Double-click a status pill to advance (audited via the state-machine service) · drag between groups to reassign · F2 jumps to next actionable · scanner input always captured.

DNs and claims send automatically (DN per supply event at handout; claim sweep after gateClaim() passes — SM-6). The actions here are the manual/exception controls: send-now, re-send failed, withdraw DN, amend claim, return to Spine, per-row View FHIR/XML source, and a multi-select batch clear/re-process over selected rows (ProScript F3/F4/F7/F8 equivalents + G2.1 batch parity — AC-40).

“Patient says the GP sent it” workflow — shows where the script actually is (signed but not downloaded / with another dispenser / cancelled). Every trace is audited with care context.

Sch 2/3 CD owing balances and split-plan supplies cannot be supplied after day 28 (SM-7 / SP-2) — auto-expiry creates a patient-notification task. A split plan never fires pmr.owing_created and never enters the StockIQ urgent-reorder loop; resolving an owing unblocks the claim.

One MDS model only (no parallel schemas) · mid-cycle changes regenerate unchecked trays and flag checked ones · MAR chart prints with each batch · batch-ready emits to delivery + comms.

Per-instalment collector capture · Sch 2 supplies write the CD register via compliance API · missed instalment requires an action note · claims via the monthly paper FP34C bundle (CM-10).

Two statutory bases, two records (ES-3): a patient-request supply captures the nature of the emergency + interval-since-last-supply + statutory-max and has no Rx-to-follow; a prescriber-request supply captures the prescriber undertaking and is overdue-tracked at supplied_at + 72h. Both feed the compliance POM register (emergency_supply_patient / emergency_supply_prescriber); the same overdue surface appears on the compliance inspection dashboard.

Record views are audited with care context · safeguarding/AIS pills render with forced visibility everywhere the patient appears · PDS "no match" results render in PDS order with no matching level shown.

PDS demographics last synced today 06:12 · née Hartley · operational status Active · DOB exact (PDS-traced).

Append-only ledger (pat_balance_lines): corrections are a new offsetting line or a void — never an in-place edit. balance_minor always equals the signed sum of non-voided lines; a recalc job alarms on drift, never silent-corrects. adjustment/write_off are manager-gated; charge/payment originate from dispensing only. Drives the comms owing-arrival prompt and the debtor-ageing report.

Audit: every field change is recorded with actor + before/after. NHS number is read-only (Modulus-11 validated, PDS-verified). Deceased marker blocks dispensing at API level; soft-delete only via the governed GDPR workflow, never row deletion.

One open (resident) residency per patient · wing must be one of the home's defined wings · status & wing/dose-round/self-admin/covert/crush changes emit pat.care_home_resident_changed (dispensing re-plans MDS + regenerates MAR annotations; delivery re-plans per-wing rounds).

Merge is elevated-permission and fully audited; the losing row survives with merged_into_id + redirect (pat_merges). A "Not a duplicate" decision is also recorded (duplicate decisions are audited).

Merge and GDPR actions are refused offline with explicit messaging (online-only, governed). The merge is blocked if the dependent-object census could not complete or if re-auth fails — both audited.

Action-window timer starts at receipt · DNA triggers a 24 h follow-up task · rejected referrals return to sender with a reason.

Windows computed from the content pack (engagement +7…14d, intervention +14…21d) · out-of-window completion needs an audited reason and flags the claim · declined patients suppress re-identification 3 months.

Batch + expiry mandatory at administration · 15-min observation for COVID · GP/NIVS notified day-of/next-day · stock draw-down via pmr.service_supply.

A recorded observation-period reaction offers one-tap Yellow Card (§2.11, YC-1/YC-3) — distinct from LFPSE incident. Fees: flu £10.06 · COVID £8.70 (in-campaign) · stock draw-down pmr.service_supply.

clin_appointments state machine: requested → booked → confirmed → completed | dna | cancelled · DNA raises the service follow-up task · NBS and portal book through this API.

CP monthly count drives the fixed-payment band (£500 at 20–29 · £1,000 at 30+, bundling: HCF+PCS) · MI/UMS excluded from the band · in-episode strand transition (MI → CP) re-resolves content + claimability (§2.3.5).

PIN-1: cohort obtained via cds.evaluateIndicators() (pull, never re-implemented here) · PIN-2: every triage/intervention is an audit event · estate-wide (NULL branch) audits are central-ops-scoped · emits clin.pincer_intervention_recorded → reporting.

