#3574 fix(clinical,teaching,roster): remediate adversarial audit findings across calculators, handover privacy, EPA magic links, QR check-in, and roster swaps

User description

Summary

• Bedside Clinical Calculators (ClinicalMathPanel, calculators/search-page.tsx, renal.ts, types.ts):
  • Initialize all numeric inputs (age, weightKg, creatinine, heightCm, qtMs, hrBpm, lithiumLevel, currentDoseMg, targetLevel) to "" so no fabricated patient numbers (92.25 mL/min, 875 mg/day) or false Level status: invalid (target 0–0 mmol/L) warnings render before clinician input.
  • Replace permissive Number.parseFloat with strict numeric parsing (parseStrictNumber), use 88.42 (CREATININE_UMOL_PER_MG_DL) for creatinine unit conversion, distinguish weightBasis: "adjusted" (ABW) vs "ideal" (IBW) in Cockcroft-Gault results, and mount only a single <ClinicalMathPanel /> in the DOM across desktop/mobile viewports.
• On-Call Handover Scratchpad & Clinical Note Editor Privacy (note-editor.tsx, handover-page.tsx, handover.ts):
  • Gate ClinicalNoteEditor changes and saves on checkPatientDetail (src/lib/work-text/patient-detail-check.ts) with an accessible role="alert" privacy banner (data-testid="note-editor-privacy-warning"), and only show "Saved" / "Save now" when an onSave handler is provided.
  • Lift scratchpadText into OnCallHandoverPage backed by loadOnCallHandoverScratchpad / saveOnCallHandoverScratchpad (with writePatientLabels expiry wrapper and onCallDeviceStoreChangedEvent sync) so toggling "Make table" -> "Back to the form", switching specialty, or reloading never drops de-identified shift notes.
• Teaching Mode, QR Check-In & EPA Magic-Link Security (respond/[token]/route.ts, magic-link.ts, teaching-code-sheet.tsx, qr-check-in-helper.tsx, teaching-qr-checkin-sheet.tsx, teaching-organise.tsx, organise-sheets.tsx, repository.ts):
  • Fail closed (503 assessment_store_unavailable) in production on /api/teaching/assessments/respond/[token] (matching dual-sign-off/route.ts), require requireAuthenticatedUser on PUT, bound magicRateLimitStore eviction, and validate clinician names via checkEpaClinicianName (Dr J. Smith, Ms Taylor) without weakening global checkPatientDetail.
  • Handle /teaching/c/<token> projector QR URLs in both TeachingCodeSheet and TeachingQrCheckinSheet, remove duplicate manual entry / filter inputs, fetch term attendance counts for AttendanceGapsSheet, and verify active on_call_service_members membership before display.revoke.
• Roster Swap Server Rules & Safe-Number Concurrency (roster/team/repository.ts, roster-decision-sheet.tsx, needs-you-strip.tsx, roster-safe-number.tsx):
  • Scope verifySwapApproveRules to active managers on non-expired 'accepted' swaps with non-superseded shifts so non-managers, swap parties, expired swaps, and superseded shifts reach SQL roster_command's authoritative status/role transitions.
  • Pass acknowledgeRuleWarnings: true when rule warnings are uncheckable or acknowledged, keep RosterDecisionSheet open on 409 roster_swap_rule_warning, and guard RosterSafeNumber "Overwrite with my changes" against a third concurrent edit arriving after the conflict banner opened.
• Clinical Governance & Sign-Off Hygiene (source-acquisitions.json, forms-content-review.json, service-records-review.json, publish-site-content-first-catalogue.ts, apply-specifier-worksheet.mjs):
  • Keep the 23 candidate TGA Product Information entries (#05WXHX) conservative (validationStatus: "unverified", documentStatus: "review_due", disposition: "rejected") with no unverified dates or attestations, enforce "Psych Sift" display-name sign-off (2026-10-16-psych-sift-display-name-sign-off.md), validate 64-hex reviewedContentSha256 on catalogue publication, and flush blockquote buffers across blank lines.
• Zero RAG Changes: No RAG, retrieval, embedding, answer-verification, source-text-sanitizer, hazard-controls, or PDF-extractor files are touched (ragRanking: false).

