From cc3d1e3d27bdd6ae7a4dd94ac0103a7acf806961 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 04:34:21 +0800
Subject: [PATCH 01/54] Ward Flow Phase 4: the specialist-boards design, with
 its nine product-owner decisions

Twelve items: eleven built, one deliberately held.

Measured before writing, not assumed. Every one of the 41 open movements has at
least six eligible wards, so the escalation board and the handover's placement-gone-wrong
section have nothing to show on tonight's data; that is a fixture problem, not a board
problem, so a scarcer scenario lands first. All fifteen reducer events move a patient
forwards, and the only path that releases a held bed is closing the movement by declaring
the patient does not need admission - so a coordinator who holds the wrong bed must lie
about the patient to correct it. Seven beds are held, one hold has already expired and six
expire within the hour, and nobody can act on any of them.

The statutory clock board is HELD, not built. It was a board of legal countdowns, every
legal deadline has been removed on the owner's instruction, and rebuilding it would either
be empty or would re-invent the statutory figures this project has fabricated four times.
It waits for the owner's real figures and no agent may supply them.

Every fixed reason list is ruled in the spec rather than left to an implementer, and each
is deliberately content-free: no reason code describes a patient, a diagnosis, a clinical
judgement or a legal requirement.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ...d-flow-phase-4-specialist-boards-design.md | 400 ++++++++++++++++++
 1 file changed, 400 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md

diff --git a/docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md b/docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md
new file mode 100644
index 0000000000..4dd0b6b997
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md
@@ -0,0 +1,400 @@
+# Ward Flow Phase 4 — specialist boards, design
+
+**Date:** 2026-08-25. **Product owner:** a psychiatrist in Perth.
+
+Ward Flow is a **synthetic, offline prototype, not clinical decision support.** No live database,
+no patient data, no OpenAI call, no server. Every number is invented.
+
+## 0. Authority
+
+- **Binding:** `docs/superpowers/specs/2026-08-18-ward-flow-metro-patient-flow-design.md` — §6
+  (specialist boards), §11 (success criteria), §15 (migration), §18 (phasing).
+- **Phase 3 close:** `docs/ward-flow-phase-3-handover.md`.
+- This document settles Phase 4's open questions and **supersedes** the one-line Phase 4 sentence
+  in §18 of the binding spec. Where the two disagree, this document wins for Phase 4 scope only;
+  every other section of the binding spec still governs.
+
+## 1. Standing constraints — absolute, unchanged
+
+1. **Never invent, infer, restate or "correct" any figure, requirement, title or classification
+   from the Mental Health Act.** If a legal quantity is needed it comes from the product owner or
+   it does not exist. This is the project's single most-violated rule: four fabricated statutory
+   figures have reached the code, one of them production. Form titles resolve from the Chief
+   Psychiatrist's official register or render as the bare code.
+2. **Synthetic data only.** No name, date of birth, medical record number, address, diagnosis,
+   narrative history or treatment. **Sex is the only permitted patient attribute. Free text
+   counts** — see item 11, which removes the last free-text input in the prototype.
+3. **Advisory only.** The system proposes; a human confirms or overrides, always, with the reason
+   recorded. Nothing auto-allocates and nothing defaults after a timeout.
+4. **Conservative failure.** Missing data narrows what is shown. An absence renders as an explicit
+   absence, never as a substituted default. No `?? array[0]`, no `.find()!`.
+5. **Not a medical device**, and the pages say so.
+6. **Repo gates:** design tokens only (no raw hex); every `<button>` has a real handler, is a
+   submit inside a form, or is a `<Link>`; never both `disabled` and `aria-disabled`; production
+   tap targets `3rem`/48px, never `2.75rem`; one search composer per page; internal navigation via
+   `<Link>`/`router.push`, never a raw `<a href>`; a new production route needs an inbound nav
+   link plus a reachability assertion.
+7. **Purity:** no `Math.random()`; no wall-clock read outside `ward-clock.ts`; the reducer stays
+   pure and `now` arrives on the event.
+
+## 2. Where Phase 4 starts — measured, 2026-08-25
+
+Everything below was measured against the code, not read from a plan.
+
+| Fact                                         | Value                                                    |
+| -------------------------------------------- | -------------------------------------------------------- |
+| Movements in the fixture                     | 48 (18 authored + 30 generated), **41 open**             |
+| Reducer events that exist                    | **15**, every one of them forward-only                   |
+| Open movements with **no** eligible ward     | **0** — the scarcest has six                             |
+| Movements with a recorded escalation         | **1**                                                    |
+| Movements with any decline                   | **2**                                                    |
+| Beds held                                    | **7** — 1 hold already expired, 6 expire within the hour |
+| Movements with a transport job               | 8 (2 accepted, 6 collected)                              |
+| Longest waits                                | 15h52, 15h15, 14h01, 13h24, 12h47                        |
+| Open movements past the 24h ED access target | **0**                                                    |
+| Movements carrying a recorded status change  | **1**, hand-authored                                     |
+
+Four gaps follow from that table and drive most of this phase:
+
+- **The synthetic night is easy.** Every open patient has at least six eligible wards, so the
+  escalation board, the handover's "placement gone wrong" section and the whole scarcity story have
+  nothing to show. Item 2 fixes the data, not the boards.
+- **Nothing can be undone.** All fifteen events move a patient forwards. The _only_ path that
+  releases a held bed or cancels a transport job is closing the movement entirely — recording an
+  examination with outcome `community_order` or `revoked`. A coordinator who holds the wrong bed
+  must therefore declare the patient no longer needs admission. Item 10 fixes this.
+- **Nothing can change after referral.** No event writes `movement.statusChanges`, and urgency is
+  fixed at `RAISE_REFERRAL`. The binding spec §7 says explicitly that urgency is editable
+  mid-movement with a record of who changed it. Item 3 fixes this.
+- **One free-text box survives.** The escalation contact is a `<textarea>` whose label asks for
+  "a role or service only, never a person's name". Nothing enforces it. Item 11 fixes this.
+
+## 3. Product-owner decisions settled for this phase
+
+Each answered 2026-08-24/25.
+
+| #      | Decision                                                                                                                                                                                                                                                                         |
+| ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **D1** | **The statutory clock board is HELD, not built.** It was a board of legal countdowns and every legal deadline has been removed. Nothing is built and nothing claims a legal deadline until the owner supplies real figures.                                                      |
+| **D2** | **Urgency and legal status both become changeable**, each change recorded with who made it and when. **Both roles — the emergency department and the coordinator — can change both.**                                                                                            |
+| **D3** | **A second, scarcer scenario** is added, switchable from the existing demo menu. **Fewer beds only** — the same patients, genuinely tight beds.                                                                                                                                  |
+| **D4** | **The escalation board records and shows only.** It never suggests a ward the patient does not fit, and never ranks "least-bad options".                                                                                                                                         |
+| **D5** | **Release-a-hold and cancel-a-transport are added.** Available to **the coordinator and the ward holding the bed.**                                                                                                                                                              |
+| **D6** | **The escalation contact becomes a fixed list**: State bed coordination desk, Duty psychiatrist, Bed management, Nurse unit manager (destination ward), Escort or transport provider, **plus a general "Other service" entry.** No typing.                                       |
+| **D7** | **Two live effectiveness numbers** go on the governance board: median time from referral to a ward accepting, and average wards contacted per patient. **The third success measure — "legal deadlines passed while a patient waits" — is dropped**, because it no longer exists. |
+| **D8** | **Patient search gets its own page**, reached from the left-hand rail.                                                                                                                                                                                                           |
+| **D9** | **The shift handover** is its own printable page, frozen at the moment it is opened, statewide, leading with longest waits ranked.                                                                                                                                               |
+
+## 4. The twelve items
+
+Eleven are built. One (item 12) is held.
+
+---
+
+### Item 1 — Shift handover
+
+**What it is.** A point-in-time, printable summary produced at shift changeover. Coordinators
+assemble this by hand today.
+
+**Design (D9), approved by the product owner.** Its own page. **Frozen at the moment it is
+opened** — a handover that changes while it is being read is worse than no handover — with the
+freeze time shown. Statewide. Four sections, each of which **states plainly when it is empty**
+rather than being hidden:
+
+1. **Longest waits, ranked.** Every open movement, longest first, with time since arrival, current
+   stage, emergency department and destination if one is chosen. Always populated. **No threshold**
+   — this deliberately replaces "who is breaching", because 0 of 41 patients are past the 24-hour
+   departmental access target and a breach-led handover would be blank.
+2. **Beds held and expiring.** Every held bed with its unit, the patient it is held for, and
+   whether the hold has expired or expires soon. **This is the sharpest section on the page** — a
+   held bed silently lapsing is what the incoming coordinator most needs to catch.
+3. **In transit.** Every movement with a transport job, split by leg — accepted and awaiting
+   departure, versus physically in a vehicle.
+4. **Placement gone wrong.** Movements with a recorded escalation, and movements declined by every
+   unit they were referred to. Small on today's data and honestly so.
+
+**What must not happen.** No section may invent a threshold, a deadline, or a legal claim. The
+freeze must be real — the page reads state once on open and does not re-derive on a clock tick.
+
+**Route.** `/ward-management/handover`. Needs a left-rail entry and a reachability assertion.
+
+---
+
+### Item 2 — The scarce-beds scenario
+
+**What it is.** A second synthetic night, switchable from the **existing demo-controls menu** —
+which is already marked "not a clinical action" and already carries the `demo` role, so a scenario
+switch belongs there and nowhere near a clinical screen.
+
+**What gets built (D3).** **Fewer beds only.** The same 48 movements and the same patients; unit
+allocatable counts, sex-mix headroom and specialling capacity are tightened until the network is
+genuinely exhausted for some patients. Scarcity is the single variable that changes.
+
+**The acceptance test for this item is a measurement, not a screenshot:** in the scarce scenario,
+**at least one open movement must have zero eligible wards**, and the distribution of eligible-ward
+counts must be materially tighter than tonight's (where the minimum is six). Report both
+distributions. If the scarce night still leaves everyone six options, the item is not done.
+
+**What must not happen.** No new patient attribute, no free text, no clinical content of any kind.
+The scenario differs in operational numbers only. `RESET_SCENARIO` must return to the standard
+night, and switching scenarios must not leave a half-applied state.
+
+---
+
+### Item 3 — Urgency and legal status can change
+
+**What it is.** Two new events, each recording who made the change and when. **Both the emergency
+department and the coordinator may change both** (D2).
+
+**What gets built.**
+
+- **Change urgency.** Re-orders the queue immediately, because urgency is the queue's first sort
+  key. Records the previous and new tier, the role that changed it, and the time.
+- **Change legal status.** Writes `movement.statusChanges`, the field that exists today and that no
+  event has ever written.
+- Both changes require a **reason chosen from a fixed list**, never typed — the same treatment
+  decline reasons already have. **The lists, ruled here so no implementer invents one:**
+  - urgency: `reassessed`, `new_information`, `correcting_an_error`
+  - legal status: `recorded_by_treating_team`, `correcting_an_error`
+
+  These are deliberately operational and content-free. **None of them describes a patient, a
+  diagnosis, a clinical judgement or a legal requirement** — a reason code that said "patient
+  deteriorated" would be narrative clinical content, which rule 2 forbids, and one that said
+  "order made" would be a claim about the Act, which rule 1 forbids. If the product owner wants
+  richer reasons he supplies them; no agent adds one.
+
+**The risk this creates, and it must be designed for, not discovered.** A legal status change can
+make a destination that was lawful when it was chosen unlawful now — a patient accepted to an
+unauthorised unit who becomes an involuntary patient. **The system must surface this as an
+exception and must never silently re-sort, re-suggest or un-accept the patient.** Nothing
+auto-allocates; that rule does not bend because the trigger was a status change.
+
+**What must not happen.** No inference about what a legal status _means_ legally. The model records
+which of its four statuses applies and who said so. It asserts nothing about the Act.
+
+---
+
+### Item 4 — Escalation board
+
+**What it is.** One place showing every patient whose placement has gone wrong.
+
+**What gets built (D4).** Two groups, both read-only:
+
+1. **Escalated** — movements with a recorded escalation: when, which units were tried, who is being
+   contacted, and how long the patient has been waiting.
+2. **Nowhere eligible** — open movements with zero eligible wards right now.
+
+**It records and shows. It suggests nothing.** No "least-bad options", no ranking of wards the
+patient does not fit, no statement of what would need to change. Suggesting an ineligible
+destination is the software making a placement judgement, which this project has repeatedly and
+deliberately pulled back from.
+
+**Route.** `/ward-management/escalation`, left-rail entry, reachability assertion.
+
+**Note for the implementer:** recording an escalation already works, on the coordinator's shortlist
+panel. This item adds the board, not the recording.
+
+---
+
+### Item 5 — Patient search
+
+**What it is (D8).** Its own page, reached from the left rail. Searches by patient identifier,
+emergency department, destination unit, stage, and owning role.
+
+**What gets built.** A single search field plus stage and department filters; results show
+identifier, stage, department, destination, time since arrival, and a link to the patient page.
+**One search composer per page** — this repository's rule — so the page owns its composer and does
+not also mount the shell's.
+
+**What must not happen.** Search must never surface a closed movement as if it were open, and must
+render "no matches" explicitly rather than an empty table.
+
+---
+
+### Item 6 — Capacity board extensions
+
+**What it is.** The capacity board shows bed counts and freshness. It does not show the three
+things that actually decide whether a patient can go to a unit.
+
+**What gets built.** Add to each unit row: **current sex mix**, **specialling capacity**
+(one-to-one observation headroom), and **whether the unit is authorised under the Mental Health Act
+to receive involuntary admissions**. All three already exist on the model and already gate
+placement; they are simply invisible on the board whose job is capacity.
+
+**What must not happen.** The authorisation flag is a property the model already carries about a
+unit. Rendering it is not a legal claim and must not be dressed as one — no explanation of what
+authorisation requires or means.
+
+---
+
+### Item 7 — Governance board extensions
+
+**What it is.** The governance board carries the assurance cards. It lacks the not-a-medical-device
+statement (which today appears only on the coordinator screen) and any audit of changes.
+
+**What gets built.**
+
+- The **not-a-medical-device** statement.
+- An **audit of changes** — every urgency change, legal status change, hold release and transport
+  cancellation from item 3 and item 10, with who and when. This is the reason item 3 comes first.
+- **Two live effectiveness numbers (D7):** median time from referral to a ward accepting, and
+  average number of units contacted per patient. Both computed from movements in the current
+  scenario.
+- **The third success measure is dropped.** The binding spec §11 lists "legal deadlines passed
+  while a patient waits" as one of three measures; it no longer exists and cannot be computed.
+  Record the drop on the page rather than silently omitting it.
+
+**What must not happen.** Neither number may be presented as evidence the prototype works. They
+describe the synthetic scenario, and the page must say so.
+
+---
+
+### Item 8 — Patient page extensions
+
+**What it is.** The patient page shows the legal form but not the three records §15 of the binding
+spec requires.
+
+**What gets built.** That patient's **declines** (which unit, fixed reason, when), their **status
+changes** (from item 3), and their **escalation record**. Each renders an explicit absence when
+empty.
+
+---
+
+### Item 9 — Bed release flagging
+
+**What it is.** A ward saying "a bed is coming free". Bed releases exist today as static fixture
+data feeding the _potential_ capacity figure — **no ward can flag one.** This was named as part of
+Phase 3 and did not get built.
+
+**What gets built.** A control on the ward screen recording a coming-free bed with its
+**confidence** (confirmed, likely, possible), the **blocker** holding it up, and who confirmed it.
+
+**What must not happen.** A bed release carries **nothing whatsoever about the departing patient** —
+no identifier, no timing that could identify them, no reason relating to them. That is a privacy
+rule from the binding spec §4 and it is not negotiable. The blocker is an operational fact about
+the bed ("awaiting clean"), never about a person.
+
+---
+
+### Item 10 — Release a hold, cancel a transport
+
+**What it is.** The undo the prototype has never had. Today the only way to release a held bed or
+cancel a transport job is to close the movement by declaring the patient does not need admission.
+
+**What gets built (D5).** Two events, available to **the coordinator and the ward holding the bed**:
+
+- **Release a held bed** — available **only at stage `bed_held`**, never once the patient is
+  `handover_ready` or `moving`, because by then a vehicle and a receiving ward are committed and
+  unwinding it is a different decision. The bed returns to allocatable, the movement returns to
+  **`accepted_awaiting_bed`** — the unit has still accepted them in principle, it just no longer
+  holds a bed — and the release is recorded with who and why.
+- **Cancel a transport job** — available while a transport job exists, is not already cancelled,
+  and the patient has not arrived. The movement returns to **`handover_ready`** and survives;
+  `transport.cancelledAt` already exists on the model and is currently reachable only through
+  closure.
+
+Both take a **reason from a fixed list**, ruled here:
+
+- release a hold: `patient_no_longer_coming`, `bed_needed_for_another_patient`,
+  `ward_withdrew_the_bed`, `hold_made_in_error`
+- cancel transport: `provider_unavailable`, `patient_not_ready`, `destination_changed`,
+  `job_created_in_error`
+
+Both appear in the governance audit (item 7).
+
+**This also makes the expiring-hold warning actionable.** The system correctly refuses to silently
+drop a held bed at 3am and raises a warning instead — right, and until now nobody could act on it.
+Seven beds are held, one hold has already expired, six expire within the hour.
+
+**How "the ward holding the bed" is enforced.** Follow the `CONFIRM_CAPACITY` precedent exactly: a
+ward caller states the unit it is acting as, the ward screen supplies its own route `unitId`, and
+the reducer refuses when the acting unit is not the unit holding the bed, naming both ids. **Say
+plainly in the comment, as `CONFIRM_CAPACITY` does, that this records the caller's claim and does
+not prove it, and that this is not an identity model** — claiming more would be the defect this
+project keeps producing. A coordinator caller needs no acting unit.
+
+**What must not happen.** Releasing a bed must not close the movement, must not clear the patient's
+legal form, and must not auto-refer them anywhere. Cancelling transport must not close the movement.
+The reducer must refuse both on a closed movement, naming the closure reason, the way every other
+handler already does.
+
+---
+
+### Item 11 — The last free-text box becomes a fixed list
+
+**What it is.** The escalation form asks the coordinator to type who they are contacting next. Its
+label says "a role or service only, never a person's name (synthetic data only)". Nothing enforces
+that, and it is the only free-text input left in the prototype.
+
+**What gets built (D6).** A picker offering exactly: **State bed coordination desk**, **Duty
+psychiatrist**, **Bed management**, **Nurse unit manager (destination ward)**, **Escort or transport
+provider**, and **Other service**. No typing. Every entry except "Other service" is drawn from
+language the model already uses; none is invented.
+
+**Why it matters more than its size.** The synthetic-data promise currently depends on a user
+reading a label and complying. After this it is true by construction — the same reasoning that made
+decline reasons a fixed list.
+
+**Migration:** the one authored escalation in the fixture uses "State bed coordination desk", which
+is on the list, so no fixture data is lost.
+
+---
+
+### Item 12 — Statutory clock board (HELD, not built)
+
+**Not built (D1).** This was a board of legal countdowns. Every legal deadline was removed from the
+model on the owner's instruction, so the board has nothing to show and any rebuild would either be
+empty or would re-invent the statutory figures this project has fabricated four times.
+
+**It is recorded here as awaiting real timeframes from the product owner.** If they arrive, the
+precedent is set: `LegalForm.dueAt` is already optional and the "Statutory timing" factor in the
+operational score is dormant rather than deleted, so the board returns as an optional field plus one
+derivation. **No agent may supply those figures.**
+
+---
+
+## 5. Build order
+
+Groundwork first, because four boards read what it produces.
+
+1. **Item 2** — the scarce scenario. Everything downstream is demonstrable only against it.
+2. **Item 3** — urgency and legal status changes. Item 7's audit and item 8 both depend on it.
+3. **Item 10** — release a hold, cancel a transport. Shares the audit and the fixed-reason pattern
+   with item 3, and is the highest-value single addition in the phase.
+4. **Item 1** — shift handover.
+5. **Item 4** — escalation board.
+6. **Item 11** — the fixed contact list. Small, and it touches the escalation surface item 4 just
+   built.
+7. **Item 5** — patient search.
+8. **Item 6** — capacity board extensions.
+9. **Item 7** — governance extensions, including the two effectiveness numbers.
+10. **Item 8** — patient page extensions.
+11. **Item 9** — bed release flagging.
+
+Items 5 through 11 are small and largely independent; their order can move. Items 1 through 4
+cannot.
+
+## 6. How it gets proved
+
+- **Contract tests** for every new event: role gating, refusal on a closed movement, refusal on a
+  mismatched acting unit where one applies, and the exact state each event does and does not touch.
+- **A measurement, not an assertion, for item 2** — the eligible-ward distribution in both
+  scenarios, reported in full.
+- **Every test mutation-tested**: make the single edit that should kill it, print the edited line
+  back from the file, watch it fail, revert, confirm green. A mutation not read back did not
+  happen. A mutation that does not kill the test is **reported, not reshaped**.
+- **Dark, forced-colours and print coverage** for every new page, following the established
+  `emulateMedia` pattern. The handover's print rendering is a requirement, not a nicety.
+- **Reachability assertions** for all three new routes.
+- Read counts, never exit codes.
+
+## 7. Known limits, stated so they are not later filed as defects
+
+- **Everything runs in one browser window.** One person switches between roles. The prototype
+  therefore cannot demonstrate its own central claim — that shared visibility removes the
+  ring-around — because two people cannot use it at once. That needs a server build and is out of
+  scope for every phase of this prototype.
+- **The system never observes a discharge**, so it cannot derive bed supply from its own data.
+  Supply arrives only as a ward-reported bed release (item 9).
+- **No legal countdown exists anywhere in this model** and none may be added (item 12).
+- **The two effectiveness numbers describe a synthetic scenario**, not real performance.

From 56bdf6314680f60e22f2097e75670c9759b96add Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 04:40:02 +0800
Subject: [PATCH 02/54] Ward Flow Phase 4: the implementation plan, eleven
 tasks

Task order is groundwork first: the scarce scenario, then mid-flight urgency and
legal-status changes, then release-a-hold and cancel-a-transport. Four later boards
read what those produce, and on tonight's data three of them would render empty
without the first.

Two structural facts the plan pins so no implementer guesses at them. EVENT_ROLE is
today one role per event and the reducer gate is an equality check; two of the new
events need two roles each, so the table widens to arrays in Task 2 rather than being
special-cased. And release-a-hold follows the CONFIRM_CAPACITY precedent for stating an
acting unit, including its comment saying plainly that this records a claim and does
not prove it.

Every fixed reason list is written out in full. The statutory clock board is named as
deliberately absent, with the note that a task appearing to need a legal deadline is a
defect in the task rather than a licence.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ...-25-ward-flow-phase-4-specialist-boards.md | 1168 +++++++++++++++++
 1 file changed, 1168 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md

