, Pacific) + tabs for each active location and Telehealth. Every appointment that day, time-ordered: patient (first name + last initial only — contact info stays behind View, per the auth-gated-unpaid convention), provider, New/Renewal, visit-status chip, and a payment chip that reuses the EXACT cert-gate money math (expected fee incl. discounts, the partial-pay sentinel state, the $1 rounding tolerance) — never a second derivation. Unpaid rows get the existing Bill via Poynt / Mark as Paid buttons; no new mutation routes. Summary strip + end-of-day attention list make the reconcile explicit: past rows still Scheduled/Checked-in ("mark seen or no-show", 15-min grace after the slot ends) and seen-but-unpaid rows. Roles: admin/manager/scheduler — Kat + Mary's daily driver. Metadata-only VIEW_CLINIC_DAY audit row per load (date + location key + counts, never identifiers). Pure derivation lib (src/lib/clinic-day-shared.ts) with unit tests + source pins for the role gate, PHI-minimal select, and money-math reuse. [staff][appointments][payments]

Added

• 🎓 **Training on-ramp on Today (Doug 7/23: "intuitive… hit the ground running").** /admin/today opens with a single slim start-here card whenever the signed-in staffer has incomplete required training for their role — one click lands on /admin/training, which auto-selects their next module. Shows progress ("2 of 7 done — keep going") and disappears on its own once required modules are complete. Tolerant of the not-yet-applied completions migration (shows the card rather than hiding on a DB hiccup). Appointments still render first (Kat cmrf9jkv respected). [training][staff]
• ⚡ **Kat added to the trusted auto-fix list (KATCTRL1).** seattlecckat@gmail.com joins REVIEWER_FEEDBACK_AUTOFIX_TRUSTED (same mechanism as Mariane, Doug 2026-06-02 "just fix what she submits"): her GW feedback rows auto-promote to approved-autofix on insert, so the agent fix loop sees them without a triage click. One-line trust-list change; the §4.1 role gate, PHI carve-outs, and the fix-loop's REFUSE list are unchanged. [feedback][staff]

Added

• ✍️ **Weekly timesheet sign-off (TIMECLOCK1 — Doug 7/23 "have kat sign off on them every week and double check").** New TimesheetWeekApproval table (prod-migration-119, expand-only, NOT applied — all reads/writes tolerate its absence, deploy order flexible): one row per (staff, PT week) recording approver, timestamp, optional note, and a SNAPSHOT of the derived worked total at sign-off. /admin/timesheets grows a Weekly sign-off band: completed weeks get an Approve button (ADMIN/MANAGER only); approved weeks show a green badge; and if the freshly derived total ever diverges from the sign-off snapshot the badge flips to an amber re-review warning — the double-check, so a stale approval can never be silently trusted. POST /api/admin/timesheets/approve upserts (re-approval replaces; the audit trail keeps every event, metadata only). [staff][timesheet][schema]
• 📗 **Bookkeeper read access to the time clock (Doug 7/23).** The Timesheets PAGE widens to FINANCE (ADMIN/MANAGER/BOOKKEEPER) in the proxy carve-out, edge gate, nav, and in-page guard — payroll needs the worked-hours view. STRICTLY view-only: every /api/admin/timesheets/* write (schedule replace + weekly sign-off) stays ADMIN/MANAGER at the proxy edge, and the schedule editor + approve controls don't render for BOOKKEEPER. SCHEDULER remains fully excluded (she is the person being reviewed). Help pages (/admin/help) also added to the bookkeeper's allowed paths — the nav showed Help but the proxy bounced her to accounting (dead link). [staff][rbac]

Fixed

• 🔒 **/admin/inquiry-coverage now enforces its role gate in-page.** The nav hides it from SCHEDULER/BOOKKEEPER but the page accepted ANY signed-in session by typed URL — hiding a link is not an access control. Added the same ADMIN/MANAGER check /admin/mariane-today uses (identifier-fragments on that dashboard: phone last-4s, redacted email locals → §164.502(b) minimum-necessary). Found by the 7/22 portal audit, noted as out-of-lane by the day-1 batch; closed here. [rbac][hipaa]

Fixed

• 🔘 **Feedback widget "won't submit" (Kat 7/22, /admin/locations) — silent Send-disable killed.** Root cause: the 10-character minimum lived only in the Send button's disabled prop, so a short note (Kat's was the 5-character "error") left Send permanently grey while the explanatory copy inside submit() sat unreachable behind that very disable. The minimum + block-reason copy now live in lib/reviewer-feedback.ts (REVIEWER_FEEDBACK_BODY_MIN, feedbackSendBlockReason) shared by the widget AND /api/feedback's server clamp; Send only disables while a submit is in flight, clicking with a short body shows the reason, and a live hint under the textarea says how much more to write. Pinned in feedback-send-gate.test.ts — including Kat's exact 5-character body. No auth or endpoint behavior changed. [staff][bugfix][test]
• ⏱️ **Feedback bubble failure copy is honest about WHAT failed (C4).** Thrown-fetch copy extracted to feedbackSubmitErrorCopy: a timeout (TimeoutError, and old-Safari's generic AbortError — WebKit < ~17.4 reports signal timeouts that way) says "took too long — try Send again"; a killed fetch (TypeError) keeps the couldn't-reach + content-blocker hint; and the unknown-error fallback now says "Couldn't reach the server" instead of the vague "Network glitch." Recovery action unchanged everywhere — retry, with the draft still saved locally. [staff][copy][test]
• 🗂️ **Timesheets no longer silently shows the wrong person when the default account is missing (C6).** If the page's default-staff email lookup finds no account (not created yet, or re-created under a new address) and no staff member was explicitly chosen, it previously fell back to the alphabetically-first admin's timesheet — a wrong-person read that looked authoritative. It now renders a friendly "Select a staff member above" state with the picker front and center. Explicit selections and the found-default path are unchanged. [staff][honesty]