Areas touched: Personal practice, Clinical reference content, App experience, Delivery and assurance, Answer engine, Knowledge and records

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains PsychSift Production (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Verification

Paste the decisive line from whatever you ran — exit code 0 alone is not proof.

• Checks run:
  • npm run typecheck: [gate-receipts] recorded a pass for "typecheck:internal" (10171 input files).
  • npx eslint --max-warnings=0 <33 changed code files>: 0 errors, 0 warnings
  • npm run check:diff-integrity -- --base origin/main: [diff-integrity] OK — inspected 39 changed file(s) against origin/main (10 test file(s) checked for floor drops).
  • npm run check:forms-review-sheet: Wrote docs/evidence/forms-operational-guidance-review.md. (clean check)
  • npm run source-acquisitions:check-order & npm run check:source-acquisitions: Source acquisition ledger passed.
  • npx vitest run <14 affected suites>: Test Files 14 passed (14) | Tests 344 passed (344)
  • UI verification not run: Covered locally by deterministic jsdom component suites (tests/note-editor-caret.dom.test.tsx, tests/qr-check-in-helper.dom.test.tsx, tests/attendance-roster.dom.test.tsx, tests/clinical-math-bounds.test.ts) and delegated to hosted GitHub CI browser shards.
  • Verification not run: Provider-backed evaluations (eval:retrieval:quality, eval:rag, eval:quality) not run because zero RAG/retrieval/answer-generation files were changed (ragRanking: false).

Risk and rollout

Worth a line for clinical, data, auth/privacy, migration, dependency, or deployment changes.

• Risk: Low — hardens bedside calculator empty-input defaults, client/localStorage PII guards on handover notes, EPA magic-link production fail-closed/auth guards, QR check-in URL parsing, and roster swap approval preflight checks without altering database schema or RAG behavior.
• Rollback: Revert this PR commit cleanly (git revert); no database migrations or external state changes are included.
• Provider or production effects: None

Notes

• Includes two-stage adversarial swarm audit (initial 4-agent adversarial assessment + post-fix 4-agent adversarial review) with immutable branch review record docs/branch-review-records/2a6b620065f5371039438fdbff73be97da6baf6c40dace3596e26c7bad0047dd.record.md.

Summary by CodeRabbit

• New Features

  • Attendance-gap views include loading, error, retry, and demo states, plus roster search and accessible gap details.
  • On-call handover notes can be saved between visits and are cleared when the handover is wiped.
  • Teaching check-in accepts validated QR links and provides clearer feedback for invalid links and demo-mode scans.

• Improvements

  • Clinical calculators start with blank inputs, distinguish missing from invalid values, show partial results when possible, and use adjusted weight for some kidney-function estimates.
  • Clinical notes flag potential patient-identifying details and prevent saving until corrected.
  • Roster approvals and edits better handle rule warnings and concurrent changes.
  • Assessment submissions and teaching access checks provide clearer errors and stronger validation.
  • Calculator panels display in the appropriate sidebar for desktop and mobile screens.

CodeAnt-AI Description

Prevent unsafe clinical results and protect handover, teaching, and roster workflows

What Changed

• Clinical calculators start with blank inputs, show prompts until required values are entered, and reject malformed numbers instead of displaying fabricated results.
• The shift scratchpad warns about detected patient details and blocks saving them. Notes persist across form changes, reloads, and tabs; on shared devices, saving requires an explicit action.
• EPA supervisor links require sign-in to register and are unavailable in production until responses can be stored reliably. Clinicians can enter names with titles, and errors are shown when registration fails.
• Teaching check-in rejects invalid or off-site QR links, ignores scans that finish after the scanner stops, and clearly warns that demo check-ins are not saved.
• Attendance gaps show loading and retryable error states when term records cannot be loaded, rather than showing misleading gaps.
• Roster approvals keep requests open when rule checks fail and require review of warnings; safe-number edits detect newer changes before overwriting them.
• Content publishing stops when a reviewed item lacks a valid record tying its sign-off to the content.

Impact

✅ No fabricated clinical results before patient input
✅ Shift notes survive reloads without saving detected patient details
✅ Invalid teaching check-in links are rejected

@codeant-ai ask: Your question here

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

@codeant-ai: Your feedback here

@codeant-ai: Do not flag unused imports.

@codeant-ai: review