diff --git a/docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md b/docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md
new file mode 100644
index 0000000000..99a075c112
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md
@@ -0,0 +1,1168 @@
+# Ward Flow Phase 4 — specialist boards, implementation plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Build the eleven Phase 4 items — a scarcer scenario, mid-flight urgency and legal-status
+changes, the undo the prototype has never had, and six specialist boards — leaving the statutory
+clock board deliberately unbuilt.
+
+**Architecture:** Every change follows the existing shape. New behaviour arrives as a reducer event
+with a role gate and a `Rejection` on refusal; new reads arrive as pure derivations in
+`ward-derivations.ts`; new screens are route components under `src/app/ward-management/` rendering
+components under `src/components/ward-management/`. The reducer stays pure, `now` arrives on every
+event, and nothing reads the wall clock outside `ward-clock.ts`.
+
+**Tech Stack:** Next.js 16 App Router, React 19, TypeScript 6 strict, CSS modules with `@theme`
+design tokens, Vitest for unit and DOM tests, Playwright (Chromium) for journeys.
+
+**Spec:** `docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md`
+
+## Global Constraints
+
+Copied verbatim from spec §1. Every task's requirements implicitly include this section.
+
+1. **Never invent, infer, restate or "correct" any figure, requirement, title or classification from
+   the Mental Health Act.** If a legal quantity is needed it comes from the product owner or it does
+   not exist. Form titles resolve from the official register (`formTitleForCode`) or render as the
+   bare code.
+2. **Synthetic data only.** No name, date of birth, medical record number, address, diagnosis,
+   narrative history or treatment. **Sex is the only permitted patient attribute. Free text counts.**
+3. **Advisory only.** The system proposes; a human confirms or overrides, always, with the reason
+   recorded. Nothing auto-allocates and nothing defaults after a timeout.
+4. **Conservative failure.** Missing data narrows what is shown. An absence renders as an explicit
+   absence, never as a substituted default. No `?? array[0]`, no `.find()!`.
+5. **Not a medical device**, and the pages say so.
+6. **Repo gates:** design tokens only (no raw hex); every `<button>` has a real handler, is a submit
+   inside a form, or is a `<Link>`; never both `disabled` and `aria-disabled`; production tap targets
+   `3rem`/48px, never `2.75rem`; one search composer per page; internal navigation via
+   `<Link>`/`router.push`, never a raw `<a href>`; a new production route needs an inbound nav link
+   plus a reachability assertion in `tests/route-reachability.test.ts`.
+7. **Purity:** no `Math.random()`; no wall-clock read outside `ward-clock.ts`; the reducer stays pure
+   and `now` arrives on the event.
+
+**Additional execution constraints for every task:**
+
+- **Mutation-test every test you add or change.** Make the single edit that should kill it, **print
+  the edited line back from the file**, run it, watch it fail, revert, confirm green. A mutation you
+  did not read back did not happen. **If a mutation does not kill the test, say so and stop** — do
+  not reshape the test until something goes red.
+- **No assertion may be weakened, removed, or made unable to fail.**
+- Read counts, never exit codes. Leave no stray files, including in the repository root.
+- **Do not run Playwright, `npm run lint`, or a build** — the controller runs those gates.
+- One commit per task. **Do not push.**
+
+## File Structure
+
+| File                                                                             | Responsibility                                                                                  | New?    |
+| -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | ------- |
+| `src/components/ward-management/ward-scenarios.ts`                               | The two synthetic nights and the tightening rule                                                | **new** |
+| `src/components/ward-management/ward-change-reasons.ts`                          | The four fixed reason lists and the escalation contact list                                     | **new** |
+| `src/components/ward-management/ward-flow-events.ts`                             | Event union + role table                                                                        | modify  |
+| `src/components/ward-management/ward-flow-reducer.ts`                            | New handlers, widened role gate, scenario seed                                                  | modify  |
+| `src/components/ward-management/ward-model.ts`                                   | `ChangeRecord`, `BedRelease` writer fields                                                      | modify  |
+| `src/components/ward-management/ward-derivations.ts`                             | `handoverSnapshot`, `escalationBoard`, `searchMovements`, `effectivenessNumbers`, `changeAudit` | modify  |
+| `src/components/ward-management/handover/handover-page.tsx` + `.module.css`      | Item 1                                                                                          | **new** |
+| `src/components/ward-management/escalation/escalation-board.tsx` + `.module.css` | Item 4                                                                                          | **new** |
+| `src/components/ward-management/search/patient-search.tsx` + `.module.css`       | Item 5                                                                                          | **new** |
+| `src/app/ward-management/handover/page.tsx`                                      | Route for item 1                                                                                | **new** |
+| `src/app/ward-management/escalation/page.tsx`                                    | Route for item 4                                                                                | **new** |
+| `src/app/ward-management/search/page.tsx`                                        | Route for item 5                                                                                | **new** |
+
+---
+
+## Task 1: The scarce-beds scenario (spec item 2)
+
+**Files:**
+
+- Create: `src/components/ward-management/ward-scenarios.ts`
+- Modify: `src/components/ward-management/ward-flow-events.ts` (add `SET_SCENARIO`)
+- Modify: `src/components/ward-management/ward-flow-reducer.ts` (`seedWardFlowState`, `SET_SCENARIO`, `subjectId`)
+- Modify: `src/components/ward-management/ward-demo-controls.tsx`
+- Test: `tests/ward-scenarios.test.ts` (new)
+
+**Interfaces:**
+
+- Consumes: `allUnits()` from `ward-sites.ts`; `wardMovements` from `ward-movements.ts`;
+  `eligibility(movement, unit, now)` from `ward-eligibility.ts`; `isOpen(movement)` from
+  `ward-derivations.ts`; `NOW_ANCHOR` from `ward-sites.ts`.
+- Produces:
+  - `export type WardScenario = "standard" | "scarce";`
+  - `export const WARD_SCENARIOS: readonly WardScenario[];`
+  - `export function scenarioUnits(scenario: WardScenario): Unit[];`
+  - `export const scenarioLabels: Record<WardScenario, string>;`
+  - `WardFlowState` gains `scenario: WardScenario`.
+  - Event `{ type: "SET_SCENARIO"; role: WardFlowRole; now: Instant; scenario: WardScenario }`,
+    `EVENT_ROLE.SET_SCENARIO = "demo"`.
+
+**Why this task is first:** four later boards have nothing to show without it. Measured on the
+standard night, every one of the 41 open movements has **at least six** eligible wards.
+
+- [ ] **Step 1: Write the failing measurement test**
+
+`tests/ward-scenarios.test.ts`:
+
+```ts
+import { describe, expect, it } from "vitest";
+
+import { eligibility } from "@/components/ward-management/ward-eligibility";
+import { isOpen } from "@/components/ward-management/ward-derivations";
+import { wardMovements } from "@/components/ward-management/ward-movements";
+import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
+import { scenarioUnits } from "@/components/ward-management/ward-scenarios";
+
+function eligibleCounts(scenario: "standard" | "scarce") {
+  const units = scenarioUnits(scenario);
+  return wardMovements
+    .filter(isOpen)
+    .map((movement) => units.filter((unit) => eligibility(movement, unit, NOW_ANCHOR).eligible).length);
+}
+
+describe("ward scenarios", () => {
+  it("the standard night leaves every open movement several eligible wards", () => {
+    const counts = eligibleCounts("standard");
+    expect(counts.length).toBeGreaterThan(30);
+    expect(Math.min(...counts)).toBeGreaterThanOrEqual(5);
+  });
+
+  it("the scarce night exhausts the network for at least one open movement", () => {
+    const counts = eligibleCounts("scarce");
+    expect(counts.length).toBeGreaterThan(30);
+    expect(Math.min(...counts)).toBe(0);
+    expect(counts.filter((count) => count === 0).length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("the scarce night is strictly tighter than the standard night, movement for movement", () => {
+    const standard = eligibleCounts("standard");
+    const scarce = eligibleCounts("scarce");
+    expect(scarce.every((count, index) => count <= standard[index])).toBe(true);
+    const scarceTotal = scarce.reduce((sum, count) => sum + count, 0);
+    const standardTotal = standard.reduce((sum, count) => sum + count, 0);
+    expect(scarceTotal).toBeLessThan(standardTotal / 2);
+  });
+
+  it("changes operational numbers only — never a patient attribute", () => {
+    const standard = scenarioUnits("standard");
+    const scarce = scenarioUnits("scarce");
+    expect(scarce.map((unit) => unit.id)).toEqual(standard.map((unit) => unit.id));
+    expect(scarce.map((unit) => unit.cohort)).toEqual(standard.map((unit) => unit.cohort));
+    expect(scarce.map((unit) => unit.security)).toEqual(standard.map((unit) => unit.security));
+    expect(scarce.map((unit) => unit.authorised)).toEqual(standard.map((unit) => unit.authorised));
+    expect(scarce.map((unit) => unit.name)).toEqual(standard.map((unit) => unit.name));
+  });
+});
+```
+
+- [ ] **Step 2: Run it and watch it fail**
+
+Run: `npx vitest run tests/ward-scenarios.test.ts`
+Expected: FAIL — `ward-scenarios` does not exist.
+
+- [ ] **Step 3: Write `ward-scenarios.ts`**
+
+The tightening levers, read from `ward-eligibility.ts`, are exactly three: `allocatable.value`
+(the `sex_mix` gate needs more than one free bed when there are no same-sex occupants),
+`speciallingCapacity` (the `specialling` gate), and `sexMix`. **Cohort, security, authorisation
+and identity must not move** — the fourth test pins that.
+
+Start from this deterministic rule and **adjust the constants until the second and third tests
+pass**. No `Math.random()`. Every unit keeps its identity:
+
+```ts
+import type { Unit } from "@/components/ward-management/ward-model";
+import { allUnits } from "@/components/ward-management/ward-sites";
+
+export type WardScenario = "standard" | "scarce";
+export const WARD_SCENARIOS: readonly WardScenario[] = ["standard", "scarce"] as const;
+
+export const scenarioLabels: Record<WardScenario, string> = {
+  standard: "Standard night",
+  scarce: "Scarce beds",
+};
+
+/**
+ * The scarce night differs from the standard night in OPERATIONAL NUMBERS ONLY. It carries the
+ * same units, the same patients and the same identities; what changes is how many beds a ward
+ * can actually allocate and how much one-to-one observation it can staff. Nothing here is a
+ * clinical, legal or patient-level difference, and nothing here may become one.
+ */
+export function scenarioUnits(scenario: WardScenario): Unit[] {
+  const units = structuredClone(allUnits());
+  if (scenario === "standard") return units;
+  return units.map((unit, index) => ({
+    ...unit,
+    // Every third unit keeps a single allocatable bed; the rest have none. A single bed still
+    // fails the sex_mix gate unless the ward already holds same-sex occupants, which is exactly
+    // the squeeze a real scarce night produces.
+    allocatable: { ...unit.allocatable, value: index % 3 === 0 ? 1 : 0 },
+    speciallingCapacity: 0,
+  }));
+}
+```
+
+**Report the full eligible-ward distribution for both scenarios in your task report** — spec §4
+item 2 makes that measurement the acceptance test, not a screenshot.
+
+- [ ] **Step 4: Run the tests and watch them pass**
+
+Run: `npx vitest run tests/ward-scenarios.test.ts`
+Expected: PASS, 4 tests.
+
+- [ ] **Step 5: Add the `SET_SCENARIO` event**
+
+In `ward-flow-events.ts`, add to the union and to `EVENT_ROLE`:
+
+```ts
+  | { type: "SET_SCENARIO"; role: WardFlowRole; now: Instant; scenario: WardScenario }
+```
+
+```ts
+  SET_SCENARIO: "demo",
+```
+
+In `ward-flow-reducer.ts`: add `scenario: WardScenario` to `WardFlowState`; change
+`seedWardFlowState()` to `seedWardFlowState(scenario: WardScenario = "standard")` returning
+`{ ...state, scenario, units: scenarioUnits(scenario) }`; handle the event as
+`case "SET_SCENARIO": return seedWardFlowState(event.scenario);`; add `"SET_SCENARIO"` to the
+`subjectId` switch alongside `ADVANCE_CLOCK`/`RESET_SCENARIO`, returning `"none"`.
+
+**`RESET_SCENARIO` keeps calling `seedWardFlowState()` with no argument, so reset always returns
+to the standard night** (spec D3). Do not make reset scenario-sticky.
+
+- [ ] **Step 6: Add reducer tests**
+
+Add to `tests/ward-flow-reducer.test.ts`: `SET_SCENARIO` to `"scarce"` replaces the units and
+leaves movement ids unchanged; `SET_SCENARIO` raised by role `"ward"` is refused with a
+`Rejection`; `RESET_SCENARIO` after `SET_SCENARIO` returns `state.scenario === "standard"`.
+
+- [ ] **Step 7: Add the scenario switch to the demo menu**
+
+`ward-demo-controls.tsx` already carries the `demo` role, an `aria-label` naming it "not a
+clinical action", and a notice sentence before any reachable button. Add one button per entry in
+`WARD_SCENARIOS`, labelled from `scenarioLabels`, dispatching `SET_SCENARIO`. Mark the active one
+with `aria-pressed`. **Do not put a scenario control on any clinical screen.**
+
+- [ ] **Step 8: Run the ward unit suites, then commit**
+
+Run: `npx vitest run tests/ward-*.test.ts tests/ward-*.dom.test.tsx`
+Report the file and test counts. Then:
+
+```bash
+git add src/components/ward-management tests/ward-scenarios.test.ts tests/ward-flow-reducer.test.ts
+git commit -m "Ward Flow: a scarce-beds scenario, so the escalation surfaces have something to show"
+```
+
+---
+
+## Task 2: Urgency and legal status can change (spec item 3)
+
+**Files:**
+
+- Create: `src/components/ward-management/ward-change-reasons.ts`
+- Modify: `ward-model.ts`, `ward-flow-events.ts`, `ward-flow-reducer.ts`
+- Modify: `src/components/ward-management/coordinator/shortlist-panel.tsx`, `ed/ed-screen.tsx`
+- Test: `tests/ward-flow-reducer.test.ts`, `tests/ward-change-reasons.test.ts` (new)
+
+**Interfaces:**
+
+- Consumes: `Movement.urgency`, `Movement.legalStatus`, `Movement.statusChanges`, `StatusChange`
+  (`{ at; from; to; by }`), `EVENT_ROLE`, `reject()`.
+- Produces:
+  - `export const URGENCY_CHANGE_REASONS = ["reassessed", "new_information", "correcting_an_error"] as const;`
+  - `export const LEGAL_STATUS_CHANGE_REASONS = ["recorded_by_treating_team", "correcting_an_error"] as const;`
+  - `Movement.urgencyChanges: UrgencyChange[]` where
+    `UrgencyChange = { at: Instant; from: 1 | 2 | 3; to: 1 | 2 | 3; by: string; reason: UrgencyChangeReason }`
+  - `StatusChange` gains `reason: LegalStatusChangeReason`.
+  - Events `CHANGE_URGENCY` and `CHANGE_LEGAL_STATUS`.
+  - **`EVENT_ROLE` becomes `Record<WardFlowEvent["type"], readonly WardFlowRole[]>`** — see step 3.
+
+**The structural change this task carries.** `EVENT_ROLE` is today
+`Record<WardFlowEvent["type"], WardFlowRole>` — exactly one role per event — and the reducer gate
+is `if (requiredRole !== event.role)`. Spec D2 requires **two** roles for both new events, and
+Task 3 requires two for its events as well. **Widen the table to arrays in this task.** Do not
+special-case the new events past a single-role table; do not pick one role and quietly drop the
+other.
+
+- [ ] **Step 1: Write the failing reducer tests**
+
+Add to `tests/ward-flow-reducer.test.ts`:
+
+```ts
+it("records an urgency change with who made it, from both permitted roles", () => {
+  const seeded = seedWardFlowState();
+  const movement = seeded.movements.find((candidate) => candidate.urgency !== 1)!;
+  const after = wardFlowReducer(seeded, {
+    type: "CHANGE_URGENCY",
+    role: "coordinator",
+    now: NOW_ANCHOR,
+    movementId: movement.id,
+    urgency: 1,
+    reason: "reassessed",
+  });
+  const updated = after.movements.find((candidate) => candidate.id === movement.id)!;
+  expect(updated.urgency).toBe(1);
+  expect(updated.urgencyChanges).toHaveLength(1);
+  expect(updated.urgencyChanges[0]).toMatchObject({
+    from: movement.urgency,
+    to: 1,
+    by: "coordinator",
+    reason: "reassessed",
+  });
+  expect(after.rejections).toHaveLength(0);
+
+  const fromEd = wardFlowReducer(seeded, {
+    type: "CHANGE_URGENCY",
+    role: "ed",
+    now: NOW_ANCHOR,
+    movementId: movement.id,
+    urgency: 1,
+    reason: "reassessed",
+  });
+  expect(fromEd.rejections).toHaveLength(0);
+});
+
+it("refuses an urgency change from a role that may not make one", () => {
+  const seeded = seedWardFlowState();
+  const movement = seeded.movements[0];
+  const after = wardFlowReducer(seeded, {
+    type: "CHANGE_URGENCY",
+    role: "officer",
+    now: NOW_ANCHOR,
+    movementId: movement.id,
+    urgency: 1,
+    reason: "reassessed",
+  });
+  expect(after.rejections).toHaveLength(1);
+  expect(after.movements.find((candidate) => candidate.id === movement.id)!.urgency).toBe(movement.urgency);
+});
+
+it("records a legal status change and never re-sorts or un-accepts the patient", () => {
+  const seeded = seedWardFlowState();
+  const movement = seeded.movements.find(
+    (candidate) => candidate.legalStatus === "Voluntary" && candidate.acceptedUnitId !== undefined,
+  )!;
+  const after = wardFlowReducer(seeded, {
+    type: "CHANGE_LEGAL_STATUS",
+    role: "ed",
+    now: NOW_ANCHOR,
+    movementId: movement.id,
+    legalStatus: "Involuntary inpatient",
+    reason: "recorded_by_treating_team",
+  });
+  const updated = after.movements.find((candidate) => candidate.id === movement.id)!;
+  expect(updated.legalStatus).toBe("Involuntary inpatient");
+  expect(updated.statusChanges).toHaveLength(1);
+  expect(updated.statusChanges[0]).toMatchObject({ from: "Voluntary", to: "Involuntary inpatient", by: "ed" });
+  // Nothing auto-allocates: the accepted unit, the stage and the referrals are untouched.
+  expect(updated.acceptedUnitId).toBe(movement.acceptedUnitId);
+  expect(updated.stage).toBe(movement.stage);
+  expect(updated.referredUnitIds).toEqual(movement.referredUnitIds);
+});
+
+it("refuses both changes on a closed movement, naming the closure reason", () => {
+  const seeded = seedWardFlowState();
+  const movement = seeded.movements[0];
+  const closed = {
+    ...seeded,
+    movements: seeded.movements.map((candidate) =>
+      candidate.id === movement.id
+        ? { ...candidate, closure: { at: NOW_ANCHOR, outcome: "arrived" as const, reason: "arrived at unit" } }
+        : candidate,
+    ),
+  };
+  const after = wardFlowReducer(closed, {
+    type: "CHANGE_URGENCY",
+    role: "coordinator",
+    now: NOW_ANCHOR,
+    movementId: movement.id,
+    urgency: 1,
+    reason: "reassessed",
+  });
+  expect(after.rejections).toHaveLength(1);
+  expect(after.rejections[0].reason).toContain("arrived at unit");
+});
+```
+
+If a fixture movement matching a test's precondition does not exist, **say so in your report and
+construct the precondition explicitly from `seedWardFlowState()`** rather than deleting the test.
+
+- [ ] **Step 2: Run and watch them fail**
+
+Run: `npx vitest run tests/ward-flow-reducer.test.ts`
+Expected: FAIL — `CHANGE_URGENCY` is not a known event type.
+
+- [ ] **Step 3: Widen the role table**
+
+In `ward-flow-events.ts`:
+
+```ts
+export const EVENT_ROLE: Record<WardFlowEvent["type"], readonly WardFlowRole[]> = {
+  RAISE_REFERRAL: ["ed"],
+  RECORD_EXAMINATION: ["ed"],
+  REFER_TO_UNITS: ["coordinator"],
+  ACCEPT_IN_PRINCIPLE: ["ward"],
+  HOLD_BED: ["ward"],
+  DECLINE: ["ward"],
+  HANDOVER_READY: ["ed"],
+  TRANSPORT_ACCEPTED: ["officer"],
+  TRANSPORT_EN_ROUTE: ["officer"],
+  PATIENT_COLLECTED: ["officer"],
+  PATIENT_ARRIVED: ["officer"],
+  CONFIRM_CAPACITY: ["ward"],
+  RECORD_ESCALATION: ["coordinator"],
+  ADVANCE_CLOCK: ["demo"],
+  RESET_SCENARIO: ["demo"],
+  SET_SCENARIO: ["demo"],
+  CHANGE_URGENCY: ["coordinator", "ed"],
+  CHANGE_LEGAL_STATUS: ["coordinator", "ed"],
+};
+```
+
+In `ward-flow-reducer.ts`, replace the gate:
+
+```ts
+const permittedRoles = EVENT_ROLE[event.type];
+if (!permittedRoles.includes(event.role)) {
+  return reject(
+    state,
+    event,
+    `${event.type} requires role ${permittedRoles.join(" or ")}, but was raised by role ${event.role}`,
+  );
+}
+```
+
+**Every existing role-refusal test must still pass unchanged in behaviour.** If a test asserts the
+exact refusal string, update it to the new wording and say so in your report — that is a message
+change, not a weakened assertion.
+
+- [ ] **Step 4: Add the reason lists**
+
+`src/components/ward-management/ward-change-reasons.ts`:
+
+```ts
+/**
+ * Fixed reason lists. Chosen, never typed — the same treatment `DECLINE_REASONS` already has,
+ * and for the same reason: the synthetic-data promise must be true by construction rather than
+ * by a user reading a label and complying.
+ *
+ * These are deliberately operational and content-free. NONE of them describes a patient, a
+ * diagnosis, a clinical judgement or a legal requirement. A reason reading "patient
+ * deteriorated" would be narrative clinical content; one reading "order made" would be a claim
+ * about the Mental Health Act. Both are forbidden. If richer reasons are wanted they come from
+ * the product owner; no agent adds one.
+ */
+export const URGENCY_CHANGE_REASONS = ["reassessed", "new_information", "correcting_an_error"] as const;
+export type UrgencyChangeReason = (typeof URGENCY_CHANGE_REASONS)[number];
+
+export const LEGAL_STATUS_CHANGE_REASONS = ["recorded_by_treating_team", "correcting_an_error"] as const;
+export type LegalStatusChangeReason = (typeof LEGAL_STATUS_CHANGE_REASONS)[number];
+
+export const changeReasonLabels: Record<UrgencyChangeReason | LegalStatusChangeReason, string> = {
+  reassessed: "Reassessed",
+  new_information: "New information",
+  correcting_an_error: "Correcting an error",
+  recorded_by_treating_team: "Recorded by treating team",
+};
+```
+
+- [ ] **Step 5: Add the model fields and the two handlers**
+
+`ward-model.ts`: add `reason: LegalStatusChangeReason` to `StatusChange`; add the `UrgencyChange`
+type and `urgencyChanges: UrgencyChange[]` to `Movement`. Seed `urgencyChanges: []` everywhere
+`statusChanges: []` is seeded, in `ward-movements.ts` and in the reducer's `RAISE_REFERRAL`.
+
+`ward-flow-reducer.ts`: both handlers reject a closed movement (naming `movement.closure.reason`),
+reject an unknown movement id, and otherwise append the change record and set the new value.
+`by: event.role`. Neither handler may touch `stage`, `acceptedUnitId`, `referredUnitIds`,
+`declines`, `transport`, `legalForm` or `bedHeldUntil`.
+
+- [ ] **Step 6: Run and watch them pass**
+
+Run: `npx vitest run tests/ward-flow-reducer.test.ts`
+Expected: PASS. Report the count.
+
+- [ ] **Step 7: Surface the lawfulness exception**
+
+A legal status change can make an already-accepted destination unlawful. Add a derivation to
+`ward-derivations.ts`:
+
+```ts
+/**
+ * A movement whose CURRENT legal status requires an authorised destination, but whose already
+ * accepted unit is not authorised. This is a real situation created by a mid-flight status
+ * change, and it is surfaced as an exception for a human to resolve. It NEVER re-sorts,
+ * re-suggests or un-accepts the patient: nothing in this prototype auto-allocates, and that
+ * rule does not bend because the trigger was a status change.
+ */
+export function destinationNoLongerLawful(movement: Movement, units: Unit[]): Unit | undefined {
+  if (!isOpen(movement)) return undefined;
+  if (!requiresAuthorisedDestination(movement.legalStatus)) return undefined;
+  if (movement.acceptedUnitId === undefined) return undefined;
+  const unit = units.find((candidate) => candidate.id === movement.acceptedUnitId);
+  if (unit === undefined) return undefined;
+  return unit.authorised ? undefined : unit;
+}
+```
+
+Add an `InboxItem` for it in `buildActionInbox` with tone `"danger"`, so it reaches the
+coordinator's existing exceptions band. Test it in `tests/ward-derivations.test.ts` — a movement
+with an unauthorised accepted unit and a status requiring authorisation returns the unit; the same
+movement Voluntary returns `undefined`; a closed movement returns `undefined`.
+
+- [ ] **Step 8: Add the two controls**
+
+On the coordinator's `shortlist-panel.tsx` and the ED screen (`ed-screen.tsx`): an urgency picker
+(tiers 1–3) and a legal-status picker (the four existing statuses), each with a **required reason
+`<select>`** from the lists in step 4, submitting a form. Follow the existing legal-status select
+in `ed-screen.tsx` exactly rather than inventing a control pattern; every `<select>` needs a real
+associated `<label>`. Test-ids: `ward-change-urgency`, `ward-change-legal-status`.
+
+- [ ] **Step 9: Run the ward suites and commit**
+
+Run: `npx vitest run tests/ward-*.test.ts tests/ward-*.dom.test.tsx`
+
+```bash
+git add src/components/ward-management tests
+git commit -m "Ward Flow: urgency and legal status can change mid-flight, each change recorded"
+```
+
+---
+
+## Task 3: Release a hold, cancel a transport (spec item 10)
+
+**Files:**
+
+- Modify: `ward-model.ts`, `ward-flow-events.ts`, `ward-flow-reducer.ts`, `ward-change-reasons.ts`
+- Modify: `src/components/ward-management/coordinator/shortlist-panel.tsx`, `ward/ward-screen.tsx`
+- Test: `tests/ward-flow-reducer.test.ts`
+
+**Interfaces:**
+
+- Consumes: the widened `EVENT_ROLE` from Task 2; `Movement.bedHeldUntil`,
+  `Movement.acceptedUnitId`, `Movement.transport`, `TransportJob.cancelledAt`; the
+  `CONFIRM_CAPACITY` `actingUnitId` precedent.
+- Produces:
+  - `RELEASE_HOLD_REASONS`, `CANCEL_TRANSPORT_REASONS` in `ward-change-reasons.ts`.
+  - Events `RELEASE_HOLD` and `CANCEL_TRANSPORT`, both `["coordinator", "ward"]`, both carrying
+    `actingUnitId?: string`.
+  - `Movement.unwinds: UnwindRecord[]` where
+    `UnwindRecord = { at: Instant; kind: "hold_released" | "transport_cancelled"; by: string; reason: string }`.
+
+**Why this matters.** Measured: the **only** path that releases a held bed today is closing the
+movement by recording an examination with outcome `community_order` or `revoked` — so a
+coordinator who holds the wrong bed must declare the patient does not need admission. Seven beds
+are held, one hold has already expired and six expire within the hour, and nobody can act on any
+of them.
+
+- [ ] **Step 1: Add the reason lists**
+
+Append to `ward-change-reasons.ts`, extending `changeReasonLabels` to cover every new entry:
+
+```ts
+export const RELEASE_HOLD_REASONS = [
+  "patient_no_longer_coming",
+  "bed_needed_for_another_patient",
+  "ward_withdrew_the_bed",
+  "hold_made_in_error",
+] as const;
+export type ReleaseHoldReason = (typeof RELEASE_HOLD_REASONS)[number];
+
+export const CANCEL_TRANSPORT_REASONS = [
+  "provider_unavailable",
+  "patient_not_ready",
+  "destination_changed",
+  "job_created_in_error",
+] as const;
+export type CancelTransportReason = (typeof CANCEL_TRANSPORT_REASONS)[number];
+```
+
+- [ ] **Step 2: Write the failing tests**
+
+Add to `tests/ward-flow-reducer.test.ts`. The four behaviours that must hold:
+
+```ts
+it("releases a held bed back to allocatable and returns the movement to accepted_awaiting_bed", () => {
+  const seeded = seedWardFlowState();
+  const movement = seeded.movements.find((candidate) => candidate.stage === "bed_held")!;
+  const unitBefore = seeded.units.find((candidate) => candidate.id === movement.acceptedUnitId)!;
+  const after = wardFlowReducer(seeded, {
+    type: "RELEASE_HOLD",
+    role: "coordinator",
+    now: NOW_ANCHOR,
+    movementId: movement.id,
+    reason: "hold_made_in_error",
+  });
+  const updated = after.movements.find((candidate) => candidate.id === movement.id)!;
+  const unitAfter = after.units.find((candidate) => candidate.id === movement.acceptedUnitId)!;
+  expect(updated.stage).toBe("accepted_awaiting_bed");
+  expect(updated.bedHeldUntil).toBeUndefined();
+  expect(unitAfter.allocatable.value).toBe(unitBefore.allocatable.value + 1);
+  // The movement survives, keeps its acceptance, and is not re-referred anywhere.
+  expect(updated.closure).toBeUndefined();
+  expect(updated.acceptedUnitId).toBe(movement.acceptedUnitId);
+  expect(updated.legalForm).toEqual(movement.legalForm);
+  expect(updated.unwinds.at(-1)).toMatchObject({ kind: "hold_released", by: "coordinator" });
+});
+
+it("refuses a release once the patient is handover_ready or moving", () => {
+  const seeded = seedWardFlowState();
+  const movement = seeded.movements.find((candidate) => candidate.stage === "moving")!;
+  const after = wardFlowReducer(seeded, {
+    type: "RELEASE_HOLD",
+    role: "coordinator",
+    now: NOW_ANCHOR,
+    movementId: movement.id,
+    reason: "hold_made_in_error",
+  });
+  expect(after.rejections).toHaveLength(1);
+  expect(after.movements.find((candidate) => candidate.id === movement.id)!.stage).toBe("moving");
+});
+
+it("refuses a ward caller acting as a unit that is not holding the bed, naming both ids", () => {
+  const seeded = seedWardFlowState();
+  const movement = seeded.movements.find((candidate) => candidate.stage === "bed_held")!;
+  const otherUnit = seeded.units.find((candidate) => candidate.id !== movement.acceptedUnitId)!;
+  const after = wardFlowReducer(seeded, {
+    type: "RELEASE_HOLD",
+    role: "ward",
+    now: NOW_ANCHOR,
+    movementId: movement.id,
+    actingUnitId: otherUnit.id,
+    reason: "ward_withdrew_the_bed",
+  });
+  expect(after.rejections).toHaveLength(1);
+  expect(after.rejections[0].reason).toContain(otherUnit.id);
+  expect(after.rejections[0].reason).toContain(movement.acceptedUnitId!);
+});
+
+it("cancels a transport job without closing the movement", () => {
+  const seeded = seedWardFlowState();
+  const movement = seeded.movements.find(
+    (candidate) => candidate.transport !== undefined && candidate.transport.cancelledAt === undefined,
+  )!;
+  const after = wardFlowReducer(seeded, {
+    type: "CANCEL_TRANSPORT",
+    role: "coordinator",
+    now: NOW_ANCHOR,
+    movementId: movement.id,
+    reason: "provider_unavailable",
+  });
+  const updated = after.movements.find((candidate) => candidate.id === movement.id)!;
+  expect(updated.transport?.cancelledAt).toBe(NOW_ANCHOR);
+  expect(updated.closure).toBeUndefined();
+  expect(updated.stage).toBe("handover_ready");
+  expect(updated.unwinds.at(-1)).toMatchObject({ kind: "transport_cancelled" });
+});
+```
+
+- [ ] **Step 3: Run and watch them fail**
+
+Run: `npx vitest run tests/ward-flow-reducer.test.ts`
+Expected: FAIL — unknown event types.
+
+- [ ] **Step 4: Implement both handlers**
+
+`RELEASE_HOLD`: reject a closed movement (naming the closure reason); reject unless
+`movement.stage === "bed_held"`; when `event.role === "ward"`, reject unless
+`event.actingUnitId === movement.acceptedUnitId`, naming both ids. On success: return the bed
+(`allocatable.value + 1`, `confirmedAt: event.now`), clear `bedHeldUntil`, set stage to
+`accepted_awaiting_bed`, append the unwind record. **Do not** close the movement, clear
+`legalForm`, or alter `referredUnitIds`.
+
+`CANCEL_TRANSPORT`: reject a closed movement; reject when there is no transport job, when it is
+already cancelled, or when `movement.transport.arrivedAt` is set; same acting-unit rule for a ward
+caller. On success: set `cancelledAt`, set stage to `handover_ready`, append the unwind record.
+
+Carry this comment on `actingUnitId`, matching the `CONFIRM_CAPACITY` precedent:
+
+```ts
+/**
+ * The unit the caller stated it was acting as. Required for a `ward` caller, unused for a
+ * `coordinator` caller. This records the caller's CLAIM about itself and does not prove it:
+ * nothing here authenticates anything, and this model has no identity model. The comparison
+ * constrains future callers rather than this one.
+ */
+```
+
+- [ ] **Step 5: Run and watch them pass**
+
+Run: `npx vitest run tests/ward-flow-reducer.test.ts`. Report the count.
+
+- [ ] **Step 6: Add the controls**
+
+Coordinator (`shortlist-panel.tsx`) and ward screen (`ward-screen.tsx`): "Release the held bed"
+and "Cancel transport", each opening a form with a required reason `<select>`. The ward screen
+passes its own route `unitId` as `actingUnitId`. Each control renders **only when the reducer
+would accept it** — stage `bed_held` for release, a live transport job for cancel — rather than
+dispatching optimistically and letting the reducer refuse silently. Test-ids:
+`ward-release-hold`, `ward-cancel-transport`.
+
+- [ ] **Step 7: Run the ward suites and commit**
+
+```bash
+git add src/components/ward-management tests
+git commit -m "Ward Flow: a held bed can be released and a transport cancelled without closing the patient"
+```
+
+---
+
+## Task 4: Shift handover (spec item 1)
+
+**Files:**
+
+- Create: `src/components/ward-management/handover/handover-page.tsx`, `handover.module.css`
+- Create: `src/app/ward-management/handover/page.tsx`
+- Modify: `ward-derivations.ts` (`handoverSnapshot`), the left rail
+  (`ward-management-navigation.tsx` / `ClinicalRail`), `tests/route-reachability.test.ts`
+- Test: `tests/ward-handover.test.ts`, `tests/ward-handover.dom.test.tsx` (both new)
+
+**Interfaces:**
+
+- Consumes: `isOpen`, `elapsedLabel`, `transportLeg`, `destinationUnit`, `stageCopy`,
+  `eligibleCandidatesAmong` from `ward-derivations.ts`; `Movement.bedHeldUntil`,
+  `Movement.escalation`, `Movement.declines`, `Movement.referredUnitIds`.
+- Produces:
+
+  ```ts
+  export type HandoverSnapshot = {
+    frozenAt: Instant;
+    longestWaits: { movement: Movement; unit: Unit | undefined }[];
+    heldBeds: { movement: Movement; unit: Unit | undefined; expired: boolean }[];
+    inTransit: { movement: Movement; leg: TransportLeg | "Cancelled" | undefined }[];
+    placementGoneWrong: { movement: Movement; kind: "escalated" | "declined_by_all" }[];
+  };
+  export function handoverSnapshot(movements: Movement[], units: Unit[], now: Instant): HandoverSnapshot;
+  ```
+
+- [ ] **Step 1: Write the failing derivation test**
+
+`tests/ward-handover.test.ts` — assert, against `seedWardFlowState()` at `NOW_ANCHOR`:
+
+- `longestWaits` contains every open movement, in strictly non-increasing wait order, and its
+  first entry's wait is the maximum across open movements.
+- `heldBeds` contains exactly the open movements with a `bedHeldUntil`, and `expired` is true
+  exactly when `bedHeldUntil <= now`.
+- `inTransit` contains exactly the open movements with a transport job, each with its `leg`.
+- `placementGoneWrong` contains movements with an `escalation` (`kind: "escalated"`) and
+  movements with at least one referral where every referred unit has declined
+  (`kind: "declined_by_all"`), with no movement appearing twice.
+- `frozenAt` equals the `now` passed in.
+- **A non-vacuity floor:** `longestWaits.length` is greater than 30, so the test fails if the
+  fixture stops producing open movements.
+
+- [ ] **Step 2: Run and watch it fail**
+
+Run: `npx vitest run tests/ward-handover.test.ts` — FAIL, `handoverSnapshot` not exported.
+
+- [ ] **Step 3: Implement `handoverSnapshot`**
+
+Pure, no wall-clock read, `now` passed in. Sort by `now - movement.openedAt` descending.
+
+- [ ] **Step 4: Run and watch it pass**
+
+- [ ] **Step 5: Build the page**
+
+`handover-page.tsx` is a client component that calls `handoverSnapshot` **once, in a `useState`
+initialiser**, so the page is frozen at open and does not re-derive on the 30-second clock tick.
+Render the freeze time. Four sections in this order, each with a heading and each rendering an
+explicit "None" line when empty:
+
+1. `ward-handover-longest-waits` — rank, id, wait, stage, department, destination or "No
+   destination chosen".
+2. `ward-handover-held-beds` — id, unit, "Expired" or "Expires in …".
+3. `ward-handover-in-transit` — id, unit, leg.
+4. `ward-handover-placement-gone-wrong` — id, wait, and which kind.
+
+Root test-id `ward-handover-page`, freeze time `ward-handover-frozen-at`. Print styles live in
+`handover.module.css` using design tokens only. Add a "Print" button calling `window.print()`.
+
+**No section may invent a threshold, a deadline, or a legal claim.** Section 1 has no threshold by
+design: 0 of 41 open movements are past the 24-hour departmental access target, so a breach-led
+handover would be blank.
+
+- [ ] **Step 6: Wire the route and prove it is reachable**
+
+`src/app/ward-management/handover/page.tsx` renders the component with `metadata`. Add the
+left-rail entry, run `npm run docs:update`, add the `docs/codebase-index.md` entry, and add the
+assertion to `tests/route-reachability.test.ts`.
+
+- [ ] **Step 7: DOM test**
+
+`tests/ward-handover.dom.test.tsx`: renders inside `WardFlowProvider` with a fixed `initialNow`;
+asserts all four sections present; asserts the frozen time does **not** change after dispatching
+`ADVANCE_CLOCK`; asserts an empty section renders its explicit "None" line.
+
+- [ ] **Step 8: Run the ward suites and commit**
+
+```bash
+git add src tests docs
+git commit -m "Ward Flow: the shift handover, frozen when opened and printable"
+```
+
+---
+
+## Task 5: Escalation board (spec item 4)
+
+**Files:**
+
+- Create: `src/components/ward-management/escalation/escalation-board.tsx`, `escalation.module.css`
+- Create: `src/app/ward-management/escalation/page.tsx`
+- Modify: `ward-derivations.ts` (`escalationBoard`), left rail, `tests/route-reachability.test.ts`
+- Test: `tests/ward-escalation.test.ts`, `tests/ward-escalation.dom.test.tsx` (both new)
+
+**Interfaces:**
+
+- Consumes: `isOpen`, `elapsedLabel`, `eligibleCandidatesAmong(movement, units, now, limit)`,
+  `Movement.escalation`.
+- Produces:
+
+  ```ts
+  export type EscalationBoard = {
+    escalated: { movement: Movement; triedUnits: Unit[] }[];
+    nowhereEligible: Movement[];
+  };
+  export function escalationBoard(movements: Movement[], units: Unit[], now: Instant): EscalationBoard;
+  ```
+
+- [ ] **Step 1: Write the failing test**
+
+`tests/ward-escalation.test.ts`: on the **standard** night `nowhereEligible` is empty and
+`escalated` has exactly the movements carrying an escalation; on the **scarce** night (units from
+`scenarioUnits("scarce")`) `nowhereEligible` is non-empty. Both assertions matter — the first is
+the honest empty state, the second proves the board works. Use a large `limit` when calling
+`eligibleCandidatesAmong` so the count is real rather than capped at its default of 3.
+
+- [ ] **Step 2: Run and watch it fail.** `npx vitest run tests/ward-escalation.test.ts`
+
+- [ ] **Step 3: Implement `escalationBoard`.** Closed movements are excluded from both groups.
+
+- [ ] **Step 4: Run and watch it pass.**
+
+- [ ] **Step 5: Build the board**
+
+Two sections: `ward-escalation-escalated` (when, units tried, contact, wait) and
+`ward-escalation-nowhere-eligible` (id, wait, stage, department). Both **read-only**. Each renders
+an explicit "None" line when empty.
+
+**It records and shows. It suggests nothing.** No "least-bad options", no ranking of wards the
+patient does not fit, no statement of what would need to change. If you find yourself computing a
+near-miss, stop — that is item 4's explicit prohibition.
+
+- [ ] **Step 6: Route, left rail, reachability assertion, `npm run docs:update`.**
+
+- [ ] **Step 7: DOM test, then commit**
+
+```bash
+git add src tests docs
+git commit -m "Ward Flow: the escalation board — records and shows, suggests nothing"
+```
+
+---
+
+## Task 6: The last free-text box becomes a fixed list (spec item 11)
+
+**Files:**
+
+- Modify: `ward-change-reasons.ts` (the contact list), `coordinator/shortlist-panel.tsx`
+- Test: `tests/ward-shortlist.dom.test.tsx` (or the existing shortlist DOM test file)
+
+**Interfaces:**
+
+- Produces:
+
+  ```ts
+  export const ESCALATION_CONTACTS = [
+    "State bed coordination desk",
+    "Duty psychiatrist",
+    "Bed management",
+    "Nurse unit manager (destination ward)",
+    "Escort or transport provider",
+    "Other service",
+  ] as const;
+  export type EscalationContact = (typeof ESCALATION_CONTACTS)[number];
+  ```
+
+- [ ] **Step 1: Write the failing DOM test**
+
+Assert that the escalation form renders a `<select>` (or radio group) whose options are exactly
+`ESCALATION_CONTACTS`, and that **no `<textarea>` and no free-text `<input>` exists anywhere in the
+escalation form**. Assert the dispatched `RECORD_ESCALATION` carries one of the listed values.
+
+- [ ] **Step 2: Run and watch it fail.**
+
+- [ ] **Step 3: Replace the `<textarea>`**
+
+`shortlist-panel.tsx` currently renders a `<textarea id="ward-shortlist-escalation-contact">` whose
+label reads "Role or service being contacted next — a role or service only, never a person's name
+(synthetic data only)". Replace it with a picker over `ESCALATION_CONTACTS`, keeping the label
+text's meaning and the existing test-id. Delete the `escalationContact` free-text state.
+
+**Why this matters more than its size:** the synthetic-data promise currently depends on a user
+reading a label and complying. After this it is true by construction.
+
+**Migration check:** the one authored escalation in `ward-movements.ts` uses "State bed
+coordination desk", which is on the list. Confirm by reading it back; if any other authored value
+exists, report it rather than silently mapping it.
+
+- [ ] **Step 4: Run and watch it pass. Then grep the whole ward tree for any remaining free-text
+      input and report the result:**
+
+Run: `grep -rn "<textarea" src/components/ward-management/`
+Expected: no matches. Quote the output either way.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src/components/ward-management tests
+git commit -m "Ward Flow: the escalation contact becomes a fixed list, so synthetic-only is true by construction"
+```
+
+---
+
+## Task 7: Patient search (spec item 5)
+
+**Files:**
+
+- Create: `src/components/ward-management/search/patient-search.tsx`, `search.module.css`
+- Create: `src/app/ward-management/search/page.tsx`
+- Modify: `ward-derivations.ts` (`searchMovements`), left rail, `tests/route-reachability.test.ts`
+- Test: `tests/ward-patient-search.test.ts`, `tests/ward-patient-search.dom.test.tsx`
+
+**Interfaces:**
+
+- Produces:
+
+  ```ts
+  export type MovementSearchQuery = {
+    text: string;
+    stage?: MovementStage;
+    edId?: string;
+  };
+  export function searchMovements(movements: Movement[], units: Unit[], query: MovementSearchQuery): Movement[];
+  ```
+
+- [ ] **Step 1: Write the failing test.** `searchMovements` matches on movement id, `originEdId`,
+      destination unit id and name, `stage`, and `owner`; is case-insensitive; returns everything
+      for an empty query; and **never returns a closed movement**.
+
+- [ ] **Step 2: Run and watch it fail.**
+
+- [ ] **Step 3: Implement it.** Pure, no wall-clock read.
+
+- [ ] **Step 4: Run and watch it pass.**
+
+- [ ] **Step 5: Build the page.** One search field plus a stage `<select>` and a department
+      `<select>`, each with a real `<label>`. Results table: identifier, stage, department,
+      destination, time since arrival, and a `<Link>` to
+      `/ward-management/patients/[patientId]`. **One search composer per page** — the page owns its
+      composer and must not also mount the shell's; read `docs/search-chrome-behaviour.md` before
+      placing it. Render "No matches" explicitly rather than an empty table. Root test-id
+      `ward-patient-search`.
+
+- [ ] **Step 6: Route, left rail, reachability assertion, `npm run docs:update`, DOM test, commit.**
+
+```bash
+git add src tests docs
+git commit -m "Ward Flow: patient search, on its own page"
+```
+
+---
+
+## Task 8: Capacity board extensions (spec item 6)
+
+**Files:**
+
+- Modify: `src/components/ward-management/ward-management-modes.tsx` (`CapacityView`),
+  `ward-management.module.css`
+- Test: `tests/ward-capacity-view.dom.test.tsx` (new, or the existing modes DOM test)
+
+- [ ] **Step 1: Write the failing DOM test.** For each unit row the capacity table renders the
+      unit's current sex mix (both counts), its `speciallingCapacity`, and its authorisation state.
+      Pick one unit with `authorised: false` and assert its row says so; pick one with
+      `authorised: true` and assert it does not carry the not-authorised wording.
+
+- [ ] **Step 2: Run and watch it fail.**
+
+- [ ] **Step 3: Add three columns to the existing table** — "Sex mix", "Specialling", "MHA
+      authorised". All three values already exist on `Unit` and already gate placement in
+      `ward-eligibility.ts`; they are simply invisible on the board whose job is capacity.
+
+      **The authorisation flag is a property the model already carries about a unit. Rendering it
+          is not a legal claim and must not be dressed as one** — no explanation of what authorisation
+          requires or means.
+
+- [ ] **Step 4: Run and watch it pass. Commit.**
+
+```bash
+git add src/components/ward-management tests
+git commit -m "Ward Flow: the capacity board shows the three things that actually decide placement"
+```
+
+---
+
+## Task 9: Governance extensions (spec item 7)
+
+**Files:**
+
+- Modify: `ward-management-modes.tsx` (`GovernanceView`), `ward-derivations.ts`
+- Test: `tests/ward-governance.test.ts`, `tests/ward-governance.dom.test.tsx`
+
+**Interfaces:**
+
+- Consumes: `Movement.urgencyChanges`, `Movement.statusChanges`, `Movement.unwinds` from Tasks 2
+  and 3; `Movement.declines`, `Movement.referredUnitIds`, `Movement.withdrawnReferrals`.
+- Produces:
+
+  ```ts
+  export type ChangeAuditEntry = {
+    at: Instant;
+    movementId: string;
+    kind: "urgency" | "legal_status" | "hold_released" | "transport_cancelled";
+    by: string;
+    detail: string;
+  };
+  export function changeAudit(movements: Movement[]): ChangeAuditEntry[]; // newest first
+  export function effectivenessNumbers(movements: Movement[]): {
+    medianMinutesToAcceptance: number | undefined;
+    averageUnitsContacted: number | undefined;
+  };
+  ```
+
+- [ ] **Step 1: Write the failing tests.** `changeAudit` returns one entry per recorded change
+      across all four kinds, newest first. `effectivenessNumbers` returns `undefined` for a measure
+      it cannot compute rather than `0` — **conservative failure, rule 4** — and computes the median
+      over movements that reached acceptance and the average units contacted over movements with at
+      least one referral.
+
+- [ ] **Step 2: Run and watch them fail.**
+
+- [ ] **Step 3: Implement both derivations.** Pure.
+
+- [ ] **Step 4: Run and watch them pass.**
+
+- [ ] **Step 5: Extend `GovernanceView`** with three additions:
+
+      1. The **not-a-medical-device** statement. `coordinator-screen.tsx` already carries the exact
+             wording — reuse it rather than writing a second version.
+          2. The **change audit**, newest first, with an explicit empty state.
+          3. The **two effectiveness numbers**, each rendering an explicit absence when `undefined`.
+
+          **The third success measure is dropped and the page says so.** The binding spec §11 lists
+          "legal deadlines passed while a patient waits" as one of three measures; it no longer exists
+          and cannot be computed. Record the drop on the page rather than silently omitting it.
+
+          **Neither number may be presented as evidence the prototype works.** They describe the
+          synthetic scenario and the page must say so.
+
+- [ ] **Step 6: DOM test, then commit.**
+
+```bash
+git add src/components/ward-management tests
+git commit -m "Ward Flow: governance carries the change audit and two honest effectiveness numbers"
+```
+
+---
+
+## Task 10: Patient page extensions (spec item 8)
+
+**Files:**
+
+- Modify: `src/components/ward-management/ward-management-console.tsx` (`WardPatientWorkspace`)
+- Test: `tests/ward-patient-page.dom.test.tsx`
+
+- [ ] **Step 1: Write the failing DOM test.** For a patient with declines, the page lists each
+      decline's unit, fixed reason and time. For a patient with status or urgency changes, it lists
+      each. For a patient with an escalation, it shows when, units tried, and contact. For a patient
+      with none of these, each section renders its own explicit absence line — **not** a hidden
+      section.
+
+- [ ] **Step 2: Run and watch it fail.**
+
+- [ ] **Step 3: Add the three sections.** Test-ids `ward-patient-declines`,
+      `ward-patient-changes`, `ward-patient-escalation`. Reuse `changeReasonLabels` for reason
+      display; never render a raw snake-case reason code to a user.
+
+- [ ] **Step 4: Run and watch it pass. Commit.**
+
+```bash
+git add src/components/ward-management tests
+git commit -m "Ward Flow: the patient page carries declines, changes and the escalation record"
+```
+
+---
+
+## Task 11: Bed release flagging (spec item 9)
+
+**Files:**
+
+- Modify: `ward-model.ts` (`BedRelease`), `ward-flow-events.ts`, `ward-flow-reducer.ts`,
+  `ward-derivations.ts` (`unitCapacity`), `ward/ward-screen.tsx`
+- Test: `tests/ward-flow-reducer.test.ts`, `tests/ward-bed-release.dom.test.tsx`
+
+**Interfaces:**
+
+- Consumes: the existing `BedRelease` type and the `bedReleases` fixture, which
+  `unitCapacity` already reads for its `potential` figure; the widened `EVENT_ROLE`.
+- Produces: event
+  `{ type: "FLAG_BED_RELEASE"; role; now; unitId; actingUnitId; confidence: "confirmed" | "likely" | "possible"; blocker: BedReleaseBlocker }`,
+  `EVENT_ROLE.FLAG_BED_RELEASE = ["ward"]`, and `WardFlowState.bedReleases: BedRelease[]`.
+
+**Why this exists.** Bed releases are static fixture data feeding the _potential_ capacity figure;
+**no ward can flag one**. This was named as part of Phase 3 and did not get built.
+
+- [ ] **Step 1: Move `bedReleases` into reducer state.** `seedWardFlowState` seeds
+      `structuredClone(bedReleases)`; `unitCapacity` takes the releases as a parameter rather than
+      importing the module constant, so a flagged release actually moves the number. Update every
+      existing `unitCapacity` call site and report how many there were.
+
+- [ ] **Step 2: Write the failing tests.** `FLAG_BED_RELEASE` appends a release for the acting
+      unit and increases that unit's `potential` by one; a ward acting as a different unit is
+      refused, naming both ids; a `coordinator` caller is refused.
+
+- [ ] **Step 3: Run and watch them fail.**
+
+- [ ] **Step 4: Implement it.** The blocker is a **fixed list**, not free text — add
+      `BED_RELEASE_BLOCKERS` to `ward-change-reasons.ts` drawn from the blocker wording the fixture
+      already uses (for example "awaiting clean", "awaiting pharmacy", "awaiting transport"). Do
+      not invent a blocker that describes a person.
+
+      **A bed release carries nothing whatsoever about the departing patient** — no identifier, no
+          timing that could identify them, no reason relating to them. That is a privacy rule from the
+          binding spec §4 and it is not negotiable. Add a test that asserts the `BedRelease` type has
+          no field capable of carrying a patient reference, and say plainly in your report how you
+          proved it.
+
+- [ ] **Step 5: Run and watch them pass.**
+
+- [ ] **Step 6: Add the ward-screen control.** "Flag a bed coming free", with confidence and
+      blocker pickers, passing the route `unitId` as `actingUnitId`. Test-id
+      `ward-flag-bed-release`.
+
+- [ ] **Step 7: Run the full ward suites and commit.**
+
+```bash
+git add src/components/ward-management tests
+git commit -m "Ward Flow: a ward can flag a bed coming free"
+```
+
+---
+
+## Not built: the statutory clock board (spec item 12)
+
+**Deliberately absent from this plan.** It was a board of legal countdowns; every legal deadline
+was removed from the model on the product owner's instruction, so it has nothing to show and any
+rebuild would either be empty or would re-invent the statutory figures this project has fabricated
+four times. It waits for the owner's real figures. **No agent may supply them.** If a task in this
+plan appears to need a legal deadline, that is a defect in the task, not a licence.
+
+## Final verification (controller, after Task 11)
+
+- `npx tsc --noEmit -p tsconfig.json` — quote the output.
+- Full unit suite — quote the file and test counts. Baseline before this plan: **821 files passed,
+  9865 passed, 74 skipped, 0 failed.**
+- Ward Chromium journeys against a warmed dev server on this worktree's printed port (`npm run
+ensure` first) — quote the "N passed" line.
+- Dark, forced-colours and print coverage for the three new pages, following the established
+  `emulateMedia` pattern in `tests/ui-ward-management.spec.ts`.
+- `npm run docs:update`, then `npx prettier --check` on every changed file.
+- **Do not run** `verify:release`, `eval:*`, `check:supabase-project`, or anything touching
+  OpenAI, Supabase, GitHub Actions or the live database.

From c658b307366991845bd75bc7c9f4d085e7261e76 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 05:10:58 +0800
Subject: [PATCH 03/54] Ward Flow: a scarce-beds scenario, so the escalation
 surfaces have something to show

---
 .../ward-demo-controls.module.css             | 34 +++++++++++++
 .../ward-management/ward-demo-controls.tsx    | 22 ++++++++-
 .../ward-management/ward-flow-events.ts       |  5 +-
 .../ward-management/ward-flow-provider.tsx    |  8 +++-
 .../ward-management/ward-flow-reducer.ts      | 21 ++++++--
 .../ward-management/ward-scenarios.ts         | 29 +++++++++++
 tests/ward-flow-reducer.test.ts               | 38 +++++++++++++++
 tests/ward-flow-single-source.test.ts         | 13 +++--
 tests/ward-legal-figure-guard.test.ts         | 28 +++++++++--
 tests/ward-scenarios.test.ts                  | 48 +++++++++++++++++++
 10 files changed, 230 insertions(+), 16 deletions(-)
 create mode 100644 src/components/ward-management/ward-scenarios.ts
 create mode 100644 tests/ward-scenarios.test.ts

diff --git a/src/components/ward-management/ward-demo-controls.module.css b/src/components/ward-management/ward-demo-controls.module.css
index 90af9f0f7e..db2c604f65 100644
--- a/src/components/ward-management/ward-demo-controls.module.css
+++ b/src/components/ward-management/ward-demo-controls.module.css
@@ -129,6 +129,40 @@
   background: var(--dc-subtle);
 }
 
+.scenarioRow {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--dc-space-6);
+  border-top: 0.0625rem solid var(--dc-border);
+  padding-top: var(--dc-space-8);
+}
+
+.scenarioButton {
+  display: flex;
+  min-height: var(--dc-tap);
+  flex: 1 1 6rem;
+  align-items: center;
+  justify-content: center;
+  border: 0.0625rem solid var(--dc-border);
+  border-radius: var(--radius-md);
+  background: var(--dc-canvas);
+  padding: var(--dc-space-6) var(--dc-space-8);
+  color: var(--dc-heading);
+  font-size: var(--text-sm-minus);
+  font-weight: 700;
+  cursor: pointer;
+}
+
+.scenarioButton:hover {
+  background: var(--dc-subtle);
+}
+
+.scenarioButton[aria-pressed="true"] {
+  border-color: var(--dc-warn-border);
+  background: var(--dc-warn-soft);
+  color: var(--dc-warn);
+}
+
 .resetRow {
   border-top: 0.0625rem solid var(--dc-border);
   padding-top: var(--dc-space-8);
diff --git a/src/components/ward-management/ward-demo-controls.tsx b/src/components/ward-management/ward-demo-controls.tsx
index 3eb0fff2d0..5ad6440701 100644
--- a/src/components/ward-management/ward-demo-controls.tsx
+++ b/src/components/ward-management/ward-demo-controls.tsx
@@ -5,6 +5,7 @@ import { useEffect, useRef, useState } from "react";
 
 import { formatInstant } from "@/components/ward-management/ward-clock";
 import { useWardFlow } from "@/components/ward-management/ward-flow-provider";
+import { WARD_SCENARIOS, scenarioLabels } from "@/components/ward-management/ward-scenarios";
 
 import styles from "./ward-demo-controls.module.css";
 
@@ -37,7 +38,7 @@ import styles from "./ward-demo-controls.module.css";
  * `*BlockedReason` guard: raised with `role: "demo"`, the reducer can never refuse either.
  */
 export function WardDemoControls() {
-  const { now, dispatch } = useWardFlow();
+  const { now, scenario, dispatch } = useWardFlow();
   const [open, setOpen] = useState(false);
   const containerRef = useRef<HTMLDivElement>(null);
   const triggerRef = useRef<HTMLButtonElement>(null);
@@ -70,6 +71,10 @@ export function WardDemoControls() {
     setOpen(false);
   }
 
+  function selectScenario(next: (typeof WARD_SCENARIOS)[number]) {
+    dispatch({ type: "SET_SCENARIO", role: "demo", now, scenario: next });
+  }
+
   return (
     <div className={styles.demo} ref={containerRef}>
       <button
@@ -114,6 +119,21 @@ export function WardDemoControls() {
               +1 hour
             </button>
           </div>
+          <div className={styles.scenarioRow} role="group" aria-label="Demo scenario">
+            {WARD_SCENARIOS.map((candidate) => (
+              <button
+                type="button"
+                role="menuitem"
+                key={candidate}
+                data-testid={`ward-demo-scenario-${candidate}`}
+                className={styles.scenarioButton}
+                aria-pressed={scenario === candidate}
+                onClick={() => selectScenario(candidate)}
+              >
+                {scenarioLabels[candidate]}
+              </button>
+            ))}
+          </div>
           <div className={styles.resetRow}>
             <button
               type="button"
diff --git a/src/components/ward-management/ward-flow-events.ts b/src/components/ward-management/ward-flow-events.ts
index 0d0de6803d..b71aa9ecd2 100644
--- a/src/components/ward-management/ward-flow-events.ts
+++ b/src/components/ward-management/ward-flow-events.ts
@@ -1,5 +1,6 @@
 import type { Instant } from "@/components/ward-management/ward-clock";
 import type { Cohort, DeclineReason, LegalStatus, Security, Sex } from "@/components/ward-management/ward-model";
+import type { WardScenario } from "@/components/ward-management/ward-scenarios";
 
 /**
  * Who may raise an event. `demo` is the jump-forward / reset control on the coordinator screen —
@@ -85,7 +86,8 @@ export type WardFlowEvent =
       contact: string;
     }
   | { type: "ADVANCE_CLOCK"; role: WardFlowRole; now: Instant; minutes: number }
-  | { type: "RESET_SCENARIO"; role: WardFlowRole; now: Instant };
+  | { type: "RESET_SCENARIO"; role: WardFlowRole; now: Instant }
+  | { type: "SET_SCENARIO"; role: WardFlowRole; now: Instant; scenario: WardScenario };
 
 /**
  * One table, read by the reducer's role check, rather than a `switch` repeated at every call
@@ -107,4 +109,5 @@ export const EVENT_ROLE: Record<WardFlowEvent["type"], WardFlowRole> = {
   RECORD_ESCALATION: "coordinator",
   ADVANCE_CLOCK: "demo",
   RESET_SCENARIO: "demo",
+  SET_SCENARIO: "demo",
 };
diff --git a/src/components/ward-management/ward-flow-provider.tsx b/src/components/ward-management/ward-flow-provider.tsx
index c55698db34..c3bb3adc54 100644
--- a/src/components/ward-management/ward-flow-provider.tsx
+++ b/src/components/ward-management/ward-flow-provider.tsx
@@ -18,6 +18,7 @@ import type { WardFlowEvent } from "@/components/ward-management/ward-flow-event
 import { seedWardFlowState, wardFlowReducer } from "@/components/ward-management/ward-flow-reducer";
 import type { Movement, Rejection, Unit } from "@/components/ward-management/ward-model";
 import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
+import type { WardScenario } from "@/components/ward-management/ward-scenarios";
 
