- Shipped
- August 27, 2026 at 3:53 PM UTC
- Author
- Kamo
- Commit
- 331f0d0
ServiceType.EHR was held at TESTING long after the vertical was finished, because AppCatalogService derives availability from COMPLETED and three separate paths would then have provisioned a clinical record system into ordinary tenants: - FeatureController.list auto-provisions every available non-core app that has no OrgFeature row, on a plain Settings page load, for every org - the PUBLIC UNAUTHENTICATED host lookup in OrganizationController does the same on its own loop - entitlement fail-open grants an app the plan matrix never mentions, and PLATFORM_APP_CATALOG is empty in production PhiTenantGuard stops none of them, which is the part worth knowing. It reads like the thing that would, and it does the opposite: for a NOT_PHI tenant it returns true for EVERY module, because its job is keeping a PHI tenant inside the compliance boundary, not keeping the boundary out of everyone else. So isPhiPermitted() would have waved the EHR into any ordinary organization. Holding the stage bought the right property by accident, at the price of a finished app nobody could be offered and an operator console reporting a stage that was no longer true. This inverts that: the guarantee moves to **************** all three paths consult it, and the stage is free to say what is actually the case. One list rather than three, so they cannot drift, and the next app of this kind is one entry instead of an archaeology exercise. The exclusion stays narrow -- everything except the EHR provisions exactly as before, which **************** pins. The two tests that asserted stage != COMPLETED were pinning the workaround; they now pin the property it stood in for.