Reference results, exceptions & pilot runbook

Everything below describes engineering source contracts and isolated test evidence (disposable PostgreSQL, loopback PostgREST, test-signed tokens). Where a behavior is described as "designed", it exists in source and isolated tests only — not as a joined, persisted canonical R1 workflow. This is not an availability, certification or publication announcement.

1. Prepared
2. Dispatched by sender
3. Carrier in transit
4. Carrier delivered
5. Received by performer
6. Accessioned
7. Processing
8. Rejected / recollection (per specimen)

• Each event requires an actor, source and timestamp, correlated to the order and specimen.
• Dispatch never implies delivery; delivery never implies receipt; receipt never implies accession.
• Rejecting one specimen requests recollection for that specimen only; unrelated specimens and the order continue.
• No courier integration is provided or implied.

• Transport receipt (for example HTTP 201) means bytes were delivered — not that the performer accepted the order.
• Application acknowledgement means the performer system accepted it — not accession or analysis.
• Only the performer's clinical release creates an official result.

In the source design and isolated tests, a CORRECTED result appends a new version and earlier released versions remain historically visible to the authorized sender. This is not canonical result_sets release for R1: no joined persisted sender→performer→released-result chain exists.

• An approved synthetic generic contract is used for FINAL/CORRECTED tests.
• The Nexus-shaped candidate contract is unverified; its FINAL/CORRECTED statuses stay PENDING_CLINICAL_REVIEW and are never auto-released.
• A critical-value flag is not a human notification. Critical-result calls remain the performer's clinical procedure.

1. 409 or timeout after send: mark uncertain. Do not resend.
2. Query the performer's state under the same idempotency identity; record the outcome.
3. Missing application ACK: hold; never treat transport receipt as acceptance.
4. Specimen, code or performer identity mismatch: hold for operator review; no automatic correction.
5. Unsigned or replayed callback: refuse; verify installation credentials.
6. Corrected result pending review: keep the prior released version current.
7. Turnaround past due: check custody evidence before contacting the partner.

• "Reference Testing configuration pending": expected while packages are unapplied and gates are off.
• Directory shows 0 laboratories: no reference-publication directory is installed; Consumer Health listings are not reference publication.
• Buttons disabled with a reason: the required authority is not installed. Nothing was sent or saved.
• Reference Testing missing from navigation: Consumer Health Program workspaces do not include it.

1. Core operator: apply relationships, then Program bindings, then order links, each with preflight, postflight and rehearsed rollback — Sandbox first.
2. Both laboratories: signed relationship agreement and completed six-step onboarding.
3. Clinical: establish an independent licensed reviewer authority; approve each mapping version.
4. Security/operations: native installation registry, credential custody, replay fences.
5. Release owner: separate approval for each reference gate.
6. Acceptance: genuine signed-in test of both laboratories and one joined same-order Sandbox chain through FINAL and CORRECTED.

• Source: typed contracts and unit tests.
• Isolated: disposable PostgreSQL and loopback PostgREST with test-signed tokens (not genuine hosted sign-in).
• Hosted/operational: not established.
• Joined same-order reference workflow: PARTIAL.