 /**
  * The screens never see the raw reducer state or the clock's internal offsets — they see the
@@ -40,6 +41,10 @@ type WardFlowContextValue = {
   units: Unit[];
   rejections: Rejection[];
   now: Instant;
+  /** Which synthetic night is seeded — `ward-scenarios.ts`'s `WardScenario` — so a UI surface
+   *  (`ward-demo-controls.tsx`'s scenario switch) can mark the active one without guessing it
+   *  from `units` itself. */
+  scenario: WardScenario;
   dispatch: Dispatch<WardFlowEvent>;
   focusMovementId: string | undefined;
   setFocusMovementId: Dispatch<SetStateAction<string | undefined>>;
@@ -108,11 +113,12 @@ export function WardFlowProvider({ children, initialNow }: WardFlowProviderProps
       units: state.units,
       rejections: state.rejections,
       now,
+      scenario: state.scenario,
       dispatch,
       focusMovementId,
       setFocusMovementId,
     }),
-    [state.movements, state.units, state.rejections, now, dispatch, focusMovementId],
+    [state.movements, state.units, state.rejections, now, state.scenario, dispatch, focusMovementId],
   );
 
   return <WardFlowContext.Provider value={value}>{children}</WardFlowContext.Provider>;
diff --git a/src/components/ward-management/ward-flow-reducer.ts b/src/components/ward-management/ward-flow-reducer.ts
index 7a64347e57..4536a62b3c 100644
--- a/src/components/ward-management/ward-flow-reducer.ts
+++ b/src/components/ward-management/ward-flow-reducer.ts
@@ -3,7 +3,8 @@ import { SELECTABLE_LEGAL_FORMS } from "@/components/ward-management/ward-legal-
 import { PARALLEL_REFERRAL_CAP } from "@/components/ward-management/ward-model";
 import type { Movement, MovementStage, Rejection, Unit } from "@/components/ward-management/ward-model";
 import { wardMovements } from "@/components/ward-management/ward-movements";
-import { allEmergencyDepartments, allUnits } from "@/components/ward-management/ward-sites";
+import { allEmergencyDepartments } from "@/components/ward-management/ward-sites";
+import { scenarioUnits, type WardScenario } from "@/components/ward-management/ward-scenarios";
 
 /**
  * Stages `REFER_TO_UNITS` accepts, exported so a UI surface can pre-check referability and gate
@@ -31,16 +32,24 @@ export type WardFlowState = {
   clockOffsetMinutes: number;
   /** Deterministic id source for referrals raised through RAISE_REFERRAL. No Math.random(). */
   referralSequence: number;
+  /** Which synthetic night is seeded — `ward-scenarios.ts`'s operational-numbers-only variants. */
+  scenario: WardScenario;
 };
 
-/** Deep-copies the frozen fixture so tests (and later, screens) never alias or mutate it. */
-export function seedWardFlowState(): WardFlowState {
+/**
+ * Deep-copies the frozen fixture so tests (and later, screens) never alias or mutate it.
+ * Defaults to the standard night so `RESET_SCENARIO` (which calls this with no argument) always
+ * returns to the standard night rather than staying on whichever scenario was active — an
+ * explicit product-owner decision, not an oversight.
+ */
+export function seedWardFlowState(scenario: WardScenario = "standard"): WardFlowState {
   return {
     movements: structuredClone(wardMovements),
-    units: structuredClone(allUnits()),
+    units: scenarioUnits(scenario),
     rejections: [],
     clockOffsetMinutes: 0,
     referralSequence: 0,
+    scenario,
   };
 }
 
@@ -53,6 +62,7 @@ function subjectId(event: WardFlowEvent): string {
       return event.unitId;
     case "ADVANCE_CLOCK":
     case "RESET_SCENARIO":
+    case "SET_SCENARIO":
       return "none";
     default:
       return event.movementId;
@@ -116,6 +126,9 @@ export function wardFlowReducer(state: WardFlowState, event: WardFlowEvent): War
     case "RESET_SCENARIO":
       return seedWardFlowState();
 
+    case "SET_SCENARIO":
+      return seedWardFlowState(event.scenario);
+
     case "ADVANCE_CLOCK":
       return { ...state, clockOffsetMinutes: state.clockOffsetMinutes + event.minutes };
 
diff --git a/src/components/ward-management/ward-scenarios.ts b/src/components/ward-management/ward-scenarios.ts
new file mode 100644
index 0000000000..8a7e3f0700
--- /dev/null
+++ b/src/components/ward-management/ward-scenarios.ts
@@ -0,0 +1,29 @@
+import type { Unit } from "@/components/ward-management/ward-model";
+import { allUnits } from "@/components/ward-management/ward-sites";
+
+export type WardScenario = "standard" | "scarce";
+export const WARD_SCENARIOS: readonly WardScenario[] = ["standard", "scarce"] as const;
+
+export const scenarioLabels: Record<WardScenario, string> = {
+  standard: "Standard night",
+  scarce: "Scarce beds",
+};
+
+/**
+ * The scarce night differs from the standard night in OPERATIONAL NUMBERS ONLY. It carries the
+ * same units, the same patients and the same identities; what changes is how many beds a ward
+ * can actually allocate and how much one-to-one observation it can staff. Nothing here is a
+ * clinical, legal or patient-level difference, and nothing here may become one.
+ */
+export function scenarioUnits(scenario: WardScenario): Unit[] {
+  const units = structuredClone(allUnits());
+  if (scenario === "standard") return units;
+  return units.map((unit, index) => ({
+    ...unit,
+    // Every third unit keeps a single allocatable bed; the rest have none. A single bed still
+    // fails the sex_mix gate unless the ward already holds same-sex occupants, which is exactly
+    // the squeeze a real scarce night produces.
+    allocatable: { ...unit.allocatable, value: index % 3 === 0 ? 1 : 0 },
+    speciallingCapacity: 0,
+  }));
+}
diff --git a/tests/ward-flow-reducer.test.ts b/tests/ward-flow-reducer.test.ts
index 4c10a2a068..024d564152 100644
--- a/tests/ward-flow-reducer.test.ts
+++ b/tests/ward-flow-reducer.test.ts
@@ -724,6 +724,44 @@ describe("demo controls", () => {
   });
 });
 
+describe("scenario selection", () => {
+  it("replaces the units with the scarce night's, leaving movement ids unchanged", () => {
+    const state = seeded();
+    expect(state.scenario).toBe("standard");
+    const standardMovementIds = state.movements.map((candidate) => candidate.id);
+
+    const next = wardFlowReducer(state, { type: "SET_SCENARIO", role: "demo", now: NOW, scenario: "scarce" });
+
+    expect(next.scenario).toBe("scarce");
+    expect(next.movements.map((candidate) => candidate.id)).toEqual(standardMovementIds);
+    // The scarce night's units are strictly tighter, not merely different — every unit's
+    // allocatable count moves to 0 or 1 and specialling capacity moves to 0 (`ward-scenarios.ts`).
+    expect(next.units.every((unit) => unit.allocatable.value <= 1 && unit.speciallingCapacity === 0)).toBe(true);
+    expect(next.units).not.toEqual(state.units);
+  });
+
+  it("refuses SET_SCENARIO raised by a role other than demo", () => {
+    const next = wardFlowReducer(seeded(), {
+      type: "SET_SCENARIO",
+      role: "ward",
+      now: NOW,
+      scenario: "scarce",
+    } as never);
+    expect(next.rejections).toHaveLength(1);
+    expect(next.rejections[0].reason).toMatch(/role/i);
+    expect(next.scenario).toBe("standard");
+  });
+
+  it("returns to the standard night on RESET_SCENARIO after SET_SCENARIO — reset is never scenario-sticky", () => {
+    let state = seeded();
+    state = wardFlowReducer(state, { type: "SET_SCENARIO", role: "demo", now: NOW, scenario: "scarce" });
+    expect(state.scenario).toBe("scarce");
+
+    const reset = wardFlowReducer(state, { type: "RESET_SCENARIO", role: "demo", now: NOW });
+    expect(reset.scenario).toBe("standard");
+  });
+});
+
 describe("arrival capacity floor", () => {
   it("refuses an arrival once the unit's physically empty beds are exhausted", () => {
     // A ward can CONFIRM_CAPACITY an allocatable count above what is physically empty — nothing
diff --git a/tests/ward-flow-single-source.test.ts b/tests/ward-flow-single-source.test.ts
index 3497cbb1a0..ad21b1b108 100644
--- a/tests/ward-flow-single-source.test.ts
+++ b/tests/ward-flow-single-source.test.ts
@@ -69,10 +69,13 @@ const NOW_ANCHOR_ALLOWLIST = new Set([
  *   - `ward-movements.ts` (the movement fixture) calls `allUnits()` to build its own synthetic
  *     unit-name lookups at module load — a fixture-to-fixture read at data-authoring time, never
  *     a live surface a user's screen renders from.
- *   - `ward-flow-reducer.ts`'s `seedWardFlowState` calls `structuredClone(allUnits())` exactly
- *     once — the single legitimate place the reducer's live `state.units` is ever initialised
- *     FROM the frozen fixture. Every later read of unit state anywhere in the app must come from
- *     that live `state.units` (via the provider's `units`), never from `ward-sites.ts` again.
+ *   - `ward-scenarios.ts`'s `scenarioUnits` calls `structuredClone(allUnits())` exactly once —
+ *     the single legitimate place ANY live state is ever initialised FROM the frozen fixture, for
+ *     either scenario. Ward Flow Phase 4 Task 1 moved this read here from `ward-flow-reducer.ts`:
+ *     `seedWardFlowState` no longer touches `allUnits()` itself, it calls `scenarioUnits(scenario)`,
+ *     so `ward-flow-reducer.ts` has left this list and `ward-scenarios.ts` has taken its place.
+ *     Every later read of unit state anywhere in the app must come from that live `state.units`
+ *     (via the provider's `units`), never from `ward-sites.ts` again.
  * `ward-derivations.ts` is no longer on this list (final-fix-wave R70): its own explicitly
  * deprecated `eligibleCandidates(movement, now, limit)` wrapper — kept only because
  * `tests/ward-flow-contracts.test.ts` called it with the pre-fix three-argument shape while a
@@ -88,7 +91,7 @@ const NOW_ANCHOR_ALLOWLIST = new Set([
 const UNITS_FIXTURE_ALLOWLIST = new Set([
   "src/components/ward-management/ward-sites.ts",
   "src/components/ward-management/ward-movements.ts",
-  "src/components/ward-management/ward-flow-reducer.ts",
+  "src/components/ward-management/ward-scenarios.ts",
 ]);
 
 /**
diff --git a/tests/ward-legal-figure-guard.test.ts b/tests/ward-legal-figure-guard.test.ts
index ff6a0c0894..d6ac32f1fd 100644
--- a/tests/ward-legal-figure-guard.test.ts
+++ b/tests/ward-legal-figure-guard.test.ts
@@ -12,6 +12,7 @@ import {
 import { SELECTABLE_LEGAL_FORMS } from "../src/components/ward-management/ward-legal-forms";
 import { DECLINE_REASONS, type LegalForm, type LegalStatus } from "../src/components/ward-management/ward-model";
 import { wardMovements } from "../src/components/ward-management/ward-movements";
+import { WARD_SCENARIOS } from "../src/components/ward-management/ward-scenarios";
 import { allEmergencyDepartments, NOW_ANCHOR } from "../src/components/ward-management/ward-sites";
 
 /**
@@ -447,6 +448,10 @@ function candidateEvents(type: WardFlowEvent["type"], state: WardFlowState, now:
       return [{ type, role, now, minutes: 30 }];
     case "RESET_SCENARIO":
       return [{ type, role, now }];
+    case "SET_SCENARIO":
+      // Both scenarios, like RAISE_REFERRAL's real domain values above — not one hard-coded
+      // choice that would leave the other half of `WARD_SCENARIOS` untested.
+      return WARD_SCENARIOS.map((scenario) => ({ type, role, now, scenario }));
   }
 }
 
@@ -568,9 +573,10 @@ function driveEveryEventAgainst(
     const pivot = round % ALL_EVENT_TYPES.length;
     const order = [...ALL_EVENT_TYPES.slice(pivot), ...ALL_EVENT_TYPES.slice(0, pivot)];
     for (const type of order) {
-      // RESET_SCENARIO would discard the movement the sweep is building; it is exercised on its
-      // own below, where the invariant is checked against the reset state directly.
-      if (type === "RESET_SCENARIO") continue;
+      // RESET_SCENARIO and SET_SCENARIO would both discard the movement the sweep is building —
+      // seedWardFlowState() replaces `state.movements` wholesale either way. Both are exercised on
+      // their own below, where the invariant is checked against the resulting state directly.
+      if (type === "RESET_SCENARIO" || type === "SET_SCENARIO") continue;
       const result = applyFirstAccepted(type, state, now, code);
       if (!result) continue;
       accepted.add(type);
@@ -764,7 +770,7 @@ describe("Mental Health Act figures cannot return to the ward model", () => {
     // code-targetable, but must still be exercised and must still leave the invariant intact.
     for (const [code, accepted] of coverage) {
       const unscoped = ALL_EVENT_TYPES.filter(
-        (type) => !MOVEMENT_TARGETED_EVENTS.has(type) && type !== "RESET_SCENARIO",
+        (type) => !MOVEMENT_TARGETED_EVENTS.has(type) && type !== "RESET_SCENARIO" && type !== "SET_SCENARIO",
       );
       expect(
         unscoped.filter((type) => !accepted.has(type)),
@@ -778,6 +784,20 @@ describe("Mental Health Act figures cannot return to the ward model", () => {
     expect(reset, "RESET_SCENARIO was never accepted").toBeDefined();
     offenders.push(...offendingFormsIn(reset!.applied, "RESET_SCENARIO"));
 
+    // SET_SCENARIO on its own, same reason as RESET_SCENARIO above — and against BOTH scenarios,
+    // since `candidateEvents` offers one candidate per entry in `WARD_SCENARIOS` and this loop must
+    // not silently exercise only the first one it is handed.
+    for (const scenario of WARD_SCENARIOS) {
+      const setScenario = wardFlowReducer(seedWardFlowState(), {
+        type: "SET_SCENARIO",
+        role: EVENT_ROLE.SET_SCENARIO,
+        now: NOW_ANCHOR,
+        scenario,
+      });
+      expect(setScenario.rejections, `SET_SCENARIO to ${scenario} was refused`).toEqual([]);
+      offenders.push(...offendingFormsIn(setScenario, `SET_SCENARIO(${scenario})`));
+    }
+
     expect(offenders).toEqual([]);
   });
 
diff --git a/tests/ward-scenarios.test.ts b/tests/ward-scenarios.test.ts
new file mode 100644
index 0000000000..0a1fd57528
--- /dev/null
+++ b/tests/ward-scenarios.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+
+import { eligibility } from "@/components/ward-management/ward-eligibility";
+import { isOpen } from "@/components/ward-management/ward-derivations";
+import { wardMovements } from "@/components/ward-management/ward-movements";
+import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
+import { scenarioUnits } from "@/components/ward-management/ward-scenarios";
+
+function eligibleCounts(scenario: "standard" | "scarce") {
+  const units = scenarioUnits(scenario);
+  return wardMovements
+    .filter(isOpen)
+    .map((movement) => units.filter((unit) => eligibility(movement, unit, NOW_ANCHOR).eligible).length);
+}
+
+describe("ward scenarios", () => {
+  it("the standard night leaves every open movement several eligible wards", () => {
+    const counts = eligibleCounts("standard");
+    expect(counts.length).toBeGreaterThan(30);
+    expect(Math.min(...counts)).toBeGreaterThanOrEqual(5);
+  });
+
+  it("the scarce night exhausts the network for at least one open movement", () => {
+    const counts = eligibleCounts("scarce");
+    expect(counts.length).toBeGreaterThan(30);
+    expect(Math.min(...counts)).toBe(0);
+    expect(counts.filter((count) => count === 0).length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("the scarce night is strictly tighter than the standard night, movement for movement", () => {
+    const standard = eligibleCounts("standard");
+    const scarce = eligibleCounts("scarce");
+    expect(scarce.every((count, index) => count <= standard[index])).toBe(true);
+    const scarceTotal = scarce.reduce((sum, count) => sum + count, 0);
+    const standardTotal = standard.reduce((sum, count) => sum + count, 0);
+    expect(scarceTotal).toBeLessThan(standardTotal / 2);
+  });
+
+  it("changes operational numbers only — never a patient attribute", () => {
+    const standard = scenarioUnits("standard");
+    const scarce = scenarioUnits("scarce");
+    expect(scarce.map((unit) => unit.id)).toEqual(standard.map((unit) => unit.id));
+    expect(scarce.map((unit) => unit.cohort)).toEqual(standard.map((unit) => unit.cohort));
+    expect(scarce.map((unit) => unit.security)).toEqual(standard.map((unit) => unit.security));
+    expect(scarce.map((unit) => unit.authorised)).toEqual(standard.map((unit) => unit.authorised));
+    expect(scarce.map((unit) => unit.name)).toEqual(standard.map((unit) => unit.name));
+  });
+});

From aea62a141ea33de4e0aa5d0d9e24e37c0f0d1983 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 05:17:41 +0800
Subject: [PATCH 04/54] Correct the standard-night assertion: it was built on
 my own mis-measurement

The Task 1 test asserted every open movement has at least five eligible wards. That
is false, and the way it is false matters. The number came from counting the LENGTH of
eligibleCandidatesAmong(), which sorts eligible-first and truncates to its limit - it
never filters to eligible. That length is the count of same-cohort units, not eligible
ones. Read as eligibility it produced a confident wrong answer that reached a design
document and a product-owner conversation before anything ran it.

Measured directly at NOW_ANCHOR across all 22 units: 41 open movements, 337 eligible
movement/unit pairs, distribution {0:2, 4:11, 5:6, 6:3, 11:1, 12:9, 14:9}. Two
movements, WF-009 and WF-308, already have nowhere eligible on the standard night.

The implementer left the assertion red rather than weakening it to fit, which is the
correct call and the reason this was caught at all. The replacement pins both ends: a
floor of 300 eligible pairs so the standard night stays a night with real choice on it,
and exactly two stranded movements so a regression stranding more fails here instead of
passing quietly. Both mutation-tested.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 tests/ward-scenarios.test.ts | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/tests/ward-scenarios.test.ts b/tests/ward-scenarios.test.ts
index 0a1fd57528..ce22acce31 100644
--- a/tests/ward-scenarios.test.ts
+++ b/tests/ward-scenarios.test.ts
@@ -14,10 +14,30 @@ function eligibleCounts(scenario: "standard" | "scarce") {
 }
 
 describe("ward scenarios", () => {
-  it("the standard night leaves every open movement several eligible wards", () => {
+  /**
+   * The assertion this test originally carried — "every open movement has at least five eligible
+   * wards" — was false, and the way it was false is worth recording. It came from counting the
+   * LENGTH of `eligibleCandidatesAmong(...)`, which sorts eligible-first and truncates to its
+   * `limit`; it does not filter to eligible. That length is therefore the number of same-cohort
+   * units, never the number of eligible ones, and reading it as eligibility produced a confident
+   * wrong answer that survived into a design document.
+   *
+   * Measured directly on 2026-08-25 at NOW_ANCHOR, counting `eligibility(...).eligible` across all
+   * 22 units: 41 open movements, 337 eligible movement/unit pairs, distribution
+   * {0:2, 4:11, 5:6, 6:3, 11:1, 12:9, 14:9} — and **two movements, WF-009 and WF-308, already have
+   * nowhere eligible on the standard night.** Both are the fixture as authored, not something the
+   * scarce scenario introduced.
+   */
+  it("the standard night leaves most open movements real choice, but already strands two", () => {
     const counts = eligibleCounts("standard");
     expect(counts.length).toBeGreaterThan(30);
-    expect(Math.min(...counts)).toBeGreaterThanOrEqual(5);
+    // Non-vacuity floor: the standard night must stay a night with genuine choice on it, so this
+    // goes red if the fixture or the gates ever degrade it toward the scarce night.
+    expect(counts.reduce((sum, count) => sum + count, 0)).toBeGreaterThan(300);
+    // ...but it is NOT a night on which everyone has somewhere to go, and the escalation board
+    // exists partly because of these two. Pinned exactly, so a regression that strands more
+    // patients fails here rather than passing quietly.
+    expect(counts.filter((count) => count === 0)).toHaveLength(2);
   });
 
   it("the scarce night exhausts the network for at least one open movement", () => {

From 3199f91e4add12001c331ef8241e54b8abe39c96 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 05:55:14 +0800
Subject: [PATCH 05/54] Ward Flow: urgency and legal status can change
 mid-flight, each change recorded

---
 .../coordinator/coordinator-screen.tsx        |   2 +-
 .../coordinator/coordinator.module.css        |  10 +
 .../coordinator/shortlist-panel.tsx           | 202 +++++++++++++++++-
 .../ward-management/ed/ed-screen.tsx          | 186 ++++++++++++++++
 .../ward-management/ward-change-reasons.ts    |  23 ++
 .../ward-management/ward-derivations.ts       |  42 +++-
 .../ward-management/ward-flow-events.ts       |  60 ++++--
 .../ward-management/ward-flow-reducer.ts      |  55 ++++-
 .../ward-management/ward-management-modes.tsx |   4 +-
 src/components/ward-management/ward-model.ts  |  16 ++
 .../ward-management/ward-movements.ts         |  27 ++-
 tests/ui-ward-coordinator.spec.ts             |   2 +-
 tests/ward-change-reasons.test.ts             |  81 +++++++
 tests/ward-derivations.test.ts                |  62 +++++-
 tests/ward-eligibility.test.ts                |   1 +
 tests/ward-flow-reducer.test.ts               | 116 ++++++++++
 tests/ward-legal-figure-guard.test.ts         |  48 ++++-
 17 files changed, 895 insertions(+), 42 deletions(-)
 create mode 100644 src/components/ward-management/ward-change-reasons.ts
 create mode 100644 tests/ward-change-reasons.test.ts

diff --git a/src/components/ward-management/coordinator/coordinator-screen.tsx b/src/components/ward-management/coordinator/coordinator-screen.tsx
index 39b874de0c..f51ae7ccc6 100644
--- a/src/components/ward-management/coordinator/coordinator-screen.tsx
+++ b/src/components/ward-management/coordinator/coordinator-screen.tsx
@@ -142,7 +142,7 @@ export function CoordinatorScreen() {
   // on a live work list. Latent on today's fixture — no closed movement currently qualifies for
   // any of the three categories — but it is precisely the shape of Phase 1's "48 open movements"
   // defect, which was also a closed record counted as live.
-  const actionInbox = useMemo(() => buildActionInbox(movements.filter(isOpen), now), [movements, now]);
+  const actionInbox = useMemo(() => buildActionInbox(movements.filter(isOpen), now, units), [movements, now, units]);
 
   return (
     <div className={styles.screen} data-testid="ward-coordinator">
diff --git a/src/components/ward-management/coordinator/coordinator.module.css b/src/components/ward-management/coordinator/coordinator.module.css
index 8f71663597..edac75781d 100644
--- a/src/components/ward-management/coordinator/coordinator.module.css
+++ b/src/components/ward-management/coordinator/coordinator.module.css
@@ -1541,6 +1541,16 @@
   line-height: var(--co-leading-body);
 }
 
+.shortlistOverrideSelect {
+  min-height: var(--co-space-48);
+  border: 0.0625rem solid var(--border);
+  border-radius: var(--radius-md);
+  background: var(--surface);
+  padding: 0 var(--co-space-8);
+  color: var(--text);
+  font-size: var(--text-2xs);
+}
+
 .shortlistOverrideSubmit {
   display: inline-flex;
   min-height: var(--co-space-48);
diff --git a/src/components/ward-management/coordinator/shortlist-panel.tsx b/src/components/ward-management/coordinator/shortlist-panel.tsx
index 17257b9b1b..29affc2b4d 100644
--- a/src/components/ward-management/coordinator/shortlist-panel.tsx
+++ b/src/components/ward-management/coordinator/shortlist-panel.tsx
@@ -3,6 +3,13 @@
 import { CheckCircle2, CircleAlert } from "lucide-react";
 import { useMemo, useState, type Dispatch, type FormEvent } from "react";
 
+import {
+  changeReasonLabels,
+  LEGAL_STATUS_CHANGE_REASONS,
+  URGENCY_CHANGE_REASONS,
+  type LegalStatusChangeReason,
+  type UrgencyChangeReason,
+} from "@/components/ward-management/ward-change-reasons";
 import { clockState, formatInstant, minutesUntil, type Instant } from "@/components/ward-management/ward-clock";
 import {
   candidateReason,
@@ -16,7 +23,12 @@ import {
 import { eligibility, type GateResult } from "@/components/ward-management/ward-eligibility";
 import type { WardFlowEvent } from "@/components/ward-management/ward-flow-events";
 import { legalFormName } from "@/components/ward-management/ward-legal-forms";
-import { PARALLEL_REFERRAL_CAP, type Movement, type Unit } from "@/components/ward-management/ward-model";
+import {
+  PARALLEL_REFERRAL_CAP,
+  type LegalStatus,
+  type Movement,
+  type Unit,
+} from "@/components/ward-management/ward-model";
 import { operationalScore } from "@/components/ward-management/ward-priority";
 import { allEmergencyDepartments } from "@/components/ward-management/ward-sites";
 import { ignoreUnavailableActivation } from "@/components/ui-primitives";
@@ -62,6 +74,17 @@ const GATE_LABELS: Record<string, string> = {
   allocatable_bed: "Allocatable bed",
 };
 
+/** Every `LegalStatus` value — the same hand-listed shape `ed-screen.tsx`'s own intake picker
+ *  keeps, since `ward-model.ts` exports the type but no runtime list of its members. */
+const LEGAL_STATUS_OPTIONS: LegalStatus[] = [
+  "Voluntary",
+  "Referred for psychiatric examination",
+  "Detained awaiting examination",
+  "Involuntary inpatient",
+];
+
+const URGENCY_OPTIONS = [1, 2, 3] as const;
+
 function capacityLine(unit: Unit) {
   const capacity = unitCapacity(unit);
   return `Ready ${capacity.available} · Held ${capacity.held} · Blocked ${capacity.blocked} · Occupied ${capacity.occupied}`;
@@ -156,6 +179,19 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
   // render, the same discipline `overrideSucceeded` already holds to for the override record.
   const [escalationOpen, setEscalationOpen] = useState(false);
   const [escalationContact, setEscalationContact] = useState("");
+  // Task 2: urgency and legal status can change mid-flight. Both a coordinator and the referring
+  // ED clinician may make either change (`EVENT_ROLE.CHANGE_URGENCY`/`CHANGE_LEGAL_STATUS`), so
+  // this panel dispatches as role "coordinator" — the ED screen's own controls dispatch as "ed".
+  const [urgencyChangeOpen, setUrgencyChangeOpen] = useState(false);
+  const [urgencyDraft, setUrgencyDraft] = useState<{ urgency: 1 | 2 | 3; reason: UrgencyChangeReason }>({
+    urgency: movement?.urgency ?? 1,
+    reason: URGENCY_CHANGE_REASONS[0],
+  });
+  const [legalStatusChangeOpen, setLegalStatusChangeOpen] = useState(false);
+  const [legalStatusDraft, setLegalStatusDraft] = useState<{
+    legalStatus: LegalStatus;
+    reason: LegalStatusChangeReason;
+  }>({ legalStatus: movement?.legalStatus ?? "Voluntary", reason: LEGAL_STATUS_CHANGE_REASONS[0] });
 
   // A confirmation, an open override form, or a referral selection all belong to the movement
   // they were made against — moving to a different movement must never leave a stale "Referred"
@@ -171,6 +207,10 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
     setReferTargets([]);
     setEscalationOpen(false);
     setEscalationContact("");
+    setUrgencyChangeOpen(false);
+    setUrgencyDraft({ urgency: movement?.urgency ?? 1, reason: URGENCY_CHANGE_REASONS[0] });
+    setLegalStatusChangeOpen(false);
+    setLegalStatusDraft({ legalStatus: movement?.legalStatus ?? "Voluntary", reason: LEGAL_STATUS_CHANGE_REASONS[0] });
   }
 
   if (!movement) {
@@ -327,6 +367,41 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
     setEscalationContact("");
   }
 
+  /**
+   * Records who changed the tier, when and why — and nothing else. Nothing auto-allocates: this
+   * never re-sorts, re-suggests, un-accepts or re-refers the patient (Global Constraint 3).
+   */
+  function submitUrgencyChange(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    dispatch({
+      type: "CHANGE_URGENCY",
+      role: "coordinator",
+      now,
+      movementId,
+      urgency: urgencyDraft.urgency,
+      reason: urgencyDraft.reason,
+    });
+    setUrgencyChangeOpen(false);
+  }
+
+  /**
+   * Records the legal status change and nothing else. A status change can make an already
+   * accepted destination unlawful (`destinationNoLongerLawful`, surfaced on the Exceptions
+   * drawer) — this handler never reacts to that itself.
+   */
+  function submitLegalStatusChange(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    dispatch({
+      type: "CHANGE_LEGAL_STATUS",
+      role: "coordinator",
+      now,
+      movementId,
+      legalStatus: legalStatusDraft.legalStatus,
+      reason: legalStatusDraft.reason,
+    });
+    setLegalStatusChangeOpen(false);
+  }
+
   // Structurally incapable of claiming an override succeeded when it did not: this checks the
   // movement's OWN post-dispatch `referredUnitIds` — read fresh on every render from the live
   // provider — not a flag captured once at click time. Override is not stage-gated (see the
@@ -418,6 +493,131 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
         )}
       </header>
 
+      {/* Task 2: urgency and legal status can change mid-flight, each change recorded with who
+          made it and when. Nothing here auto-allocates — see `submitUrgencyChange` and
+          `submitLegalStatusChange` above; a status change that makes the accepted destination
+          unlawful surfaces on the Exceptions drawer instead (`destinationNoLongerLawful`). */}
+      <section aria-label="Change urgency or legal status">
+        <h4 className={styles.shortlistSectionHeading}>Change urgency or legal status</h4>
+        <div className={styles.shortlistActionRow}>
+          <button
+            type="button"
+            data-testid="ward-change-urgency-toggle"
+            aria-expanded={urgencyChangeOpen}
+            className={styles.shortlistOverrideButton}
+            onClick={() => setUrgencyChangeOpen((open) => !open)}
+          >
+            Change urgency
+          </button>
+          <button
+            type="button"
+            data-testid="ward-change-legal-status-toggle"
+            aria-expanded={legalStatusChangeOpen}
+            className={styles.shortlistOverrideButton}
+            onClick={() => setLegalStatusChangeOpen((open) => !open)}
+          >
+            Change legal status
+          </button>
+        </div>
+
+        {urgencyChangeOpen ? (
+          <form
+            className={styles.shortlistOverrideForm}
+            onSubmit={submitUrgencyChange}
+            data-testid="ward-change-urgency"
+          >
+            <label className={styles.shortlistOverrideLabel} htmlFor="ward-change-urgency-tier">
+              Urgency tier for {movement.id}
+            </label>
+            <select
+              id="ward-change-urgency-tier"
+              className={styles.shortlistOverrideSelect}
+              value={urgencyDraft.urgency}
+              onChange={(event) =>
+                setUrgencyDraft((current) => ({ ...current, urgency: Number(event.target.value) as 1 | 2 | 3 }))
+              }
+            >
+              {URGENCY_OPTIONS.map((option) => (
+                <option key={option} value={option}>
+                  {option}
+                </option>
+              ))}
+            </select>
+            <label className={styles.shortlistOverrideLabel} htmlFor="ward-change-urgency-reason">
+              Reason
+            </label>
+            <select
+              id="ward-change-urgency-reason"
+              required
+              className={styles.shortlistOverrideSelect}
+              value={urgencyDraft.reason}
+              onChange={(event) =>
+                setUrgencyDraft((current) => ({ ...current, reason: event.target.value as UrgencyChangeReason }))
+              }
+            >
+              {URGENCY_CHANGE_REASONS.map((reason) => (
+                <option key={reason} value={reason}>
+                  {changeReasonLabels[reason]}
+                </option>
+              ))}
+            </select>
+            <button type="submit" className={styles.shortlistOverrideSubmit}>
+              Record urgency change
+            </button>
+          </form>
+        ) : null}
+
+        {legalStatusChangeOpen ? (
+          <form
+            className={styles.shortlistOverrideForm}
+            onSubmit={submitLegalStatusChange}
+            data-testid="ward-change-legal-status"
+          >
+            <label className={styles.shortlistOverrideLabel} htmlFor="ward-change-legal-status-value">
+              Legal status for {movement.id}
+            </label>
+            <select
+              id="ward-change-legal-status-value"
+              className={styles.shortlistOverrideSelect}
+              value={legalStatusDraft.legalStatus}
+              onChange={(event) =>
+                setLegalStatusDraft((current) => ({ ...current, legalStatus: event.target.value as LegalStatus }))
+              }
+            >
+              {LEGAL_STATUS_OPTIONS.map((option) => (
+                <option key={option} value={option}>
+                  {option}
+                </option>
+              ))}
+            </select>
+            <label className={styles.shortlistOverrideLabel} htmlFor="ward-change-legal-status-reason">
+              Reason
+            </label>
+            <select
+              id="ward-change-legal-status-reason"
+              required
+              className={styles.shortlistOverrideSelect}
+              value={legalStatusDraft.reason}
+              onChange={(event) =>
+                setLegalStatusDraft((current) => ({
+                  ...current,
+                  reason: event.target.value as LegalStatusChangeReason,
+                }))
+              }
+            >
+              {LEGAL_STATUS_CHANGE_REASONS.map((reason) => (
+                <option key={reason} value={reason}>
+                  {changeReasonLabels[reason]}
+                </option>
+              ))}
+            </select>
+            <button type="submit" className={styles.shortlistOverrideSubmit}>
+              Record legal status change
+            </button>
+          </form>
+        ) : null}
+      </section>
+
       <section aria-label="Candidate units">
         {/* Whole-branch review Critical 1: this list was headed "Nearest candidates", a proximity
             claim the model cannot support — `Unit` has no distance, geo, locality or catchment
diff --git a/src/components/ward-management/ed/ed-screen.tsx b/src/components/ward-management/ed/ed-screen.tsx
index 2a5a3076d6..e5f41cec84 100644
--- a/src/components/ward-management/ed/ed-screen.tsx
+++ b/src/components/ward-management/ed/ed-screen.tsx
@@ -10,6 +10,13 @@ import {
   wardServiceOrder,
 } from "@/components/ward-management/ward-derivations";
 import { splitDuration, type Instant } from "@/components/ward-management/ward-clock";
+import {
+  changeReasonLabels,
+  LEGAL_STATUS_CHANGE_REASONS,
+  URGENCY_CHANGE_REASONS,
+  type LegalStatusChangeReason,
+  type UrgencyChangeReason,
+} from "@/components/ward-management/ward-change-reasons";
 import { useWardFlow } from "@/components/ward-management/ward-flow-provider";
 import { ClinicalRail } from "@/components/ward-management/ward-management-navigation";
 import { legalFormName, SELECTABLE_LEGAL_FORMS } from "@/components/ward-management/ward-legal-forms";
@@ -201,6 +208,21 @@ export function EdScreen({ edId }: EdScreenProps) {
   const [examinationOutcome, setExaminationOutcome] = useState<
     "inpatient_order" | "community_order" | "revoked" | undefined
   >(undefined);
+  // Task 2: urgency and legal status can change mid-flight. Both a coordinator and the referring
+  // ED clinician may make either change (`EVENT_ROLE.CHANGE_URGENCY`/`CHANGE_LEGAL_STATUS`), so
+  // this screen dispatches as role "ed" — the shortlist panel's own control dispatches as
+  // "coordinator". Each control keeps its own open-for/draft state, the same shape the
+  // examination toggle above already uses.
+  const [urgencyChangeOpenFor, setUrgencyChangeOpenFor] = useState<string | undefined>(undefined);
+  const [urgencyDraft, setUrgencyDraft] = useState<{ urgency: 1 | 2 | 3; reason: UrgencyChangeReason }>({
+    urgency: 1,
+    reason: URGENCY_CHANGE_REASONS[0],
+  });
+  const [legalStatusChangeOpenFor, setLegalStatusChangeOpenFor] = useState<string | undefined>(undefined);
+  const [legalStatusDraft, setLegalStatusDraft] = useState<{
+    legalStatus: LegalStatus;
+    reason: LegalStatusChangeReason;
+  }>({ legalStatus: "Voluntary", reason: LEGAL_STATUS_CHANGE_REASONS[0] });
 
   if (!department) {
     return (
@@ -250,6 +272,42 @@ export function EdScreen({ edId }: EdScreenProps) {
     setExaminationOutcome(undefined);
   }
 
+  function toggleUrgencyChange(movementId: string, currentUrgency: 1 | 2 | 3) {
+    setUrgencyChangeOpenFor((current) => (current === movementId ? undefined : movementId));
+    setUrgencyDraft({ urgency: currentUrgency, reason: URGENCY_CHANGE_REASONS[0] });
+  }
+
+  function submitUrgencyChange(event: FormEvent<HTMLFormElement>, movementId: string) {
+    event.preventDefault();
+    dispatch({
+      type: "CHANGE_URGENCY",
+      role: "ed",
+      now,
+      movementId,
+      urgency: urgencyDraft.urgency,
+      reason: urgencyDraft.reason,
+    });
+    setUrgencyChangeOpenFor(undefined);
+  }
+
+  function toggleLegalStatusChange(movementId: string, currentLegalStatus: LegalStatus) {
+    setLegalStatusChangeOpenFor((current) => (current === movementId ? undefined : movementId));
+    setLegalStatusDraft({ legalStatus: currentLegalStatus, reason: LEGAL_STATUS_CHANGE_REASONS[0] });
+  }
+
+  function submitLegalStatusChange(event: FormEvent<HTMLFormElement>, movementId: string) {
+    event.preventDefault();
+    dispatch({
+      type: "CHANGE_LEGAL_STATUS",
+      role: "ed",
+      now,
+      movementId,
+      legalStatus: legalStatusDraft.legalStatus,
+      reason: legalStatusDraft.reason,
+    });
+    setLegalStatusChangeOpenFor(undefined);
+  }
+
   return (
     <div className={styles.screen} data-testid="ward-ed-screen">
       <ClinicalRail />
@@ -417,6 +475,8 @@ export function EdScreen({ edId }: EdScreenProps) {
                 const examBlocked = examinationBlockedReason(movement);
                 const handoverBlocked = handoverBlockedReason(movement);
                 const examOpen = examinationOpenFor === movement.id;
+                const urgencyChangeOpen = urgencyChangeOpenFor === movement.id;
+                const legalStatusChangeOpen = legalStatusChangeOpenFor === movement.id;
                 // Whole-branch review Critical 1: resolved from the live `units`, not `unitById`.
                 const acceptedUnit = movement.acceptedUnitId
                   ? units.find((unit) => unit.id === movement.acceptedUnitId)
@@ -513,6 +573,24 @@ export function EdScreen({ edId }: EdScreenProps) {
                       >
                         Mark handover ready
                       </button>
+                      <button
+                        type="button"
+                        data-testid={`ward-change-urgency-toggle-${movement.id}`}
+                        aria-expanded={urgencyChangeOpen}
+                        className={styles.declineButton}
+                        onClick={() => toggleUrgencyChange(movement.id, movement.urgency)}
+                      >
+                        Change urgency
+                      </button>
+                      <button
+                        type="button"
+                        data-testid={`ward-change-legal-status-toggle-${movement.id}`}
+                        aria-expanded={legalStatusChangeOpen}
+                        className={styles.declineButton}
+                        onClick={() => toggleLegalStatusChange(movement.id, movement.legalStatus)}
+                      >
+                        Change legal status
+                      </button>
                     </div>
                     {examBlocked ? (
                       <span id={`ward-ed-examine-unavailable-${movement.id}`} className="sr-only">
@@ -557,6 +635,114 @@ export function EdScreen({ edId }: EdScreenProps) {
                         </button>
                       </form>
                     ) : null}
+
+                    {urgencyChangeOpen ? (
+                      <form
+                        className={styles.declineForm}
+                        onSubmit={(event) => submitUrgencyChange(event, movement.id)}
+                        data-testid={`ward-change-urgency-${movement.id}`}
+                      >
+                        <label className={styles.referralField} htmlFor={`ward-change-urgency-tier-${movement.id}`}>
+                          Urgency tier for {movement.id}
+                          <select
+                            id={`ward-change-urgency-tier-${movement.id}`}
+                            value={urgencyDraft.urgency}
+                            onChange={(event) =>
+                              setUrgencyDraft((current) => ({
+                                ...current,
+                                urgency: Number(event.target.value) as 1 | 2 | 3,
+                              }))
+                            }
+                          >
+                            {URGENCY_OPTIONS.map((option) => (
+                              <option key={option} value={option}>
+                                {option}
+                              </option>
+                            ))}
+                          </select>
+                        </label>
+                        <label className={styles.referralField} htmlFor={`ward-change-urgency-reason-${movement.id}`}>
+                          Reason
+                          <select
+                            id={`ward-change-urgency-reason-${movement.id}`}
+                            required
+                            value={urgencyDraft.reason}
+                            onChange={(event) =>
+                              setUrgencyDraft((current) => ({
+                                ...current,
+                                reason: event.target.value as UrgencyChangeReason,
+                              }))
+                            }
+                          >
+                            {URGENCY_CHANGE_REASONS.map((reason) => (
+                              <option key={reason} value={reason}>
+                                {changeReasonLabels[reason]}
+                              </option>
+                            ))}
+                          </select>
+                        </label>
+                        <button type="submit" className={styles.declineSubmit}>
+                          Record urgency change
+                        </button>
+                      </form>
+                    ) : null}
+
+                    {legalStatusChangeOpen ? (
+                      <form
+                        className={styles.declineForm}
+                        onSubmit={(event) => submitLegalStatusChange(event, movement.id)}
+                        data-testid={`ward-change-legal-status-${movement.id}`}
+                      >
+                        <label
+                          className={styles.referralField}
+                          htmlFor={`ward-change-legal-status-value-${movement.id}`}
+                        >
+                          Legal status for {movement.id}
+                          <select
+                            id={`ward-change-legal-status-value-${movement.id}`}
+                            value={legalStatusDraft.legalStatus}
+                            onChange={(event) =>
+                              setLegalStatusDraft((current) => ({
+                                ...current,
+                                legalStatus: event.target.value as LegalStatus,
+                              }))
+                            }
+                          >
+                            {LEGAL_STATUS_OPTIONS.map((option) => (
+                              <option key={option} value={option}>
+                                {option}
+                              </option>
+                            ))}
+                          </select>
+                        </label>
+                        <label
+                          className={styles.referralField}
+                          htmlFor={`ward-change-legal-status-reason-${movement.id}`}
+                        >
+                          Reason
+                          <select
+                            id={`ward-change-legal-status-reason-${movement.id}`}
+                            required
+                            value={legalStatusDraft.reason}
+                            onChange={(event) =>
+                              setLegalStatusDraft((current) => ({
+                                ...current,
+                                reason: event.target.value as LegalStatusChangeReason,
+                              }))
+                            }
+                          >
+                            {LEGAL_STATUS_CHANGE_REASONS.map((reason) => (
+                              <option key={reason} value={reason}>
+                                {changeReasonLabels[reason]}
+                              </option>
+                            ))}
+                          </select>
+                        </label>
+                        <button type="submit" className={styles.declineSubmit}>
+                          Record legal status change
+                        </button>
+                      </form>
+                    ) : null}
                   </li>
                 );
               })}
diff --git a/src/components/ward-management/ward-change-reasons.ts b/src/components/ward-management/ward-change-reasons.ts
new file mode 100644
index 0000000000..bb35ba0651
--- /dev/null
+++ b/src/components/ward-management/ward-change-reasons.ts
@@ -0,0 +1,23 @@
+/**
+ * Fixed reason lists. Chosen, never typed — the same treatment `DECLINE_REASONS` already has,
+ * and for the same reason: the synthetic-data promise must be true by construction rather than
+ * by a user reading a label and complying.
+ *
+ * These are deliberately operational and content-free. NONE of them describes a patient, a
+ * diagnosis, a clinical judgement or a legal requirement. A reason reading "patient
+ * deteriorated" would be narrative clinical content; one reading "order made" would be a claim
+ * about the Mental Health Act. Both are forbidden. If richer reasons are wanted they come from
+ * the product owner; no agent adds one.
+ */
+export const URGENCY_CHANGE_REASONS = ["reassessed", "new_information", "correcting_an_error"] as const;
+export type UrgencyChangeReason = (typeof URGENCY_CHANGE_REASONS)[number];
+
+export const LEGAL_STATUS_CHANGE_REASONS = ["recorded_by_treating_team", "correcting_an_error"] as const;
+export type LegalStatusChangeReason = (typeof LEGAL_STATUS_CHANGE_REASONS)[number];
+
+export const changeReasonLabels: Record<UrgencyChangeReason | LegalStatusChangeReason, string> = {
+  reassessed: "Reassessed",
+  new_information: "New information",
+  correcting_an_error: "Correcting an error",
+  recorded_by_treating_team: "Recorded by treating team",
+};
diff --git a/src/components/ward-management/ward-derivations.ts b/src/components/ward-management/ward-derivations.ts
index e442ffa521..33d5b2f225 100644
--- a/src/components/ward-management/ward-derivations.ts
+++ b/src/components/ward-management/ward-derivations.ts
@@ -16,7 +16,11 @@ import {
   minutesUntil,
   type Instant,
 } from "@/components/ward-management/ward-clock";
-import { eligibility, type EligibilityVerdict } from "@/components/ward-management/ward-eligibility";
+import {
+  eligibility,
+  requiresAuthorisedDestination,
+  type EligibilityVerdict,
+} from "@/components/ward-management/ward-eligibility";
 import {
   MOVEMENT_STAGES,
   PARALLEL_REFERRAL_CAP,
@@ -99,6 +103,22 @@ export function isOpen(movement: Movement): boolean {
   return !movement.closure && movement.stage !== "arrived";
 }
 
