What's shipped.

Added

• PHI access logging — every read of a patient record emits a structured event to a dedicated PHI access log — tenant, user, action, timestamp.
• Dynamic form builder with auto-versioning on edit-with-submissions. Lifecycle state machine: draft → published → archived.
• Global React error boundary with server-side error reporting.
• Tenant-aware structured logging across all modules.
• Form lifecycle audit log — publish, version, and archive events recorded.
• Referential-integrity guards prevent deletion of records that still have dependent form data.

Improved

• Settings hub layout with module cards.
• Clinic profile splits into regional / branding / regulatory sections.

Fixed

• Form clone now correctly preserves field-level visibility flags.

Added — Billing & Revenue (M1–M6)

• Invoice lifecycle: draft → issue → cancel with line items via Service catalogue or ad-hoc.
• Multi-method payments: cash, POS, mobile transfer, and bank transfer — with method-specific reference fields and void audit trail.
• Tenant billing preferences: tax rate, invoice prefix, payment-method toggles, receipt behaviour.
• Soft payment gate: Awaiting Payment partition with Collect Payment CTA.
• Override path for clinic admins, recorded in the audit trail with a [CLEARED WITHOUT PAYMENT] marker.
• Daily Cash-Up reconciliation — tenant-timezone correct, methods × dates, print-ready.
• Currency lock — currency mutation blocked once any Service / Invoice / Payment exists.
• Draft invoice tax projection — preview matches the rate stamped at issue time.

Added — Patient Portal

• Magic-link authentication with configurable token expiry.
• Intake forms via the dynamic Forms system.
• Direct messaging — patient ↔ staff threads, message categories, auto-archive.
• Staff profile visibility controls.

Added — Staff & User Management

• Staff CRUD with profile photos and clinical specialties.
• Staff-only members (visible in directory, no app login).
• Staff → User conversion to grant app access with role assignment.
• Token-based user invitations.
• Roles & Permissions UI with permission matrix.

Deferred (to M7)

• Invoice / receipt PDF export.
• Dedicated billing audit trail.

Added — Appointments & Pre-Visit

• Appointment scheduling engine.
• Vital-signs capture with unit conversion and reference ranges.
• Workflow actions: schedule, check-in, record vitals, mark-ready, and start-visit.
• Payment-aware queue partitions: Arrivals → Awaiting Payment → Needs Vitals → Ready for Provider → In Progress → Completed.
• Frontend: check-in workflow with chief complaint.
• Frontend: vitals recording form.
• [Start Visit] → Clinical Workspace transition.
• Service catalogue picker on appointment create / edit with duration prefill.

Added — Clinical Workspace

• Clinical Workspace unified page — every artifact for a visit on one signed surface.
• Visit session management.
• SOAP-N note editor with signing workflow. Notes lock on sign; edits require an addendum.
• Prescription management (structured prescriptions).
• Lab order workflow — orders + results.
• ICD-10 / CPT code integration on clinical notes.
• Visit summary PDF export — patient-facing summary in one click.
• Patient binder export / import (.tpb.zip cross-tenant transfer).