Changed

• 📤 **Patient records upload: named progress + specific failure reasons (B3).** While a file uploads, the box now shows the file's name, a spinner with an indeterminate progress bar (deliberately no fake percentages — the browser doesn't report upload progress), and a "keep this page open" note, so a slow photo upload doesn't invite a second tap and a duplicate. Failures now say what actually happened: over-10-MB (client pre-check AND the server's 413, same words), "took too long" for a timeout, "couldn't reach the server" for a dead connection, and the server's own reason when it rejects a file — previously every thrown failure claimed "Upload timed out." Existing 10 MB limit and accepted file types unchanged; also swapped the bare AbortSignal.timeout for the fleet-standard timeoutSignal so pre-Safari-16 browsers don't sync-throw before the upload even starts. [patient-facing][copy]

Added

• 🎓 **Role-based training-module program (TRAINMOD1 — Kat 2026-07-22 "Reply Requested", Mary starts 7/23).** /admin/training restructured from a doc-style guide into a Brapp-style module program. New pure registry src/lib/training-modules.ts: 9 modules from Kat's proposal — 7 READY (Day One · Daily Workflow · Booking Appointments · Patient Records · Phone Calls & Patient Communication · Scheduling & Providers · Marketing & Referrals) with content mined from the existing vetted knowledge base and expanded with why-each-step + realistic examples; 2 DRAFT-GATED (HIPAA & Patient Privacy · Handling Difficult Patients) rendering honest "In review" cards — excluded from completable modules, and deliberately non-blocking so the chain never dead-ends on a pending review. Per-role required chains (SCHEDULER-first ordering), locked-until-previous-complete; each ready module gates on a quiz (all-correct bar, REUSING the existing "Check your understanding" mechanism — Daily Workflow + Patient Records carry the vetted quizzes verbatim; Booking + Phone add 3 questions each mined from the same source sections) or an acknowledgment. [training][staff-ops]
• 🛂 **HIPAA & Patient Privacy stays gated (Kat's #1 concern, handled honestly).** The module is slot #2 in every role's chain — "In review — required before you touch patient records" — pointing at the existing DRAFT outline by path only. training-hipaa-draft.ts remains un-imported by every training surface (test-pinned), and the completions API refuses draft-gated ids server-side, so NOTHING can record HIPAA training as complete until hipaa-architect + clinician sign-off publishes reviewed content (gate already on the board). Interim privacy ground rules live in Day One: lock your screen, nothing patient-related leaves the system, report slips to Doug. [hipaa][training]
• 📊 **Completion tracking + management matrix.** New expand-only TrainingCompletion table (STAGED prod-migration-118-training-completions.sql, idempotent, NOT applied): one metadata-only row per staff × module (staff id + module id + gate kind + score — no patient data reachable by construction), unique per pair, upsert on re-take. Server-authoritative gates: /api/admin/training/completions re-scores quiz answers against the registry (a client claim can't pass a failed quiz) and writes a TRAINING_MODULE_COMPLETED audit row (metadata-only detail) per completion. ADMIN/MANAGER get the Team progress tab via /api/admin/training/matrix (role re-checked server-side, SCHEDULER/BOOKKEEPER excluded): per-staff × per-module ✓ + date + quiz score, required-vs-optional and in-review columns distinguished. DEPLOY-ORDER SAFE: every read/write tolerates the table's absence (Prisma P2021 / raw 42P01 → trackingAvailable:false), the program falls back to device-local progress with a plain "tracking pending" note, and the matrix still renders the staff list. [training][rbac]
• 📚 **Reference library preserved + Soft-launch section clarified (Kat: "confusing").** All existing knowledge-base sections remain reachable under the Reference tab — none of Kat's material deleted. The "Soft-launch Mode" section is now "Manual Callback Mode": plain-words intro ("your call IS the confirmation"), vendor/config jargon removed, same real workflow (morning callback queue · owes-payment collection · no-confirmation-email reassurance script). New training-modules.test.ts pins the registry invariants: unique ids, ready⇔exactly-one-gate, draft-gated non-completable + non-blocking, chain ordering per role, PHI-shape scans across ALL module copy, and the missing-table tolerance classifier. [training][copy][test]