+/**
+ * A movement whose CURRENT legal status requires an authorised destination, but whose already
+ * accepted unit is not authorised. This is a real situation created by a mid-flight status
+ * change, and it is surfaced as an exception for a human to resolve. It NEVER re-sorts,
+ * re-suggests or un-accepts the patient: nothing in this prototype auto-allocates, and that
+ * rule does not bend because the trigger was a status change.
+ */
+export function destinationNoLongerLawful(movement: Movement, units: Unit[]): Unit | undefined {
+  if (!isOpen(movement)) return undefined;
+  if (!requiresAuthorisedDestination(movement.legalStatus)) return undefined;
+  if (movement.acceptedUnitId === undefined) return undefined;
+  const unit = units.find((candidate) => candidate.id === movement.acceptedUnitId);
+  if (unit === undefined) return undefined;
+  return unit.authorised ? undefined : unit;
+}
+
 /**
  * Whether `wardFlowReducer`'s `REFER_TO_UNITS` case would actually accept a referral for this
  * movement right now, and if not, why — named from the movement's own real stage via `stageCopy`,
@@ -349,9 +369,27 @@ export type InboxItem = {
  * legitimately carries a deadline falls due. This is the coordinator's work list, not a report:
  * every qualifying movement gets its own row.
  */
-export function buildActionInbox(movements: Movement[], now: Instant): InboxItem[] {
+export function buildActionInbox(movements: Movement[], now: Instant, units: Unit[]): InboxItem[] {
   const items: InboxItem[] = [];
 
+  // A legal status change can make an already-accepted destination unlawful — see
+  // `destinationNoLongerLawful`'s own doc comment. This never re-sorts or un-accepts the
+  // patient; it only surfaces the fact for a human, exactly like every other category here.
+  const noLongerLawful = movements
+    .map((movement) => ({ movement, unit: destinationNoLongerLawful(movement, units) }))
+    .filter((entry): entry is { movement: Movement; unit: Unit } => entry.unit !== undefined);
+  for (const { movement, unit } of noLongerLawful) {
+    items.push({
+      id: `destination-unlawful-${movement.id}`,
+      tone: "danger",
+      icon: CircleAlert,
+      title: "Accepted destination no longer lawful",
+      detail: `${movement.id} · ${unit.name} is not authorised under the Mental Health Act for ${movement.legalStatus}`,
+      owner: movement.owner,
+      movementId: movement.id,
+    });
+  }
+
   // A form with no `dueAt` is never breached and contributes nothing here; `undefined` must never
   // reach `clockState`'s arithmetic. As of the 2026-08-23 product-owner correction that is every
   // Form 1A and every Form 3B in this model — the record carries no deadline for them. Stated
diff --git a/src/components/ward-management/ward-flow-events.ts b/src/components/ward-management/ward-flow-events.ts
index b71aa9ecd2..de214215b7 100644
--- a/src/components/ward-management/ward-flow-events.ts
+++ b/src/components/ward-management/ward-flow-events.ts
@@ -1,4 +1,5 @@
 import type { Instant } from "@/components/ward-management/ward-clock";
+import type { LegalStatusChangeReason, UrgencyChangeReason } from "@/components/ward-management/ward-change-reasons";
 import type { Cohort, DeclineReason, LegalStatus, Security, Sex } from "@/components/ward-management/ward-model";
 import type { WardScenario } from "@/components/ward-management/ward-scenarios";
 
@@ -87,27 +88,50 @@ export type WardFlowEvent =
     }
   | { type: "ADVANCE_CLOCK"; role: WardFlowRole; now: Instant; minutes: number }
   | { type: "RESET_SCENARIO"; role: WardFlowRole; now: Instant }
-  | { type: "SET_SCENARIO"; role: WardFlowRole; now: Instant; scenario: WardScenario };
+  | { type: "SET_SCENARIO"; role: WardFlowRole; now: Instant; scenario: WardScenario }
+  | {
+      type: "CHANGE_URGENCY";
+      role: WardFlowRole;
+      now: Instant;
+      movementId: string;
+      urgency: 1 | 2 | 3;
+      reason: UrgencyChangeReason;
+    }
+  | {
+      type: "CHANGE_LEGAL_STATUS";
+      role: WardFlowRole;
+      now: Instant;
+      movementId: string;
+      legalStatus: LegalStatus;
+      reason: LegalStatusChangeReason;
+    };
 
 /**
  * One table, read by the reducer's role check, rather than a `switch` repeated at every call
  * site. Adding an event here without an entry is a compile error, which is the point.
+ *
+ * Widened from one role per event to a non-empty list of permitted roles (this task, spec D2).
+ * `CHANGE_URGENCY` and `CHANGE_LEGAL_STATUS` are the first events with more than one — both a
+ * coordinator and the referring ED clinician may record either change — and Task 3's events need
+ * the same shape, so the table is widened here rather than special-cased per event.
  */
-export const EVENT_ROLE: Record<WardFlowEvent["type"], WardFlowRole> = {
-  RAISE_REFERRAL: "ed",
-  RECORD_EXAMINATION: "ed",
-  REFER_TO_UNITS: "coordinator",
-  ACCEPT_IN_PRINCIPLE: "ward",
-  HOLD_BED: "ward",
-  DECLINE: "ward",
-  HANDOVER_READY: "ed",
-  TRANSPORT_ACCEPTED: "officer",
-  TRANSPORT_EN_ROUTE: "officer",
-  PATIENT_COLLECTED: "officer",
-  PATIENT_ARRIVED: "officer",
-  CONFIRM_CAPACITY: "ward",
-  RECORD_ESCALATION: "coordinator",
-  ADVANCE_CLOCK: "demo",
-  RESET_SCENARIO: "demo",
-  SET_SCENARIO: "demo",
+export const EVENT_ROLE: Record<WardFlowEvent["type"], readonly WardFlowRole[]> = {
+  RAISE_REFERRAL: ["ed"],
+  RECORD_EXAMINATION: ["ed"],
+  REFER_TO_UNITS: ["coordinator"],
+  ACCEPT_IN_PRINCIPLE: ["ward"],
+  HOLD_BED: ["ward"],
+  DECLINE: ["ward"],
+  HANDOVER_READY: ["ed"],
+  TRANSPORT_ACCEPTED: ["officer"],
+  TRANSPORT_EN_ROUTE: ["officer"],
+  PATIENT_COLLECTED: ["officer"],
+  PATIENT_ARRIVED: ["officer"],
+  CONFIRM_CAPACITY: ["ward"],
+  RECORD_ESCALATION: ["coordinator"],
+  ADVANCE_CLOCK: ["demo"],
+  RESET_SCENARIO: ["demo"],
+  SET_SCENARIO: ["demo"],
+  CHANGE_URGENCY: ["coordinator", "ed"],
+  CHANGE_LEGAL_STATUS: ["coordinator", "ed"],
 };
diff --git a/src/components/ward-management/ward-flow-reducer.ts b/src/components/ward-management/ward-flow-reducer.ts
index 4536a62b3c..6ecf043dd3 100644
--- a/src/components/ward-management/ward-flow-reducer.ts
+++ b/src/components/ward-management/ward-flow-reducer.ts
@@ -1,4 +1,4 @@
-import { EVENT_ROLE, type WardFlowEvent, type WardFlowRole } from "@/components/ward-management/ward-flow-events";
+import { EVENT_ROLE, type WardFlowEvent } from "@/components/ward-management/ward-flow-events";
 import { SELECTABLE_LEGAL_FORMS } from "@/components/ward-management/ward-legal-forms";
 import { PARALLEL_REFERRAL_CAP } from "@/components/ward-management/ward-model";
 import type { Movement, MovementStage, Rejection, Unit } from "@/components/ward-management/ward-model";
@@ -117,9 +117,13 @@ function nextReferralId(sequence: number): string {
 
 export function wardFlowReducer(state: WardFlowState, event: WardFlowEvent): WardFlowState {
   // 1. Role check first, before the event's payload is inspected at all.
-  const requiredRole: WardFlowRole = EVENT_ROLE[event.type];
-  if (requiredRole !== event.role) {
-    return reject(state, event, `${event.type} requires role ${requiredRole}, but was raised by role ${event.role}`);
+  const permittedRoles = EVENT_ROLE[event.type];
+  if (!permittedRoles.includes(event.role)) {
+    return reject(
+      state,
+      event,
+      `${event.type} requires role ${permittedRoles.join(" or ")}, but was raised by role ${event.role}`,
+    );
   }
 
   switch (event.type) {
@@ -166,6 +170,7 @@ export function wardFlowReducer(state: WardFlowState, event: WardFlowEvent): War
         // own source and must not become mutable state hanging off a movement.
         legalForm: chosenForm === undefined ? undefined : { ...chosenForm },
         statusChanges: [],
+        urgencyChanges: [],
         stage: "placement_requested",
         owner: department.name,
         referredUnitIds: [],
@@ -532,5 +537,47 @@ export function wardFlowReducer(state: WardFlowState, event: WardFlowEvent): War
       };
       return replaceMovement(state, movement.id, updated);
     }
+
+    case "CHANGE_URGENCY": {
+      const movement = findMovement(state, event.movementId);
+      if (!movement) return reject(state, event, `no movement found for id ${event.movementId}`);
+      if (movement.closure) {
+        return reject(state, event, `cannot change urgency for a closed movement (${movement.closure.reason})`);
+      }
+      // Nothing auto-allocates. This records who changed the tier, when and why; it never
+      // re-sorts, re-suggests, un-accepts or re-refers the patient — that rule does not bend
+      // because the trigger was a status change (Global Constraint 3, spec D2).
+      const updated: Movement = {
+        ...movement,
+        urgency: event.urgency,
+        urgencyChanges: [
+          ...movement.urgencyChanges,
+          { at: event.now, from: movement.urgency, to: event.urgency, by: event.role, reason: event.reason },
+        ],
+      };
+      return replaceMovement(state, movement.id, updated);
+    }
+
+    case "CHANGE_LEGAL_STATUS": {
+      const movement = findMovement(state, event.movementId);
+      if (!movement) return reject(state, event, `no movement found for id ${event.movementId}`);
+      if (movement.closure) {
+        return reject(state, event, `cannot change legal status for a closed movement (${movement.closure.reason})`);
+      }
+      // A legal status change can make an already-accepted destination unlawful — see
+      // `destinationNoLongerLawful` in ward-derivations.ts, which surfaces that as an exception
+      // for a human. This handler NEVER reacts to that itself: it records the change and nothing
+      // else. `stage`, `acceptedUnitId`, `referredUnitIds`, `declines`, `transport`, `legalForm`
+      // and `bedHeldUntil` are all untouched.
+      const updated: Movement = {
+        ...movement,
+        legalStatus: event.legalStatus,
+        statusChanges: [
+          ...movement.statusChanges,
+          { at: event.now, from: movement.legalStatus, to: event.legalStatus, by: event.role, reason: event.reason },
+        ],
+      };
+      return replaceMovement(state, movement.id, updated);
+    }
   }
 }
diff --git a/src/components/ward-management/ward-management-modes.tsx b/src/components/ward-management/ward-management-modes.tsx
index 6e049822d5..d4acf68868 100644
--- a/src/components/ward-management/ward-management-modes.tsx
+++ b/src/components/ward-management/ward-management-modes.tsx
@@ -484,10 +484,10 @@ function MovementsView() {
 }
 
 function ExceptionsView() {
-  const { movements, now } = useWardFlow();
+  const { movements, units, now } = useWardFlow();
   // Whole-branch review Minor 6: same open-movement scoping as the coordinator screen — a closed
   // record must never appear on a live exception work list.
-  const items = buildActionInbox(movements.filter(isOpen), now);
+  const items = buildActionInbox(movements.filter(isOpen), now, units);
   // Task 8 review (Minor 7): `tone === "danger"` also matches the parallel-referral-cap
   // category, which is a capacity dead end, not a passed deadline — counting it under a label
   // that says "overdue" overstated the true breach count by one once Ruling 1 started emitting
diff --git a/src/components/ward-management/ward-model.ts b/src/components/ward-management/ward-model.ts
index 790ca15ce4..7542fff7f6 100644
--- a/src/components/ward-management/ward-model.ts
+++ b/src/components/ward-management/ward-model.ts
@@ -1,4 +1,5 @@
 import type { Instant } from "@/components/ward-management/ward-clock";
+import type { LegalStatusChangeReason, UrgencyChangeReason } from "@/components/ward-management/ward-change-reasons";
 
 export type HealthService = "North Metro" | "South Metro" | "East Metro" | "WACHS" | "Private";
 export type Cohort = "Adult" | "Older adult";
@@ -155,6 +156,18 @@ export type StatusChange = {
   from: LegalStatus;
   to: LegalStatus;
   by: string;
+  reason: LegalStatusChangeReason;
+};
+
+/** The urgency-tier counterpart of `StatusChange` — same shape, same discipline: who made the
+ *  change, when, and a reason chosen from a fixed list rather than typed (see
+ *  `ward-change-reasons.ts`'s own doc comment for why). */
+export type UrgencyChange = {
+  at: Instant;
+  from: 1 | 2 | 3;
+  to: 1 | 2 | 3;
+  by: string;
+  reason: UrgencyChangeReason;
 };
 
 export type TransportJob = {
@@ -188,6 +201,9 @@ export type Movement = {
   legalStatus: LegalStatus;
   legalForm?: LegalForm;
   statusChanges: StatusChange[];
+  /** Urgency-tier changes, in the order they were made. Empty for a movement whose urgency has
+   *  never changed since it was raised. */
+  urgencyChanges: UrgencyChange[];
   stage: MovementStage;
   owner: string;
   /** Units currently holding a live referral. Never longer than PARALLEL_REFERRAL_CAP. */
diff --git a/src/components/ward-management/ward-movements.ts b/src/components/ward-management/ward-movements.ts
index 6dbaafc423..d5cf26952c 100644
--- a/src/components/ward-management/ward-movements.ts
+++ b/src/components/ward-management/ward-movements.ts
@@ -24,6 +24,7 @@ const seededMovements: Movement[] = [
     legalStatus: "Referred for psychiatric examination",
     legalForm: { code: "1A", kind: "examination" },
     statusChanges: [],
+    urgencyChanges: [],
     stage: "placement_requested",
     owner: "ED mental health team",
     referredUnitIds: [],
@@ -42,6 +43,7 @@ const seededMovements: Movement[] = [
     specialling: true,
     legalStatus: "Voluntary",
     statusChanges: [],
+    urgencyChanges: [],
     stage: "destination_review",
     owner: "Flow coordinator",
     referredUnitIds: ["fsh-older-adult"],
@@ -66,6 +68,7 @@ const seededMovements: Movement[] = [
       kind: "detention",
     },
     statusChanges: [],
+    urgencyChanges: [],
     stage: "accepted_awaiting_bed",
     owner: "Flow coordinator",
     referredUnitIds: [],
@@ -92,6 +95,7 @@ const seededMovements: Movement[] = [
       dueAt: NOW_ANCHOR + 300,
     },
     statusChanges: [],
+    urgencyChanges: [],
     stage: "bed_held",
     owner: "Flow coordinator",
     referredUnitIds: [],
@@ -113,6 +117,7 @@ const seededMovements: Movement[] = [
     legalStatus: "Detained awaiting examination",
     legalForm: { code: "1A", kind: "examination" },
     statusChanges: [],
+    urgencyChanges: [],
     stage: "handover_ready",
     owner: "ED mental health team",
     referredUnitIds: [],
@@ -145,6 +150,7 @@ const seededMovements: Movement[] = [
       dueAt: NOW_ANCHOR + 90,
     },
     statusChanges: [],
+    urgencyChanges: [],
     stage: "moving",
     owner: "Flow coordinator",
     referredUnitIds: [],
@@ -181,6 +187,7 @@ const seededMovements: Movement[] = [
     specialling: false,
     legalStatus: "Voluntary",
     statusChanges: [],
+    urgencyChanges: [],
     stage: "arrived",
     owner: "Ward nurse in charge",
     referredUnitIds: [],
@@ -201,6 +208,7 @@ const seededMovements: Movement[] = [
     specialling: false,
     legalStatus: "Voluntary",
     statusChanges: [],
+    urgencyChanges: [],
     // Ruling R64: carries acceptedUnitId but no bedHeldUntil and no transport. HOLD_BED is the
     // only reducer transition that writes bedHeldUntil, and HANDOVER_READY (the only producer of
     // "handover_ready") requires stage "bed_held" already — so a movement with an accepted unit
@@ -234,6 +242,7 @@ const seededMovements: Movement[] = [
       kind: "detention",
     },
     statusChanges: [],
+    urgencyChanges: [],
     stage: "destination_review",
     owner: "Flow coordinator",
     referredUnitIds: [],
@@ -296,8 +305,15 @@ const seededMovements: Movement[] = [
     legalStatus: "Detained awaiting examination",
     legalForm: { code: "1A", kind: "examination" },
     statusChanges: [
-      { at: NOW_ANCHOR - 40, from: "Voluntary", to: "Detained awaiting examination", by: "Duty psychiatrist" },
+      {
+        at: NOW_ANCHOR - 40,
+        from: "Voluntary",
+        to: "Detained awaiting examination",
+        by: "Duty psychiatrist",
+        reason: "recorded_by_treating_team",
+      },
     ],
+    urgencyChanges: [],
     stage: "destination_review",
     owner: "Flow coordinator",
     referredUnitIds: ["sjgm-adult-open"],
@@ -321,6 +337,7 @@ const seededMovements: Movement[] = [
       dueAt: NOW_ANCHOR + 340,
     },
     statusChanges: [],
+    urgencyChanges: [],
     stage: "bed_held",
     owner: "Flow coordinator",
     referredUnitIds: [],
@@ -342,6 +359,7 @@ const seededMovements: Movement[] = [
     legalStatus: "Referred for psychiatric examination",
     legalForm: { code: "1A", kind: "examination" },
     statusChanges: [],
+    urgencyChanges: [],
     stage: "placement_requested",
     owner: "ED mental health team",
     // Was ["gry-adult-secure"] — fix for review C2. `RAISE_REFERRAL` is the only reducer branch
@@ -374,6 +392,7 @@ const seededMovements: Movement[] = [
     specialling: false,
     legalStatus: "Voluntary",
     statusChanges: [],
+    urgencyChanges: [],
     stage: "destination_review",
     owner: "Flow coordinator",
     referredUnitIds: ["bty-older-adult", "gry-older-adult"],
@@ -398,6 +417,7 @@ const seededMovements: Movement[] = [
       dueAt: NOW_ANCHOR + 60,
     },
     statusChanges: [],
+    urgencyChanges: [],
     stage: "moving",
     owner: "Flow coordinator",
     referredUnitIds: [],
@@ -428,6 +448,7 @@ const seededMovements: Movement[] = [
     specialling: true,
     legalStatus: "Voluntary",
     statusChanges: [],
+    urgencyChanges: [],
     stage: "handover_ready",
     owner: "Ward nurse in charge",
     referredUnitIds: [],
@@ -449,6 +470,7 @@ const seededMovements: Movement[] = [
     legalStatus: "Referred for psychiatric examination",
     legalForm: { code: "1A", kind: "examination" },
     statusChanges: [],
+    urgencyChanges: [],
     stage: "bed_held",
     owner: "Flow coordinator",
     referredUnitIds: [],
@@ -473,6 +495,7 @@ const seededMovements: Movement[] = [
       kind: "detention",
     },
     statusChanges: [],
+    urgencyChanges: [],
     stage: "destination_review",
     owner: "ED mental health team",
     referredUnitIds: ["bty-adult-secure"],
@@ -499,6 +522,7 @@ const seededMovements: Movement[] = [
     specialling: false,
     legalStatus: "Voluntary",
     statusChanges: [],
+    urgencyChanges: [],
     stage: "placement_requested",
     owner: "ED mental health team",
     referredUnitIds: [],
@@ -644,6 +668,7 @@ function routineMovements(count: number, startIndex: number): Movement[] {
             }
           : undefined,
       statusChanges: [],
+      urgencyChanges: [],
       stage,
       owner: index % 2 === 0 ? "Flow coordinator" : "ED mental health team",
       referredUnitIds: [],
diff --git a/tests/ui-ward-coordinator.spec.ts b/tests/ui-ward-coordinator.spec.ts
index 0a3c65ab35..3c51d760d1 100644
--- a/tests/ui-ward-coordinator.spec.ts
+++ b/tests/ui-ward-coordinator.spec.ts
@@ -163,7 +163,7 @@ test.describe("Ward Flow coordinator screen", () => {
     // Whole-branch review Minor 6: the drawer is scoped to OPEN movements, so the independent
     // count here must be too — computing it over all 48 records would agree with a screen that
     // wrongly listed a closed patient's breached deadline.
-    const expectedCount = buildActionInbox(wardMovements.filter(isOpen), NOW_ANCHOR).length;
+    const expectedCount = buildActionInbox(wardMovements.filter(isOpen), NOW_ANCHOR, allUnits()).length;
     expect(expectedCount).toBeGreaterThan(1);
     await expect(items).toHaveCount(expectedCount);
     await expect(toggle).toContainText(String(expectedCount));
diff --git a/tests/ward-change-reasons.test.ts b/tests/ward-change-reasons.test.ts
new file mode 100644
index 0000000000..77fb78f457
--- /dev/null
+++ b/tests/ward-change-reasons.test.ts
@@ -0,0 +1,81 @@
+// tests/ward-change-reasons.test.ts
+import { describe, expect, it } from "vitest";
+
+import {
+  changeReasonLabels,
+  LEGAL_STATUS_CHANGE_REASONS,
+  URGENCY_CHANGE_REASONS,
+  type LegalStatusChangeReason,
+  type UrgencyChangeReason,
+} from "../src/components/ward-management/ward-change-reasons";
+
+describe("ward-change-reasons", () => {
+  it("holds exactly the three urgency-change reasons, in this order", () => {
+    expect(URGENCY_CHANGE_REASONS).toEqual(["reassessed", "new_information", "correcting_an_error"]);
+  });
+
+  it("holds exactly the two legal-status-change reasons, in this order", () => {
+    expect(LEGAL_STATUS_CHANGE_REASONS).toEqual(["recorded_by_treating_team", "correcting_an_error"]);
+  });
+
+  it("labels every urgency-change reason with real, non-empty text", () => {
+    for (const reason of URGENCY_CHANGE_REASONS) {
+      expect(changeReasonLabels[reason]).toBeTruthy();
+      expect(changeReasonLabels[reason].length).toBeGreaterThan(0);
+    }
+  });
+
+  it("labels every legal-status-change reason with real, non-empty text", () => {
+    for (const reason of LEGAL_STATUS_CHANGE_REASONS) {
+      expect(changeReasonLabels[reason]).toBeTruthy();
+      expect(changeReasonLabels[reason].length).toBeGreaterThan(0);
+    }
+  });
+
+  // Content-free, synthetic-data guard: none of the eight rulings in the brief permits a reason
+  // describing a patient, a diagnosis, a clinical judgement or a legal requirement. This asserts
+  // it structurally rather than trusting a comment — a reason string is never free text (every
+  // reason picker in this task is a `<select>` over these fixed lists), so this check on the
+  // fixed lists themselves is a check on every reason the product can ever record.
+  it("never names a clinical, diagnostic or statutory concept in a reason value or label", () => {
+    const forbiddenTokens = [
+      "patient",
+      "diagnos",
+      "deteriorat",
+      "order made",
+      "section",
+      "act 2014",
+      "mental health act",
+      "detained",
+      "involuntary",
+    ];
+    const allText = [
+      ...URGENCY_CHANGE_REASONS,
+      ...LEGAL_STATUS_CHANGE_REASONS,
+      ...Object.values(changeReasonLabels),
+    ].map((value) => value.toLowerCase());
+
+    for (const text of allText) {
+      for (const token of forbiddenTokens) {
+        expect(text.includes(token), `"${text}" contains the forbidden token "${token}"`).toBe(false);
+      }
+    }
+  });
+
+  it("gives every union member a label and no label an orphan entry", () => {
+    const allReasons: (UrgencyChangeReason | LegalStatusChangeReason)[] = [
+      ...URGENCY_CHANGE_REASONS,
+      ...LEGAL_STATUS_CHANGE_REASONS,
+    ];
+    // Every reason in both lists resolves to a label.
+    for (const reason of allReasons) {
+      expect(Object.keys(changeReasonLabels)).toContain(reason);
+    }
+    // "correcting_an_error" is shared by both lists, so the label map has exactly THREE unique
+    // keys, not four — this pins that de-duplication rather than letting a stray fourth key (a
+    // typo'd duplicate) slip in unnoticed.
+    expect(Object.keys(changeReasonLabels).sort()).toEqual(
+      ["correcting_an_error", "new_information", "reassessed", "recorded_by_treating_team"].sort(),
+    );
+  });
+});
diff --git a/tests/ward-derivations.test.ts b/tests/ward-derivations.test.ts
index 0cbc730021..c71102890b 100644
--- a/tests/ward-derivations.test.ts
+++ b/tests/ward-derivations.test.ts
@@ -4,6 +4,7 @@ import { describe, expect, it } from "vitest";
 import { clockState } from "../src/components/ward-management/ward-clock";
 import {
   buildActionInbox,
+  destinationNoLongerLawful,
   eligibleCandidatesAmong,
   restrictionNotice,
   transportLeg,
@@ -55,7 +56,7 @@ describe("buildActionInbox", () => {
       .map((movement) => `legal-${movement.id}`)
       .sort();
 
-    const items = buildActionInbox(wardMovements, NOW_ANCHOR)
+    const items = buildActionInbox(wardMovements, NOW_ANCHOR, allUnits())
       .filter((item) => item.id.startsWith("legal-"))
       .map((item) => item.id)
       .sort();
@@ -104,7 +105,7 @@ describe("buildActionInbox", () => {
       legalForm: { code: "4A", kind: "transport", dueAt: NOW_ANCHOR + 500 },
     });
 
-    const items = buildActionInbox([first, second, notDue], NOW_ANCHOR)
+    const items = buildActionInbox([first, second, notDue], NOW_ANCHOR, allUnits())
       .filter((item) => item.id.startsWith("legal-"))
       .map((item) => item.id)
       .sort();
@@ -124,7 +125,7 @@ describe("buildActionInbox", () => {
     expect(movement?.legalForm?.code).toBe("1A");
     expect(movement?.legalForm?.dueAt).toBeUndefined();
 
-    const items = buildActionInbox(wardMovements, NOW_ANCHOR);
+    const items = buildActionInbox(wardMovements, NOW_ANCHOR, allUnits());
     expect(items.find((item) => item.id === "legal-WF-303")).toBeUndefined();
   });
 
@@ -140,7 +141,7 @@ describe("buildActionInbox", () => {
       .map((movement) => `declines-${movement.id}`)
       .sort();
 
-    const items = buildActionInbox(wardMovements, NOW_ANCHOR)
+    const items = buildActionInbox(wardMovements, NOW_ANCHOR, allUnits())
       .filter((item) => item.id.startsWith("declines-"))
       .map((item) => item.id)
       .sort();
@@ -162,7 +163,11 @@ describe("buildActionInbox", () => {
       PARALLEL_REFERRAL_CAP,
     );
 
-    const items = buildActionInbox([capped("TEST-declines-one"), capped("TEST-declines-two"), underCap], NOW_ANCHOR)
+    const items = buildActionInbox(
+      [capped("TEST-declines-one"), capped("TEST-declines-two"), underCap],
+      NOW_ANCHOR,
+      allUnits(),
+    )
       .filter((item) => item.id.startsWith("declines-"))
       .map((item) => item.id)
       .sort();
@@ -187,7 +192,7 @@ describe("buildActionInbox", () => {
 
     expect(expectedIds.length, "the fixture no longer contains a stalled transport").toBeGreaterThan(1);
 
-    const items = buildActionInbox(wardMovements, NOW_ANCHOR)
+    const items = buildActionInbox(wardMovements, NOW_ANCHOR, allUnits())
       .filter((item) => item.id.startsWith("transport-"))
       .map((item) => item.id)
       .sort();
@@ -203,7 +208,7 @@ describe("buildActionInbox", () => {
     const expired = wardMovements.find((movement) => movement.id === "WF-004")!;
     expect(expired.bedHeldUntil).toBeLessThan(NOW_ANCHOR);
 
-    expect(buildActionInbox(wardMovements, NOW_ANCHOR)).toContainEqual(
+    expect(buildActionInbox(wardMovements, NOW_ANCHOR, allUnits())).toContainEqual(
       expect.objectContaining({
         id: "bed-hold-WF-004",
         title: "Bed hold expired",
@@ -229,13 +234,13 @@ describe("buildActionInbox", () => {
         movement.stage === "bed_held" && movement.bedHeldUntil !== undefined && movement.bedHeldUntil < NOW_ANCHOR,
     ).length;
 
-    expect(buildActionInbox(wardMovements, NOW_ANCHOR)).toHaveLength(
+    expect(buildActionInbox(wardMovements, NOW_ANCHOR, allUnits())).toHaveLength(
       legalCount + declineCount + transportCount + expiredHoldCount,
     );
   });
 
   it("gives every item a unique id even with several movements in the same category", () => {
-    const items = buildActionInbox(wardMovements, NOW_ANCHOR);
+    const items = buildActionInbox(wardMovements, NOW_ANCHOR, allUnits());
     const ids = items.map((item) => item.id);
     expect(new Set(ids).size).toBe(ids.length);
   });
@@ -249,7 +254,7 @@ describe("buildActionInbox", () => {
     expect(movement?.legalForm?.code).toBe("3B");
     expect(movement?.legalForm?.dueAt).toBeUndefined();
 
-    const items = buildActionInbox(wardMovements, NOW_ANCHOR);
+    const items = buildActionInbox(wardMovements, NOW_ANCHOR, allUnits());
     expect(items.find((item) => item.id === "legal-WF-003")).toBeUndefined();
   });
 });
@@ -398,3 +403,40 @@ describe("transportLeg", () => {
     expect(transportLeg(cancelledAfterProgress)).toBe("Cancelled");
   });
 });
+
+describe("destinationNoLongerLawful", () => {
+  // "sjgs-adult-open" is a real fixture unit that is `authorised: false` — private, and never
+  // authorised to receive an involuntary admission under the Mental Health Act (see its own
+  // comment in ward-sites.ts).
+  const UNAUTHORISED_UNIT_ID = "sjgs-adult-open";
+
+  it("returns the accepted unit when the current legal status requires authorisation and the accepted unit does not have it", () => {
+    const movement = movementFrom({ legalStatus: "Involuntary inpatient", acceptedUnitId: UNAUTHORISED_UNIT_ID });
+    const flagged = destinationNoLongerLawful(movement, allUnits());
+    expect(flagged?.id).toBe(UNAUTHORISED_UNIT_ID);
+  });
+
+  it("returns undefined for the same movement when it is Voluntary — Voluntary needs no authorisation", () => {
+    const movement = movementFrom({ legalStatus: "Voluntary", acceptedUnitId: UNAUTHORISED_UNIT_ID });
+    expect(destinationNoLongerLawful(movement, allUnits())).toBeUndefined();
+  });
+
+  it("returns undefined for a closed movement, even with an unauthorised accepted unit and a status requiring authorisation", () => {
+    const movement = movementFrom({
+      legalStatus: "Involuntary inpatient",
+      acceptedUnitId: UNAUTHORISED_UNIT_ID,
+      closure: { at: NOW_ANCHOR, outcome: "arrived", reason: "arrived at unit" },
+    });
+    expect(destinationNoLongerLawful(movement, allUnits())).toBeUndefined();
+  });
+
+  it("returns undefined when the accepted unit IS authorised", () => {
+    const movement = movementFrom({ legalStatus: "Involuntary inpatient", acceptedUnitId: "rph-adult-secure" });
+    expect(destinationNoLongerLawful(movement, allUnits())).toBeUndefined();
+  });
+
+  it("returns undefined when there is no accepted unit at all", () => {
+    const movement = movementFrom({ legalStatus: "Involuntary inpatient", acceptedUnitId: undefined });
+    expect(destinationNoLongerLawful(movement, allUnits())).toBeUndefined();
+  });
+});
diff --git a/tests/ward-eligibility.test.ts b/tests/ward-eligibility.test.ts
index d631c1b3dd..2b636fc764 100644
--- a/tests/ward-eligibility.test.ts
+++ b/tests/ward-eligibility.test.ts
@@ -36,6 +36,7 @@ function movement(overrides: Partial<Movement> = {}): Movement {
     specialling: false,
     legalStatus: "Voluntary",
     statusChanges: [],
+    urgencyChanges: [],
     stage: "destination_review",
     owner: "Flow coordinator",
     referredUnitIds: [],
diff --git a/tests/ward-flow-reducer.test.ts b/tests/ward-flow-reducer.test.ts
index 024d564152..77ce50dd58 100644
--- a/tests/ward-flow-reducer.test.ts
+++ b/tests/ward-flow-reducer.test.ts
@@ -829,3 +829,119 @@ describe("arrival capacity floor", () => {
     expect(after.empty.value).toBe(0);
   });
 });
+
+describe("urgency and legal status changes (Task 2)", () => {
+  it("records an urgency change with who made it, from both permitted roles", () => {
+    const seeded = seedWardFlowState();
+    const target = seeded.movements.find((candidate) => candidate.urgency !== 1)!;
+    const after = wardFlowReducer(seeded, {
+      type: "CHANGE_URGENCY",
+      role: "coordinator",
+      now: NOW,
+      movementId: target.id,
+      urgency: 1,
+      reason: "reassessed",
+    });
+    const updated = after.movements.find((candidate) => candidate.id === target.id)!;
+    expect(updated.urgency).toBe(1);
+    expect(updated.urgencyChanges).toHaveLength(1);
+    expect(updated.urgencyChanges[0]).toMatchObject({
+      from: target.urgency,
+      to: 1,
+      by: "coordinator",
+      reason: "reassessed",
+    });
+    expect(after.rejections).toHaveLength(0);
+
+    const fromEd = wardFlowReducer(seeded, {
+      type: "CHANGE_URGENCY",
+      role: "ed",
+      now: NOW,
+      movementId: target.id,
+      urgency: 1,
+      reason: "reassessed",
+    });
+    expect(fromEd.rejections).toHaveLength(0);
+  });
+
+  it("refuses an urgency change from a role that may not make one", () => {
+    const seeded = seedWardFlowState();
+    const target = seeded.movements[0];
+    const after = wardFlowReducer(seeded, {
+      type: "CHANGE_URGENCY",
+      role: "officer",
+      now: NOW,
+      movementId: target.id,
+      urgency: 1,
+      reason: "reassessed",
+    });
+    expect(after.rejections).toHaveLength(1);
+    expect(after.movements.find((candidate) => candidate.id === target.id)!.urgency).toBe(target.urgency);
+  });
+
+  it("records a legal status change and never re-sorts or un-accepts the patient", () => {
+    const seeded = seedWardFlowState();
+
+    // The brief's literal precondition (legalStatus === "Voluntary" && acceptedUnitId !==
+    // undefined) is satisfied by three fixture movements — WF-007, WF-008 and WF-015 — but the
+    // first two are both CLOSED (WF-007 "arrived", WF-008 "did_not_proceed") and sort earlier in
+    // fixture array order than WF-015, the only OPEN one. A naive `.find()` over just those two
+    // fields would therefore resolve to a closed movement, exercising the closed-movement
+    // rejection path rather than the success path this test is about — a trap in the fixture's
+    // own ordering, not a defect in the reducer. Constructed explicitly instead, from a real open
+    // Voluntary movement (WF-002) with `acceptedUnitId` set directly, so the outcome never
+    // depends on which movement the fixture happens to put first.
+    const base = seeded.movements.find((candidate) => candidate.id === "WF-002")!;
+    const withAcceptedUnit = { ...base, legalStatus: "Voluntary" as const, acceptedUnitId: "fsh-older-adult" };
+    const seededWithAcceptedVoluntary = {
+      ...seeded,
+      movements: seeded.movements.map((candidate) =>
+        candidate.id === withAcceptedUnit.id ? withAcceptedUnit : candidate,
+      ),
+    };
+
+    const after = wardFlowReducer(seededWithAcceptedVoluntary, {
+      type: "CHANGE_LEGAL_STATUS",
+      role: "ed",
+      now: NOW,
+      movementId: withAcceptedUnit.id,
+      legalStatus: "Involuntary inpatient",
+      reason: "recorded_by_treating_team",
+    });
+    const updated = after.movements.find((candidate) => candidate.id === withAcceptedUnit.id)!;
+    expect(updated.legalStatus).toBe("Involuntary inpatient");
+    expect(updated.statusChanges).toHaveLength(1);
+    expect(updated.statusChanges[0]).toMatchObject({
+      from: "Voluntary",
+      to: "Involuntary inpatient",
+      by: "ed",
+    });
+    // Nothing auto-allocates: the accepted unit, the stage and the referrals are untouched.
+    expect(updated.acceptedUnitId).toBe(withAcceptedUnit.acceptedUnitId);
+    expect(updated.stage).toBe(withAcceptedUnit.stage);
+    expect(updated.referredUnitIds).toEqual(withAcceptedUnit.referredUnitIds);
+  });
+
+  it("refuses both changes on a closed movement, naming the closure reason", () => {
+    const seeded = seedWardFlowState();
+    const target = seeded.movements[0];
+    const closed = {
+      ...seeded,
+      movements: seeded.movements.map((candidate) =>
+        candidate.id === target.id
+          ? { ...candidate, closure: { at: NOW, outcome: "arrived" as const, reason: "arrived at unit" } }
+          : candidate,
+      ),
+    };
+    const after = wardFlowReducer(closed, {
+      type: "CHANGE_URGENCY",
+      role: "coordinator",
+      now: NOW,
+      movementId: target.id,
+      urgency: 1,
+      reason: "reassessed",
+    });
+    expect(after.rejections).toHaveLength(1);
+    expect(after.rejections[0].reason).toContain("arrived at unit");
+  });
+});
diff --git a/tests/ward-legal-figure-guard.test.ts b/tests/ward-legal-figure-guard.test.ts
index d6ac32f1fd..09a59a7d49 100644
--- a/tests/ward-legal-figure-guard.test.ts
+++ b/tests/ward-legal-figure-guard.test.ts
@@ -3,6 +3,10 @@ import { join } from "node:path";
 import ts from "typescript";
 import { describe, expect, it } from "vitest";
 
+import {
+  LEGAL_STATUS_CHANGE_REASONS,
+  URGENCY_CHANGE_REASONS,
+} from "../src/components/ward-management/ward-change-reasons";
 import { EVENT_ROLE, type WardFlowEvent } from "../src/components/ward-management/ward-flow-events";
 import {
   seedWardFlowState,
@@ -359,6 +363,15 @@ function scanWardFiles(): ScannedFile[] {
 /** Every event type in the union, taken from the role table so a new variant cannot be forgotten. */
 const ALL_EVENT_TYPES = Object.keys(EVENT_ROLE) as WardFlowEvent["type"][];
 
