Reference mappings, private pricing and referral orders

Everything below describes engineering source contracts and isolated test evidence (disposable PostgreSQL, loopback PostgREST, test-signed tokens). Where a behavior is described as "designed", it exists in source and isolated tests only — not as a joined, persisted canonical R1 workflow. This is not an availability, certification or publication announcement.

• Immutable sender laboratory and sender native code; performer native code and full panel component set (every component, not overlap).
• Specimen type, collection method, container, minimum volume, preparation, transport temperature/handling and stability.
• Method and reportable units (UCUM); LOINC codes as descriptive evidence only.
• Turnaround and serviceability (specimen, collection, region).
• Reviewed source and destination fingerprints, clinical reviewer, review status, version, effective_from / effective_until, and clinical/commercial scope.

• Performer native cost: private to the performing laboratory, never projected to a sender.
• Contracted (negotiated) price: visible only to the exact authorized sender for that relationship and terms version.
• Published network price: only under an explicit publication and visibility decision.
• Patient/DTC prices are a separate surface. There is no wholesale settlement, referral commission or automatic billing.
• When a relationship, mapping or grant lapses, the menu projection returns only a safe refusal reason and non-orderable state — no native codes, specimen requirements, terms, prices or result/webhook scopes.

The design keeps these identities distinct and never merges them: sender external reference, canonical order, transmission, kit barcode, performing accession and each specimen ID. The design also records an order-time snapshot of mapping and terms versions. These are source contracts and staged SQL; the reference order link refuses every insert while no approved mapping authority exists, so no snapshot is persisted operationally.

• A deterministic fingerprint of the command defines idempotency. Same key + same fingerprint is a duplicate; same key + different fingerprint is a conflict and is refused.
• The acting laboratory, tenant and environment come from the authenticated session, never from client-supplied fields.
• Refusals before any write: reference_execution_disabled, relationship not bilateral/current, wrong tenant/environment/Program/client, stale Program or mapping version or fingerprint, withdrawn or future-only test, panel component mismatch, specimen/method/region incompatibility, missing clinical reviewer, missing commercial or technical authority, absent native registry.

Source contracts describe and evaluate; only installed Core authority decides. The Control Plane and projections never grant a relationship, mapping, Program grant or order. Until the staged packages are applied and approved, every evaluation ends non-executable.