Added

• 🩺 **Full add-provider form (PROVADD1 — portal-completeness Lane A4; Erin Brown onboarding driver).** /admin/providers Add now captures NPI, license type/number/expiry, email, and Doxy.me URL at create — the POST at /api/admin/providers validates with the SAME zod schemas the edit path uses (email .email() server-side + client format check; Doxy URL through the strict-hostname DX0125 guard, license-expiry via the shared Q10 LICEXP1 schema). New providers are created **INACTIVE** and stay out of the booking wizard until signature + schedule are set and an admin flips them Active. Creation audited (CREATE_PROVIDER, metadata-only detail). Provider onboarding no longer requires SQL. [staff][rbac]
• 📅 **Inline weekly-schedule editor + full-replace endpoint.** Schedule button on each provider row edits their recurring template (day-of-week, start/end, Telehealth/In-Person, office) and saves via new PUT /api/admin/providers/[id]/schedule — full-replace semantics like the timesheets schedule endpoint, but implemented as soft-deactivate + recreate in one transaction (never a hard delete; history + already-generated slots survive, mirroring the /api/admin/schedules remove idiom). Written rows match the exact ProviderSchedule shape the Sunday slot cron and Isabella's standing-availability describer read. Validation lives in a shared pure lib (provider-schedule-template.ts) run on BOTH client and server: end after start, no overlapping shifts on the same day, 21-row cap. Audited as CAPACITY_UPDATE kind=schedule-replace (weekday + minute integers only). ADMIN/MANAGER-gated with source-pin tests; SCHEDULER stays excluded per the providers-bucket doctrine. [staff][test]
• ✅ **Onboarding checklist strip (computed, read-only).** Each provider row now shows the five-step path — row created · location · signature uploaded · schedule set · setup link sent — derived entirely from data already on the row (active-schedule count via the providers GET; "setup link sent" from an existing reset-token or already-set password). Fully-onboarded-but-Inactive rows show one line: flip the toggle when they're ready. Reuses the existing send-setup-link action untouched. [staff]

Added

• ✍️ **Provider signature self-upload page (Lane A3).** New /provider/portal/signature-upload: cookie-gated with the exact verifyProviderSession + fail-closed notFound() guard as the sibling earnings page, reads ONLY the session provider's own row (zero patient data), and reuses the EXISTING /api/provider/signature route — same private Vercel Blob store, same Provider.signatureUrl update, same metadata-only PROVIDER_SELF_UPDATE kind=signature audit row as the admin flow (no new storage mechanism, no new audit surface). On success the form bounces back with ?uploaded=1 and the server re-reads the DB before showing the confirmation banner. Pre-sign checklist's missing-signature item now deep-links here instead of the bare portal home. [provider][self-service]
• ⏳ **Session-expired feedback on provider sign-in (Lane A7).** When a provider_session cookie is present but no longer verifies (idle/absolute-cap expiry), the proxy bounce to /provider/login now carries ?reason=session-expired and the login page shows one calm line: "Your session expired — log in again." A never-logged-in bounce stays banner-less; admin and dispensary bounces are unchanged. [provider][ux]

Fixed

• 🗺️ **PDMP no-configured-state notice is now action-framed (Lane A2).** The multi-state encounter chart's red box for a jurisdiction without a configured PDMP program read like a system bug ("no PDMP reference configured"). It now frames the task: check that state's prescription monitoring program directly, run the query in the state's own portal, and document the result in your note before certifying — never substituting another state's portal. Copy only — the fail-closed behavior (no deep-link is ever invented for an unconfigured state) and the WA/PA/OH/IL/MD configured renderings are byte-for-byte unchanged. [provider][multi-state][copy]
• 🩹 **Replacing an existing signature no longer errors.** The provider self-upload route stored to a fixed blob key without allowOverwrite, so replacing an already-on-file signature hit the blob store's "already exists" error and surfaced as a storage failure; now matches the admin route's deliberate-overwrite semantics. [provider][bugfix]

Fixed

• 🔐 **Patient magic links are now SINGLE-USE (Lane B2 — PHI hardening, audit-flagged HIGH).** The /my-appointments email link was a stateless HMAC token: signature-checked and 15-minute-TTL-bounded, but nothing marked it USED — a forwarded email (or shared-device history) granted repeat access to appointment PHI within the window. First open now atomically INSERTs the token's SHA-256 into new table PortalLinkClaim (primary-key uniqueness is the concurrency arbiter — two simultaneous clicks can NEVER both render PHI; the loser gets the friendly page). Second use lands on the existing LINKFRESH1 one-click "email me a fresh link" rail with already-used copy, never a raw error. The 15-min TTL is unchanged; mints now carry a random jti nonce so two same-second links for one email each get their own single-use slot (older nonce-less tokens still verify). Sub-resources the rendered page itself calls with the token (documents, ICS, set-password) deliberately keep the stateless TTL check. DEPLOY-ORDER SAFE: prod-migration-117-portal-link-claim.sql is expand-only + idempotent and NOT yet applied — until it is, the claim path detects the missing table and FAILS OPEN to the old TTL-only behavior (warn-logged). PHI hygiene: only the one-way hash is stored (no email/patient id/raw token — a table dump can't be replayed into a working link); errors log by name only. 14 pin tests: mint→claim→reject-second, concurrent-click arbitration, per-token independence, fail-open arms, hash hygiene, TTL preserved, pre-nonce token rollout safety. [patient-facing][hipaa][test]
• 🧭 **Renewal-link-expired page gives a next step (Lane B5).** /renew's invalid/expired state said only that the link "has expired or its security signature did not match" — a dead end. It now adds: "That's OK — call us and we'll book your renewal directly, or check your latest email for a fresh link," with the patient line rendered from the PHONE SSoT constant (src/lib/constants.ts), never hardcoded. "Latest email" is genuinely actionable because each reminder stage (60/30/15/7 days pre-expiry) mints a fresh 30-day token. [patient-facing][copy]