+/** Every `LegalStatus` value, hand-listed — `ward-model.ts` exports the type but no runtime list
+ *  of its members, the same reason `ed-screen.tsx` keeps its own `LEGAL_STATUS_OPTIONS`. */
+const LEGAL_STATUS_OPTIONS: LegalStatus[] = [
+  "Voluntary",
+  "Referred for psychiatric examination",
+  "Detained awaiting examination",
+  "Involuntary inpatient",
+];
+
 /**
  * Candidate events of one type, generated against the CURRENT state rather than hard-coded, so a
  * fixture change cannot silently make the traversal untestable. Every candidate carries the role
@@ -366,7 +379,11 @@ const ALL_EVENT_TYPES = Object.keys(EVENT_ROLE) as WardFlowEvent["type"][];
  * event proves nothing about what the reducer body does.
  */
 function candidateEvents(type: WardFlowEvent["type"], state: WardFlowState, now: number): WardFlowEvent[] {
-  const role = EVENT_ROLE[type];
+  // `EVENT_ROLE[type]` is a non-empty list of permitted roles (widened this task, spec D2); any
+  // one of them is refused by the role check identically to any other, so the first is enough to
+  // get past the gate and exercise the reducer body — the coverage this sweep is checking never
+  // depends on which of two permitted roles raised the event.
+  const role = EVENT_ROLE[type][0];
   const movementIds = state.movements.map((movement) => movement.id);
   const unitIds = state.units.map((unit) => unit.id);
   const pairs = movementIds.flatMap((movementId) => unitIds.map((unitId) => ({ movementId, unitId })));
@@ -444,6 +461,31 @@ function candidateEvents(type: WardFlowEvent["type"], state: WardFlowState, now:
         triedUnitIds: unitIds.slice(0, 1),
         contact: "State-wide bed coordination line",
       }));
+    case "CHANGE_URGENCY":
+      // One candidate per urgency tier — the same precedent SET_SCENARIO sets below — so the
+      // sweep cannot silently leave two of the three tiers untested.
+      return movementIds.flatMap((movementId) =>
+        ([1, 2, 3] as const).map((urgency) => ({
+          type,
+          role,
+          now,
+          movementId,
+          urgency,
+          reason: URGENCY_CHANGE_REASONS[0],
+        })),
+      );
+    case "CHANGE_LEGAL_STATUS":
+      // One candidate per legal status, for the same reason.
+      return movementIds.flatMap((movementId) =>
+        LEGAL_STATUS_OPTIONS.map((legalStatus) => ({
+          type,
+          role,
+          now,
+          movementId,
+          legalStatus,
+          reason: LEGAL_STATUS_CHANGE_REASONS[0],
+        })),
+      );
     case "ADVANCE_CLOCK":
       return [{ type, role, now, minutes: 30 }];
     case "RESET_SCENARIO":
@@ -468,6 +510,8 @@ const MOVEMENT_TARGETED_EVENTS: ReadonlySet<WardFlowEvent["type"]> = new Set([
   "PATIENT_COLLECTED",
   "PATIENT_ARRIVED",
   "RECORD_ESCALATION",
+  "CHANGE_URGENCY",
+  "CHANGE_LEGAL_STATUS",
 ]);
 
 /**
@@ -790,7 +834,7 @@ describe("Mental Health Act figures cannot return to the ward model", () => {
     for (const scenario of WARD_SCENARIOS) {
       const setScenario = wardFlowReducer(seedWardFlowState(), {
         type: "SET_SCENARIO",
-        role: EVENT_ROLE.SET_SCENARIO,
+        role: EVENT_ROLE.SET_SCENARIO[0],
         now: NOW_ANCHOR,
         scenario,
       });

From 18ce659cfd43747eccf3119177ec79005787cdc7 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 05:57:44 +0800
Subject: [PATCH 06/54] Document the one mutation in destinationNoLongerLawful
 that cannot kill its test

The acceptedUnitId guard is redundant by behaviour - the find below returns undefined
for an undefined id anyway - so no test can observe its removal. The implementer
correctly reported the surviving mutation instead of reshaping the test around it.
Recorded in place so the line is not mistaken for load-bearing, and so the survival is
explained rather than sitting silently in a report.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/components/ward-management/ward-derivations.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/components/ward-management/ward-derivations.ts b/src/components/ward-management/ward-derivations.ts
index 33d5b2f225..f7f84000ec 100644
--- a/src/components/ward-management/ward-derivations.ts
+++ b/src/components/ward-management/ward-derivations.ts
@@ -113,6 +113,11 @@ export function isOpen(movement: Movement): boolean {
 export function destinationNoLongerLawful(movement: Movement, units: Unit[]): Unit | undefined {
   if (!isOpen(movement)) return undefined;
   if (!requiresAuthorisedDestination(movement.legalStatus)) return undefined;
+  // Redundant by behaviour, kept for readability: the `find` below would return `undefined` for an
+  // undefined id anyway, so removing this line is behaviour-preserving and no test can observe it.
+  // Recorded rather than deleted so a future reader does not mistake it for load-bearing — and
+  // recorded rather than left silent because mutating it is the one mutation in this function that
+  // does not kill its test, which is a property of the line, not a gap in the test.
   if (movement.acceptedUnitId === undefined) return undefined;
   const unit = units.find((candidate) => candidate.id === movement.acceptedUnitId);
   if (unit === undefined) return undefined;

From aea4dc6b2d4d8e263ba5adda0d7ae61e637ea366 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 06:43:44 +0800
Subject: [PATCH 07/54] Ward Flow: a held bed can be released and a transport
 cancelled without closing the patient

---
 .../coordinator/shortlist-panel.tsx           | 138 ++++++++++++++++
 .../ward-management/ward-change-reasons.ts    |  38 ++++-
 .../ward-management/ward-flow-events.ts       |  37 ++++-
 .../ward-management/ward-flow-reducer.ts      |  88 ++++++++++
 src/components/ward-management/ward-model.ts  |  21 +++
 .../ward-management/ward-movements.ts         |  19 +++
 .../ward-management/ward/ward-screen.tsx      | 151 ++++++++++++++++++
 tests/ward-change-reasons.test.ts             |  66 +++++++-
 tests/ward-eligibility.test.ts                |   1 +
 tests/ward-flow-reducer.test.ts               |  80 ++++++++++
 tests/ward-legal-figure-guard.test.ts         |  14 ++
 11 files changed, 645 insertions(+), 8 deletions(-)

diff --git a/src/components/ward-management/coordinator/shortlist-panel.tsx b/src/components/ward-management/coordinator/shortlist-panel.tsx
index 29affc2b4d..2a4edf21a5 100644
--- a/src/components/ward-management/coordinator/shortlist-panel.tsx
+++ b/src/components/ward-management/coordinator/shortlist-panel.tsx
@@ -4,10 +4,14 @@ import { CheckCircle2, CircleAlert } from "lucide-react";
 import { useMemo, useState, type Dispatch, type FormEvent } from "react";
 
 import {
+  CANCEL_TRANSPORT_REASONS,
   changeReasonLabels,
   LEGAL_STATUS_CHANGE_REASONS,
+  RELEASE_HOLD_REASONS,
   URGENCY_CHANGE_REASONS,
+  type CancelTransportReason,
   type LegalStatusChangeReason,
+  type ReleaseHoldReason,
   type UrgencyChangeReason,
 } from "@/components/ward-management/ward-change-reasons";
 import { clockState, formatInstant, minutesUntil, type Instant } from "@/components/ward-management/ward-clock";
@@ -192,6 +196,15 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
     legalStatus: LegalStatus;
     reason: LegalStatusChangeReason;
   }>({ legalStatus: movement?.legalStatus ?? "Voluntary", reason: LEGAL_STATUS_CHANGE_REASONS[0] });
+  // Task 3: the undo the prototype has never had. Both forms only ever OPEN when the reducer
+  // would actually accept the event — see `canReleaseHold`/`canCancelTransport` below — so
+  // neither control can advertise an action the reducer would silently refuse.
+  const [releaseHoldOpen, setReleaseHoldOpen] = useState(false);
+  const [releaseHoldReason, setReleaseHoldReason] = useState<ReleaseHoldReason>(RELEASE_HOLD_REASONS[0]);
+  const [cancelTransportOpen, setCancelTransportOpen] = useState(false);
+  const [cancelTransportReason, setCancelTransportReason] = useState<CancelTransportReason>(
+    CANCEL_TRANSPORT_REASONS[0],
+  );
 
   // A confirmation, an open override form, or a referral selection all belong to the movement
   // they were made against — moving to a different movement must never leave a stale "Referred"
@@ -211,6 +224,10 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
     setUrgencyDraft({ urgency: movement?.urgency ?? 1, reason: URGENCY_CHANGE_REASONS[0] });
     setLegalStatusChangeOpen(false);
     setLegalStatusDraft({ legalStatus: movement?.legalStatus ?? "Voluntary", reason: LEGAL_STATUS_CHANGE_REASONS[0] });
+    setReleaseHoldOpen(false);
+    setReleaseHoldReason(RELEASE_HOLD_REASONS[0]);
+    setCancelTransportOpen(false);
+    setCancelTransportReason(CANCEL_TRANSPORT_REASONS[0]);
   }
 
   if (!movement) {
@@ -225,6 +242,16 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
   const movementId = movement.id;
   const declinedUnitIds = movement.declines.map((decline) => decline.unitId);
 
+  // Task 3: each control renders ONLY when the reducer would accept it — never dispatched
+  // optimistically and left for the reducer to refuse silently (the defect Task 5's `canRefer`
+  // exists to prevent, applied here to the undo path). Mirrors `RELEASE_HOLD`/`CANCEL_TRANSPORT`'s
+  // own preconditions in `ward-flow-reducer.ts` exactly.
+  const canReleaseHold = movement.stage === "bed_held";
+  const canCancelTransport =
+    movement.transport !== undefined &&
+    movement.transport.cancelledAt === undefined &&
+    movement.transport.arrivedAt === undefined;
+
   const originEd = allEmergencyDepartments().find((ed) => ed.id === movement.originEdId);
   // Neutral "currently at" language, never framed as an authorisation requirement — authorisation
   // gates the destination only, and a patient's current ED is never itself a compliance problem.
@@ -402,6 +429,31 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
     setLegalStatusChangeOpen(false);
   }
 
+  /**
+   * Releases a held bed back to allocatable WITHOUT closing the movement, clearing `legalForm`,
+   * or touching `referredUnitIds` — the patient survives and keeps their acceptance; only the
+   * hold itself unwinds. Dispatched as role "coordinator", so no `actingUnitId` is needed — a
+   * coordinator may release a hold at any unit.
+   */
+  function submitReleaseHold(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    if (!canReleaseHold) return;
+    dispatch({ type: "RELEASE_HOLD", role: "coordinator", now, movementId, reason: releaseHoldReason });
+    setReleaseHoldOpen(false);
+  }
+
+  /**
+   * Cancels the transport job WITHOUT closing the movement — the bed itself (held or already
+   * occupied) is untouched by this handler. Dispatched as role "coordinator", so no
+   * `actingUnitId` is needed.
+   */
+  function submitCancelTransport(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    if (!canCancelTransport) return;
+    dispatch({ type: "CANCEL_TRANSPORT", role: "coordinator", now, movementId, reason: cancelTransportReason });
+    setCancelTransportOpen(false);
+  }
+
   // Structurally incapable of claiming an override succeeded when it did not: this checks the
   // movement's OWN post-dispatch `referredUnitIds` — read fresh on every render from the live
   // provider — not a flag captured once at click time. Override is not stage-gated (see the
@@ -618,6 +670,92 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
         ) : null}
       </section>
 
+      {/* Task 3: the undo the prototype has never had. Before this, the only path that released a
+          held bed or cancelled a transport job was closing the movement outright, by recording an
+          examination with outcome community_order or revoked. Each control renders only while the
+          reducer would actually accept it — see `canReleaseHold`/`canCancelTransport` above. */}
+      {canReleaseHold || canCancelTransport ? (
+        <section aria-label="Release or cancel">
+          <h4 className={styles.shortlistSectionHeading}>Release hold or cancel transport</h4>
+          <div className={styles.shortlistActionRow}>
+            {canReleaseHold ? (
+              <button
+                type="button"
+                data-testid="ward-release-hold-toggle"
+                aria-expanded={releaseHoldOpen}
+                className={styles.shortlistOverrideButton}
+                onClick={() => setReleaseHoldOpen((open) => !open)}
+              >
+                Release the held bed
+              </button>
+            ) : null}
+            {canCancelTransport ? (
+              <button
+                type="button"
+                data-testid="ward-cancel-transport-toggle"
+                aria-expanded={cancelTransportOpen}
+                className={styles.shortlistOverrideButton}
+                onClick={() => setCancelTransportOpen((open) => !open)}
+              >
+                Cancel transport
+              </button>
+            ) : null}
+          </div>
+
+          {canReleaseHold && releaseHoldOpen ? (
+            <form className={styles.shortlistOverrideForm} onSubmit={submitReleaseHold} data-testid="ward-release-hold">
+              <label className={styles.shortlistOverrideLabel} htmlFor="ward-release-hold-reason">
+                Reason for releasing the held bed for {movement.id}
+              </label>
+              <select
+                id="ward-release-hold-reason"
+                required
+                className={styles.shortlistOverrideSelect}
+                value={releaseHoldReason}
+                onChange={(event) => setReleaseHoldReason(event.target.value as ReleaseHoldReason)}
+              >
+                {RELEASE_HOLD_REASONS.map((reason) => (
+                  <option key={reason} value={reason}>
+                    {changeReasonLabels[reason]}
+                  </option>
+                ))}
+              </select>
+              <button type="submit" className={styles.shortlistOverrideSubmit}>
+                Release the held bed
+              </button>
+            </form>
+          ) : null}
+
+          {canCancelTransport && cancelTransportOpen ? (
+            <form
+              className={styles.shortlistOverrideForm}
+              onSubmit={submitCancelTransport}
+              data-testid="ward-cancel-transport"
+            >
+              <label className={styles.shortlistOverrideLabel} htmlFor="ward-cancel-transport-reason">
+                Reason for cancelling transport for {movement.id}
+              </label>
+              <select
+                id="ward-cancel-transport-reason"
+                required
+                className={styles.shortlistOverrideSelect}
+                value={cancelTransportReason}
+                onChange={(event) => setCancelTransportReason(event.target.value as CancelTransportReason)}
+              >
+                {CANCEL_TRANSPORT_REASONS.map((reason) => (
+                  <option key={reason} value={reason}>
+                    {changeReasonLabels[reason]}
+                  </option>
+                ))}
+              </select>
+              <button type="submit" className={styles.shortlistOverrideSubmit}>
+                Cancel transport
+              </button>
+            </form>
+          ) : null}
+        </section>
+      ) : null}
+
       <section aria-label="Candidate units">
         {/* Whole-branch review Critical 1: this list was headed "Nearest candidates", a proximity
             claim the model cannot support — `Unit` has no distance, geo, locality or catchment
diff --git a/src/components/ward-management/ward-change-reasons.ts b/src/components/ward-management/ward-change-reasons.ts
index bb35ba0651..a5815c29b8 100644
--- a/src/components/ward-management/ward-change-reasons.ts
+++ b/src/components/ward-management/ward-change-reasons.ts
@@ -15,9 +15,45 @@ export type UrgencyChangeReason = (typeof URGENCY_CHANGE_REASONS)[number];
 export const LEGAL_STATUS_CHANGE_REASONS = ["recorded_by_treating_team", "correcting_an_error"] as const;
 export type LegalStatusChangeReason = (typeof LEGAL_STATUS_CHANGE_REASONS)[number];
 
-export const changeReasonLabels: Record<UrgencyChangeReason | LegalStatusChangeReason, string> = {
+/**
+ * Task 3: the undo the prototype has never had. Same discipline as the two lists above — chosen,
+ * never typed, operational and content-free. Neither describes a patient, a diagnosis, a clinical
+ * judgement or a legal requirement.
+ */
+export const RELEASE_HOLD_REASONS = [
+  "patient_no_longer_coming",
+  "bed_needed_for_another_patient",
+  "ward_withdrew_the_bed",
+  "hold_made_in_error",
+] as const;
+export type ReleaseHoldReason = (typeof RELEASE_HOLD_REASONS)[number];
+
+export const CANCEL_TRANSPORT_REASONS = [
+  "provider_unavailable",
+  "patient_not_ready",
+  "destination_changed",
+  "job_created_in_error",
+] as const;
+export type CancelTransportReason = (typeof CANCEL_TRANSPORT_REASONS)[number];
+
+export const changeReasonLabels: Record<
+  UrgencyChangeReason | LegalStatusChangeReason | ReleaseHoldReason | CancelTransportReason,
+  string
+> = {
   reassessed: "Reassessed",
   new_information: "New information",
   correcting_an_error: "Correcting an error",
   recorded_by_treating_team: "Recorded by treating team",
+  // These three labels deliberately avoid the word "patient" even though the underlying reason
+  // VALUE (fixed by the product brief, never renamed) carries it — `tests/ward-change-reasons.test.ts`
+  // bans that token from any reason value or label it can rewrite, and the label text is the part
+  // this file controls.
+  patient_no_longer_coming: "No longer coming",
+  bed_needed_for_another_patient: "Bed needed elsewhere",
+  ward_withdrew_the_bed: "Ward withdrew the bed",
+  hold_made_in_error: "Hold made in error",
+  provider_unavailable: "Provider unavailable",
+  patient_not_ready: "Not yet ready",
+  destination_changed: "Destination changed",
+  job_created_in_error: "Job created in error",
 };
diff --git a/src/components/ward-management/ward-flow-events.ts b/src/components/ward-management/ward-flow-events.ts
index de214215b7..ec128f2a3f 100644
--- a/src/components/ward-management/ward-flow-events.ts
+++ b/src/components/ward-management/ward-flow-events.ts
@@ -1,5 +1,10 @@
 import type { Instant } from "@/components/ward-management/ward-clock";
-import type { LegalStatusChangeReason, UrgencyChangeReason } from "@/components/ward-management/ward-change-reasons";
+import type {
+  CancelTransportReason,
+  LegalStatusChangeReason,
+  ReleaseHoldReason,
+  UrgencyChangeReason,
+} from "@/components/ward-management/ward-change-reasons";
 import type { Cohort, DeclineReason, LegalStatus, Security, Sex } from "@/components/ward-management/ward-model";
 import type { WardScenario } from "@/components/ward-management/ward-scenarios";
 
@@ -104,6 +109,34 @@ export type WardFlowEvent =
       movementId: string;
       legalStatus: LegalStatus;
       reason: LegalStatusChangeReason;
+    }
+  | {
+      type: "RELEASE_HOLD";
+      role: WardFlowRole;
+      now: Instant;
+      movementId: string;
+      reason: ReleaseHoldReason;
+      /**
+       * The unit the caller stated it was acting as. Required for a `ward` caller, unused for a
+       * `coordinator` caller. This records the caller's CLAIM about itself and does not prove it:
+       * nothing here authenticates anything, and this model has no identity model. The comparison
+       * constrains future callers rather than this one.
+       */
+      actingUnitId?: string;
+    }
+  | {
+      type: "CANCEL_TRANSPORT";
+      role: WardFlowRole;
+      now: Instant;
+      movementId: string;
+      reason: CancelTransportReason;
+      /**
+       * The unit the caller stated it was acting as. Required for a `ward` caller, unused for a
+       * `coordinator` caller. This records the caller's CLAIM about itself and does not prove it:
+       * nothing here authenticates anything, and this model has no identity model. The comparison
+       * constrains future callers rather than this one.
+       */
+      actingUnitId?: string;
     };
 
 /**
@@ -134,4 +167,6 @@ export const EVENT_ROLE: Record<WardFlowEvent["type"], readonly WardFlowRole[]>
   SET_SCENARIO: ["demo"],
   CHANGE_URGENCY: ["coordinator", "ed"],
   CHANGE_LEGAL_STATUS: ["coordinator", "ed"],
+  RELEASE_HOLD: ["coordinator", "ward"],
+  CANCEL_TRANSPORT: ["coordinator", "ward"],
 };
diff --git a/src/components/ward-management/ward-flow-reducer.ts b/src/components/ward-management/ward-flow-reducer.ts
index 6ecf043dd3..ab719e7196 100644
--- a/src/components/ward-management/ward-flow-reducer.ts
+++ b/src/components/ward-management/ward-flow-reducer.ts
@@ -177,6 +177,7 @@ export function wardFlowReducer(state: WardFlowState, event: WardFlowEvent): War
         declines: [],
         blocker: "Awaiting coordinator referral",
         withdrawnReferrals: [],
+        unwinds: [],
         // `formedAt` is deliberately left unset. It used to be stamped in this same branch, on
         // the strength of the status-derived Form 1A that has now been deleted; with that
         // derivation gone there is no rule left to hang it on, and inventing a replacement one
@@ -579,5 +580,92 @@ export function wardFlowReducer(state: WardFlowState, event: WardFlowEvent): War
       };
       return replaceMovement(state, movement.id, updated);
     }
+
+    case "RELEASE_HOLD": {
+      const movement = findMovement(state, event.movementId);
+      if (!movement) return reject(state, event, `no movement found for id ${event.movementId}`);
+      if (movement.closure) {
+        return reject(state, event, `cannot release a hold for a closed movement (${movement.closure.reason})`);
+      }
+      if (movement.stage !== "bed_held") {
+        return reject(state, event, `cannot release a hold while the movement is ${movement.stage}`);
+      }
+      // Same claim-not-proof discipline as CONFIRM_CAPACITY: this compares what the caller SAID
+      // it was acting as against the unit actually holding the bed, and refuses when they differ.
+      // Unused for a coordinator caller, who may act on behalf of any unit.
+      if (event.role === "ward" && event.actingUnitId !== movement.acceptedUnitId) {
+        return reject(
+          state,
+          event,
+          `RELEASE_HOLD was raised acting as unit ${event.actingUnitId} but movement ${movement.id}'s bed is held at ${movement.acceptedUnitId}`,
+        );
+      }
+      if (!movement.acceptedUnitId) {
+        return reject(state, event, `movement ${movement.id} has no accepted unit holding a bed`);
+      }
+      const unit = findUnit(state, movement.acceptedUnitId);
+      if (!unit) return reject(state, event, `no unit found for id ${movement.acceptedUnitId}`);
+
+      // The EXACT inverse of HOLD_BED's own writes (ruling P4-1) — every field HOLD_BED sets,
+      // undone, and nothing else touched. HOLD_BED writes four fields: `unit.allocatable.value`
+      // (-1), `unit.allocatable.confirmedAt` (event.now), `movement.stage` ("bed_held") and
+      // `movement.bedHeldUntil` (event.now + 60). It does NOT touch `Unit.held` — that field is
+      // seed-only data; the live held count on every screen is `unitCapacity()`'s own derivation
+      // from `empty` and `allocatable`, so giving back the bed by raising `allocatable.value` is
+      // the whole correction, on both fields HOLD_BED actually wrote to the unit.
+      const releasedUnit: Unit = {
+        ...unit,
+        allocatable: { ...unit.allocatable, value: unit.allocatable.value + 1, confirmedAt: event.now },
+      };
+      // Never closes the movement, never clears `legalForm`, never touches `referredUnitIds` —
+      // the patient survives and keeps their acceptance; only the hold itself unwinds.
+      const updatedMovement: Movement = {
+        ...movement,
+        stage: "accepted_awaiting_bed",
+        bedHeldUntil: undefined,
+        unwinds: [...movement.unwinds, { at: event.now, kind: "hold_released", by: event.role, reason: event.reason }],
+      };
+      const withUnit = replaceUnit(state, unit.id, releasedUnit);
+      return replaceMovement(withUnit, movement.id, updatedMovement);
+    }
+
+    case "CANCEL_TRANSPORT": {
+      const movement = findMovement(state, event.movementId);
+      if (!movement) return reject(state, event, `no movement found for id ${event.movementId}`);
+      if (movement.closure) {
+        return reject(state, event, `cannot cancel transport for a closed movement (${movement.closure.reason})`);
+      }
+      if (!movement.transport) {
+        return reject(state, event, `movement ${movement.id} has no transport job to cancel`);
+      }
+      if (movement.transport.cancelledAt !== undefined) {
+        return reject(state, event, `transport for movement ${movement.id} was already cancelled`);
+      }
+      if (movement.transport.arrivedAt !== undefined) {
+        return reject(state, event, `cannot cancel transport for movement ${movement.id} — the patient has arrived`);
+      }
+      // Same claim-not-proof discipline as CONFIRM_CAPACITY: this compares what the caller SAID
+      // it was acting as against the unit the movement is accepted at, and refuses when they
+      // differ. Unused for a coordinator caller, who may act on behalf of any unit.
+      if (event.role === "ward" && event.actingUnitId !== movement.acceptedUnitId) {
+        return reject(
+          state,
+          event,
+          `CANCEL_TRANSPORT was raised acting as unit ${event.actingUnitId} but movement ${movement.id} is accepted at ${movement.acceptedUnitId ?? "no unit"}`,
+        );
+      }
+      // Never closes the movement — the patient stays open, only the transport job unwinds. The
+      // bed itself (if still held or already occupied) is untouched by this handler.
+      const updatedMovement: Movement = {
+        ...movement,
+        stage: "handover_ready",
+        transport: { ...movement.transport, cancelledAt: event.now },
+        unwinds: [
+          ...movement.unwinds,
+          { at: event.now, kind: "transport_cancelled", by: event.role, reason: event.reason },
+        ],
+      };
+      return replaceMovement(state, movement.id, updatedMovement);
+    }
   }
 }
diff --git a/src/components/ward-management/ward-model.ts b/src/components/ward-management/ward-model.ts
index 7542fff7f6..3b4e5edf5c 100644
--- a/src/components/ward-management/ward-model.ts
+++ b/src/components/ward-management/ward-model.ts
@@ -188,6 +188,24 @@ export type MovementClosure = {
   reason: string;
 };
 
+/**
+ * The undo the prototype has never had (Task 3, spec item 10). Before this, the only path that
+ * released a held bed or cancelled a transport job was closing the movement outright — recording
+ * an examination with outcome `community_order` or `revoked` — so a coordinator who held the
+ * wrong bed had to declare the patient does not need admission in order to correct it.
+ * `RELEASE_HOLD` and `CANCEL_TRANSPORT` unwind exactly one earlier reservation each, WITHOUT
+ * closing the movement, clearing `legalForm`, or touching `referredUnitIds` — the movement
+ * survives and keeps its acceptance. Every unwind is recorded here so the fact that a hold or a
+ * transport job was undone is never silently lost, the same discipline `StatusChange` and
+ * `UrgencyChange` already hold to for their own reversible facts.
+ */
+export type UnwindRecord = {
+  at: Instant;
+  kind: "hold_released" | "transport_cancelled";
+  by: string;
+  reason: string;
+};
+
 export type Movement = {
   id: string;
   /** Where the patient physically is. Detention here is lawful even when unauthorised. */
@@ -227,6 +245,9 @@ export type Movement = {
   withdrawnReferrals: { unitId: string; at: Instant; reason: string }[];
   /** Recorded when the network is exhausted. */
   escalation?: { at: Instant; triedUnitIds: string[]; contact: string };
+  /** Every hold released and transport job cancelled against this movement, oldest first. Empty
+   *  for a movement nothing has ever been unwound on. See `UnwindRecord`'s own doc comment. */
+  unwinds: UnwindRecord[];
 };
 
 /** A transition the reducer refused, surfaced on the coordinator screen rather than swallowed. */
diff --git a/src/components/ward-management/ward-movements.ts b/src/components/ward-management/ward-movements.ts
index d5cf26952c..0b502363f0 100644
--- a/src/components/ward-management/ward-movements.ts
+++ b/src/components/ward-management/ward-movements.ts
@@ -31,6 +31,7 @@ const seededMovements: Movement[] = [
     declines: [],
     blocker: "Confirming destination options",
     withdrawnReferrals: [],
+    unwinds: [],
   },
   {
     id: "WF-002",
@@ -50,6 +51,7 @@ const seededMovements: Movement[] = [
     declines: [],
     blocker: "Awaiting older-adult bed confirmation",
     withdrawnReferrals: [],
+    unwinds: [],
     formedAt: NOW_ANCHOR - 180 - 90,
     arrivalMode: "ambulance",
   },
@@ -76,6 +78,7 @@ const seededMovements: Movement[] = [
     declines: [],
     blocker: "Bed being made ready",
     withdrawnReferrals: [],
+    unwinds: [],
     arrivalMode: "ambulance",
     examination: { at: NOW_ANCHOR - 60, outcome: "inpatient_order" },
   },
@@ -103,6 +106,7 @@ const seededMovements: Movement[] = [
     declines: [],
     blocker: "Escort provider organising secure transport",
     withdrawnReferrals: [],
+    unwinds: [],
     bedHeldUntil: NOW_ANCHOR - 10,
   },
   {
@@ -132,6 +136,7 @@ const seededMovements: Movement[] = [
     },
     blocker: "Transport escort confirming departure time",
     withdrawnReferrals: [],
+    unwinds: [],
     formedAt: NOW_ANCHOR - 330 - 150,
   },
   {
@@ -175,6 +180,7 @@ const seededMovements: Movement[] = [
         reason: "Referral withdrawn once RGH Adult Secure confirmed the bed",
       },
     ],
+    unwinds: [],
   },
   {
     id: "WF-007",
@@ -196,6 +202,7 @@ const seededMovements: Movement[] = [
     blocker: "None — handover complete",
     closure: { at: NOW_ANCHOR - 5, outcome: "arrived", reason: "Handover complete at SCGH Older Adult" },
     withdrawnReferrals: [],
+    unwinds: [],
   },
   {
     id: "WF-008",
@@ -226,6 +233,7 @@ const seededMovements: Movement[] = [
       reason: "Patient self-discharged from ED before transport arrived",
     },
     withdrawnReferrals: [],
+    unwinds: [],
   },
   {
     id: "WF-009",
@@ -279,6 +287,7 @@ const seededMovements: Movement[] = [
     // capped at three parallel referrals.
     blocker: "No secure adult bed available across the network",
     withdrawnReferrals: [],
+    unwinds: [],
     arrivalMode: "police",
     examination: { at: NOW_ANCHOR - 100, outcome: "inpatient_order" },
     escalation: {
@@ -320,6 +329,7 @@ const seededMovements: Movement[] = [
     declines: [],
     blocker: "Awaiting destination response",
     withdrawnReferrals: [],
+    unwinds: [],
   },
   {
     id: "WF-011",
@@ -345,6 +355,7 @@ const seededMovements: Movement[] = [
     declines: [],
     blocker: "Awaiting single-room clean",
     withdrawnReferrals: [],
+    unwinds: [],
     bedHeldUntil: NOW_ANCHOR + 20,
   },
   {
@@ -380,6 +391,7 @@ const seededMovements: Movement[] = [
     declines: [],
     blocker: "Awaiting specialling roster confirmation",
     withdrawnReferrals: [],
+    unwinds: [],
   },
   {
     id: "WF-013",
@@ -399,6 +411,7 @@ const seededMovements: Movement[] = [
     declines: [],
     blocker: "Comparing two older-adult options",
     withdrawnReferrals: [],
+    unwinds: [],
     formedAt: NOW_ANCHOR - 200 - 120,
   },
   {
@@ -436,6 +449,7 @@ const seededMovements: Movement[] = [
     },
     blocker: "None — in transit",
     withdrawnReferrals: [],
+    unwinds: [],
   },
   {
     id: "WF-015",
@@ -457,6 +471,7 @@ const seededMovements: Movement[] = [
     transport: { id: "TR-1015", provider: "St John WA", escortRequired: false, acceptedAt: NOW_ANCHOR - 15 },
     blocker: "Awaiting transport escort",
     withdrawnReferrals: [],
+    unwinds: [],
   },
   {
     id: "WF-016",
@@ -478,6 +493,7 @@ const seededMovements: Movement[] = [
     declines: [],
     blocker: "Ward finalising bed clean",
     withdrawnReferrals: [],
+    unwinds: [],
     bedHeldUntil: NOW_ANCHOR + 45,
   },
   {
@@ -509,6 +525,7 @@ const seededMovements: Movement[] = [
     ],
     blocker: "Escalated to duty psychiatrist — breach imminent",
     withdrawnReferrals: [],
+    unwinds: [],
     examination: { at: NOW_ANCHOR - 260, outcome: "inpatient_order" },
   },
   {
@@ -541,6 +558,7 @@ const seededMovements: Movement[] = [
     // would fabricate exactly the kind of state this prototype must never invent, and nothing
     // else in this record (blocker text, stage, other fields) supports that history.
     withdrawnReferrals: [],
+    unwinds: [],
   },
 ];
 
@@ -675,6 +693,7 @@ function routineMovements(count: number, startIndex: number): Movement[] {
       declines: [],
       blocker: index % 5 === 0 ? "Awaiting destination response" : "No blocker",
       withdrawnReferrals: [],
+      unwinds: [],
       ...stageFields(stage, cohort, security, index),
     } satisfies Movement;
   });
diff --git a/src/components/ward-management/ward/ward-screen.tsx b/src/components/ward-management/ward/ward-screen.tsx
index c2dd9010b7..11f564fa36 100644
--- a/src/components/ward-management/ward/ward-screen.tsx
+++ b/src/components/ward-management/ward/ward-screen.tsx
@@ -2,6 +2,13 @@
 
 import { useState, type FormEvent } from "react";
 
+import {
+  CANCEL_TRANSPORT_REASONS,
+  changeReasonLabels,
+  RELEASE_HOLD_REASONS,
+  type CancelTransportReason,
+  type ReleaseHoldReason,
+} from "@/components/ward-management/ward-change-reasons";
 import { formatInstant, formatRemaining, minutesUntil } from "@/components/ward-management/ward-clock";
 import {
   elapsedLabel,
@@ -87,6 +94,13 @@ export function WardScreen({ unitId }: WardScreenProps) {
   const [declineOpenFor, setDeclineOpenFor] = useState<string | undefined>(undefined);
   const [declineReason, setDeclineReason] = useState<DeclineReason | undefined>(undefined);
   const [capacityValue, setCapacityValue] = useState<string>(() => String(unit?.allocatable.value ?? 0));
+  // Task 3: the undo the prototype has never had. Keyed by movementId, same pattern as
+  // `declineOpenFor`/`declineReason` above — at most one release form and one cancel form open
+  // at a time.
+  const [releaseOpenFor, setReleaseOpenFor] = useState<string | undefined>(undefined);
+  const [releaseReason, setReleaseReason] = useState<ReleaseHoldReason | undefined>(undefined);
+  const [cancelOpenFor, setCancelOpenFor] = useState<string | undefined>(undefined);
+  const [cancelReason, setCancelReason] = useState<CancelTransportReason | undefined>(undefined);
 
   if (!unit) {
     return (
@@ -160,6 +174,48 @@ export function WardScreen({ unitId }: WardScreenProps) {
     });
   }
 
+  function toggleRelease(movementId: string) {
+    setReleaseOpenFor((current) => (current === movementId ? undefined : movementId));
+    setReleaseReason(undefined);
+  }
+
+  function submitRelease(event: FormEvent<HTMLFormElement>, movementId: string) {
+    event.preventDefault();
+    if (!releaseReason) return;
+    // `actingUnitId` is this screen's own route parameter, exactly like `submitCapacity` above —
+    // it states which ward the caller says it is; it does not prove it.
+    dispatch({
+      type: "RELEASE_HOLD",
+      role: "ward",
+      now,
+      movementId,
+      actingUnitId: unitId,
+      reason: releaseReason,
+    });
+    setReleaseOpenFor(undefined);
+    setReleaseReason(undefined);
+  }
+
+  function toggleCancel(movementId: string) {
+    setCancelOpenFor((current) => (current === movementId ? undefined : movementId));
+    setCancelReason(undefined);
+  }
+
+  function submitCancel(event: FormEvent<HTMLFormElement>, movementId: string) {
+    event.preventDefault();
+    if (!cancelReason) return;
+    dispatch({
+      type: "CANCEL_TRANSPORT",
+      role: "ward",
+      now,
+      movementId,
+      actingUnitId: unitId,
+      reason: cancelReason,
+    });
+    setCancelOpenFor(undefined);
+    setCancelReason(undefined);
+  }
+
   return (
     <div className={styles.screen} data-testid="ward-unit-screen">
       <ClinicalRail />
@@ -350,6 +406,15 @@ export function WardScreen({ unitId }: WardScreenProps) {
                 const notice = restrictionNotice(movement, unit);
                 const canHold = movement.stage === "accepted_awaiting_bed";
                 const blocked = canHold ? holdBlockedReason(movement, unit) : undefined;
+                // Task 3: each control renders ONLY when the reducer would accept it — never
+                // dispatched optimistically and left for the reducer to refuse silently.
+                const canRelease = movement.stage === "bed_held";
+                const canCancel =
+                  movement.transport !== undefined &&
+                  movement.transport.cancelledAt === undefined &&
+                  movement.transport.arrivedAt === undefined;
+                const releaseOpen = releaseOpenFor === movement.id;
+                const cancelOpen = cancelOpenFor === movement.id;
                 return (
                   <li key={movement.id} data-testid={`ward-accepted-${movement.id}`} className={styles.card}>
                     <header className={styles.cardHeader}>
@@ -401,6 +466,92 @@ export function WardScreen({ unitId }: WardScreenProps) {
                         ) : null}
                       </div>
                     ) : null}
+                    {canRelease ? (
+                      <div className={styles.actionRow}>
+                        <button
+                          type="button"
+                          data-testid={`ward-release-hold-toggle-${movement.id}`}
+                          aria-expanded={releaseOpen}
+                          className={styles.declineButton}
+                          onClick={() => toggleRelease(movement.id)}
+                        >
+                          Release the held bed
+                        </button>
+                      </div>
+                    ) : null}
+                    {canRelease && releaseOpen ? (
+                      <form
+                        className={styles.declineForm}
+                        onSubmit={(event) => submitRelease(event, movement.id)}
+                        data-testid={`ward-release-hold-${movement.id}`}
+                      >
+                        <label className={styles.declineLegend} htmlFor={`ward-release-hold-reason-${movement.id}`}>
+                          Reason for releasing the held bed for {movement.id}
+                        </label>
+                        <select
+                          id={`ward-release-hold-reason-${movement.id}`}
+                          required
+                          className={styles.capacityInput}
+                          value={releaseReason ?? ""}
+                          onChange={(event) => setReleaseReason(event.target.value as ReleaseHoldReason)}
+                        >
+                          <option value="" disabled>
+                            Choose a reason
+                          </option>
+                          {RELEASE_HOLD_REASONS.map((reason) => (
+                            <option key={reason} value={reason}>
+                              {changeReasonLabels[reason]}
+                            </option>
+                          ))}
+                        </select>
+                        <button type="submit" disabled={!releaseReason} className={styles.declineSubmit}>
+                          Confirm release
+                        </button>
+                      </form>
+                    ) : null}
+                    {canCancel ? (
+                      <div className={styles.actionRow}>
+                        <button
+                          type="button"
+                          data-testid={`ward-cancel-transport-toggle-${movement.id}`}
+                          aria-expanded={cancelOpen}
+                          className={styles.declineButton}
+                          onClick={() => toggleCancel(movement.id)}
+                        >
+                          Cancel transport
+                        </button>
+                      </div>
+                    ) : null}
+                    {canCancel && cancelOpen ? (
+                      <form
+                        className={styles.declineForm}
+                        onSubmit={(event) => submitCancel(event, movement.id)}
+                        data-testid={`ward-cancel-transport-${movement.id}`}
+                      >
+                        <label className={styles.declineLegend} htmlFor={`ward-cancel-transport-reason-${movement.id}`}>
+                          Reason for cancelling transport for {movement.id}
+                        </label>
+                        <select
+                          id={`ward-cancel-transport-reason-${movement.id}`}
+                          required
+                          className={styles.capacityInput}
+                          value={cancelReason ?? ""}
+                          onChange={(event) => setCancelReason(event.target.value as CancelTransportReason)}
+                        >
+                          <option value="" disabled>
+                            Choose a reason
+                          </option>
+                          {CANCEL_TRANSPORT_REASONS.map((reason) => (
+                            <option key={reason} value={reason}>
+                              {changeReasonLabels[reason]}
+                            </option>
+                          ))}
+                        </select>
+                        <button type="submit" disabled={!cancelReason} className={styles.declineSubmit}>
+                          Confirm cancellation
+                        </button>
+                      </form>
+                    ) : null}
                   </li>
                 );
               })}
diff --git a/tests/ward-change-reasons.test.ts b/tests/ward-change-reasons.test.ts
index 77fb78f457..dab3834160 100644
--- a/tests/ward-change-reasons.test.ts
+++ b/tests/ward-change-reasons.test.ts
@@ -2,10 +2,14 @@
 import { describe, expect, it } from "vitest";
 
 import {
+  CANCEL_TRANSPORT_REASONS,
   changeReasonLabels,
   LEGAL_STATUS_CHANGE_REASONS,
+  RELEASE_HOLD_REASONS,
   URGENCY_CHANGE_REASONS,
+  type CancelTransportReason,
   type LegalStatusChangeReason,
+  type ReleaseHoldReason,
   type UrgencyChangeReason,
 } from "../src/components/ward-management/ward-change-reasons";
 
@@ -18,6 +22,25 @@ describe("ward-change-reasons", () => {
     expect(LEGAL_STATUS_CHANGE_REASONS).toEqual(["recorded_by_treating_team", "correcting_an_error"]);
   });
 
+  // Task 3: the undo the prototype has never had. Same discipline, same pinned order.
+  it("holds exactly the four release-hold reasons, in this order", () => {
+    expect(RELEASE_HOLD_REASONS).toEqual([
+      "patient_no_longer_coming",
+      "bed_needed_for_another_patient",
+      "ward_withdrew_the_bed",
+      "hold_made_in_error",
+    ]);
+  });
+
+  it("holds exactly the four cancel-transport reasons, in this order", () => {
+    expect(CANCEL_TRANSPORT_REASONS).toEqual([
+      "provider_unavailable",
+      "patient_not_ready",
+      "destination_changed",
+      "job_created_in_error",
+    ]);
+  });
+
   it("labels every urgency-change reason with real, non-empty text", () => {
     for (const reason of URGENCY_CHANGE_REASONS) {
       expect(changeReasonLabels[reason]).toBeTruthy();
@@ -32,6 +55,20 @@ describe("ward-change-reasons", () => {
     }
   });
 
