Add auditable medication charge workflow

[evangauer]

Summary

• add an append-only dispense charge transition ledger and the explicitly confirmed, operation-idempotent visit charge workflow
• add a visit-scoped medication append action that preserves existing reconciled invoice lines and never deducts dispensed stock twice
• surface older prescription refills in visit reconciliation and charge capture using exact dispense queue identity
• block direct invoice edits and treatment templates from duplicating pending, waived, or already-sourced medication
• serialize estimate conversion, invoice editing, voiding, refills, templates, and product inventory through canonical lock order
• document the exact API contracts and strengthen forced-overlap PostgreSQL coverage

Clinic impact

A clinic can now finish a visit that includes a refill from an older prescription without leaving an invisible medication charge behind. Staff explicitly confirm the immutable dispense description, quantity, and price; OpenVPM appends exactly one sourced invoice line, preserves prior performed-work reconciliation, refreshes the encounter, and blocks send, payment, or checkout until every visit medication charge is invoiced or waived.

Safety properties

• no charge is created without a staff confirmation
• the action never collects payment
• response-loss retries converge on one invoice line and one audited transition
• dispensed inventory is never decremented a second time
• stale visit, invoice, queue, catalog, price, or medication state fails closed
• treatment templates cannot bypass medication source evidence
• unsaved encounter edits cannot overwrite a server-appended refill charge
• no SMS, carrier, payment, or production provider calls were made
• the public-repo scan found no secrets, private paths, or participant identities

Validation

• full web suite: 374 files passed, 4 skipped; 3,900 tests passed, 21 expected database-gated skips
• focused encounter, invoice, template, reconciliation, and closeout suite: 149/149
• web type-check: passed
• production Next.js build: passed
• git diff check and targeted secret scan: passed
• three independent safety reviews found no remaining blocker in the medication append, lock ordering, reconciliation, or template paths

The expanded 15-case PostgreSQL billing integration suite compiles and is wired into CI, but could not run locally because no disposable PostgreSQL endpoint was available. It includes real lock-wait barriers, deadlock rejection, inventory rollback, older-refill append replay, template collision, sourced-to-unsourced rejection, invoice send, and visit checkout. It remains a required gate on the combined main-targeting PR.

Stack and release order

This PR targets the feature branch used by #198. Merge #199 into that branch first. Then require #198 to rerun build, full tests, the real PostgreSQL RLS/integration job, and CodeQL at the new combined SHA. Only merge #198 to main after those checks pass.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openvpm-app	Ready	Preview	Aug 11, 2026 1:16pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
openvpm	Ignored		Aug 11, 2026 1:16pm