Fixed

• 🧭 **SCHEDULER nav ⊆ page-role parity audit + permanent pin (C1 — Mary starts 7/23).** Audited every NAV_GROUPS item + ACTION_COMMANDS palette entry visible to SCHEDULER against its destination's own guard (page-level bounce or proxy.ts edge gate). Result: ZERO drift today — every scheduler-visible destination admits SCHEDULER (the supervisory queues — Mariane Today / Doug Queue / Inquiry Coverage / Timesheets / Staff Scorecard — and the FINANCE surfaces were already hidden). What ships is the regression pin: new nav-scheduler-page-parity.test.ts fails the suite the moment a scheduler-visible nav item points at a page carrying an ADMIN/MANAGER-only bounce guard (all four observed guard shapes), a proxy edge-gated MANAGER+ path becomes scheduler-visible, /admin/payments nav visibility contradicts the PAYMENTS_VIEW_ROLES SSoT (the KATFIX1 silent-bounce class), or a supervisory queue gets widened instead of hidden. check-admin-route-scheduler-coverage.mjs re-run before + after: 0 violations. [staff][rbac][test]
• 🌗 **Dark-feature empty states say "deliberately off," not "broken" (C2).** Three surfaces a new hire can land on read like bugs when their feature flag is off: /admin/tasks said "being set up… ready shortly" (it's parked pending a Doug gate), /admin/patients/records-needed said the monitor "is currently off" without saying that's intentional, and /admin/waitlist's empty state coached "keep generating slots" while the waitlist itself is deliberately paused until self-scheduling ships (Mariane M24#15). Each off/empty state now says the feature is built but deliberately not switched on, and to ask Doug or Mariane if it's needed. Copy only — no flags flipped, no gating changed. [staff][copy]
• 💌 **Booking-confirmation email honesty when a deposit still holds the spot (B1 — extends HONESTREQ1/SCHEDHONESTY1).** The post-booking email opened "Appointment confirmed — {date}" / "You're booked" even when its own body said "💳 Confirm your appointment with a $50 deposit" — the request-vs-confirmed contradiction the honesty arc exists to kill (patients no-show or 1-star when the 'confirmed' visit still needed payment). Subject + opener are now conditional on the deposit block's EXACT render condition (pay link present + nothing collected + deposit-eligible): that state reads "Your appointment request is in — one step left ({date})" / "Your request is in — one step left. A deposit (or full payment) below locks in your spot." Fully paid, deposit-already-in, and optional pay-ahead states keep the confirmed framing byte-for-byte. No other email template touched; honesty pins added to the pay-options test file cover all four payment states. [patient-facing][honesty][email]

Added

• 💵 **Provider pay-visibility page (PROVEARN1 — portal-completeness Lane A1 P0).** New /provider/portal/earnings: cookie-gated (same verifyProviderSession + fail-closed notFound() guard as the sibling portal pages), scoped STRICTLY to the session's providerId, and derived from the SAME math as the FINANCE-gated /admin/payments/provider-payouts report — provider-payout.ts stays the single source of truth (flat $50 new / $45 renewal; Olympia = 50% of collected). YTD summary (paid visits · earned · awaiting payment) + per-month ledger: visit date, patient REDACTED to "LastInitial., FirstInitial." (never a full name, DOB, or contact info), NEW/RENEWAL, location, rate basis, amount, Paid/Pending. Pending = completed visit with no recorded payment — excluded from owed totals; a pending Olympia visit shows "—" (50% of an uncollected amount is unknowable, never guessed at $0). Pure derivation lives in unit-tested provider-earnings-shared.ts. [provider][pay-visibility]
• 🏠 **Portal-home earnings tile.** Fourth tile in the portal-home quick-links grid: last-3-months paid total + visit count, linking to the full ledger. The tile's query fetches NO patient data at all — totals only. [provider]
• 🛡️ **Audit + PHI discipline.** One VIEW_PROVIDER_EARNINGS_SUMMARY audit row per page load (§164.312(b)) with explicit provider attribution (cookie-only providers have no admin header) and METADATA-ONLY detail — row/month counts, never a patient identifier or dollar amount. Pin tests enforce the auth gate, the providerId query fence, the initials-only patient select, and payout-math parity with the provider-payout SSoT. [provider][hipaa][test]

Fixed

• 🗓️ **Isabella scheduling honesty — repo↔phone reconcile (SCHEDHONESTY1; Kat 7/10 + 7/15).** Four VOICE_PROMPT edits, applied surgically onto clean main (NOT a copy of the divergent working tree): (1) dated-slots guard now appends the NEVER-offer-a-same-day-appointment rule — same-day asks become take-details-and-callback, no time named; (2) the walk-in/stop-by answer no longer says "I can book you a slot right now" — it takes details for a team callback ("including today if we have it") instead of proposing a time; (3) the renewal preferred-day shape now opens "Great — I'm noting your preferred day as a request, not a confirmed booking. Nothing is on the schedule until our team calls you back to confirm an actual time." (records sentence + portal/fax rails unchanged); (4) wrap-up beat (2) appends "nothing is booked yet; this is a request until our team calls you back to confirm a time." The spec's Edit 5 (slot-window floor so the tool can never return a same-day slot) is ALREADY on main in stronger form — SLOTSAFE1's startOfNextPtDay floor in dateRangeWindow — so no code change was needed there. Live phone already runs this copy (Retell sync 2026-07-22, hash 91f7d172bce8, abstention-eval 20/20): do NOT re-run scripts/sync-retell-prompt.mjs for this commit. [voice][honesty][repo-phone-reconcile]