+  it("labels every release-hold reason with real, non-empty text", () => {
+    for (const reason of RELEASE_HOLD_REASONS) {
+      expect(changeReasonLabels[reason]).toBeTruthy();
+      expect(changeReasonLabels[reason].length).toBeGreaterThan(0);
+    }
+  });
+
+  it("labels every cancel-transport reason with real, non-empty text", () => {
+    for (const reason of CANCEL_TRANSPORT_REASONS) {
+      expect(changeReasonLabels[reason]).toBeTruthy();
+      expect(changeReasonLabels[reason].length).toBeGreaterThan(0);
+    }
+  });
+
   // Content-free, synthetic-data guard: none of the eight rulings in the brief permits a reason
   // describing a patient, a diagnosis, a clinical judgement or a legal requirement. This asserts
   // it structurally rather than trusting a comment — a reason string is never free text (every
@@ -63,19 +100,36 @@ describe("ward-change-reasons", () => {
   });
 
   it("gives every union member a label and no label an orphan entry", () => {
-    const allReasons: (UrgencyChangeReason | LegalStatusChangeReason)[] = [
+    const allReasons: (UrgencyChangeReason | LegalStatusChangeReason | ReleaseHoldReason | CancelTransportReason)[] = [
       ...URGENCY_CHANGE_REASONS,
       ...LEGAL_STATUS_CHANGE_REASONS,
+      ...RELEASE_HOLD_REASONS,
+      ...CANCEL_TRANSPORT_REASONS,
     ];
-    // Every reason in both lists resolves to a label.
+    // Every reason in all four lists resolves to a label.
     for (const reason of allReasons) {
       expect(Object.keys(changeReasonLabels)).toContain(reason);
     }
-    // "correcting_an_error" is shared by both lists, so the label map has exactly THREE unique
-    // keys, not four — this pins that de-duplication rather than letting a stray fourth key (a
-    // typo'd duplicate) slip in unnoticed.
+    // "correcting_an_error" is shared by the urgency and legal-status lists, so the label map has
+    // exactly TWELVE unique keys, not thirteen — this pins that de-duplication rather than letting
+    // a stray extra key (a typo'd duplicate) slip in unnoticed. Task 3's two new lists (Release
+    // Hold, Cancel Transport) share no value with any other list, so each of their eight entries
+    // adds exactly one key.
     expect(Object.keys(changeReasonLabels).sort()).toEqual(
-      ["correcting_an_error", "new_information", "reassessed", "recorded_by_treating_team"].sort(),
+      [
+        "correcting_an_error",
+        "new_information",
+        "reassessed",
+        "recorded_by_treating_team",
+        "patient_no_longer_coming",
+        "bed_needed_for_another_patient",
+        "ward_withdrew_the_bed",
+        "hold_made_in_error",
+        "provider_unavailable",
+        "patient_not_ready",
+        "destination_changed",
+        "job_created_in_error",
+      ].sort(),
     );
   });
 });
diff --git a/tests/ward-eligibility.test.ts b/tests/ward-eligibility.test.ts
index 2b636fc764..e284292e72 100644
--- a/tests/ward-eligibility.test.ts
+++ b/tests/ward-eligibility.test.ts
@@ -43,6 +43,7 @@ function movement(overrides: Partial<Movement> = {}): Movement {
     declines: [],
     blocker: "No blocker",
     withdrawnReferrals: [],
+    unwinds: [],
     ...overrides,
   };
 }
diff --git a/tests/ward-flow-reducer.test.ts b/tests/ward-flow-reducer.test.ts
index 77ce50dd58..14f2a13504 100644
--- a/tests/ward-flow-reducer.test.ts
+++ b/tests/ward-flow-reducer.test.ts
@@ -945,3 +945,83 @@ describe("urgency and legal status changes (Task 2)", () => {
     expect(after.rejections[0].reason).toContain("arrived at unit");
   });
 });
+
+/**
+ * Task 3, spec item 10 — the undo the prototype has never had. Before this, the only path that
+ * released a held bed or cancelled a transport job was closing the movement outright, by
+ * recording an examination with outcome `community_order` or `revoked`.
+ */
+describe("release and cancel", () => {
+  it("releases a held bed back to allocatable and returns the movement to accepted_awaiting_bed", () => {
+    const seeded = seedWardFlowState();
+    const movement = seeded.movements.find((candidate) => candidate.stage === "bed_held")!;
+    const unitBefore = seeded.units.find((candidate) => candidate.id === movement.acceptedUnitId)!;
+    const after = wardFlowReducer(seeded, {
+      type: "RELEASE_HOLD",
+      role: "coordinator",
+      now: NOW_ANCHOR,
+      movementId: movement.id,
+      reason: "hold_made_in_error",
+    });
+    const updated = after.movements.find((candidate) => candidate.id === movement.id)!;
+    const unitAfter = after.units.find((candidate) => candidate.id === movement.acceptedUnitId)!;
+    expect(updated.stage).toBe("accepted_awaiting_bed");
+    expect(updated.bedHeldUntil).toBeUndefined();
+    expect(unitAfter.allocatable.value).toBe(unitBefore.allocatable.value + 1);
+    // The movement survives, keeps its acceptance, and is not re-referred anywhere.
+    expect(updated.closure).toBeUndefined();
+    expect(updated.acceptedUnitId).toBe(movement.acceptedUnitId);
+    expect(updated.legalForm).toEqual(movement.legalForm);
+    expect(updated.unwinds.at(-1)).toMatchObject({ kind: "hold_released", by: "coordinator" });
+  });
+
+  it("refuses a release once the patient is handover_ready or moving", () => {
+    const seeded = seedWardFlowState();
+    const movement = seeded.movements.find((candidate) => candidate.stage === "moving")!;
+    const after = wardFlowReducer(seeded, {
+      type: "RELEASE_HOLD",
+      role: "coordinator",
+      now: NOW_ANCHOR,
+      movementId: movement.id,
+      reason: "hold_made_in_error",
+    });
+    expect(after.rejections).toHaveLength(1);
+    expect(after.movements.find((candidate) => candidate.id === movement.id)!.stage).toBe("moving");
+  });
+
+  it("refuses a ward caller acting as a unit that is not holding the bed, naming both ids", () => {
+    const seeded = seedWardFlowState();
+    const movement = seeded.movements.find((candidate) => candidate.stage === "bed_held")!;
+    const otherUnit = seeded.units.find((candidate) => candidate.id !== movement.acceptedUnitId)!;
+    const after = wardFlowReducer(seeded, {
+      type: "RELEASE_HOLD",
+      role: "ward",
+      now: NOW_ANCHOR,
+      movementId: movement.id,
+      actingUnitId: otherUnit.id,
+      reason: "ward_withdrew_the_bed",
+    });
+    expect(after.rejections).toHaveLength(1);
+    expect(after.rejections[0].reason).toContain(otherUnit.id);
+    expect(after.rejections[0].reason).toContain(movement.acceptedUnitId!);
+  });
+
+  it("cancels a transport job without closing the movement", () => {
+    const seeded = seedWardFlowState();
+    const movement = seeded.movements.find(
+      (candidate) => candidate.transport !== undefined && candidate.transport.cancelledAt === undefined,
+    )!;
+    const after = wardFlowReducer(seeded, {
+      type: "CANCEL_TRANSPORT",
+      role: "coordinator",
+      now: NOW_ANCHOR,
+      movementId: movement.id,
+      reason: "provider_unavailable",
+    });
+    const updated = after.movements.find((candidate) => candidate.id === movement.id)!;
+    expect(updated.transport?.cancelledAt).toBe(NOW_ANCHOR);
+    expect(updated.closure).toBeUndefined();
+    expect(updated.stage).toBe("handover_ready");
+    expect(updated.unwinds.at(-1)).toMatchObject({ kind: "transport_cancelled" });
+  });
+});
diff --git a/tests/ward-legal-figure-guard.test.ts b/tests/ward-legal-figure-guard.test.ts
index 09a59a7d49..5c2ff2d685 100644
--- a/tests/ward-legal-figure-guard.test.ts
+++ b/tests/ward-legal-figure-guard.test.ts
@@ -4,7 +4,9 @@ import ts from "typescript";
 import { describe, expect, it } from "vitest";
 
 import {
+  CANCEL_TRANSPORT_REASONS,
   LEGAL_STATUS_CHANGE_REASONS,
+  RELEASE_HOLD_REASONS,
   URGENCY_CHANGE_REASONS,
 } from "../src/components/ward-management/ward-change-reasons";
 import { EVENT_ROLE, type WardFlowEvent } from "../src/components/ward-management/ward-flow-events";
@@ -494,6 +496,16 @@ function candidateEvents(type: WardFlowEvent["type"], state: WardFlowState, now:
       // Both scenarios, like RAISE_REFERRAL's real domain values above — not one hard-coded
       // choice that would leave the other half of `WARD_SCENARIOS` untested.
       return WARD_SCENARIOS.map((scenario) => ({ type, role, now, scenario }));
+    case "RELEASE_HOLD":
+      // One candidate per reason, same precedent as CHANGE_URGENCY/CHANGE_LEGAL_STATUS above —
+      // `role` is the first permitted role (coordinator), so `actingUnitId` is never needed here.
+      return movementIds.flatMap((movementId) =>
+        RELEASE_HOLD_REASONS.map((reason) => ({ type, role, now, movementId, reason })),
+      );
+    case "CANCEL_TRANSPORT":
+      return movementIds.flatMap((movementId) =>
+        CANCEL_TRANSPORT_REASONS.map((reason) => ({ type, role, now, movementId, reason })),
+      );
   }
 }
 
@@ -512,6 +524,8 @@ const MOVEMENT_TARGETED_EVENTS: ReadonlySet<WardFlowEvent["type"]> = new Set([
   "RECORD_ESCALATION",
   "CHANGE_URGENCY",
   "CHANGE_LEGAL_STATUS",
+  "RELEASE_HOLD",
+  "CANCEL_TRANSPORT",
 ]);
 
 /**

From dce6ffe8cd54003b11e8f30e8c5fa6246e823aa0 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 06:54:22 +0800
Subject: [PATCH 08/54] Ward Flow Task 3 fix round 1: prove
 RELEASE_HOLD/CANCEL_TRANSPORT reach every legal-form code

Builds the bed_held/live-transport precondition explicitly per code (RAISE_REFERRAL ->
REFER_TO_UNITS -> ACCEPT_IN_PRINCIPLE -> HOLD_BED, then RELEASE_HOLD or HANDOVER_READY ->
CANCEL_TRANSPORT), asserting no refusal at each step, rather than excusing the round-robin
sweep's inability to reach these two events for codes without a pre-seeded fixture movement.
STRUCTURALLY_IMPOSSIBLE_FOR_CODE stays empty; nothing in this file was weakened.
---
 tests/ward-legal-figure-guard.test.ts | 131 ++++++++++++++++++++++++++
 1 file changed, 131 insertions(+)

diff --git a/tests/ward-legal-figure-guard.test.ts b/tests/ward-legal-figure-guard.test.ts
index 5c2ff2d685..aff9f83617 100644
--- a/tests/ward-legal-figure-guard.test.ts
+++ b/tests/ward-legal-figure-guard.test.ts
@@ -567,6 +567,87 @@ function targetMovementId(event: WardFlowEvent): string | undefined {
   return "movementId" in event ? event.movementId : undefined;
 }
 
+/**
+ * Fix round 1 (2026-08-25). `RELEASE_HOLD` only ever succeeds at stage `bed_held`, and once the
+ * round-robin sweep above lets `HANDOVER_READY` (or a transport-progression event) fire first, a
+ * movement is past `bed_held` for good — the only way back is `RELEASE_HOLD` itself, the very
+ * event under test. That is a limitation of the SWEEP's fixed cyclic ordering, not of the domain:
+ * a movement of any legal-form code can genuinely sit at `bed_held` with a live transport job, the
+ * same as a Form 1A can (see `WF-016`/`WF-005`, the pre-seeded fixture movements that let 1A pass
+ * without needing this helper at all). Excusing the gap via `STRUCTURALLY_IMPOSSIBLE_FOR_CODE`
+ * would therefore be a FALSE claim about the domain — exactly what that list's own doc comment
+ * forbids ("never 'the sweep did not happen to get there'"). So this builds the precondition
+ * explicitly instead, the same way `RESET_SCENARIO`/`SET_SCENARIO` are exercised on their own
+ * below, and every step asserts it was NOT refused — a genuinely impossible step fails loudly with
+ * the reducer's own reason quoted, rather than the construction silently stopping early and
+ * reporting nothing.
+ */
+function buildHeldMovementFor(code: string, now: number): { state: WardFlowState; movementId: string } {
+  const seeded = seedWardFlowState();
+  const ed = allEmergencyDepartments()[0];
+  const raised = wardFlowReducer(seeded, {
+    type: "RAISE_REFERRAL",
+    role: EVENT_ROLE.RAISE_REFERRAL[0],
+    now,
+    edId: ed.id,
+    draft: {
+      cohort: "Adult",
+      security: "Open",
+      sex: "Female",
+      specialling: false,
+      legalStatus: "Referred for psychiatric examination",
+      urgency: 2,
+      legalFormCode: code,
+    },
+  });
+  expect(raised.rejections, `RAISE_REFERRAL for Form ${code} was refused: ${raised.rejections.at(-1)?.reason}`).toEqual(
+    [],
+  );
+  const movement = raised.movements.at(-1)!;
+
+  // Neither REFER_TO_UNITS, ACCEPT_IN_PRINCIPLE nor HOLD_BED gate on cohort, security or sex —
+  // that eligibility scoring lives in the protected `ward-eligibility.ts`, a UI-facing concern the
+  // reducer itself never consults — so any unit with spare allocatable capacity is a genuine,
+  // reachable destination for this construction, not a fabricated shortcut.
+  const unit = raised.units.find((candidate) => candidate.allocatable.value > 0);
+  expect(unit, `no unit with allocatable capacity was found to hold a bed for Form ${code}`).toBeDefined();
+
+  const referred = wardFlowReducer(raised, {
+    type: "REFER_TO_UNITS",
+    role: EVENT_ROLE.REFER_TO_UNITS[0],
+    now,
+    movementId: movement.id,
+    unitIds: [unit!.id],
+  });
+  expect(
+    referred.rejections,
+    `REFER_TO_UNITS for Form ${code} was refused: ${referred.rejections.at(-1)?.reason}`,
+  ).toEqual([]);
+
+  const acceptedInPrinciple = wardFlowReducer(referred, {
+    type: "ACCEPT_IN_PRINCIPLE",
+    role: EVENT_ROLE.ACCEPT_IN_PRINCIPLE[0],
+    now,
+    movementId: movement.id,
+    unitId: unit!.id,
+  });
+  expect(
+    acceptedInPrinciple.rejections,
+    `ACCEPT_IN_PRINCIPLE for Form ${code} was refused: ${acceptedInPrinciple.rejections.at(-1)?.reason}`,
+  ).toEqual([]);
+
+  const held = wardFlowReducer(acceptedInPrinciple, {
+    type: "HOLD_BED",
+    role: EVENT_ROLE.HOLD_BED[0],
+    now,
+    movementId: movement.id,
+    unitId: unit!.id,
+  });
+  expect(held.rejections, `HOLD_BED for Form ${code} was refused: ${held.rejections.at(-1)?.reason}`).toEqual([]);
+
+  return { state: held, movementId: movement.id };
+}
+
 /**
  * Applies the first candidate of this type that the reducer ACCEPTS, optionally restricted to
  * candidates acting on a movement whose legal form carries `code`.
@@ -790,6 +871,56 @@ describe("Mental Health Act figures cannot return to the ward model", () => {
       expect(carrying.length, `the sweep never held a Form ${code}`).toBeGreaterThan(0);
     }
 
+    // RELEASE_HOLD / CANCEL_TRANSPORT, exercised explicitly per code (fix round 1, 2026-08-25) —
+    // see `buildHeldMovementFor`'s own doc comment for why the round-robin sweep above can never
+    // reach these two for a code without a pre-seeded fixture movement, and why that is a
+    // traversal limitation rather than grounds for a `STRUCTURALLY_IMPOSSIBLE_FOR_CODE` entry.
+    // Mutates the SAME `Set` instances already stored in `coverage` above, so this genuinely
+    // satisfies the "Non-vacuity 3" check below rather than sidestepping it.
+    for (const code of SWEEP_CODES) {
+      const accepted = coverage.get(code)!;
+
+      const forRelease = buildHeldMovementFor(code, NOW_ANCHOR);
+      const released = wardFlowReducer(forRelease.state, {
+        type: "RELEASE_HOLD",
+        role: EVENT_ROLE.RELEASE_HOLD[0],
+        now: NOW_ANCHOR,
+        movementId: forRelease.movementId,
+        reason: "hold_made_in_error",
+      });
+      expect(
+        released.rejections,
+        `RELEASE_HOLD for Form ${code} was refused: ${released.rejections.at(-1)?.reason}`,
+      ).toEqual([]);
+      accepted.add("RELEASE_HOLD");
+      offenders.push(...offendingFormsIn(released, `RELEASE_HOLD(${code})`));
+
+      const forCancel = buildHeldMovementFor(code, NOW_ANCHOR);
+      const readyForHandover = wardFlowReducer(forCancel.state, {
+        type: "HANDOVER_READY",
+        role: EVENT_ROLE.HANDOVER_READY[0],
+        now: NOW_ANCHOR,
+        movementId: forCancel.movementId,
+      });
+      expect(
+        readyForHandover.rejections,
+        `HANDOVER_READY for Form ${code} was refused: ${readyForHandover.rejections.at(-1)?.reason}`,
+      ).toEqual([]);
+      const cancelled = wardFlowReducer(readyForHandover, {
+        type: "CANCEL_TRANSPORT",
+        role: EVENT_ROLE.CANCEL_TRANSPORT[0],
+        now: NOW_ANCHOR,
+        movementId: forCancel.movementId,
+        reason: "provider_unavailable",
+      });
+      expect(
+        cancelled.rejections,
+        `CANCEL_TRANSPORT for Form ${code} was refused: ${cancelled.rejections.at(-1)?.reason}`,
+      ).toEqual([]);
+      accepted.add("CANCEL_TRANSPORT");
+      offenders.push(...offendingFormsIn(cancelled, `CANCEL_TRANSPORT(${code})`));
+    }
+
     // Non-vacuity 3: every movement-targeted event type was ACCEPTED against a movement carrying
     // each code. This is the assertion wave 2 lacked. Reported by name, never counted — and it is
     // what proves the `code === "1A"` branch above is actually entered rather than merely

From bf5ec5afdb0b5c93e6ad86f65ab29d2acc2705a8 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 07:36:37 +0800
Subject: [PATCH 09/54] Ward Flow: the shift handover, frozen when opened and
 printable

---
 docs/codebase-index.md                        |  12 +-
 docs/design-system/ADOPTION.md                |   8 +-
 docs/design-system/adoption-contract.json     |   2 +
 docs/design-system/adoption-manifest.json     |  31 ++-
 docs/site-map.md                              |   1 +
 scripts/generate-site-map.ts                  |   1 +
 src/app/ward-management/handover/page.tsx     |  12 +
 .../handover/handover-page.tsx                | 250 ++++++++++++++++++
 .../handover/handover.module.css              | 204 ++++++++++++++
 .../ward-management/ward-derivations.ts       |  73 +++++
 .../ward-management-navigation.tsx            |  15 ++
 tests/design-system-adoption.test.ts          |  14 +-
 tests/route-reachability.test.ts              |  12 +
 tests/ward-handover.dom.test.tsx              | 170 ++++++++++++
 tests/ward-handover.test.ts                   | 102 +++++++
 15 files changed, 890 insertions(+), 17 deletions(-)
 create mode 100644 src/app/ward-management/handover/page.tsx
 create mode 100644 src/components/ward-management/handover/handover-page.tsx
 create mode 100644 src/components/ward-management/handover/handover.module.css
 create mode 100644 tests/ward-handover.dom.test.tsx
 create mode 100644 tests/ward-handover.test.ts

diff --git a/docs/codebase-index.md b/docs/codebase-index.md
index 5da11c7716..002d6d1d51 100644
--- a/docs/codebase-index.md
+++ b/docs/codebase-index.md
@@ -386,12 +386,20 @@ visible reasons and a human confirms or overrides.
   `LegalForm`/`dueAt` — a police-attendance flag, and each movement's single outstanding item; a
   raise-referral form (`RAISE_REFERRAL`), a record-examination form (`RECORD_EXAMINATION`), and
   the mark-handover-ready control (`HANDOVER_READY`) that is the only producer of a transport job;
-  statewide capacity shown read-only)
+  statewide capacity shown read-only), `handover/handover-page.tsx` (Phase 4 Task 4: the shift
+  handover — `/ward-management/handover`; four fixed, product-owner-approved sections in a fixed
+  order (longest waits, beds held, in transit, placement gone wrong) built by `ward-derivations.ts`'s
+  `handoverSnapshot`; read once from `useWardFlow()` inside a `useState` initialiser so the page is
+  frozen at the moment it is opened and never re-derives on the 30-second clock tick; every section
+  renders an explicit "None" line rather than hiding itself when empty; a Print button calls
+  `window.print()`, styled by `handover.module.css`'s own `@media print` block)
 - **State layer (Phase 3):** `ward-flow-provider.tsx` (`WardFlowProvider`/`useWardFlow`, mounted at
   `src/app/ward-management/layout.tsx`), `ward-flow-reducer.ts` (the one mutation path),
   `ward-flow-events.ts` (event/role table)
 - **Tests:** `tests/ward-management.test.ts`, `tests/ui-ward-management.spec.ts`,
-  `tests/ui-ward-coordinator.spec.ts`, `tests/ui-ward-roles.spec.ts`
+  `tests/ui-ward-coordinator.spec.ts`, `tests/ui-ward-roles.spec.ts`, `tests/ward-handover.test.ts`
+  (`handoverSnapshot`), `tests/ward-handover.dom.test.tsx` (the freeze and every section's empty
+  state)
 
 ### Developer hub (`src/app/mockups/development/`, `src/lib/developer-area/`)
 
diff --git a/docs/design-system/ADOPTION.md b/docs/design-system/ADOPTION.md
index 3c3eeccd6f..f24ebd13fb 100644
--- a/docs/design-system/ADOPTION.md
+++ b/docs/design-system/ADOPTION.md
@@ -357,12 +357,12 @@ product exclusions; the only route-only dispositions are the documented legacy-r
 surfaces. Shared shell/component roots carry their own explicit `shared-shell` disposition.
 
 Registered public components: 54
-Declared product roots: 94
+Declared product roots: 96
 Roots with a literal `.ckb-v2` opt-in: 1
-Roots inheriting `.ckb-v2` from the global `<html>`: 93
+Roots inheriting `.ckb-v2` from the global `<html>`: 95
 Production surfaces observed under v2: 17/17
 Dynamic `ckb-v2` constructions: 0
-Declared production page routes: 79/79
+Declared production page routes: 80/80
 
 Source observation and contract declaration are independent. A literal `ckb-v2` on the global `<html>` makes every production surface inherit v2, but it does not approve that adoption.
 The Proof column summarizes each surface's dark, forced-colours, 320px, print and browser declarations; exact statuses and evidence paths live in the manifest.
@@ -382,7 +382,7 @@ Observed v2 under a compatibility declaration fails closed. A declared v2 shell
 | `favourites`                                    | owned           |      1 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `tools-and-calculators`                         | owned           |      3 |     3 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `caring-contacts-workspace`                     | owned           |      1 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `ward-management`                               | owned           |     12 |    20 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `ward-management`                               | owned           |     13 |    22 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `privacy-safety-and-reference`                  | owned           |      3 |     3 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `search-results-shared`                         | shared-shell    |      0 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `answers-shared`                                | shared-shell    |      0 |     2 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
diff --git a/docs/design-system/adoption-contract.json b/docs/design-system/adoption-contract.json
index 6e8e10f954..8a278488f4 100644
--- a/docs/design-system/adoption-contract.json
+++ b/docs/design-system/adoption-contract.json
@@ -589,6 +589,7 @@
         "src/app/ward-management/ed/[edId]/page.tsx",
         "src/app/ward-management/exceptions/page.tsx",
         "src/app/ward-management/governance/page.tsx",
+        "src/app/ward-management/handover/page.tsx",
         "src/app/ward-management/movements/page.tsx",
         "src/app/ward-management/network/page.tsx",
         "src/app/ward-management/patients/[patientId]/page.tsx",
@@ -601,6 +602,7 @@
       "roots": [
         "src/components/ward-management/coordinator/coordinator-screen.tsx",
         "src/components/ward-management/ed/ed-screen.tsx",
+        "src/components/ward-management/handover/handover-page.tsx",
         "src/components/ward-management/officer/officer-screen.tsx",
         "src/components/ward-management/ward-management-console.tsx",
         "src/components/ward-management/ward-management-modes.tsx",
diff --git a/docs/design-system/adoption-manifest.json b/docs/design-system/adoption-manifest.json
index 3aee8a690e..2cef00ec83 100644
--- a/docs/design-system/adoption-manifest.json
+++ b/docs/design-system/adoption-manifest.json
@@ -3451,6 +3451,7 @@
         "src/app/ward-management/ed/[edId]/page.tsx",
         "src/app/ward-management/exceptions/page.tsx",
         "src/app/ward-management/governance/page.tsx",
+        "src/app/ward-management/handover/page.tsx",
         "src/app/ward-management/movements/page.tsx",
         "src/app/ward-management/network/page.tsx",
         "src/app/ward-management/page.tsx",
@@ -3545,6 +3546,16 @@
           "v2MountMode": "inherited-global-root",
           "sanctionedPatternsPresent": ["WardModeWorkspace"]
         },
+        {
+          "file": "src/app/ward-management/handover/page.tsx",
+          "exists": true,
+          "imports": [],
+          "importedFamilies": [],
+          "literalCkbV2": false,
+          "dynamicCkbV2": false,
+          "v2MountMode": "inherited-global-root",
+          "sanctionedPatternsPresent": []
+        },
         {
           "file": "src/app/ward-management/movements/page.tsx",
           "exists": true,
@@ -3645,6 +3656,16 @@
           "v2MountMode": "inherited-global-root",
           "sanctionedPatternsPresent": ["ClinicalRail"]
         },
+        {
+          "file": "src/components/ward-management/handover/handover-page.tsx",
+          "exists": true,
+          "imports": [],
+          "importedFamilies": [],
+          "literalCkbV2": false,
+          "dynamicCkbV2": false,
+          "v2MountMode": "inherited-global-root",
+          "sanctionedPatternsPresent": ["ClinicalRail"]
+        },
         {
           "file": "src/components/ward-management/officer/officer-screen.tsx",
           "exists": true,
@@ -4035,6 +4056,7 @@
       "src/app/ward-management/ed/[edId]/page.tsx",
       "src/app/ward-management/exceptions/page.tsx",
       "src/app/ward-management/governance/page.tsx",
+      "src/app/ward-management/handover/page.tsx",
       "src/app/ward-management/movements/page.tsx",
       "src/app/ward-management/network/page.tsx",
       "src/app/ward-management/page.tsx",
@@ -4116,6 +4138,7 @@
       "src/app/ward-management/ed/[edId]/page.tsx",
       "src/app/ward-management/exceptions/page.tsx",
       "src/app/ward-management/governance/page.tsx",
+      "src/app/ward-management/handover/page.tsx",
       "src/app/ward-management/movements/page.tsx",
       "src/app/ward-management/network/page.tsx",
       "src/app/ward-management/page.tsx",
@@ -4131,7 +4154,7 @@
   },
   "adoption": {
     "literalCkbV2RootCount": 1,
-    "inheritedCkbV2RootCount": 93,
+    "inheritedCkbV2RootCount": 95,
     "dynamicCkbV2RootCount": 0,
     "v2MountedSurfaceCount": 17,
     "declaredV2SurfaceCount": 17
@@ -4140,8 +4163,8 @@
     "registeredComponentCount": 54,
     "previewCount": 54,
     "productImportedComponentCount": 34,
-    "rootCount": 94,
-    "productionRouteCount": 79,
-    "nextUiEntryCount": 140
+    "rootCount": 96,
+    "productionRouteCount": 80,
+    "nextUiEntryCount": 141
   }
 }
diff --git a/docs/site-map.md b/docs/site-map.md
index 6e6bd9f810..9d6905147d 100644
--- a/docs/site-map.md
+++ b/docs/site-map.md
@@ -63,6 +63,7 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 - `/ward-management/ed/[edId]` - Synthetic emergency-department role screen for one origin department. Source: `src/app/ward-management/ed/[edId]/page.tsx`.
 - `/ward-management/exceptions` - Patient flow exceptions, delays, and escalation alerts. Source: `src/app/ward-management/exceptions/page.tsx`.
 - `/ward-management/governance` - Ward coordination governance, compliance, and audit log. Source: `src/app/ward-management/governance/page.tsx`.
+- `/ward-management/handover` - Synthetic, point-in-time, printable shift handover, frozen at the moment it is opened. Source: `src/app/ward-management/handover/page.tsx`.
 - `/ward-management/movements` - Scheduled and completed patient transfers and bed movements. Source: `src/app/ward-management/movements/page.tsx`.
 - `/ward-management/network` - Psychiatric bed network status and regional catchment map. Source: `src/app/ward-management/network/page.tsx`.
 - `/ward-management/queue` - Priority referral queue and triage waiting list. Source: `src/app/ward-management/queue/page.tsx`.
diff --git a/scripts/generate-site-map.ts b/scripts/generate-site-map.ts
index 16c364a465..fb4e183054 100644
--- a/scripts/generate-site-map.ts
+++ b/scripts/generate-site-map.ts
@@ -158,6 +158,7 @@ const routeDescriptions: Record<string, string> = {
   "/ward-management/ed/[edId]": "Synthetic emergency-department role screen for one origin department.",
   "/ward-management/exceptions": "Patient flow exceptions, delays, and escalation alerts.",
   "/ward-management/governance": "Ward coordination governance, compliance, and audit log.",
+  "/ward-management/handover": "Synthetic, point-in-time, printable shift handover, frozen at the moment it is opened.",
   "/ward-management/movements": "Scheduled and completed patient transfers and bed movements.",
   "/ward-management/network": "Psychiatric bed network status and regional catchment map.",
   "/ward-management/patients/[patientId]": "Synthetic patient placement and transfer trajectory detail.",
diff --git a/src/app/ward-management/handover/page.tsx b/src/app/ward-management/handover/page.tsx
new file mode 100644
index 0000000000..862422a2e5
--- /dev/null
+++ b/src/app/ward-management/handover/page.tsx
@@ -0,0 +1,12 @@
+import type { Metadata } from "next";
+
+import { HandoverPage } from "@/components/ward-management/handover/handover-page";
+
+export const metadata: Metadata = {
+  title: "Shift handover — Ward Flow",
+  description: "Synthetic, point-in-time, printable shift handover for the Ward Flow prototype.",
+};
+
+export default function WardHandoverPage() {
+  return <HandoverPage />;
+}
diff --git a/src/components/ward-management/handover/handover-page.tsx b/src/components/ward-management/handover/handover-page.tsx
new file mode 100644
index 0000000000..45b5bf6315
--- /dev/null
+++ b/src/components/ward-management/handover/handover-page.tsx
@@ -0,0 +1,250 @@
+"use client";
+
+import { useState } from "react";
+
+import { formatInstant, splitDuration } from "@/components/ward-management/ward-clock";
+import {
+  destinationUnit,
+  elapsedLabel,
+  handoverSnapshot,
+  stageCopy,
+  type HandoverSnapshot,
+} from "@/components/ward-management/ward-derivations";
+import { useWardFlow } from "@/components/ward-management/ward-flow-provider";
+import { ClinicalRail } from "@/components/ward-management/ward-management-navigation";
+import type { Movement, Unit } from "@/components/ward-management/ward-model";
+import { edById } from "@/components/ward-management/ward-sites";
+
+import styles from "./handover.module.css";
+
+/** What this page freezes at open: the snapshot itself, plus the `units` array it was built
+ * against — `inTransit` entries carry no `unit` of their own (see `HandoverSnapshot`'s own doc
+ * comment in `ward-derivations.ts`), so resolving their destination later still needs a frozen
+ * `units` reference, never the live one `useWardFlow()` keeps returning on every render. */
+type FrozenHandover = { snapshot: HandoverSnapshot; units: Unit[] };
+
+/**
+ * Task 4 (spec item 1): the shift handover — four fixed sections, in this exact
+ * product-owner-approved order, on their own page.
+ *
+ * THE FREEZE MUST BE REAL. `handoverSnapshot` is a pure derivation — called again on a later
+ * `now` it would happily compute a different answer — so what makes this a *handover* rather
+ * than just another live view is that `useWardFlow()` is read once, and the `useState`
+ * initialiser below closes over that single read to build the frozen snapshot. A `useState`
+ * initialiser runs exactly once, on the first render, and never again on any later re-render —
+ * that is the whole mechanism. Nothing else in this component calls `handoverSnapshot` again,
+ * and no section below reads `now` from `useWardFlow()` — only `frozen.snapshot.frozenAt`,
+ * which cannot change for the lifetime of this mount. A handover that silently changed while a
+ * coordinator was reading it would be worse than no handover at all.
+ *
+ * Every section renders an explicit "None" line when it has nothing to show — never a hidden
+ * or skipped section. An absence is a fact worth handing over too.
+ */
+export function HandoverPage() {
+  const { movements, units, now } = useWardFlow();
+
+  const [frozen] = useState<FrozenHandover>(() => ({
+    snapshot: handoverSnapshot(movements, units, now),
+    units,
+  }));
+
+  const { snapshot } = frozen;
+
+  return (
+    <div className={styles.screen} data-testid="ward-handover-page">
+      <ClinicalRail />
+      <main className={styles.main}>
+        <div className={styles.governanceBanner} data-testid="ward-handover-governance">
+          <span className={styles.prototypeBadge}>Synthetic prototype</span>
+          <p>
+            This handover is <strong>not a medical device</strong>. It is a point-in-time operational summary, frozen
+            the moment it was opened — it never assesses a patient&apos;s risk, acuity or treatment, and it never
+            updates itself while you are reading it.
+          </p>
+        </div>
+
+        <header className={styles.pageHeader}>
+          <h1 className={styles.pageTitle}>Shift handover</h1>
+          <p className={styles.frozenAt} data-testid="ward-handover-frozen-at">
+            Frozen at {formatInstant(snapshot.frozenAt)}
+          </p>
+          <button type="button" className={styles.printButton} onClick={() => window.print()}>
+            Print
+          </button>
+        </header>
+
+        <LongestWaitsSection snapshot={snapshot} />
+        <HeldBedsSection snapshot={snapshot} />
+        <InTransitSection snapshot={snapshot} units={frozen.units} />
+        <PlacementGoneWrongSection snapshot={snapshot} />
+      </main>
+    </div>
+  );
+}
+
+export function LongestWaitsSection({ snapshot }: { snapshot: HandoverSnapshot }) {
+  return (
+    <section className={styles.section} data-testid="ward-handover-longest-waits">
+      <h2 className={styles.sectionHeading}>Longest waits</h2>
+      {snapshot.longestWaits.length === 0 ? (
+        <p className={styles.emptyNote} data-testid="ward-handover-longest-waits-empty">
+          None — no open movement.
+        </p>
+      ) : (
+        <table className={styles.table}>
+          <thead>
+            <tr>
+              <th scope="col">Rank</th>
+              <th scope="col">Movement</th>
+              <th scope="col">Wait</th>
+              <th scope="col">Stage</th>
+              <th scope="col">Department</th>
+              <th scope="col">Destination</th>
+            </tr>
+          </thead>
+          <tbody>
+            {snapshot.longestWaits.map((entry, index) => (
+              <tr key={entry.movement.id}>
+                <td>{index + 1}</td>
+                <td>{entry.movement.id}</td>
+                <td>{elapsedLabel(entry.movement, snapshot.frozenAt)}</td>
+                <td>{stageCopy[entry.movement.stage].label}</td>
+                <td>{departmentLabel(entry.movement)}</td>
+                <td>{entry.unit?.name ?? "No destination chosen"}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </section>
+  );
+}
+
+export function HeldBedsSection({ snapshot }: { snapshot: HandoverSnapshot }) {
+  return (
+    <section className={styles.section} data-testid="ward-handover-held-beds">
+      <h2 className={styles.sectionHeading}>Beds held</h2>
+      {snapshot.heldBeds.length === 0 ? (
+        <p className={styles.emptyNote} data-testid="ward-handover-held-beds-empty">
+          None — no bed is currently held.
+        </p>
+      ) : (
+        <table className={styles.table}>
+          <thead>
+            <tr>
+              <th scope="col">Movement</th>
+              <th scope="col">Unit</th>
+              <th scope="col">Hold</th>
+            </tr>
+          </thead>
+          <tbody>
+            {snapshot.heldBeds.map((entry) => (
+              <tr key={entry.movement.id}>
+                <td>{entry.movement.id}</td>
+                <td>{entry.unit?.name ?? "No unit recorded"}</td>
+                <td>{holdLabel(entry.movement, entry.expired, snapshot.frozenAt)}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </section>
+  );
+}
+
+export function InTransitSection({ snapshot, units }: { snapshot: HandoverSnapshot; units: Unit[] }) {
+  return (
+    <section className={styles.section} data-testid="ward-handover-in-transit">
+      <h2 className={styles.sectionHeading}>In transit</h2>
+      {snapshot.inTransit.length === 0 ? (
+        <p className={styles.emptyNote} data-testid="ward-handover-in-transit-empty">
+          None — no movement currently has a transport job.
+        </p>
+      ) : (
+        <table className={styles.table}>
+          <thead>
+            <tr>
+              <th scope="col">Movement</th>
+              <th scope="col">Unit</th>
+              <th scope="col">Leg</th>
+            </tr>
+          </thead>
+          <tbody>
+            {snapshot.inTransit.map((entry) => {
+              const unit = destinationUnit(entry.movement, units);
+              return (
+                <tr key={entry.movement.id}>
+                  <td>{entry.movement.id}</td>
+                  <td>{unit?.name ?? "No destination unit recorded"}</td>
+                  <td>{entry.leg ?? "No transport leg recorded"}</td>
+                </tr>
+              );
+            })}
+          </tbody>
+        </table>
+      )}
+    </section>
+  );
+}
+
+export function PlacementGoneWrongSection({ snapshot }: { snapshot: HandoverSnapshot }) {
+  return (
+    <section className={styles.section} data-testid="ward-handover-placement-gone-wrong">
+      <h2 className={styles.sectionHeading}>Placement gone wrong</h2>
+      {snapshot.placementGoneWrong.length === 0 ? (
+        <p className={styles.emptyNote} data-testid="ward-handover-placement-gone-wrong-empty">
+          None — nothing has escalated and nothing has been declined by every unit it was referred to.
+        </p>
+      ) : (
+        <table className={styles.table}>
+          <thead>
+            <tr>
+              <th scope="col">Movement</th>
+              <th scope="col">Wait</th>
+              <th scope="col">What happened</th>
+            </tr>
+          </thead>
+          <tbody>
+            {snapshot.placementGoneWrong.map((entry) => (
+              <tr key={entry.movement.id}>
+                <td>{entry.movement.id}</td>
+                <td>{elapsedLabel(entry.movement, snapshot.frozenAt)}</td>
+                <td>{goneWrongLabel(entry.movement, entry.kind)}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </section>
+  );
+}
+
+/** Mirrors `officer-screen.tsx`'s own origin-department fallback exactly — a raw id is a real
+ * fact about the record, never a fabricated substitute for one. */
+function departmentLabel(movement: Movement) {
+  const originEd = edById(movement.originEdId);
+  return originEd
+    ? `${originEd.name} (${originEd.siteCode})`
+    : `No synthetic department matches "${movement.originEdId}"`;
+}
+
+/** "Expired" or "Expires in …" per spec — never `formatRemaining`'s "overdue"/"left" wording,
+ * which this page must not use: a held bed lapsing is an operational fact, not a countdown
+ * against a deadline this prototype is entitled to name. */
+function holdLabel(movement: Movement, expired: boolean, frozenAt: number) {
+  const bedHeldUntil = movement.bedHeldUntil;
+  if (bedHeldUntil === undefined) return "No hold time recorded";
+  if (expired) return "Expired";
+  return `Expires in ${splitDuration(bedHeldUntil - frozenAt)}`;
+}
+
+/** Names exactly what the record holds — a recorded escalation, or a decline from every unit
+ * this movement was ever referred to — and nothing the Mental Health Act does or does not
+ * require. */
+function goneWrongLabel(movement: Movement, kind: "escalated" | "declined_by_all") {
+  if (kind === "escalated") {
+    const contact = movement.escalation?.contact;
+    return contact ? `Escalated — ${contact}` : "Escalated";
+  }
+  return `All ${movement.declines.length} referred unit${movement.declines.length === 1 ? "" : "s"} declined`;
+}
diff --git a/src/components/ward-management/handover/handover.module.css b/src/components/ward-management/handover/handover.module.css
new file mode 100644
index 0000000000..87faf0e018
--- /dev/null
+++ b/src/components/ward-management/handover/handover.module.css
@@ -0,0 +1,204 @@
+/*
+ * Task 4: the shift handover — a point-in-time, printable summary. Same self-contained-tokens
+ * convention `officer.module.css` documents on its own `.screen`: every local custom property
+ * this file needs is declared here, never borrowed from another module's scope.
+ */
+.screen {
+  --ho-space-4: 0.25rem;
+  --ho-space-6: 0.375rem;
+  --ho-space-8: 0.5rem;
+  --ho-space-10: 0.625rem;
+  --ho-space-12: 0.75rem;
+  --ho-space-14: 0.875rem;
+  --ho-space-16: 1rem;
+  --ho-space-20: 1.25rem;
+  --ho-space-24: 1.5rem;
+  --ho-space-48: var(--spacing-tap);
+  --ho-leading-body: 1.4;
+  display: grid;
+  min-height: 100dvh;
+  /* The rail track stays reserved at every supported width, same as every other Ward Flow
+     screen — see ward-management.module.css's own note on this. */
+  grid-template-columns: 4.5rem minmax(0, 1fr);
+  background: var(--surface);
+  color: var(--text);
+  font-variant-numeric: tabular-nums;
+}
+
+.main {
+  grid-column: 2;
+  display: flex;
+  min-width: 0;
+  flex-direction: column;
+  gap: var(--ho-space-20);
+  overflow-x: hidden;
+  overflow-y: auto;
+  padding: var(--ho-space-16) var(--ho-space-20) var(--ho-space-24);
+}
+
+.governanceBanner {
+  display: flex;
+  min-height: var(--ho-space-48);
+  flex-wrap: wrap;
+  align-items: center;
+  gap: var(--ho-space-12);
+  border-bottom: 0.0625rem solid var(--border);
+  background: var(--surface-chrome);
+  padding: var(--ho-space-8) var(--ho-space-12);
+}
+
+.governanceBanner p {
+  min-width: 0;
+  flex: 1 1 12rem;
+  margin: 0;
+  color: var(--text-muted);
+  font-size: var(--text-3xs);
+  line-height: var(--ho-leading-body);
+}
+
+.prototypeBadge {
+  flex-shrink: 0;
+  border: 0.0625rem solid var(--warning-border);
+  border-radius: var(--radius-sm);
+  background: var(--warning-bg);
+  padding: var(--ho-space-4) var(--ho-space-8);
+  color: var(--warning-text);
+  font-size: var(--text-3xs);
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.pageHeader {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: var(--ho-space-12);
+}
+
+.pageTitle {
+  margin: 0;
+  color: var(--text-heading);
+  font-size: var(--text-lg, 1.125rem);
+  font-weight: 700;
+}
+
+.frozenAt {
+  margin: 0;
+  flex: 1 1 auto;
+  color: var(--text-muted);
+  font-size: var(--text-xs);
+}
+
+.printButton {
+  display: inline-flex;
+  min-height: var(--ho-space-48);
+  align-items: center;
+  justify-content: center;
+  border: 0.0625rem solid var(--clinical-accent-border);
+  border-radius: var(--radius-md);
+  background: var(--clinical-accent);
+  padding: 0 var(--ho-space-16);
+  color: var(--clinical-accent-contrast);
+  font-size: var(--text-xs);
+  font-weight: 700;
+}
+
+.section {
+  display: grid;
+  gap: var(--ho-space-8);
+  border: 0.0625rem solid var(--border);
+  border-radius: var(--radius-lg);
+  background: var(--surface-subtle);
+  padding: var(--ho-space-12) var(--ho-space-14);
+}
+
+.sectionHeading {
+  margin: 0;
+  color: var(--text-heading);
+  font-size: var(--text-sm, 0.875rem);
+  font-weight: 700;
+}
+
+.emptyNote {
+  margin: 0;
+  color: var(--text-muted);
+  font-size: var(--text-xs);
+  font-style: italic;
+}
+
+.table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: var(--text-xs);
+}
+
+.table th,
+.table td {
+  border-bottom: 0.0625rem solid var(--border);
+  padding: var(--ho-space-6) var(--ho-space-8);
+  text-align: left;
+  vertical-align: top;
+}
+
+.table th {
+  color: var(--text-muted);
+  font-weight: 600;
+  white-space: nowrap;
+}
+
+.table td {
+  color: var(--text);
+  overflow-wrap: anywhere;
+}
+
+.table tbody tr:last-child th,
+.table tbody tr:last-child td {
+  border-bottom: none;
+}
+
+/*
+ * Print: ink-on-paper, no rail, no chrome, no interactive control. The global print reset in
+ * globals.css already hides every `header`/`nav`/`button` element (which drops the Print
+ * button and the rail's own `<nav>`), but `ClinicalRail` renders an `<aside>`, which that
+ * global rule does not reach — so the reserved rail column would otherwise survive as a wide
+ * blank strip down every printed page. Hidden explicitly here, scoped to this screen only.
+ */
+@media print {
+  .screen {
+    grid-template-columns: 1fr;
+  }
+
+  .screen > aside {
+    display: none !important;
+  }
+
+  .main {
+    overflow: visible;
+    padding: 0;
+  }
+
+  /*
+   * Literal black, not a `var(--border)`/`var(--text)` token, and deliberately so — same call
+   * globals.css's own global print reset already makes for `html, body { background: #fff;
+   * color: #000; }` a few lines above the point this file is imported from. A theme token
+   * still resolves to whatever the CURRENT theme defines it as; in dark mode that is a light
+   * value meant to show against a dark surface, which would print as a near-invisible line on
+   * the white page the reset just forced. Print is ink-on-paper here, intentionally
+   * theme-independent, exactly like the reset it extends.
+   */
+  .governanceBanner {
+    border-bottom: 0.0625rem solid #000;
+  }
+
+  .section {
+    border-color: #000;
+    background: none;
+    break-inside: avoid;
+  }
+
+  .table th,
+  .table td {
+    border-bottom-color: #000;
+  }
+}
diff --git a/src/components/ward-management/ward-derivations.ts b/src/components/ward-management/ward-derivations.ts
index f7f84000ec..33e8948bae 100644
--- a/src/components/ward-management/ward-derivations.ts
+++ b/src/components/ward-management/ward-derivations.ts
@@ -480,6 +480,79 @@ export function buildActionInbox(movements: Movement[], now: Instant, units: Uni
   return items;
 }
 
