Reference activation and operating runbook

Everything below describes engineering source contracts and isolated test evidence (disposable PostgreSQL, loopback PostgREST, test-signed tokens). Where a behavior is described as "designed", it exists in source and isolated tests only — not as a joined, persisted canonical R1 workflow. This is not an availability, certification or publication announcement.

Engineering source is complete, operational acceptance remains PARTIAL and Production is NO-GO. Both reference gates are off. Relationship, Program-binding and attribution packages remain staged/unapplied; no native registry, approved inter-lab clinical mapping authority or joined R1 transaction exists. Documentation edits cannot approve any of these.

• Core operator / Shamil: current dependency and RLS/body snapshot, approved staged installation and rollback rehearsal.
• Lab A and Lab B owners: independent consent, scope/effective window, private terms and ordinary six-step onboarding.
• Independent licensed clinical reviewer: real reviewer identity and governance, mapping version/fingerprints, specimen requirements and clinical release.
• Security/operations: installation/signer binding, credential custody, durable nonce/replay policy and endpoint qualification.
• Release owner: separate per-gate Sandbox and Production authorization after evidence. Documentation owner: independently approved host release and read-back.

1. Obtain explicit operator authorization for a named isolated/Sandbox target and pinned revision. This guide is not apply permission.
2. Validate the relationship package manifest and its preflight; separately install/review/postflight only under approval.
3. Validate Program-binding prerequisites and its own manifest; its allowed states remain draft_hold/paused/revoked after installation.
4. Validate attribution prerequisites and manifest. Its refusal-only guard does not become an order writer.
5. Rehearse reverse dependency rollback on an empty disposable target; populated evidence requires retention, not destructive rollback.
6. Design and separately approve missing clinical mapping and native installation authority. Do not patch frozen packages or set a browser role as substitute authority.

• Verify explicit RPC EXECUTE grants, deny anonymous/direct-table access and confirm exact tenant/organization/environment projection.
• Token hash, expiry and single-claim locking do not establish encrypted transport/backup custody; verify these separately, never export token plaintext.
• Test delayed revocation on menus, new orders and queued webhook delivery; historical result policy must still revalidate canonical grant.
• Verify signer identity, immutable installation destination and durable nonce fence across restart/concurrency; synthetic signature policies are not vendor agreements.
• Verify licensed reviewer identity and approved effective version separately from diagnostic/technical review.
• No raw callback clinical payload, private price or secrets in operator exports.

Pause the affected scoped path without fabricating recovery success. Preserve audit, link, idempotency and released-version evidence; evidence-retaining rollback may refuse while rows exist. Restore through the exact governed source package or a separately reviewed forward correction, never deletion of clinical history.

• Read generated canonical Partner API reference for real current operations and scopes; there is no public R1 order endpoint.
• A public docs guide or changelog appearing proves only documentation propagation, not installed authority.
• Publishing this repository affects the application; no separate docs-only deployment is established. Require explicit approval and runtime diff review.
• After approved release, read every clean-host guide, changelog, sitemap and artifacts; compare known source markers and record timestamp/revision. Missing/stale pages stay pending.