Added

• 🗺️ **Cert-issuance state dispatch core (CERTDISPATCH1 — master-plan B3, dark).** New state-cert-issuance.ts: issueCertForAppointmentUnified now routes on the visit's attested patientPhysicalState via normalizeCertJurisdiction + a typed per-state handler registry (PA/OH/IL/MD) instead of the inline TURNERPREP2 hard block. WA (and null/empty state) stays on the in-house DOH 623123 path, byte-identical — dispatch runs before the dob/email gates exactly where the old block sat. Every expansion state's handler — and any unknown state — returns the VERBATIM legacy fail-closed reason (jurisdiction-cert-artifact-missing), so live behavior is unchanged; the per-state packet builders (IL IDPH mailed-form first) replace their registry entry in follow-up PRs without touching the dispatch again. Per-state expiry is threaded through the seam: computeExpansionCertExpiry reads validityMonths from state-cert-config (same +N-months−1-day convention as WA's untouched computeAuthExpiry, which the helper refuses to compute for WA so the two can never drift) and models the IL 1/2/3-year registry-term selector now (ilRegistryTermYears, default 1; UI lands with the IL builder). [multi-state][dark][cert]
• 🛡️ **PDMP-before-cert HARD GATE (master-plan B4 — the statutory anti-mill hole, dark).** state-pdmp.ts has always declared mandatoryForCert per state (PA per 35 P.S. §10231.403; OH per OAC 4731-32-03 with a ≥12-month OARRS floor) but the issuance path never checked it — the instant a state's builder wired up, a cert could file with the PDMP section blank. Now evaluatePdmpCertGate runs BEFORE any per-state handler: for PA/OH it refuses issuance (pdmp-query-required, no PHI in the reason) unless the visit's encounter carries a recorded query (pdmpResultClass + pdmpRanAt) and, where the state sets a floor, an attested pdmpLookbackMonths ≥ 12. New Encounter.pdmpLookbackMonths (prod-migration-115, expand-only, NOT applied) completes the durable attestation the encounter already records (provider, appointment, result class, ran-at); accepted dark through the encounter PATCH zod + saveSoapNote. WA is DELIBERATELY exempt — its PDMP duty stays a clinical-UI control and the live WA issuance path is frozen byte-identical (note: state-pdmp.ts declares WA mandatoryForCert: true, so gating on the flag alone would have changed live WA behavior; arming a WA issuance gate is its own reviewed flip). IL/MD are advisory (no statutory mandate) and unaffected. [multi-state][compliance][dark]
• 📦 **Non-WA packet workflow scaffolding (dark, no UI).** Expansion-state issuance is an assisted packet + a HUMAN filing act (physician portal entry PA/OH/MD; physician direct-mails the IL IDPH form), never auto-submission — so Authorization grows a lifecycle beyond issued: packet-generated → physician-filed → patient-notified (canonical strings + guard in state-cert-issuance.ts; packetWorkflowStatus/packetWorkflowUpdatedAt columns, prod-migration-116, expand-only, NOT applied). Nothing writes them yet — the per-state builders + provider portal wire the lifecycle. [multi-state][schema][dark]

Fixed

• 🏷️ **Authorization.jurisdictionState is now written on every issuance.** The column has existed since migration 83 but nothing ever wrote it. Both issueAuthorization call sites in the unified pipeline now stamp the normalized jurisdiction ("WA" — the only state that can reach them). NULL keeps its legacy-WA meaning, so pre-existing rows and legacy callers are unchanged and no backfill is needed. [multi-state][cert]
• 📍 **Hardcoded WA clinic-address literal retired from buildCertInput.** The cert's clinic block rendered ${address}, ${city}, WA ${zip} regardless of the Location row. Now formatClinicAddressLine reads Location.state (schema default "WA", falls back to "WA" when empty) — WA output is byte-identical (pin-tested against the exact legacy template) and a future non-WA Location renders its own state. [multi-state][cert]
• 🧪 **Pin coverage:** new state-cert-issuance.test.ts (dispatch fail-closed per state + unknown states, WA-never-dispatches, PDMP gate matrix incl. the OH 12-month floor and the WA exemption, IL term expiry math, clinic-address byte-identity) + a CERTDISPATCH1 block in cert-pdf-issue.test.ts (dispatch/gate ordering pins, WA-path-unchanged pins, jurisdiction-stamp count). [test]