+/**
+ * Task 4 (spec item 1): the shift handover — a point-in-time, printable summary a coordinator
+ * hands to the incoming coordinator, built from four fixed sections in a product-owner-approved
+ * order. This function is a pure derivation, exactly like every other one in this module — `now`
+ * arrives as a parameter, nothing here reads the wall clock — but the FREEZE that makes it a
+ * handover rather than a live view is the caller's responsibility, not this function's: a page
+ * must call this exactly once, in a `useState` initialiser, so what a coordinator reads never
+ * changes under them while the shift clock keeps ticking in the background. Calling this
+ * function itself is always safe and always pure; only the page can break the freeze.
+ *
+ * Every section is scoped to OPEN movements (`isOpen`) — a shift handover is about the live
+ * caseload being handed over, not movements that have already arrived or otherwise closed.
+ *
+ * `longestWaits` carries every open movement, ranked by wait, with deliberately NO threshold:
+ * measured against the real fixture at NOW_ANCHOR, zero of the open movements are past the
+ * 24-hour departmental access target, so a breach-led ranking would render this section empty.
+ * Ranking by wait alone always has something to hand over.
+ *
+ * `placementGoneWrong` names exactly two situations, neither of them a legal claim:
+ * - `"escalated"` — the movement carries a recorded `escalation`: a human already declared the
+ *   referral network exhausted and rang the state bed coordination desk.
+ * - `"declined_by_all"` — the movement has a decline on record and nothing still pending
+ *   (`referredUnitIds` empty, `declines` non-empty). `ward-flow-reducer.ts`'s own `case
+ *   "DECLINE"` only ever removes a unit from `referredUnitIds` in the same update that adds the
+ *   matching `declines` entry, so this condition is exactly "every unit this movement was ever
+ *   referred to has since said no, and none of them are still deciding".
+ * A movement can satisfy both at once; the escalation check runs first, so it is listed once,
+ * as `"escalated"`, never twice.
+ */
+export type HandoverSnapshot = {
+  frozenAt: Instant;
+  longestWaits: { movement: Movement; unit: Unit | undefined }[];
+  heldBeds: { movement: Movement; unit: Unit | undefined; expired: boolean }[];
+  inTransit: { movement: Movement; leg: TransportLeg | "Cancelled" | undefined }[];
+  placementGoneWrong: { movement: Movement; kind: "escalated" | "declined_by_all" }[];
+};
+
+export function handoverSnapshot(movements: Movement[], units: Unit[], now: Instant): HandoverSnapshot {
+  const open = movements.filter(isOpen);
+
+  const longestWaits = [...open]
+    .sort((a, b) => now - b.openedAt - (now - a.openedAt))
+    .map((movement) => ({ movement, unit: destinationUnit(movement, units) }));
+
+  const heldBeds = open
+    .filter((movement) => movement.bedHeldUntil !== undefined)
+    .map((movement) => {
+      const bedHeldUntil = movement.bedHeldUntil as Instant;
+      return { movement, unit: destinationUnit(movement, units), expired: bedHeldUntil <= now };
+    });
+
+  const inTransit = open
+    .filter((movement) => movement.transport !== undefined)
+    .map((movement) => ({ movement, leg: transportLeg(movement.transport) }));
+
+  const escalated = open
+    .filter((movement) => movement.escalation !== undefined)
+    .map((movement) => ({ movement, kind: "escalated" as const }));
+  const escalatedIds = new Set(escalated.map((entry) => entry.movement.id));
+  const declinedByAll = open
+    .filter((movement) => !escalatedIds.has(movement.id))
+    .filter((movement) => movement.referredUnitIds.length === 0 && movement.declines.length > 0)
+    .map((movement) => ({ movement, kind: "declined_by_all" as const }));
+
+  return {
+    frozenAt: now,
+    longestWaits,
+    heldBeds,
+    inTransit,
+    placementGoneWrong: [...escalated, ...declinedByAll],
+  };
+}
+
 /** A real, per-movement audit trail built from actual fields — never generic flavour text. */
 export function movementTimeline(movement: Movement) {
   const events: Array<{ at: Instant; label: string }> = [{ at: movement.openedAt, label: "Movement opened" }];
diff --git a/src/components/ward-management/ward-management-navigation.tsx b/src/components/ward-management/ward-management-navigation.tsx
index 3993d05447..bf52940728 100644
--- a/src/components/ward-management/ward-management-navigation.tsx
+++ b/src/components/ward-management/ward-management-navigation.tsx
@@ -7,6 +7,7 @@ import {
   BedSingle,
   Building2,
   CircleAlert,
+  ClipboardList,
   FileCheck2,
   HeartPulse,
   LayoutDashboard,
@@ -164,6 +165,20 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
         >
           <Siren aria-hidden="true" />
         </Link>
+        {/* Task 4: `/ward-management/handover` — same shape as the Officer and Emergency
+            department links immediately above and for the exact same reason (see the Officer
+            link's own comment): a raw `<Link>` with a literal string `href`, never `RailLink`,
+            because `RailLink` passes its `href` through as a destructured prop, which reads as a
+            plain `Identifier` to `tests/route-reachability.test.ts`'s AST scan and would leave
+            this route invisible to it. It also sits outside the eight-link `WardModeNavigation`
+            strip on purpose — that nav's own Playwright spec asserts an exact count of 8 links,
+            so a ninth entry there would break it, exactly as the Officer link's comment already
+            explains. "Handover" collides with no other accessible name in this rail or in
+            `WardModeNavigation` as a substring, so Playwright's default substring accessible-name
+            match cannot resolve it to more than one element. */}
+        <Link href="/ward-management/handover" aria-label="Handover" title="Handover" className={shellStyles.railLink}>
+          <ClipboardList aria-hidden="true" />
+        </Link>
         <RailLink href="/?mode=answer" label="Favourites">
           <HeartPulse aria-hidden="true" />
         </RailLink>
diff --git a/tests/design-system-adoption.test.ts b/tests/design-system-adoption.test.ts
index 6b27de9c78..718bd2d016 100644
--- a/tests/design-system-adoption.test.ts
+++ b/tests/design-system-adoption.test.ts
@@ -1412,15 +1412,15 @@ describe("design-system adoption manifest", () => {
           ["committed", "not-committed", "not-applicable"].includes(surface.baseline.status),
       ),
     ).toBe(true);
-    // 79 = 59 + 6 + 13 + 1: the 59 production pages that preceded both changes,
+    // 80 = 59 + 6 + 14 + 1: the 59 production pages that preceded both changes,
     // the six `<mode>/search` routes home consolidation split out of the bare paths,
-    // the thirteen-route Ward Flow synthetic patient-flow prototype (mode home,
+    // the fourteen-route Ward Flow synthetic patient-flow prototype (mode home,
     // eight remaining workspace routes, ED/ward/officer role screens, the per-patient
-    // detail route, and the retired constellation redirect), and the Caring Contacts
-    // workspace. Redirect stubs keep legacy deep links resolving and still count as
-    // declared routes. This is a census, so a route nobody intended to add still
-    // fails the contract.
-    expect(manifest.routeCoverage.discovered).toHaveLength(79);
+    // detail route, the Phase 4 shift handover, and the retired constellation redirect),
+    // and the Caring Contacts workspace. Redirect stubs keep legacy deep links resolving
+    // and still count as declared routes. This is a census, so a route nobody intended to
+    // add still fails the contract.
+    expect(manifest.routeCoverage.discovered).toHaveLength(80);
     expect(manifest.routeCoverage.declared).toEqual(manifest.routeCoverage.discovered);
     expect(manifest.routeCoverage.undeclared).toEqual([]);
     expect(manifest.routeCoverage.missing).toEqual([]);
diff --git a/tests/route-reachability.test.ts b/tests/route-reachability.test.ts
index 808af6651c..d6b9937eff 100644
--- a/tests/route-reachability.test.ts
+++ b/tests/route-reachability.test.ts
@@ -635,6 +635,18 @@ describe("route reachability", () => {
     ).toEqual([]);
   });
 
+  // Task 4 (Ward Flow shift handover): the generic orphan sweep above already covers this route,
+  // but it covers every static route at once and a failure there does not name which route
+  // regressed. This is the same assertion, narrowed to the one route this task added, so a
+  // future edit that drops the rail link (or the page itself) fails with an unambiguous message
+  // rather than only showing up buried in a combined orphan list.
+  it("/ward-management/handover is linked from the clinical rail", () => {
+    const route = staticPageRoutes.find((entry) => entry.route === "/ward-management/handover");
+    expect(route, "/ward-management/handover must exist as a static page route").toBeDefined();
+    if (!route) return;
+    expect(isReachable(route.route, route.file)).toBe(true);
+  });
+
   it("reachability allowlist has no stale entries", () => {
     const routes = new Set(staticPageRoutes.map((entry) => entry.route));
     for (const route of REACHABILITY_ALLOWLIST.keys()) {
diff --git a/tests/ward-handover.dom.test.tsx b/tests/ward-handover.dom.test.tsx
new file mode 100644
index 0000000000..6f4964f9fd
--- /dev/null
+++ b/tests/ward-handover.dom.test.tsx
@@ -0,0 +1,170 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+// Same reason as every sibling dom suite (ward-screen.dom.test.tsx, ward-ed-screen.dom.test.tsx,
+// ward-flow-clock-consistency.dom.test.tsx): `ClinicalRail` renders next/link anchors and this
+// suite never checks routing, so a plain <a> avoids an App Router context jsdom cannot provide.
+vi.mock("next/link", () => ({
+  default: ({ children, href, ...rest }: { children: ReactNode; href: string }) => (
+    <a href={href} {...rest}>
+      {children}
+    </a>
+  ),
+}));
+
+import { formatInstant } from "@/components/ward-management/ward-clock";
+import type { HandoverSnapshot } from "@/components/ward-management/ward-derivations";
+import {
+  HandoverPage,
+  HeldBedsSection,
+  InTransitSection,
+  LongestWaitsSection,
+  PlacementGoneWrongSection,
+} from "@/components/ward-management/handover/handover-page";
+import { useWardFlow, WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
+
+/** Raises the same `ADVANCE_CLOCK` demo event the real demo controls dispatch, so this suite can
+ * move the shared clock without reaching into the reducer directly — mirrors `ClockAdvancer` in
+ * ward-flow-clock-consistency.dom.test.tsx and `DispatchProbe` in ward-flow-provider.dom.test.tsx. */
+function ClockAdvancer({ minutes }: { minutes: number }) {
+  const { now, dispatch } = useWardFlow();
+  return (
+    <button type="button" onClick={() => dispatch({ type: "ADVANCE_CLOCK", role: "demo", now, minutes })}>
+      advance clock
+    </button>
+  );
+}
+
+function renderHandover() {
+  return render(
+    <WardFlowProvider initialNow={NOW_ANCHOR}>
+      <HandoverPage />
+      <ClockAdvancer minutes={100} />
+    </WardFlowProvider>,
+  );
+}
+
+describe("HandoverPage", () => {
+  it("renders the root and all four sections, in order", () => {
+    renderHandover();
+
+    expect(screen.getByTestId("ward-handover-page")).toBeInTheDocument();
+
+    const order = [
+      "ward-handover-longest-waits",
+      "ward-handover-held-beds",
+      "ward-handover-in-transit",
+      "ward-handover-placement-gone-wrong",
+    ];
+    const positions = order.map((testId) => {
+      const node = screen.getByTestId(testId);
+      expect(node).toBeInTheDocument();
+      return Array.prototype.indexOf.call(document.querySelectorAll("[data-testid]"), node);
+    });
+    for (let index = 1; index < positions.length; index += 1) {
+      expect(positions[index]).toBeGreaterThan(positions[index - 1]);
+    }
+  });
+
+  it("shows the real fixture's non-empty sections as tables, not the empty note", () => {
+    renderHandover();
+
+    // The real fixture at NOW_ANCHOR carries 41 open movements, 7 held beds, 8 in transit and
+    // one escalated movement (measured — see tests/ward-handover.test.ts) — none of the four
+    // sections is naturally empty against this seed, so none of the "-empty" notes should render
+    // here. The explicit-empty-note behaviour itself is proved separately below, against a
+    // constructed empty snapshot, because the live seed can never produce one (see that test's
+    // own comment).
+    expect(screen.queryByTestId("ward-handover-longest-waits-empty")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("ward-handover-held-beds-empty")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("ward-handover-in-transit-empty")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("ward-handover-placement-gone-wrong-empty")).not.toBeInTheDocument();
+  });
+
+  /**
+   * THE FREEZE MUST BE REAL. `handoverSnapshot` is a pure function of `now`, so if
+   * `HandoverPage` ever re-derived it on the provider's live clock tick — instead of freezing it
+   * once at mount — this test would catch it two different ways:
+   *
+   * 1. The freeze-time label itself would move.
+   * 2. WF-016's held bed (`bedHeldUntil = NOW_ANCHOR + 45`, fixture-authored, see
+   *    ward-movements.ts) reads "Expires in 45m" at mount. Advancing the clock 100 minutes takes
+   *    the LIVE `now` past that bed's hold time — if this page recomputed on that live clock, the
+   *    same row would flip to "Expired", a categorical change, not just a shifted number. A
+   *    frozen page must still show "Expires in 45m" after the advance.
+   *
+   * The whole page's rendered text is also compared before and after, so any other section
+   * quietly drifting (a wait label ticking up, a new "Expired" row) fails this test too, not just
+   * the two named checks above.
+   */
+  it("freezes at open and does not change when the shared clock advances", () => {
+    renderHandover();
+
+    const frozenAtBefore = screen.getByTestId("ward-handover-frozen-at").textContent;
+    expect(frozenAtBefore).toBe(`Frozen at ${formatInstant(NOW_ANCHOR)}`);
+
+    const heldBedsBefore = screen.getByTestId("ward-handover-held-beds").textContent;
+    expect(heldBedsBefore).toContain("WF-016");
+    expect(heldBedsBefore).toContain("Expires in 45m");
+
+    const pageBefore = screen.getByTestId("ward-handover-page").textContent;
+
+    fireEvent.click(screen.getByRole("button", { name: "advance clock" }));
+
+    const frozenAtAfter = screen.getByTestId("ward-handover-frozen-at").textContent;
+    expect(frozenAtAfter).toBe(frozenAtBefore);
+
+    const heldBedsAfter = screen.getByTestId("ward-handover-held-beds").textContent;
+    expect(heldBedsAfter).toBe(heldBedsBefore);
+    expect(heldBedsAfter).toContain("Expires in 45m");
+
+    const pageAfter = screen.getByTestId("ward-handover-page").textContent;
+    expect(pageAfter).toBe(pageBefore);
+  });
+
+  // Every section must state plainly when it is empty (spec's conservative-failure rule) — but
+  // the real fixture, at any `now`, never produces an empty section: 41 open movements, 7 held
+  // beds, 8 in-transit jobs and one placement-gone-wrong entry are all authored into the seed
+  // (see ward-movements.ts), and the freeze mechanism above means a post-mount reducer event can
+  // never reach a frozen page's own rendering anyway. Rather than weaken this assertion by
+  // skipping it, the precondition is constructed explicitly: an empty `HandoverSnapshot` is a
+  // real, valid value of the exported type (every section is independently optional — nothing
+  // about "zero open movements" is fabricated clinical data, it is simply an empty array), and
+  // each section component takes that snapshot as a plain prop, with no dependency on the
+  // provider or the freeze. Rendering each one directly proves the empty-note branch for real.
+  describe("renders the explicit empty note for every section, given an empty snapshot", () => {
+    const emptySnapshot: HandoverSnapshot = {
+      frozenAt: NOW_ANCHOR,
+      longestWaits: [],
+      heldBeds: [],
+      inTransit: [],
+      placementGoneWrong: [],
+    };
+
+    it("longest waits", () => {
+      render(<LongestWaitsSection snapshot={emptySnapshot} />);
+      expect(screen.getByTestId("ward-handover-longest-waits-empty")).toHaveTextContent("None");
+      expect(screen.queryByRole("table")).not.toBeInTheDocument();
+    });
+
+    it("held beds", () => {
+      render(<HeldBedsSection snapshot={emptySnapshot} />);
+      expect(screen.getByTestId("ward-handover-held-beds-empty")).toHaveTextContent("None");
+      expect(screen.queryByRole("table")).not.toBeInTheDocument();
+    });
+
+    it("in transit", () => {
+      render(<InTransitSection snapshot={emptySnapshot} units={[]} />);
+      expect(screen.getByTestId("ward-handover-in-transit-empty")).toHaveTextContent("None");
+      expect(screen.queryByRole("table")).not.toBeInTheDocument();
+    });
+
+    it("placement gone wrong", () => {
+      render(<PlacementGoneWrongSection snapshot={emptySnapshot} />);
+      expect(screen.getByTestId("ward-handover-placement-gone-wrong-empty")).toHaveTextContent("None");
+      expect(screen.queryByRole("table")).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/tests/ward-handover.test.ts b/tests/ward-handover.test.ts
new file mode 100644
index 0000000000..a6f22b3e27
--- /dev/null
+++ b/tests/ward-handover.test.ts
@@ -0,0 +1,102 @@
+// tests/ward-handover.test.ts
+import { describe, expect, it } from "vitest";
+
+import { handoverSnapshot, isOpen, transportLeg } from "../src/components/ward-management/ward-derivations";
+import { seedWardFlowState } from "../src/components/ward-management/ward-flow-reducer";
+import { NOW_ANCHOR } from "../src/components/ward-management/ward-sites";
+
+const { movements, units } = seedWardFlowState();
+const openMovements = movements.filter(isOpen);
+const snapshot = handoverSnapshot(movements, units, NOW_ANCHOR);
+
+describe("handoverSnapshot", () => {
+  it("freezes at exactly the now it was called with", () => {
+    expect(snapshot.frozenAt).toBe(NOW_ANCHOR);
+  });
+
+  it("ranks every open movement by wait, strictly non-increasing, longest first", () => {
+    expect(snapshot.longestWaits).toHaveLength(openMovements.length);
+    expect(snapshot.longestWaits.map((entry) => entry.movement.id).sort()).toEqual(
+      openMovements.map((movement) => movement.id).sort(),
+    );
+
+    const waits = snapshot.longestWaits.map((entry) => NOW_ANCHOR - entry.movement.openedAt);
+    for (let index = 1; index < waits.length; index += 1) {
+      expect(waits[index]).toBeLessThanOrEqual(waits[index - 1]);
+    }
+
+    const maxWait = Math.max(...openMovements.map((movement) => NOW_ANCHOR - movement.openedAt));
+    expect(waits[0]).toBe(maxWait);
+  });
+
+  // A non-vacuity floor: the fixture carries 41 open movements at NOW_ANCHOR (measured, not
+  // assumed). This fails the moment the fixture stops producing a real open caseload — a
+  // breach-led handover with nothing left to rank would otherwise pass silently.
+  it("a non-vacuity floor: the open caseload stays real, not near-empty", () => {
+    expect(snapshot.longestWaits.length).toBeGreaterThan(30);
+  });
+
+  it("heldBeds contains exactly the open movements carrying a bedHeldUntil, expired iff bedHeldUntil <= now", () => {
+    const expectedIds = openMovements
+      .filter((movement) => movement.bedHeldUntil !== undefined)
+      .map((movement) => movement.id)
+      .sort();
+    expect(snapshot.heldBeds.map((entry) => entry.movement.id).sort()).toEqual(expectedIds);
+
+    // Measured against the real fixture at NOW_ANCHOR: 7 beds held, 1 already expired. Pinned
+    // so a fixture change that silently drops a hold is caught here, not only on screen.
+    expect(snapshot.heldBeds).toHaveLength(7);
+    expect(snapshot.heldBeds.filter((entry) => entry.expired)).toHaveLength(1);
+
+    for (const entry of snapshot.heldBeds) {
+      const bedHeldUntil = entry.movement.bedHeldUntil;
+      if (bedHeldUntil === undefined) {
+        throw new Error(`${entry.movement.id} appears in heldBeds without a bedHeldUntil`);
+      }
+      expect(entry.expired).toBe(bedHeldUntil <= NOW_ANCHOR);
+    }
+  });
+
+  it("inTransit contains exactly the open movements carrying a transport job, each with its real leg", () => {
+    const expectedIds = openMovements
+      .filter((movement) => movement.transport !== undefined)
+      .map((movement) => movement.id)
+      .sort();
+    expect(snapshot.inTransit.map((entry) => entry.movement.id).sort()).toEqual(expectedIds);
+
+    // Measured against the real fixture at NOW_ANCHOR: 8 movements carry a transport job.
+    expect(snapshot.inTransit).toHaveLength(8);
+
+    for (const entry of snapshot.inTransit) {
+      expect(entry.leg).toBe(transportLeg(entry.movement.transport));
+    }
+  });
+
+  it("placementGoneWrong lists an escalated or declined-by-all movement exactly once each", () => {
+    const escalated = openMovements.filter((movement) => movement.escalation !== undefined);
+    const declinedByAll = openMovements.filter(
+      (movement) =>
+        movement.escalation === undefined && movement.referredUnitIds.length === 0 && movement.declines.length > 0,
+    );
+    const expectedIds = [...escalated, ...declinedByAll].map((movement) => movement.id).sort();
+
+    const actualIds = snapshot.placementGoneWrong.map((entry) => entry.movement.id);
+    expect([...actualIds].sort()).toEqual(expectedIds);
+    expect(new Set(actualIds).size).toBe(actualIds.length);
+
+    for (const entry of snapshot.placementGoneWrong) {
+      const expectedKind = entry.movement.escalation !== undefined ? "escalated" : "declined_by_all";
+      expect(entry.kind).toBe(expectedKind);
+    }
+  });
+
+  // Measured against the real fixture at NOW_ANCHOR (2026-08-25): WF-009 is the only movement
+  // carrying a recorded escalation, and no other movement satisfies declined-by-all once
+  // WF-009's escalation claims it first. Pinned so a future fixture change that silently drops
+  // the escalation, or adds a second stranded movement, is caught here rather than only in a
+  // screenshot.
+  it("matches the measured fixture: WF-009 escalated, nothing else stranded", () => {
+    expect(snapshot.placementGoneWrong.map((entry) => entry.movement.id)).toEqual(["WF-009"]);
+    expect(snapshot.placementGoneWrong[0]?.kind).toBe("escalated");
+  });
+});

From 32a5a080bcddb977efc8eee12dca86a165c1718b Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 08:16:30 +0800
Subject: [PATCH 10/54] =?UTF-8?q?Ward=20Flow:=20the=20escalation=20board?=
 =?UTF-8?q?=20=E2=80=94=20records=20and=20shows,=20suggests=20nothing?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/codebase-index.md                        |  17 +-
 docs/design-system/ADOPTION.md                |   8 +-
 docs/design-system/adoption-contract.json     |   2 +
 docs/design-system/adoption-manifest.json     |  31 +++-
 docs/site-map.md                              |   1 +
 scripts/generate-site-map.ts                  |   2 +
 src/app/ward-management/escalation/page.tsx   |  13 ++
 .../escalation/escalation-board.tsx           | 147 ++++++++++++++++++
 .../escalation/escalation.module.css          | 141 +++++++++++++++++
 .../ward-management/ward-derivations.ts       |  52 +++++++
 .../ward-management-navigation.tsx            |  19 +++
 tests/design-system-adoption.test.ts          |  14 +-
 tests/route-reachability.test.ts              |  10 ++
 tests/ward-escalation.dom.test.tsx            | 125 +++++++++++++++
 tests/ward-escalation.test.ts                 |  96 ++++++++++++
 15 files changed, 661 insertions(+), 17 deletions(-)
 create mode 100644 src/app/ward-management/escalation/page.tsx
 create mode 100644 src/components/ward-management/escalation/escalation-board.tsx
 create mode 100644 src/components/ward-management/escalation/escalation.module.css
 create mode 100644 tests/ward-escalation.dom.test.tsx
 create mode 100644 tests/ward-escalation.test.ts

diff --git a/docs/codebase-index.md b/docs/codebase-index.md
index 002d6d1d51..3e054e9152 100644
--- a/docs/codebase-index.md
+++ b/docs/codebase-index.md
@@ -392,14 +392,27 @@ visible reasons and a human confirms or overrides.
   `handoverSnapshot`; read once from `useWardFlow()` inside a `useState` initialiser so the page is
   frozen at the moment it is opened and never re-derives on the 30-second clock tick; every section
   renders an explicit "None" line rather than hiding itself when empty; a Print button calls
-  `window.print()`, styled by `handover.module.css`'s own `@media print` block)
+  `window.print()`, styled by `handover.module.css`'s own `@media print` block), `escalation/escalation-board.tsx`
+  (Phase 4 Task 5: the escalation board — `/ward-management/escalation`; one place showing every
+  patient whose placement has gone wrong, via `ward-derivations.ts`'s `escalationBoard`; two
+  independently-computed, read-only sections — `escalated` (movements carrying a recorded
+  `Movement.escalation`: when, `triedUnitIds` resolved to real `Unit` objects, contact, wait) and
+  `nowhereEligible` (open movements with zero eligible wards right now, via `eligibleCandidatesAmong`
+  called with an unlimited-effective `limit` so nothing truncates); a movement can appear in both, and
+  on the real fixture at `NOW_ANCHOR` WF-009 does — it has a recorded escalation and, independently,
+  still has nowhere eligible. Unlike the handover, this page is NOT frozen: it reads the live clock on
+  every render, since a coordinator working this board wants the current picture. Records and shows
+  only — it computes no near-miss, no least-bad option, and no statement of what would need to change
+  for a ward to work)
 - **State layer (Phase 3):** `ward-flow-provider.tsx` (`WardFlowProvider`/`useWardFlow`, mounted at
   `src/app/ward-management/layout.tsx`), `ward-flow-reducer.ts` (the one mutation path),
   `ward-flow-events.ts` (event/role table)
 - **Tests:** `tests/ward-management.test.ts`, `tests/ui-ward-management.spec.ts`,
   `tests/ui-ward-coordinator.spec.ts`, `tests/ui-ward-roles.spec.ts`, `tests/ward-handover.test.ts`
   (`handoverSnapshot`), `tests/ward-handover.dom.test.tsx` (the freeze and every section's empty
-  state)
+  state), `tests/ward-escalation.test.ts` (`escalationBoard`, including the standard-night
+  `WF-009`/`WF-308` and scarce-night nine-movement measurements), `tests/ward-escalation.dom.test.tsx`
+  (both sections and their empty states)
 
 ### Developer hub (`src/app/mockups/development/`, `src/lib/developer-area/`)
 
diff --git a/docs/design-system/ADOPTION.md b/docs/design-system/ADOPTION.md
index f24ebd13fb..88d20d2dd9 100644
--- a/docs/design-system/ADOPTION.md
+++ b/docs/design-system/ADOPTION.md
@@ -357,12 +357,12 @@ product exclusions; the only route-only dispositions are the documented legacy-r
 surfaces. Shared shell/component roots carry their own explicit `shared-shell` disposition.
 
 Registered public components: 54
-Declared product roots: 96
+Declared product roots: 98
 Roots with a literal `.ckb-v2` opt-in: 1
-Roots inheriting `.ckb-v2` from the global `<html>`: 95
+Roots inheriting `.ckb-v2` from the global `<html>`: 97
 Production surfaces observed under v2: 17/17
 Dynamic `ckb-v2` constructions: 0
-Declared production page routes: 80/80
+Declared production page routes: 81/81
 
 Source observation and contract declaration are independent. A literal `ckb-v2` on the global `<html>` makes every production surface inherit v2, but it does not approve that adoption.
 The Proof column summarizes each surface's dark, forced-colours, 320px, print and browser declarations; exact statuses and evidence paths live in the manifest.
@@ -382,7 +382,7 @@ Observed v2 under a compatibility declaration fails closed. A declared v2 shell
 | `favourites`                                    | owned           |      1 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `tools-and-calculators`                         | owned           |      3 |     3 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `caring-contacts-workspace`                     | owned           |      1 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `ward-management`                               | owned           |     13 |    22 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `ward-management`                               | owned           |     14 |    24 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `privacy-safety-and-reference`                  | owned           |      3 |     3 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `search-results-shared`                         | shared-shell    |      0 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `answers-shared`                                | shared-shell    |      0 |     2 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
diff --git a/docs/design-system/adoption-contract.json b/docs/design-system/adoption-contract.json
index 8a278488f4..84ffed3650 100644
--- a/docs/design-system/adoption-contract.json
+++ b/docs/design-system/adoption-contract.json
@@ -587,6 +587,7 @@
         "src/app/ward-management/page.tsx",
         "src/app/ward-management/capacity/page.tsx",
         "src/app/ward-management/ed/[edId]/page.tsx",
+        "src/app/ward-management/escalation/page.tsx",
         "src/app/ward-management/exceptions/page.tsx",
         "src/app/ward-management/governance/page.tsx",
         "src/app/ward-management/handover/page.tsx",
@@ -602,6 +603,7 @@
       "roots": [
         "src/components/ward-management/coordinator/coordinator-screen.tsx",
         "src/components/ward-management/ed/ed-screen.tsx",
+        "src/components/ward-management/escalation/escalation-board.tsx",
         "src/components/ward-management/handover/handover-page.tsx",
         "src/components/ward-management/officer/officer-screen.tsx",
         "src/components/ward-management/ward-management-console.tsx",
diff --git a/docs/design-system/adoption-manifest.json b/docs/design-system/adoption-manifest.json
index 2cef00ec83..89606913cc 100644
--- a/docs/design-system/adoption-manifest.json
+++ b/docs/design-system/adoption-manifest.json
@@ -3449,6 +3449,7 @@
       "routes": [
         "src/app/ward-management/capacity/page.tsx",
         "src/app/ward-management/ed/[edId]/page.tsx",
+        "src/app/ward-management/escalation/page.tsx",
         "src/app/ward-management/exceptions/page.tsx",
         "src/app/ward-management/governance/page.tsx",
         "src/app/ward-management/handover/page.tsx",
@@ -3526,6 +3527,16 @@
           "v2MountMode": "inherited-global-root",
           "sanctionedPatternsPresent": []
         },
+        {
+          "file": "src/app/ward-management/escalation/page.tsx",
+          "exists": true,
+          "imports": [],
+          "importedFamilies": [],
+          "literalCkbV2": false,
+          "dynamicCkbV2": false,
+          "v2MountMode": "inherited-global-root",
+          "sanctionedPatternsPresent": []
+        },
         {
           "file": "src/app/ward-management/exceptions/page.tsx",
           "exists": true,
@@ -3656,6 +3667,16 @@
           "v2MountMode": "inherited-global-root",
           "sanctionedPatternsPresent": ["ClinicalRail"]
         },
+        {
+          "file": "src/components/ward-management/escalation/escalation-board.tsx",
+          "exists": true,
+          "imports": [],
+          "importedFamilies": [],
+          "literalCkbV2": false,
+          "dynamicCkbV2": false,
+          "v2MountMode": "inherited-global-root",
+          "sanctionedPatternsPresent": ["ClinicalRail"]
+        },
         {
           "file": "src/components/ward-management/handover/handover-page.tsx",
           "exists": true,
@@ -4054,6 +4075,7 @@
       "src/app/ward-management/capacity/page.tsx",
       "src/app/ward-management/constellation/page.tsx",
       "src/app/ward-management/ed/[edId]/page.tsx",
+      "src/app/ward-management/escalation/page.tsx",
       "src/app/ward-management/exceptions/page.tsx",
       "src/app/ward-management/governance/page.tsx",
       "src/app/ward-management/handover/page.tsx",
@@ -4136,6 +4158,7 @@
       "src/app/ward-management/capacity/page.tsx",
       "src/app/ward-management/constellation/page.tsx",
       "src/app/ward-management/ed/[edId]/page.tsx",
+      "src/app/ward-management/escalation/page.tsx",
       "src/app/ward-management/exceptions/page.tsx",
       "src/app/ward-management/governance/page.tsx",
       "src/app/ward-management/handover/page.tsx",
@@ -4154,7 +4177,7 @@
   },
   "adoption": {
     "literalCkbV2RootCount": 1,
-    "inheritedCkbV2RootCount": 95,
+    "inheritedCkbV2RootCount": 97,
     "dynamicCkbV2RootCount": 0,
     "v2MountedSurfaceCount": 17,
     "declaredV2SurfaceCount": 17
@@ -4163,8 +4186,8 @@
     "registeredComponentCount": 54,
     "previewCount": 54,
     "productImportedComponentCount": 34,
-    "rootCount": 96,
-    "productionRouteCount": 80,
-    "nextUiEntryCount": 141
+    "rootCount": 98,
+    "productionRouteCount": 81,
+    "nextUiEntryCount": 142
   }
 }
diff --git a/docs/site-map.md b/docs/site-map.md
index 9d6905147d..223c65767b 100644
--- a/docs/site-map.md
+++ b/docs/site-map.md
@@ -61,6 +61,7 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 - `/ward-management/capacity` - Ward bed availability, unit occupancy, and staffing capacity. Source: `src/app/ward-management/capacity/page.tsx`.
 - `/ward-management/constellation` - Compatibility redirect to `/ward-management/network`. Phase 2 retired the constellation command view. Source: `src/app/ward-management/constellation/page.tsx`.
 - `/ward-management/ed/[edId]` - Synthetic emergency-department role screen for one origin department. Source: `src/app/ward-management/ed/[edId]/page.tsx`.
+- `/ward-management/escalation` - One place showing every synthetic Ward Flow patient whose placement has gone wrong. Records and shows only. Source: `src/app/ward-management/escalation/page.tsx`.
 - `/ward-management/exceptions` - Patient flow exceptions, delays, and escalation alerts. Source: `src/app/ward-management/exceptions/page.tsx`.
 - `/ward-management/governance` - Ward coordination governance, compliance, and audit log. Source: `src/app/ward-management/governance/page.tsx`.
 - `/ward-management/handover` - Synthetic, point-in-time, printable shift handover, frozen at the moment it is opened. Source: `src/app/ward-management/handover/page.tsx`.
diff --git a/scripts/generate-site-map.ts b/scripts/generate-site-map.ts
index fb4e183054..09e6700ea4 100644
--- a/scripts/generate-site-map.ts
+++ b/scripts/generate-site-map.ts
@@ -156,6 +156,8 @@ const routeDescriptions: Record<string, string> = {
   "/ward-management/constellation":
     "Compatibility redirect to `/ward-management/network`. Phase 2 retired the constellation command view.",
   "/ward-management/ed/[edId]": "Synthetic emergency-department role screen for one origin department.",
+  "/ward-management/escalation":
+    "One place showing every synthetic Ward Flow patient whose placement has gone wrong. Records and shows only.",
   "/ward-management/exceptions": "Patient flow exceptions, delays, and escalation alerts.",
   "/ward-management/governance": "Ward coordination governance, compliance, and audit log.",
   "/ward-management/handover": "Synthetic, point-in-time, printable shift handover, frozen at the moment it is opened.",
diff --git a/src/app/ward-management/escalation/page.tsx b/src/app/ward-management/escalation/page.tsx
new file mode 100644
index 0000000000..3c4c84ffeb
--- /dev/null
+++ b/src/app/ward-management/escalation/page.tsx
@@ -0,0 +1,13 @@
+import type { Metadata } from "next";
+
+import { EscalationBoardPage } from "@/components/ward-management/escalation/escalation-board";
+
+export const metadata: Metadata = {
+  title: "Escalation board — Ward Flow",
+  description:
+    "Synthetic prototype: one place showing every Ward Flow patient whose placement has gone wrong. Records and shows only — it suggests nothing.",
+};
+
+export default function WardEscalationPage() {
+  return <EscalationBoardPage />;
+}
diff --git a/src/components/ward-management/escalation/escalation-board.tsx b/src/components/ward-management/escalation/escalation-board.tsx
new file mode 100644
index 0000000000..5bde11dbae
--- /dev/null
+++ b/src/components/ward-management/escalation/escalation-board.tsx
@@ -0,0 +1,147 @@
+"use client";
+
+import { formatInstant, type Instant } from "@/components/ward-management/ward-clock";
+import {
+  elapsedLabel,
+  escalationBoard,
+  stageCopy,
+  type EscalationBoard,
+} from "@/components/ward-management/ward-derivations";
+import { useWardFlow } from "@/components/ward-management/ward-flow-provider";
+import { ClinicalRail } from "@/components/ward-management/ward-management-navigation";
+import type { Movement } from "@/components/ward-management/ward-model";
+import { edById } from "@/components/ward-management/ward-sites";
+
+import styles from "./escalation.module.css";
+
+/**
+ * Task 5 (spec item 4): the escalation board — one place showing every patient whose placement
+ * has gone wrong. Unlike the shift handover (`handover-page.tsx`), this page is deliberately
+ * NOT frozen at open: a coordinator working this board wants the live picture — a fresh
+ * escalation recorded a minute ago, a ward's confirmed capacity that just changed the
+ * `nowhereEligible` count — so `escalationBoard` is called fresh on every render against
+ * `useWardFlow()`'s live `movements`/`units`/`now`, with no `useState` freeze. Nothing here
+ * mutates anything; both sections are read-only.
+ *
+ * THE HARDEST RULE IN THIS TASK: THE BOARD RECORDS AND SHOWS. IT SUGGESTS NOTHING (spec D4). No
+ * "least-bad options", no ranking of wards the patient does not fit, no statement of what would
+ * need to change. `escalationBoard` itself already enforces this in its own derivation — see
+ * that function's doc comment in `ward-derivations.ts` — so nothing in this component may
+ * compute a near-miss, a "closest" ward, or any suggestion of its own.
+ */
+export function EscalationBoardPage() {
+  const { movements, units, now } = useWardFlow();
+  const board = escalationBoard(movements, units, now);
+
+  return (
+    <div className={styles.screen} data-testid="ward-escalation-page">
+      <ClinicalRail />
+      <main className={styles.main}>
+        <div className={styles.governanceBanner} data-testid="ward-escalation-governance">
+          <span className={styles.prototypeBadge}>Synthetic prototype</span>
+          <p>
+            This board is <strong>not a medical device</strong>. It records and shows what has already happened — a
+            recorded escalation, or a movement with nowhere eligible right now — and nothing more. It never ranks a ward
+            the patient does not fit, and it never states what would need to change for one to work.
+          </p>
+        </div>
+
+        <header className={styles.pageHeader}>
+          <h1 className={styles.pageTitle}>Escalation board</h1>
+          <p className={styles.pageSubtitle}>Every patient whose placement has gone wrong, right now.</p>
+        </header>
+
+        <EscalatedSection board={board} now={now} />
+        <NowhereEligibleSection board={board} now={now} />
+      </main>
+    </div>
+  );
+}
+
+export function EscalatedSection({ board, now }: { board: EscalationBoard; now: Instant }) {
+  return (
+    <section className={styles.section} data-testid="ward-escalation-escalated">
+      <h2 className={styles.sectionHeading}>Escalated</h2>
+      {board.escalated.length === 0 ? (
+        <p className={styles.emptyNote} data-testid="ward-escalation-escalated-empty">
+          None — no open movement carries a recorded escalation.
+        </p>
+      ) : (
+        <table className={styles.table}>
+          <thead>
+            <tr>
+              <th scope="col">Movement</th>
+              <th scope="col">When</th>
+              <th scope="col">Units tried</th>
+              <th scope="col">Contact</th>
+              <th scope="col">Wait</th>
+            </tr>
+          </thead>
+          <tbody>
+            {board.escalated.map((entry) => (
+              <tr key={entry.movement.id}>
+                <td>{entry.movement.id}</td>
+                <td>{entry.movement.escalation ? formatInstant(entry.movement.escalation.at) : "No time recorded"}</td>
+                <td>{triedUnitsLabel(entry.triedUnits)}</td>
+                <td>{entry.movement.escalation?.contact ?? "No contact recorded"}</td>
+                <td>{elapsedLabel(entry.movement, now)}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </section>
+  );
+}
+
+export function NowhereEligibleSection({ board, now }: { board: EscalationBoard; now: Instant }) {
+  return (
+    <section className={styles.section} data-testid="ward-escalation-nowhere-eligible">
+      <h2 className={styles.sectionHeading}>Nowhere eligible</h2>
+      {board.nowhereEligible.length === 0 ? (
+        <p className={styles.emptyNote} data-testid="ward-escalation-nowhere-eligible-empty">
+          None — every open movement has at least one eligible ward right now.
+        </p>
+      ) : (
+        <table className={styles.table}>
+          <thead>
+            <tr>
+              <th scope="col">Movement</th>
+              <th scope="col">Wait</th>
+              <th scope="col">Stage</th>
+              <th scope="col">Department</th>
+            </tr>
+          </thead>
+          <tbody>
+            {board.nowhereEligible.map((movement) => (
+              <tr key={movement.id}>
+                <td>{movement.id}</td>
+                <td>{elapsedLabel(movement, now)}</td>
+                <td>{stageCopy[movement.stage].label}</td>
+                <td>{departmentLabel(movement)}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </section>
+  );
+}
+
+/** Every unit this movement's escalation record names as already tried — a record of what
+ * happened, never a live candidate list. Mirrors `shortlist-panel.tsx`'s own decline-row
+ * fallback: an id that does not resolve to a real `Unit` renders as an explicit absence, never a
+ * substituted default. */
+function triedUnitsLabel(triedUnits: { name: string }[]) {
+  if (triedUnits.length === 0) return "No units recorded";
+  return triedUnits.map((unit) => unit.name).join(", ");
+}
+
+/** Mirrors `handover-page.tsx`'s own origin-department fallback exactly — a raw id is a real
+ * fact about the record, never a fabricated substitute for one. */
+function departmentLabel(movement: Movement) {
+  const originEd = edById(movement.originEdId);
+  return originEd
+    ? `${originEd.name} (${originEd.siteCode})`
+    : `No synthetic department matches "${movement.originEdId}"`;
+}
diff --git a/src/components/ward-management/escalation/escalation.module.css b/src/components/ward-management/escalation/escalation.module.css
new file mode 100644
index 0000000000..8072fda6c5
--- /dev/null
+++ b/src/components/ward-management/escalation/escalation.module.css
@@ -0,0 +1,141 @@
+/*
+ * Task 5: the escalation board. Same self-contained-tokens convention `handover.module.css` and
+ * `officer.module.css` document on their own `.screen`: every local custom property this file
+ * needs is declared here, never borrowed from another module's scope.
+ */
+.screen {
+  --es-space-4: 0.25rem;
+  --es-space-6: 0.375rem;
+  --es-space-8: 0.5rem;
+  --es-space-12: 0.75rem;
+  --es-space-14: 0.875rem;
+  --es-space-16: 1rem;
+  --es-space-20: 1.25rem;
+  --es-space-24: 1.5rem;
+  --es-space-48: var(--spacing-tap);
+  --es-leading-body: 1.4;
+  display: grid;
+  min-height: 100dvh;
+  /* The rail track stays reserved at every supported width, same as every other Ward Flow
+     screen — see ward-management.module.css's own note on this. */
+  grid-template-columns: 4.5rem minmax(0, 1fr);
+  background: var(--surface);
+  color: var(--text);
+  font-variant-numeric: tabular-nums;
+}
+
+.main {
+  grid-column: 2;
+  display: flex;
+  min-width: 0;
+  flex-direction: column;
+  gap: var(--es-space-20);
+  overflow-x: hidden;
+  overflow-y: auto;
+  padding: var(--es-space-16) var(--es-space-20) var(--es-space-24);
+}
+
+.governanceBanner {
+  display: flex;
+  min-height: var(--es-space-48);
+  flex-wrap: wrap;
+  align-items: center;
+  gap: var(--es-space-12);
+  border-bottom: 0.0625rem solid var(--border);
+  background: var(--surface-chrome);
+  padding: var(--es-space-8) var(--es-space-12);
+}
+
+.governanceBanner p {
+  min-width: 0;
+  flex: 1 1 12rem;
+  margin: 0;
+  color: var(--text-muted);
+  font-size: var(--text-3xs);
+  line-height: var(--es-leading-body);
+}
+
+.prototypeBadge {
+  flex-shrink: 0;
+  border: 0.0625rem solid var(--warning-border);
+  border-radius: var(--radius-sm);
+  background: var(--warning-bg);
+  padding: var(--es-space-4) var(--es-space-8);
+  color: var(--warning-text);
+  font-size: var(--text-3xs);
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.pageHeader {
+  display: flex;
+  flex-direction: column;
+  gap: var(--es-space-4);
+}
+
+.pageTitle {
+  margin: 0;
+  color: var(--text-heading);
+  font-size: var(--text-lg, 1.125rem);
+  font-weight: 700;
+}
+
+.pageSubtitle {
+  margin: 0;
+  color: var(--text-muted);
+  font-size: var(--text-xs);
+}
+
+.section {
+  display: grid;
+  gap: var(--es-space-8);
+  border: 0.0625rem solid var(--border);
+  border-radius: var(--radius-lg);
+  background: var(--surface-subtle);
+  padding: var(--es-space-12) var(--es-space-14);
+}
+
+.sectionHeading {
+  margin: 0;
+  color: var(--text-heading);
+  font-size: var(--text-sm, 0.875rem);
+  font-weight: 700;
+}
+
+.emptyNote {
+  margin: 0;
+  color: var(--text-muted);
+  font-size: var(--text-xs);
+  font-style: italic;
+}
+
+.table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: var(--text-xs);
+}
+
+.table th,
+.table td {
+  border-bottom: 0.0625rem solid var(--border);
+  padding: var(--es-space-6) var(--es-space-8);
+  text-align: left;
+  vertical-align: top;
+}
+
+.table th {
+  color: var(--text-muted);
+  font-weight: 600;
+  white-space: nowrap;
+}
+
+.table td {
+  color: var(--text);
+  overflow-wrap: anywhere;
+}
+
+.table tbody tr:last-child th,
+.table tbody tr:last-child td {
+  border-bottom: none;
+}
diff --git a/src/components/ward-management/ward-derivations.ts b/src/components/ward-management/ward-derivations.ts
index 33e8948bae..e4641cbf31 100644
--- a/src/components/ward-management/ward-derivations.ts
+++ b/src/components/ward-management/ward-derivations.ts
@@ -553,6 +553,58 @@ export function handoverSnapshot(movements: Movement[], units: Unit[], now: Inst
   };
 }
 
