Found via live multi-user testing: case_migrations.source_fingerprint
was UNIQUE on its own (org-scoped, not per-user), so two org members
who both stage the local-to-shared migration with identical local case
content (most commonly zero local cases, the normal state for anyone
new to a shared org) silently collided onto the same session. The
second caller would inherit the first caller's session -- sometimes
already validated or activated -- and their own "Activate shared
dataset" button would never appear.

Scopes the dedup key to (source_fingerprint, created_by) instead,
matching the same idempotent-retry behavior for one user while no
longer colliding across different users. Fixed in both the Postgres
and in-memory stores, with a migration to update the constraint (and
backfill every already-provisioned tenant schema) plus a regression
test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Found via a live functionality tour of the admin console: the header's
org-switcher menu rendered <DropdownMenuLabel>Switch organization</DropdownMenuLabel>
without wrapping it in <DropdownMenuGroup>, which Base UI's Menu
primitive requires (Menu.GroupLabel must live inside Menu.Group or
Menu.RadioGroup). React's error boundary silently recovered each time,
so the UI still looked fine, but it threw on every render of that menu.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

These were ad-hoc scripts used to manually drive and screenshot the app
during development, not part of the maintained e2e test suite (they
aren't referenced by e2e/playwright.config.ts or package.json scripts).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

…26-08-31

Codex/release validation 2026 08 31

…al MCP control plane

Implements the full clinical-capability backlog plus its UI wiring:

- FHIR R4 read-only facade (Patient/ImagingStudy/DiagnosticReport/DocumentReference)
- SMART on FHIR: resource-server discovery/scope enforcement, and a full
  client-role launch flow (PKCE, trusted-issuer allowlist, token storage) -
  gated behind an already-authenticated ModelForge session by design
- HL7 v2: ER7 parser/builder, ORU^R01 outbound, inbound ORU/ADT parsing,
  ACK/NACK, an MLLP TCP listener, and a match/apply/review ingestion
  pipeline with the same "ambiguous match always needs human review" rule
  imaging's own DICOM patient matching uses
- Evidence provenance citations for scalar case fields, prompt versioning,
  online eval/drift monitoring, and quality-aware multi-model routing
- Electron UI: External EHR page (trusted-issuer admin, SMART launch
  trigger, session management) and an HL7 Inbox review queue, both wired
  through new IPC handlers and preload bridges
- Managed clinical MCP integration: short-lived context grants,
  exact-operation approval tickets, and structured operation provenance
  for modelforge-clinical-mcp

Each capability's scope and disclosed gaps are documented in
docs/{FHIR_INTEGRATION,SMART_LAUNCH,HL7_V2_INTEGRATION,CLINICAL_AI_EVALUATION,
CLINICAL_MCP_INTEGRATION}.md. Full server/app/frontend suites passing,
0 Semgrep findings across touched files.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

…26-08-31

Add FHIR R4, SMART on FHIR, HL7 v2, eval/drift monitoring, and clinic…

…tegration

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

…s RPC watchdog on slow Windows CI

The 'caps retained events' test does 5,000+ synchronous
recordEvent() calls with no yield point. On a slow Windows CI runner this
crossed 60s of unbroken synchronous work (61.7s in the v1.4.0 release
build), tripping vitest 3.x's own internal birpc RPC heartbeat — a
hardcoded 60s timeout, independent of and not covered by testTimeout
(only removed in vitest 4, see vitest-dev/vitest#8164/#8297). The whole
run then fails with "[vitest-worker]: Timeout calling onTaskUpdate" even
though every assertion passes. Fixed by yielding to the event loop via
setImmediate every 250 iterations so the RPC channel stays serviced
regardless of total wall-clock time. Applied the same hardening to the
other 5,000+-iteration loop in this file (the addon-gated 2x-cap stress
test) as cheap insurance against the same failure mode.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>