Added

• ⏱️ **Staff timesheet page (TIMESHEET1).** New /admin/timesheets (ADMIN/MANAGER only, gated fail-closed in proxy.ts + in-page; SCHEDULER/BOOKKEEPER excluded). Worked time is DERIVED from the AuditLog activity trail: per Pacific day, a staff user's event timestamps are clustered into work blocks (events ≤30min apart = one block; a longer silence splits = break; +15min tail credit per block since audit rows are discrete actions; today's live block is capped at now). Per-day rows show scheduled hours vs. derived blocks + totals with variance flags (worked <80% of scheduled = amber, scheduled day with zero activity = red; completed days only), plus week totals. Clustering lives in pure, unit-tested src/lib/timesheet-shared.ts. Defaults to Mary. PHI-safe by construction: the AuditLog query selects createdAt ONLY — detail/resourceId (which can carry patient identifiers) never reach the page or any timesheet response. [staff][timesheet]
• 📅 **StaffWorkSchedule table + weekly schedule editor (TIMESHEET1).** New expand-only table (Prisma model + forward-only prod-migration-114-staff-timesheet.sql; additive, no existing-table changes) storing per-weekday shifts as clinic-local (Pacific) minutes-from-midnight. In-page editor saves via PUT /api/admin/timesheets/schedule (full replace, validated, audited as STAFF_SCHEDULE_UPDATED with integer-only detail). Migration idempotently seeds Mary Fetterly's Mon–Fri 8:00am–4:30pm PT schedule (guarded per user+weekday so later edits survive re-runs). [staff][schema]
• 🫀 **Sampled presence trail in the heartbeat (TIMESHEET1).** /api/admin/heartbeat previously only overwrote AdminUser.lastSeenAt (no durable trail), so quiet-but-logged-in reading time was invisible to the timesheet. It now also writes a STAFF_ACTIVE AuditLog row at most once per user per 15 minutes (debounced via an indexed single-row lookup — at most ~34 rows per 8.5h shift, AuditLog stays lean). The row is PHI-free by construction: action + staff attribution + timestamp only; detail and resourceId are never set. [staff][audit]

Fixed

• **Booking-confirmation honesty in call-back mode (HONESTREQ1).** In StepConfirmation.tsx, the MANUAL_CALLBACK_MODE save-this-page line said "your appointment is held" — final-sounding language a new patient reads as a confirmed booking, when the appointment is only a request pending a records review (the no-show → 1-star driver). Changed to "your request is in" to match the honest request framing already carried by the wizard heading (new patients see "Request received."), the booking-confirmation email ("We've got your request"), the chat persona, and Isabella's voice prompt (RENEWREQ1). Truly-confirmed returning-patient language elsewhere is untouched. Copy-only, one string. [scheduling][patient-facing][honesty]

Added

• 🗺️ **Illinois wired into the States nav (ILNAV1).** Added the Illinois row to STATE_NAV_LINKS in states-nav.ts (/telehealth/illinois, comingSoon: true), between Ohio and Maryland per the wave-1 order (PA → OH → IL → MD). IL was already wired across every other state-config surface (booking flow, qualifying conditions, PDMP, MMJ_STATES landing page, legal reference, launch disposition, cert-config, consent copy) but was absent from the tiny client-bundle nav registry, so the dark /telehealth/illinois page was unreachable from the menu. Purely a menu-reachability fix; bookability is still owned by the fail-closed DB release gate (enforcementActive), which stays OFF for IL. [multi-state][dark][nav]
• 🔒 **Anti-divergence guardrail test now actually exists (ILNAV1).** Added states-nav-anti-divergence.test.ts — the guardrail the states-nav.ts header has long promised but that was never written. It fails the build if any MMJ_STATES entry is missing from the nav (the exact gap that hid Illinois), if a nav row's href/name drifts from its MMJ_STATES source of truth, or on a duplicate abbreviation, while allowing Washington as the one intentional non-MMJ home-state row. [multi-state][test][guardrail]

Fixed

• **Leads filter responsiveness (LEADFLTR1).** Added a Next.js loading boundary (loading.tsx) for the /admin/leads route segment. Before this fix, clicking a filter chip triggered a full server-side re-render (up to 5,000 DB rows) with no immediate UI feedback, causing the page to appear frozen for 1–3 seconds. The loading skeleton renders instantly on navigation and is replaced by the real content once the server render completes. [leads][ux][autofix]

Added

• **Patient Portal login help tooltip (PTLOGIN1).** Added an info (ⓘ) icon next to the Patient Portal link in the site header. Hovering or clicking it shows a popover guide: enter your account email to receive a secure login link; if no link arrives, you may not have a portal account yet, and completing the Book an Evaluation form creates one automatically. [nav][patient-portal][autofix]

Fixed

• **Voice lead name now populated from call transcript (VLNAME1).** Leads created by Isabella's voice capture were storing a sentinel literal (none) for first and last name even when the caller provided their name, causing the Leads queue to show a placeholder instead of the actual name. Fixed the lead creation detail format to only write the firstName field when a name was actually extracted, and updated the detail parser to treat any legacy (none) sentinel as absent so both new and existing voice leads render cleanly. [voice][leads][autofix]

Added

• 🗂️ **Per-state cert-artifact + consent-copy configs, honestly unwired (STATEART1).** New state-cert-config.ts documents each wave-1 state's REAL issuance mechanics from the operational playbooks — PA: practitioner e-signs across 8 sections in the DOH registry portal (no API exists; artifact = assisted portal-entry packet) · OH: registry entry that triggers the patient's email link, with the mandatory ≥12-mo OARRS query surfaced as a hard prerequisite · IL: physician MAILS the IDPH certification form directly (never hands it to the patient), with the ⚠️ form-lag counsel flag (current IDPH form predates P.A. 104-0463's telemedicine amendment) · MD: OneStop entry with the register-before-visit sequencing + cert-term verify flag. New state-consent-copy.ts carries counsel-bracketed consent DRAFTS for all four states (each grounded in its own statute, full anti-mill acknowledgement set, versions end '-draft' until counsel signs; WA delegates to the live self-cert-copy module — no duplication). 🔑 Readiness derives from issuanceWired/intakeWired — BOTH false everywhere but WA — never from config existence, so documentation can never satisfy the go-live flip decider while cert issuance still hard-blocks non-WA (pin-tested honesty invariant + fixed-6-artifact vacuous-pass guard). [multi-state][dark][counsel-gated]
• 💊 **IL + MD PDMP reference (verified vs primary sources 2026-07-21).** state-pdmp.ts gains external-portal mode: IL = state-run ILPMP (ilpmp.org — NOT PMP AWARE; illinois.pmpaware.net doesn't exist) · MD = CRISP (crisphealth.org/pdmp, RxGov backend). 🔑 Neither state mandates a PDMP check before a cannabis certification (410 ILCS 130/35–36 have no PMP language; COMAR 14.17.04.03 likewise — MD's tie is indirect via the provider's CDS→CRISP registration), so both render as ADVISORY, and the deep-link builder returns the portal HOME with zero patient identifiers for external-portal states (PHI-in-URL guard, pin-tested). AWARE-state prefill behavior regression-pinned. [multi-state][pdmp][phi-safe]

