What's shipped.

Added

• PHI access logging via PhiAccessObserver and a dedicated phi log channel. Every read of a patient record emits a structured event — tenant, user, action, timestamp.
• Dynamic form builder with auto-versioning on edit-with-submissions. Lifecycle state machine: draft → published → archived.
• Global React ErrorBoundary with server-side error reporting via ReportErrorController.
• Tenant-aware structured logging across all modules.
• Form lifecycle audit log via FormLifecycleLogger.
• FK guards on form_submissions and patient_form_assignments using ON DELETE RESTRICT.

Improved

• Settings hub layout with module cards.
• Clinic profile splits into regional / branding / regulatory sections.

Fixed

• Form clone now correctly preserves field-level visibility flags.

Added — Billing & Revenue (M1–M6)

• Invoice lifecycle: draft → issue → cancel with line items via Service catalogue or ad-hoc.
• Multi-method payments: cash, POS, mobile transfer, bank transfer, online — with method-specific reference fields and void audit trail.
• Tenant billing preferences: tax rate, invoice prefix, payment-method toggles, receipt behaviour.
• Soft payment gate: Awaiting Payment partition with Collect Payment CTA.
• Override path for clinic_admin with typed audit columns and [CLEARED WITHOUT PAYMENT] marker.
• Daily Cash-Up reconciliation — tenant-timezone correct, methods × dates, print-ready.
• Currency lock — currency mutation blocked once any Service / Invoice / Payment exists.
• Draft invoice tax projection — preview matches the rate stamped at issue time.

Added — Patient Portal

• Magic-link authentication via PortalToken with configurable expiry.
• Intake forms via the dynamic Forms system.
• Direct messaging — patient ↔ staff threads, message categories, auto-archive.
• Staff profile visibility controls.

Added — Staff & User Management

• Staff CRUD with profile photos and clinical specialties.
• Staff-only members (visible in directory, no app login).
• Staff → User conversion to grant app access with role assignment.
• Token-based user invitations.
• Roles & Permissions UI with permission matrix.

Deferred (to M7)

• Invoice / receipt PDF export.
• billing_audit log channel + BillingAuditObserver.

Added — Appointments & Pre-Visit

• Appointment backend (model, migrations, single-action controllers).
• VitalSigns backend with unit conversion and reference ranges.
• Form requests: StoreAppointment, CheckIn, RecordVitals, MarkReady.
• Actions: CreateAppointment, CheckIn, RecordVitals, MarkReady, StartVisit.
• API routes for workflow actions.
• Payment-aware queue partitions: Arrivals → Awaiting Payment → Needs Vitals → Ready for Provider → In Progress → Completed.
• Frontend: check-in workflow with chief complaint.
• Frontend: vitals recording form.
• [Start Visit] → Clinical Workspace transition.
• Service catalogue picker on appointment create / edit with duration prefill.

Added — Clinical Workspace

• Clinical Workspace unified page — every artifact for a visit on one signed surface.
• Visit session management.
• SOAP-N note editor with signing workflow. Notes lock on sign; edits require an addendum.
• Prescription management (eRx — basic structured Rx).
• Lab order workflow — orders + results.
• ICD-10 / CPT code integration on clinical notes.
• Visit summary PDF export — patient-facing summary in one click.
• Patient binder export / import (.tpb.zip cross-tenant transfer).