Private definitions reuse the same episode engine, wizard, supply and audit machinery as NHS services — only the assurance gate and the money output (invoice vs MYS claim) differ. Supplies emit pmr.service_supply draw-down events to StockIQ.

Status enum: native_live · bridge_pharmoutcomes_g1 · bridge_pharmoutcomes_g2 · bridge_cegedim_g1 · native_day_one. Each catalogue entry references its service definition (built in the service builder), its commissioner, its practitioner-enrolment requirement, and its claim route (MYS national vs local commissioner).

A catalogue entry is a thin read view over a service definition. Editing happens in the service builder; the rollout status is governed by the two-gate model on the catalogue.

This is the surface that absorbs PharmOutcomes' moat: a universal template engine (10 archetypes) + commissioner authoring + per-service practitioner enrolment, all native to the PMR. Definitions reuse the same episode / wizard / supply / audit machinery as the national content packs (content packs).

Enrolment is per practitioner × per service, with commissioner-defined criteria. It is read by the service builder's "enrolment requirement" step and enforced at episode start. Estate-wide reporting rolls enrolment status into the assurance pack (reporting holds no state).

Per-service status badge: bridge_pharmoutcomes (interim) → native_pilot (commissioner accepts ScriptIQ data) → native_live (commissioner commissions + pays via ScriptIQ). The catalogue rolls these into the estate-wide G2 view.

Local claiming is auto-generated direct to named commissioners (councils / LPC / ICB) per their funding definitions — the rail PharmOutcomes runs today. National Advanced (PF / CPCS / flu) stays on the MYS path; vaccinations reconcile via NIVS. Both rails feed reporting; claims-finance owns money state.

Each line references its episode id, the funding-definition version it was priced on, and the delivering practitioner. The batch is immutable once submitted (parity with the MYS claim-evidence lock CL-8). Settlement and any query route back here.

One card per product/branch/day, driven by pmr.dispensed events · shelf-stock entry → AI-suggested qty → cascade → basket · tabs + filter chips resolve the §5.2 review targets (owing · low-stock · short-dated · dmd:{code} · pip:{code} · supplier:{id}).

Tiles deep-link to the live StockIQ dashboard filtered (/stock-dashboard?filter=below-min|expiring|pending|owings, §5.2) · scope switcher carried by branch · cross-tenant reads impossible (AC-16) · envelope-wrapped, age-stamped per §5.4.

Shortage/concession/specials procurement is StockIQ-owned, deep-linked (§1.3 posture) · whether specials sit inside the cascade or a separate path is a StockIQ procurement decision (OQ-14) · the PMR side is unaffected either way.

Cascade picks best price/availability across wholesalers · locked lines stay put · urgent owing lines flagged from the PMR loop · supplier-scoped pad + MDS/MCS tab resolve the /order-pad?filter=supplier:{id}|mcs|mds Ctrl+K seeds (§5.2).

Order confirm fires stockiq.order_confirmed → owing ETAs in the PMR · delivery fires stockiq.delivery_received → "owed item arrived" tasks · the full filterable history lives on the order-history screen.

Receipt updates perpetual inventory · short/damage claims tracked against the wholesaler · owed-item arrivals raise PMR tasks + patient comms.

PMR dispense draw-downs land as reason='dispense_out' keyed on event id (no double-deduction with EPOS sales) · credit movements (return_in / write_off / broken_bulk) keep on-hand from drifting down (§4.3a) · the PMR only ever reads this via the stock-facade with the dual fetch + count age above · row click → per-product drug statistics.

Versioned snapshot in public.ref_drug_tariff (provenance + staleness columns) · feeds expected-value estimates, NCSO endorsement suggestions and margin read-models · updates relay as shared.tariff_updated.

Credentials vault-stored, never in client code · per-branch schedules drive owing ETAs · cascade order is config, not code.

Single TRUD pipeline (StockIQ) — the PMR keeps a read-only projection for offline dispensing/CDS keys; never a second ingestion.

P-medicine lines gate on pmr.rp_status_changed (no pharmacist signed in → queued for authorisation) · Rx-charge collection reconciles with the PMR charge ledger (claims OQ-6) · refunds / products / operator admin are StockIQ-EPOS-owned (NR-7), shown here as deep-link depth only.

Refunds and voids are EPOS-owned (NR-7); a saleable restock posts a StockIQ return_in movement, a faulty write-off a write_off — both EPOS-side, disjoint from the dispensing reverse/credit path (§4.3a).

Catalogue, pricing and operator permissions are StockIQ-EPOS-owned (NR-7) and shown here for deep-link continuity only — the PMR holds no retail SKU or till-operator table.