Added

• 🎚️ **Audited go-live flip for expansion states (STATEFLIP1).** New ADMIN-only POST /api/admin/state-enforcement replaces the raw-SQL enforcementActive write: server-side re-derivation of EVERY launch predicate at flip time — rule predicates (telehealthInitialAllowed / programOperational / legalPredicateMet) + ≥1 green-eligible license on an ACTIVE provider + counsel launch-disposition overlay clear + all code-derived platform artifacts ready — via the pure, pin-tested decider state-enforcement-flip.ts (17 truth-table pins; any single red refuses with named blockers, WA never flippable, garbage states fail closed). Typed state-code confirmation enforced server-side. Deactivate = fail-safe kill switch (no predicates, always allowed, refuses no-ops). New audit actions STATE_ENFORCEMENT_ACTIVATED / _DEACTIVATED (template-only detail). /admin/expansion hosts the control — locked/armed/kill-switch states — and its readiness read now matches the endpoint's stricter active-provider standard. The counsel latch (legalPredicateMet) is deliberately NOT settable here. Inert on ship: no state's enforcement changed. [multi-state][enforcement-gated][audit]

Added

• 📬 **State waitlist made real (STATEPAGE1).** New StateInterest table (prod-migration-113, expand-only, applied) + rate-limited public POST /api/state-interest (10/hr/IP, zod caps, MMJ_STATES allowlist, email lowercased, (email,state) unique → idempotent) + inline StateWaitlistForm on the coming-soon hero and sidebar (first name + email — minimum-necessary, no conditions/DOB collected pre-launch). Footer CTA anchors to the hero form. Admin /admin/expansion shows a per-state waitlist-signup badge (query fail-safe if the table is missing). Root cause: /?waitlist=true&state=XX was consumed by NOTHING — every expansion signup evaporated on the WA homepage. [multi-state][lead-capture]
• 🧭 **State-page SEO/AEO structured data.** Breadcrumb + FAQPage JSON-LD on every state landing page (same builders as the WA city pages). Dark states remain noindexed — schema only matters once a state flips live. Sibling-state cross-links added to "Other states we serve". [seo]

Fixed

• 🧾 **Registration-step copy no longer breaks on free/multi-tier fee states.** The generic "Pay the {fee} state fee" template rendered nonsense for 5 of 7 states (e.g. Maryland: "Pay the $0 — registration is free (since July 2024) state fee"). New per-state registrationStepNote override + registerFirst flag — Maryland now correctly shows registration as step 1 (the state asks patients to register BEFORE the visit), PA notes the physician enters the cert directly into the registry, IL/OH/MN get accurate fee/timing language. [multi-state][content]
• 💲 **Dark states no longer advertise WA evaluation pricing.** Quick Facts shows "Announced at launch" until a state is actually bookable — per-state pricing isn't final until launch, and the fail-closed booking gate already hides the CTAs. [multi-state]

Added

• 🗺️ **Illinois + Maryland wave-1 state support (TURNERSTATES1) — all four Turner states (PA/OH/IL/MD) now fully modeled, DARK.** state-qualifying-conditions.ts gains IL's 56 IDPH debilitating conditions (live-verified 2026-07-20 vs dph.illinois.gov, incl. 3 flagged flip re-verify items: terminal-illness delta vs the operational playbook, possible P.A. 104-0463 additions, and the OAPP lane deliberately not modeled as a slug) with variants + official display labels, and MD's nine Health–Gen. §13-3304 enumerated conditions — MD's statutory catch-all (severe chronic condition, other treatments ineffective) intentionally normalizes to null → provider review, the correct lane for clinician-judgment certs. state-booking-flow.ts gains IL_FLOW + MD_FLOW (residency question, caregiver/non-resident copy, state condition options; the trailing "other" row is load-bearing for MD's catch-all). states-content.ts gains the /telehealth/illinois landing page (fees $50/$100/$125 + 50% veteran/SSI-SSDI reduction per IDPH, 1%-medical-tax vs adult-use framing, OAPP mention). state-legal-reference.ts + the seed add MD (licensure by ENDORSEMENT in progress — seeded licenseStatus='pending', never 'active', until the MD Board license posts) so the admin expansion cockpit + provider legal-reference switcher now cover 15 states. Everything ships dark: enforcementActive stays FALSE on every state, dark pages stay noindexed, and checkVisitStateGate keeps failing closed. [multi-state][dark][enforcement-gated]

Fixed

• 📄 **Maryland state-page facts refreshed (stale since the MMCC era).** Registration is FREE since 7/1/2024 with optional ID cards (was: "$25 per year"), and the agency is the Maryland Cannabis Administration at cannabis.maryland.gov (was: MMCC / mmcc.maryland.gov). Card steps + FAQ rewritten to the current register-first → electronic-patient-ID flow, and the seed re-run refreshes the stored MD legal-reference fields. Page remains dark/noindexed until MD flips live. [multi-state][content]

Added

• 🧾 **Link hand-made Poynt invoices to appointments (INVLINK1).** New PATCH /api/admin/appointments/[id]/link-poynt-invoice (ADMIN/MANAGER/SCHEDULER) + inline control on the appointment detail page's unpaid state. Stores the dashboard invoice's order UUID in Appointment.poyntInvoiceId — the EXISTING webhook match (api/webhooks/poynt finds appointments by poyntInvoiceId on TRANSACTION_CAPTURED, hasOrder=y) then runs the full mark-paid cascade automatically; the existing alignment cron covers drift. Guards: UUID-shape validation (link-poynt-invoice-shared.ts, unit-pinned — a date-style Invoice ID can never match the webhook and is rejected loudly), link locked once the appointment is paid (refund path reads it), and one-invoice-one-appointment (duplicate link would mis-route the cascade). Audited as LINK/UNLINK_POYNT_INVOICE (PHI-free, order UUIDs only). Root cause closed: 2026-07-20 sweep — invoice payment webhook arrived with the order id but no appointment carried it, so a paid patient stayed 'unpaid' (and vice-versa phantom nags on 15/21 open invoices). No new money movement — this writes one column the rails already consume. [payments][workflow]

Changed

• 🔒 **Purge InboundFax.ocrExtractedDob on match (PHIMIN1, minimum-necessary §164.502(b)).** The OCR-extracted DOB is scaffolding to suggest a fax↔patient match; all three confirm paths — the two manual routes (/api/admin/inbound-fax/[id]/accept-ocr + /attach) AND the OCR cron's auto-link path in inbound-fax-ocr.ts (which previously persisted the DOB in the same write that confirmed the match) — now store ocrExtractedDob: null alongside matchedLeadAuditId, so the transient PHI artifact isn't retained past its purpose. Unmatched faxes unchanged (field already nullable + rendered null-safe); the re-OCR cron only processes matchedLeadAuditId: null rows so it won't re-populate. prod-migration-112 (data-only backfill, expand-safe) clears the residue on already-matched faxes. Pairs with the signed encryption-at-rest risk-analysis determination. [privacy][hipaa][minimum-necessary][phi-retention]

Fixed

• Provider signature upload: added allowOverwrite flag to blob storage so re-uploading a provider's signature no longer fails with 'blob already exists'. (✨ Auto-fixed from Mariane feedback)

Fixed

• Isabella voice prompt: clarified new-vs-returning patient distinction — callers who received an authorization from another provider or clinic are new patients at Green Wellness, not returning. Helps callers self-select the correct appointment type without staff follow-up. (✨ Auto-fixed from Mariane feedback)

Fixed

• 🔧 **Pre-deploy gate un-wedged — 18 drifted pin/guard subtests realigned to already-shipped commits (zero behavior change).** The blocking test suite had been red since ~2026-07-15 (10+ consecutive fails), silently blocking the autonomous release loop. hipaa-architect adjudicated all 18 from a fresh clone: every failure was a guard lagging a reviewed commit, not a regression. FAXPORT1 (9a18a47): synced the fax spoken-number/rendered-email pins + the prod-migration-45 seed literal to the live Notifyre DID (681) 241-7737. AILIVE1 (267b028, Doug): bumped the AI draft-email prompt version v1.3->v1.4, re-pinned the prompt sha (the version interpolates into the prompt header, so bumping changes the hash), and aligned the sign-off + version-stamp pins — hipaa-architect verified PHI-free + no-medical-claim rails intact. EMAILQUEUE1: scheduled-job count 54->55 (stage-emails). SEOCLAIMHYGIENE1: dropped the stale sitemap telehealth-getter assertion while keeping the two anti-bypass guards. Rewrote 6 staff release-note summaries to satisfy the staff-readability guard (no vendor jargon / setting-name tokens / <=800 chars). No patient-facing behavior change. (ci)(hipaa)

Fixed

• 🩺 **Claim-integrity correction #1 — /llms.txt records contradiction (CLAIMINTEGRITY1 — SEO lane + Doug-confirmed fact).** The hand-authored 'Important facts' block in src/app/llms.txt/route.ts said 'Patients do not need to bring medical records (though helpful)' — a direct contradiction of the corrected FAQ source-of-truth ('records are required before an authorization can be issued'). Since /llms.txt is GW's highest-SoV AI-cited surface (97% Perplexity), the contradiction was propagating to AI answers. Rewrote to 'Medical records documenting a qualifying condition are required before an authorization can be issued.' Also aligned the adjacent evaluation-step line to the FAQ's conditional voice ('whether an authorization is issued is the provider's individual clinical decision at the visit; if the patient qualifies, it can often be issued the same day'). No new claim introduced — a factual correction removing a self-contradiction. (compliance)(seo)(hipaa)
• 🪪 **Claim-integrity correction #2 — homepage title/description card-vs-authorization deconfliction.** The homepage