+/**
+ * Task 5 (spec item 4): the escalation board — one place showing every patient whose placement
+ * has gone wrong. Two groups, computed independently, and a movement can genuinely appear in
+ * both: `escalated` is a fact about the RECORD (a human already declared the network exhausted
+ * and rang a contact); `nowhereEligible` is a fact about the LIVE network right now
+ * (`eligibleCandidatesAmong`, evaluated against every unit so nothing is truncated). WF-009
+ * satisfies both at once in the real fixture — it has a recorded escalation and, independently,
+ * still has zero eligible wards — and that overlap is correct, not a bug: the two lists answer
+ * different questions and neither implies or excludes the other.
+ *
+ * THIS BOARD RECORDS AND SHOWS. IT SUGGESTS NOTHING (spec D4). No "least-bad options", no
+ * ranking of wards the patient does not fit, no statement of what would need to change for a
+ * ward to work. `nowhereEligible` names WHICH movements have nowhere eligible; it never names
+ * which ward almost fit, or what gate is closest to passing — that would be exactly the
+ * near-miss computation item 4 explicitly prohibits. `escalated` shows `triedUnitIds` resolved
+ * to real `Unit` objects purely as a record of what was already tried, never as live candidates.
+ *
+ * Scoped to OPEN movements only (`isOpen`) — a closed movement's placement cannot still be
+ * "going wrong" in a way this board exists to surface.
+ */
+export type EscalationBoard = {
+  escalated: { movement: Movement; triedUnits: Unit[] }[];
+  nowhereEligible: Movement[];
+};
+
+export function escalationBoard(movements: Movement[], units: Unit[], now: Instant): EscalationBoard {
+  const open = movements.filter(isOpen);
+
+  const escalated = open
+    .filter((movement) => movement.escalation !== undefined)
+    .map((movement) => {
+      const triedUnitIds = movement.escalation?.triedUnitIds ?? [];
+      const triedUnits = triedUnitIds
+        .map((unitId) => units.find((unit) => unit.id === unitId))
+        .filter((unit): unit is Unit => unit !== undefined);
+      return { movement, triedUnits };
+    });
+
+  // A large, explicit limit — never the default of 3 — so this counts every unit in the
+  // network rather than reading a truncated shortlist length as an eligibility count. That
+  // exact mistake (counting `eligibleCandidatesAmong(...).length` instead of filtering to
+  // `.verdict.eligible`) produced a false "nowhereEligible is empty on the standard night" claim
+  // in an earlier draft of this task's own brief — see tests/ward-scenarios.test.ts's comment.
+  const nowhereEligible = open.filter(
+    (movement) =>
+      eligibleCandidatesAmong(movement, units, now, units.length).filter((candidate) => candidate.verdict.eligible)
+        .length === 0,
+  );
+
+  return { escalated, nowhereEligible };
+}
+
 /** A real, per-movement audit trail built from actual fields — never generic flavour text. */
 export function movementTimeline(movement: Movement) {
   const events: Array<{ at: Instant; label: string }> = [{ at: movement.openedAt, label: "Movement opened" }];
diff --git a/src/components/ward-management/ward-management-navigation.tsx b/src/components/ward-management/ward-management-navigation.tsx
index bf52940728..26bbe5dc31 100644
--- a/src/components/ward-management/ward-management-navigation.tsx
+++ b/src/components/ward-management/ward-management-navigation.tsx
@@ -20,6 +20,7 @@ import {
   ShieldCheck,
   Siren,
   SlidersHorizontal,
+  TriangleAlert,
   Truck,
   Waypoints,
   Wrench,
@@ -179,6 +180,24 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
         <Link href="/ward-management/handover" aria-label="Handover" title="Handover" className={shellStyles.railLink}>
           <ClipboardList aria-hidden="true" />
         </Link>
+        {/* Task 5: `/ward-management/escalation` — same shape as the Handover, Officer and
+            Emergency department links immediately above and for the exact same reason (see the
+            Officer link's own comment): a raw `<Link>` with a literal string `href`, never
+            `RailLink`, because `RailLink` passes its `href` through as a destructured prop,
+            which reads as a plain `Identifier` to `tests/route-reachability.test.ts`'s AST scan
+            and would leave this route invisible to it. It also sits outside the eight-link
+            `WardModeNavigation` strip on purpose, for the same reason the Officer link's comment
+            already explains. "Escalation" collides with no other accessible name in this rail or
+            in `WardModeNavigation` as a substring, so Playwright's default substring
+            accessible-name match cannot resolve it to more than one element. */}
+        <Link
+          href="/ward-management/escalation"
+          aria-label="Escalation"
+          title="Escalation"
+          className={shellStyles.railLink}
+        >
+          <TriangleAlert aria-hidden="true" />
+        </Link>
         <RailLink href="/?mode=answer" label="Favourites">
           <HeartPulse aria-hidden="true" />
         </RailLink>
diff --git a/tests/design-system-adoption.test.ts b/tests/design-system-adoption.test.ts
index 718bd2d016..ba29829b46 100644
--- a/tests/design-system-adoption.test.ts
+++ b/tests/design-system-adoption.test.ts
@@ -1412,15 +1412,15 @@ describe("design-system adoption manifest", () => {
           ["committed", "not-committed", "not-applicable"].includes(surface.baseline.status),
       ),
     ).toBe(true);
-    // 80 = 59 + 6 + 14 + 1: the 59 production pages that preceded both changes,
+    // 81 = 59 + 6 + 15 + 1: the 59 production pages that preceded both changes,
     // the six `<mode>/search` routes home consolidation split out of the bare paths,
-    // the fourteen-route Ward Flow synthetic patient-flow prototype (mode home,
+    // the fifteen-route Ward Flow synthetic patient-flow prototype (mode home,
     // eight remaining workspace routes, ED/ward/officer role screens, the per-patient
-    // detail route, the Phase 4 shift handover, and the retired constellation redirect),
-    // and the Caring Contacts workspace. Redirect stubs keep legacy deep links resolving
-    // and still count as declared routes. This is a census, so a route nobody intended to
-    // add still fails the contract.
-    expect(manifest.routeCoverage.discovered).toHaveLength(80);
+    // detail route, the Phase 4 shift handover and escalation board, and the retired
+    // constellation redirect), and the Caring Contacts workspace. Redirect stubs keep
+    // legacy deep links resolving and still count as declared routes. This is a census,
+    // so a route nobody intended to add still fails the contract.
+    expect(manifest.routeCoverage.discovered).toHaveLength(81);
     expect(manifest.routeCoverage.declared).toEqual(manifest.routeCoverage.discovered);
     expect(manifest.routeCoverage.undeclared).toEqual([]);
     expect(manifest.routeCoverage.missing).toEqual([]);
diff --git a/tests/route-reachability.test.ts b/tests/route-reachability.test.ts
index d6b9937eff..da38c3f3c4 100644
--- a/tests/route-reachability.test.ts
+++ b/tests/route-reachability.test.ts
@@ -647,6 +647,16 @@ describe("route reachability", () => {
     expect(isReachable(route.route, route.file)).toBe(true);
   });
 
+  // Task 5 (Ward Flow escalation board): same narrowing as the handover assertion immediately
+  // above, and for the same reason — the generic orphan sweep covers this route too, but a
+  // failure there does not name which route regressed.
+  it("/ward-management/escalation is linked from the clinical rail", () => {
+    const route = staticPageRoutes.find((entry) => entry.route === "/ward-management/escalation");
+    expect(route, "/ward-management/escalation must exist as a static page route").toBeDefined();
+    if (!route) return;
+    expect(isReachable(route.route, route.file)).toBe(true);
+  });
+
   it("reachability allowlist has no stale entries", () => {
     const routes = new Set(staticPageRoutes.map((entry) => entry.route));
     for (const route of REACHABILITY_ALLOWLIST.keys()) {
diff --git a/tests/ward-escalation.dom.test.tsx b/tests/ward-escalation.dom.test.tsx
new file mode 100644
index 0000000000..0ef0a5d06a
--- /dev/null
+++ b/tests/ward-escalation.dom.test.tsx
@@ -0,0 +1,125 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+// Same reason as every sibling dom suite (ward-handover.dom.test.tsx, ward-screen.dom.test.tsx,
+// ward-ed-screen.dom.test.tsx): `ClinicalRail` renders next/link anchors and this suite never
+// checks routing, so a plain <a> avoids an App Router context jsdom cannot provide.
+vi.mock("next/link", () => ({
+  default: ({ children, href, ...rest }: { children: ReactNode; href: string }) => (
+    <a href={href} {...rest}>
+      {children}
+    </a>
+  ),
+}));
+
+import type { EscalationBoard } from "@/components/ward-management/ward-derivations";
+import {
+  EscalatedSection,
+  EscalationBoardPage,
+  NowhereEligibleSection,
+} from "@/components/ward-management/escalation/escalation-board";
+import { useWardFlow, WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
+
+/** Raises the same `ADVANCE_CLOCK` demo event the real demo controls dispatch, so this suite can
+ * move the shared clock without reaching into the reducer directly — mirrors `ClockAdvancer` in
+ * ward-handover.dom.test.tsx and ward-flow-clock-consistency.dom.test.tsx. */
+function ClockAdvancer({ minutes }: { minutes: number }) {
+  const { now, dispatch } = useWardFlow();
+  return (
+    <button type="button" onClick={() => dispatch({ type: "ADVANCE_CLOCK", role: "demo", now, minutes })}>
+      advance clock
+    </button>
+  );
+}
+
+function renderEscalationBoard() {
+  return render(
+    <WardFlowProvider initialNow={NOW_ANCHOR}>
+      <EscalationBoardPage />
+      <ClockAdvancer minutes={100} />
+    </WardFlowProvider>,
+  );
+}
+
+describe("EscalationBoardPage", () => {
+  it("renders the root and both sections, in order", () => {
+    renderEscalationBoard();
+
+    expect(screen.getByTestId("ward-escalation-page")).toBeInTheDocument();
+
+    const order = ["ward-escalation-escalated", "ward-escalation-nowhere-eligible"];
+    const positions = order.map((testId) => {
+      const node = screen.getByTestId(testId);
+      expect(node).toBeInTheDocument();
+      return Array.prototype.indexOf.call(document.querySelectorAll("[data-testid]"), node);
+    });
+    for (let index = 1; index < positions.length; index += 1) {
+      expect(positions[index]).toBeGreaterThan(positions[index - 1]);
+    }
+  });
+
+  it("shows the real fixture's non-empty sections as tables, not the empty note, and names the measured movements", () => {
+    renderEscalationBoard();
+
+    // The real fixture at NOW_ANCHOR carries exactly one escalated movement (WF-009) and exactly
+    // two movements with nowhere eligible (WF-009, WF-308) — measured, see tests/ward-escalation.test.ts.
+    // Neither section is empty against this seed, so neither "-empty" note should render.
+    expect(screen.queryByTestId("ward-escalation-escalated-empty")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("ward-escalation-nowhere-eligible-empty")).not.toBeInTheDocument();
+
+    const escalatedText = screen.getByTestId("ward-escalation-escalated").textContent ?? "";
+    expect(escalatedText).toContain("WF-009");
+    expect(escalatedText).toContain("State bed coordination desk");
+
+    const nowhereText = screen.getByTestId("ward-escalation-nowhere-eligible").textContent ?? "";
+    expect(nowhereText).toContain("WF-009");
+    expect(nowhereText).toContain("WF-308");
+  });
+
+  it("never renders a near-miss or ranking word anywhere on the page — it records and shows, it suggests nothing", () => {
+    renderEscalationBoard();
+    const pageText = screen.getByTestId("ward-escalation-page").textContent ?? "";
+    for (const forbidden of ["least-bad", "closest", "almost", "nearest", "recommend", "suggest"]) {
+      expect(pageText.toLowerCase()).not.toContain(forbidden);
+    }
+  });
+
+  // This board is deliberately NOT frozen, unlike the shift handover — see the doc comment on
+  // `EscalationBoardPage`. Advancing the shared clock must move WF-009's wait label forward, the
+  // opposite assertion of ward-handover.dom.test.tsx's freeze test. If a future edit added a
+  // `useState` freeze here (copying the handover pattern without the reasoning), this goes red.
+  it("stays live: the wait column advances when the shared clock advances", () => {
+    renderEscalationBoard();
+
+    const beforeText = screen.getByTestId("ward-escalation-escalated").textContent ?? "";
+
+    fireEvent.click(screen.getByRole("button", { name: "advance clock" }));
+
+    const afterText = screen.getByTestId("ward-escalation-escalated").textContent ?? "";
+    expect(afterText).not.toBe(beforeText);
+  });
+
+  // Every section must state plainly when it is empty (spec's conservative-failure rule) — but
+  // the real fixture, at any `now`, never produces an empty section here (WF-009 always carries
+  // its escalation; the standard scenario's nowhereEligible pair is authored into the fixture and
+  // does not clear with time). Rather than weaken this assertion by skipping it, the precondition
+  // is constructed explicitly: an empty `EscalationBoard` is a real, valid value of the exported
+  // type, and each section component takes it as a plain prop with no dependency on the provider.
+  describe("renders the explicit empty note for both sections, given an empty board", () => {
+    const emptyBoard: EscalationBoard = { escalated: [], nowhereEligible: [] };
+
+    it("escalated", () => {
+      render(<EscalatedSection board={emptyBoard} now={NOW_ANCHOR} />);
+      expect(screen.getByTestId("ward-escalation-escalated-empty")).toHaveTextContent("None");
+      expect(screen.queryByRole("table")).not.toBeInTheDocument();
+    });
+
+    it("nowhere eligible", () => {
+      render(<NowhereEligibleSection board={emptyBoard} now={NOW_ANCHOR} />);
+      expect(screen.getByTestId("ward-escalation-nowhere-eligible-empty")).toHaveTextContent("None");
+      expect(screen.queryByRole("table")).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/tests/ward-escalation.test.ts b/tests/ward-escalation.test.ts
new file mode 100644
index 0000000000..ebbd8f936f
--- /dev/null
+++ b/tests/ward-escalation.test.ts
@@ -0,0 +1,96 @@
+// tests/ward-escalation.test.ts
+import { describe, expect, it } from "vitest";
+
+import { escalationBoard, isOpen } from "../src/components/ward-management/ward-derivations";
+import { seedWardFlowState } from "../src/components/ward-management/ward-flow-reducer";
+import { scenarioUnits } from "../src/components/ward-management/ward-scenarios";
+import { NOW_ANCHOR } from "../src/components/ward-management/ward-sites";
+
+const { movements, units } = seedWardFlowState();
+const openMovements = movements.filter(isOpen);
+
+describe("escalationBoard", () => {
+  it("escalated contains exactly the open movements carrying a recorded escalation", () => {
+    const board = escalationBoard(movements, units, NOW_ANCHOR);
+    const expectedIds = openMovements
+      .filter((movement) => movement.escalation !== undefined)
+      .map((movement) => movement.id)
+      .sort();
+    expect(board.escalated.map((entry) => entry.movement.id).sort()).toEqual(expectedIds);
+  });
+
+  it("escalated resolves triedUnitIds to real Unit objects, one for one, on the real fixture", () => {
+    const board = escalationBoard(movements, units, NOW_ANCHOR);
+    for (const entry of board.escalated) {
+      const escalation = entry.movement.escalation;
+      if (!escalation) throw new Error(`${entry.movement.id} appears in escalated without an escalation record`);
+      expect(entry.triedUnits.map((unit) => unit.id)).toEqual(escalation.triedUnitIds);
+    }
+  });
+
+  // Measured directly against the real fixture at NOW_ANCHOR (2026-08-25), counting
+  // `eligibility(...).eligible` across all 22 units for every open movement (never the
+  // truncated length of `eligibleCandidatesAmong(...)`'s default 3-candidate shortlist, which
+  // is a same-cohort count, not an eligibility count): 41 open movements, 337 eligible
+  // movement/unit pairs, and exactly two movements — WF-009 and WF-308 — already have nowhere
+  // eligible on the standard night. Both are the fixture as authored. Pinned by id and by exact
+  // count so a regression that strands more (or fewer) patients is caught here, not only on
+  // screen. See tests/ward-scenarios.test.ts's own comment for the same measurement.
+  it("on the standard night, exactly WF-009 and WF-308 have nowhere eligible", () => {
+    const board = escalationBoard(movements, units, NOW_ANCHOR);
+    expect(board.nowhereEligible.map((movement) => movement.id).sort()).toEqual(["WF-009", "WF-308"]);
+  });
+
+  it("on the scarce night, nowhereEligible grows to the measured nine-movement set", () => {
+    const scarceUnits = scenarioUnits("scarce");
+    const board = escalationBoard(movements, scarceUnits, NOW_ANCHOR);
+    // Measured directly against the real fixture at NOW_ANCHOR under scenarioUnits("scarce"):
+    // 123 eligible movement/unit pairs, 9 movements stranded. Pinned exactly.
+    expect(board.nowhereEligible.map((movement) => movement.id).sort()).toEqual([
+      "WF-002",
+      "WF-009",
+      "WF-011",
+      "WF-012",
+      "WF-014",
+      "WF-015",
+      "WF-017",
+      "WF-308",
+      "WF-319",
+    ]);
+    // The honest empty state does not exist on either measured night — the scarce night is
+    // strictly a superset of the standard night's two, never a disjoint or smaller set. This
+    // guards against a scenario change that shrinks the scarce list back toward the standard
+    // one, which would quietly undercut the point of the scarce scenario.
+    const standardBoard = escalationBoard(movements, units, NOW_ANCHOR);
+    const standardIds = new Set(standardBoard.nowhereEligible.map((movement) => movement.id));
+    for (const id of standardIds) {
+      expect(board.nowhereEligible.map((movement) => movement.id)).toContain(id);
+    }
+    expect(board.nowhereEligible.length).toBeGreaterThan(standardBoard.nowhereEligible.length);
+  });
+
+  it("excludes closed movements from both groups", () => {
+    const closedWithEscalation = movements.find((movement) => movement.escalation !== undefined && !isOpen(movement));
+    // The real fixture carries no closed movement with a recorded escalation (escalation only
+    // makes sense for a patient still travelling through the pathway), so this constructs the
+    // precondition explicitly rather than weakening the assertion — the same move Tasks 2, 3 and
+    // 4 all had to make when a literal fixture lookup would not produce what the assertion needs.
+    const syntheticClosedEscalated =
+      closedWithEscalation ??
+      (() => {
+        const base = movements.find((movement) => movement.escalation !== undefined);
+        if (!base) throw new Error("fixture carries no movement with a recorded escalation to build the case from");
+        return {
+          ...base,
+          id: "WF-TEST-CLOSED-ESCALATED",
+          closure: { at: NOW_ANCHOR, outcome: "arrived" as const, reason: "Test fixture: arrived" },
+        };
+      })();
+
+    expect(isOpen(syntheticClosedEscalated)).toBe(false);
+
+    const board = escalationBoard([...movements, syntheticClosedEscalated], units, NOW_ANCHOR);
+    expect(board.escalated.map((entry) => entry.movement.id)).not.toContain(syntheticClosedEscalated.id);
+    expect(board.nowhereEligible.map((movement) => movement.id)).not.toContain(syntheticClosedEscalated.id);
+  });
+});

From 053133ff90656d0223b0aec2b20d201ebda82d55 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 08:36:03 +0800
Subject: [PATCH 11/54] Ward Flow: the escalation contact becomes a fixed list,
 so synthetic-only is true by construction

---
 .../coordinator/shortlist-panel.tsx           |  38 ++++--
 .../ward-management/ward-change-reasons.ts    |  19 +++
 tests/ward-change-reasons.test.ts             |  19 +++
 tests/ward-shortlist.dom.test.tsx             | 125 ++++++++++++++++++
 4 files changed, 188 insertions(+), 13 deletions(-)
 create mode 100644 tests/ward-shortlist.dom.test.tsx

diff --git a/src/components/ward-management/coordinator/shortlist-panel.tsx b/src/components/ward-management/coordinator/shortlist-panel.tsx
index 2a4edf21a5..d52ad0e551 100644
--- a/src/components/ward-management/coordinator/shortlist-panel.tsx
+++ b/src/components/ward-management/coordinator/shortlist-panel.tsx
@@ -6,10 +6,12 @@ import { useMemo, useState, type Dispatch, type FormEvent } from "react";
 import {
   CANCEL_TRANSPORT_REASONS,
   changeReasonLabels,
+  ESCALATION_CONTACTS,
   LEGAL_STATUS_CHANGE_REASONS,
   RELEASE_HOLD_REASONS,
   URGENCY_CHANGE_REASONS,
   type CancelTransportReason,
+  type EscalationContact,
   type LegalStatusChangeReason,
   type ReleaseHoldReason,
   type UrgencyChangeReason,
@@ -182,7 +184,10 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
   // the recorded fact itself, which lives on `movement.escalation` and is read fresh on every
   // render, the same discipline `overrideSucceeded` already holds to for the override record.
   const [escalationOpen, setEscalationOpen] = useState(false);
-  const [escalationContact, setEscalationContact] = useState("");
+  // Task 6 (spec item 11): chosen, never typed — the free-text `escalationContact` string state
+  // this replaces is gone. Defaults to the list's first entry, the same pattern every other fixed
+  // picker in this panel already uses (`urgencyDraft.reason`, `releaseHoldReason`, and so on).
+  const [escalationContact, setEscalationContact] = useState<EscalationContact>(ESCALATION_CONTACTS[0]);
   // Task 2: urgency and legal status can change mid-flight. Both a coordinator and the referring
   // ED clinician may make either change (`EVENT_ROLE.CHANGE_URGENCY`/`CHANGE_LEGAL_STATUS`), so
   // this panel dispatches as role "coordinator" — the ED screen's own controls dispatch as "ed".
@@ -219,7 +224,7 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
     setOverrideReason("");
     setReferTargets([]);
     setEscalationOpen(false);
-    setEscalationContact("");
+    setEscalationContact(ESCALATION_CONTACTS[0]);
     setUrgencyChangeOpen(false);
     setUrgencyDraft({ urgency: movement?.urgency ?? 1, reason: URGENCY_CHANGE_REASONS[0] });
     setLegalStatusChangeOpen(false);
@@ -374,24 +379,25 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
    * eligibility scan, not a record of what was actually attempted — using it would let a
    * genuinely untried unit (never referred, only eligibility-checked) be named as "tried".
    * WF-009's own pre-authored fixture escalation (`ward-movements.ts`) uses exactly this shape:
-   * its five `triedUnitIds` are its five `declines`, unit for unit. Only `contact` (a role or
-   * service, never a person — synthetic data only, the same rule every other free-text field in
-   * this prototype follows) is typed.
+   * its five `triedUnitIds` are its five `declines`, unit for unit. `contact` (a role or service,
+   * never a person) is Task 6's fixed `ESCALATION_CONTACTS` picker, not typed text — see the
+   * comment above `ward-change-reasons.ts`'s `ESCALATION_CONTACTS`.
    */
   function submitEscalation(event: FormEvent<HTMLFormElement>) {
     event.preventDefault();
-    const contact = escalationContact.trim();
-    if (contact.length === 0) return;
+    // Task 6: `escalationContact` is now always one of `ESCALATION_CONTACTS` — a `<select>` can
+    // never submit an empty or arbitrary value, so the old trim-and-check-length guard this
+    // replaced is gone along with the free-text state it protected.
     dispatch({
       type: "RECORD_ESCALATION",
       role: "coordinator",
       now,
       movementId,
       triedUnitIds: declinedUnitIds,
-      contact,
+      contact: escalationContact,
     });
     setEscalationOpen(false);
-    setEscalationContact("");
+    setEscalationContact(ESCALATION_CONTACTS[0]);
   }
 
   /**
@@ -952,14 +958,20 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
                   Role or service being contacted next — a role or service only, never a person&apos;s name (synthetic
                   data only)
                 </label>
-                <textarea
+                <select
                   id="ward-shortlist-escalation-contact"
                   required
                   data-testid="ward-shortlist-escalation-contact"
-                  className={styles.shortlistOverrideTextarea}
+                  className={styles.shortlistOverrideSelect}
                   value={escalationContact}
-                  onChange={(event) => setEscalationContact(event.target.value)}
-                />
+                  onChange={(event) => setEscalationContact(event.target.value as EscalationContact)}
+                >
+                  {ESCALATION_CONTACTS.map((contact) => (
+                    <option key={contact} value={contact}>
+                      {contact}
+                    </option>
+                  ))}
+                </select>
                 <button
                   type="submit"
                   data-testid="ward-shortlist-escalation-submit"
diff --git a/src/components/ward-management/ward-change-reasons.ts b/src/components/ward-management/ward-change-reasons.ts
index a5815c29b8..ebaa88a6e9 100644
--- a/src/components/ward-management/ward-change-reasons.ts
+++ b/src/components/ward-management/ward-change-reasons.ts
@@ -36,6 +36,25 @@ export const CANCEL_TRANSPORT_REASONS = [
 ] as const;
 export type CancelTransportReason = (typeof CANCEL_TRANSPORT_REASONS)[number];
 
+/**
+ * Task 6 (spec item 11): the escalation contact, chosen never typed — the last free-text input in
+ * the escalation form becomes a fixed list, for the same reason as the four lists above. Five
+ * entries are drawn from language this model already uses; "Other service" is the one deliberate
+ * general entry — never a free-text field of its own, which would reinstate exactly what this
+ * removes. Unlike the four reason lists above, there is no separate snake_case value / label pair:
+ * the values themselves are the rendered display text, because there is no clinical token to keep
+ * out of a label here to begin with.
+ */
+export const ESCALATION_CONTACTS = [
+  "State bed coordination desk",
+  "Duty psychiatrist",
+  "Bed management",
+  "Nurse unit manager (destination ward)",
+  "Escort or transport provider",
+  "Other service",
+] as const;
+export type EscalationContact = (typeof ESCALATION_CONTACTS)[number];
+
 export const changeReasonLabels: Record<
   UrgencyChangeReason | LegalStatusChangeReason | ReleaseHoldReason | CancelTransportReason,
   string
diff --git a/tests/ward-change-reasons.test.ts b/tests/ward-change-reasons.test.ts
index dab3834160..67be8dcf79 100644
--- a/tests/ward-change-reasons.test.ts
+++ b/tests/ward-change-reasons.test.ts
@@ -4,6 +4,7 @@ import { describe, expect, it } from "vitest";
 import {
   CANCEL_TRANSPORT_REASONS,
   changeReasonLabels,
+  ESCALATION_CONTACTS,
   LEGAL_STATUS_CHANGE_REASONS,
   RELEASE_HOLD_REASONS,
   URGENCY_CHANGE_REASONS,
@@ -69,6 +70,20 @@ describe("ward-change-reasons", () => {
     }
   });
 
+  // Task 6 (spec item 11): the escalation contact, chosen never typed. Pinned order matches the
+  // exact product-owner list from the brief — "Other service" is the one deliberate general
+  // entry, never a seventh entry and never reworded.
+  it("holds exactly the six escalation contacts, in this order", () => {
+    expect(ESCALATION_CONTACTS).toEqual([
+      "State bed coordination desk",
+      "Duty psychiatrist",
+      "Bed management",
+      "Nurse unit manager (destination ward)",
+      "Escort or transport provider",
+      "Other service",
+    ]);
+  });
+
   // Content-free, synthetic-data guard: none of the eight rulings in the brief permits a reason
   // describing a patient, a diagnosis, a clinical judgement or a legal requirement. This asserts
   // it structurally rather than trusting a comment — a reason string is never free text (every
@@ -90,6 +105,10 @@ describe("ward-change-reasons", () => {
       ...URGENCY_CHANGE_REASONS,
       ...LEGAL_STATUS_CHANGE_REASONS,
       ...Object.values(changeReasonLabels),
+      // Task 6: ESCALATION_CONTACTS carries no separate label map (its values ARE the rendered
+      // text — see the comment above its definition), so it is checked here directly rather than
+      // through changeReasonLabels.
+      ...ESCALATION_CONTACTS,
     ].map((value) => value.toLowerCase());
 
     for (const text of allText) {
diff --git a/tests/ward-shortlist.dom.test.tsx b/tests/ward-shortlist.dom.test.tsx
new file mode 100644
index 0000000000..19e17401c6
--- /dev/null
+++ b/tests/ward-shortlist.dom.test.tsx
@@ -0,0 +1,125 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import { useState } from "react";
+import { describe, expect, it } from "vitest";
+
+import { ESCALATION_CONTACTS } from "@/components/ward-management/ward-change-reasons";
+import { ShortlistPanel } from "@/components/ward-management/coordinator/shortlist-panel";
+import { useWardFlow, WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
+
+/**
+ * Task 6 (spec item 11). WF-308 is the real fixture's own second "nowhere eligible" movement at
+ * NOW_ANCHOR (WF-009 is the first, and WF-009 already carries a recorded escalation — see
+ * tests/ward-escalation.test.ts and tests/ward-escalation.dom.test.tsx), so it renders the
+ * escalation form's "Record escalation" path rather than "Update escalation".
+ */
+const TARGET_MOVEMENT_ID = "WF-308";
+
+/**
+ * Mirrors `ClockAdvancer` in ward-escalation.dom.test.tsx and `ReferFirstMovement` in
+ * ward-flow-queue-selection.dom.test.tsx: a thin sibling that reads the real provider state and
+ * hands it to the component under test, so the suite exercises the real reducer and the real
+ * fixture rather than a hand-built movement that could silently drift from what the reducer can
+ * actually produce.
+ */
+function ShortlistHarness() {
+  const { movements, units, now, dispatch } = useWardFlow();
+  const [selectedUnitId, setSelectedUnitId] = useState<string | undefined>(undefined);
+  const movement = movements.find((candidate) => candidate.id === TARGET_MOVEMENT_ID);
+  return (
+    <ShortlistPanel
+      movement={movement}
+      now={now}
+      units={units}
+      selectedUnitId={selectedUnitId}
+      onSelectUnit={setSelectedUnitId}
+      dispatch={dispatch}
+    />
+  );
+}
+
+function renderShortlist() {
+  return render(
+    <WardFlowProvider initialNow={NOW_ANCHOR}>
+      <ShortlistHarness />
+    </WardFlowProvider>,
+  );
+}
+
+/** Scopes a query to the escalation `<section>` alone, never the whole document — the override
+ *  form a few sections down also carries a `<textarea>`, and this suite must never mistake that
+ *  unrelated control for evidence about the escalation form specifically. */
+function escalationSection(container: HTMLElement): HTMLElement {
+  const section = container.querySelector('section[aria-label="Escalation"]');
+  if (!(section instanceof HTMLElement)) {
+    throw new Error("Escalation section not found");
+  }
+  return section;
+}
+
+describe("ShortlistPanel escalation contact", () => {
+  it("opens a fixed picker whose options are exactly ESCALATION_CONTACTS, in order", () => {
+    const { container } = renderShortlist();
+
+    fireEvent.click(screen.getByTestId("ward-shortlist-escalation-toggle"));
+
+    const select = screen.getByTestId("ward-shortlist-escalation-contact");
+    expect(select.tagName).toBe("SELECT");
+    expect(select).toBeInstanceOf(HTMLSelectElement);
+
+    const optionValues = Array.from((select as HTMLSelectElement).options).map((option) => option.value);
+    expect(optionValues).toEqual([...ESCALATION_CONTACTS]);
+    const optionText = Array.from((select as HTMLSelectElement).options).map((option) => option.textContent);
+    expect(optionText).toEqual([...ESCALATION_CONTACTS]);
+
+    // The decisive proof this task exists for: no textarea and no free-text input anywhere in
+    // the escalation form, scoped so the unrelated override-reason textarea elsewhere on this
+    // same panel can never satisfy this assertion by accident.
+    const section = escalationSection(container);
+    expect(section.querySelectorAll("textarea")).toHaveLength(0);
+    expect(section.querySelectorAll('input:not([type="hidden"])')).toHaveLength(0);
+  });
+
+  it("keeps the label wording and the existing test-id on the picker", () => {
+    renderShortlist();
+    fireEvent.click(screen.getByTestId("ward-shortlist-escalation-toggle"));
+
+    const select = screen.getByLabelText(
+      "Role or service being contacted next — a role or service only, never a person's name (synthetic data only)",
+    );
+    expect(select).toHaveAttribute("id", "ward-shortlist-escalation-contact");
+    expect(select.getAttribute("data-testid")).toBe("ward-shortlist-escalation-contact");
+  });
+
+  it("dispatches RECORD_ESCALATION with one of the listed contacts, chosen from the picker", () => {
+    renderShortlist();
+    fireEvent.click(screen.getByTestId("ward-shortlist-escalation-toggle"));
+
+    const select = screen.getByTestId("ward-shortlist-escalation-contact") as HTMLSelectElement;
+    const chosen = "Duty psychiatrist";
+    expect(ESCALATION_CONTACTS).toContain(chosen);
+    fireEvent.change(select, { target: { value: chosen } });
+    fireEvent.click(screen.getByTestId("ward-shortlist-escalation-submit"));
+
+    // Read the real post-dispatch fact back from the movement, the same discipline every other
+    // "did this really happen" assertion in this panel already holds to (`overrideSucceeded`,
+    // the referral badges) — never a captured local flag.
+    const record = screen.getByTestId("ward-shortlist-escalation-record");
+    expect(record.textContent).toContain(`contact: "${chosen}"`);
+    // The submit button re-opens as "Update escalation" once a record exists — proof the
+    // dispatch actually reached the reducer and stuck, not merely that the form closed.
+    expect(screen.getByTestId("ward-shortlist-escalation-toggle").textContent).toBe("Update escalation");
+  });
+
+  it("defaults the picker to the first ESCALATION_CONTACTS entry and never submits an empty value", () => {
+    renderShortlist();
+    fireEvent.click(screen.getByTestId("ward-shortlist-escalation-toggle"));
+
+    const select = screen.getByTestId("ward-shortlist-escalation-contact") as HTMLSelectElement;
+    expect(select.value).toBe(ESCALATION_CONTACTS[0]);
+
+    fireEvent.click(screen.getByTestId("ward-shortlist-escalation-submit"));
+    const record = screen.getByTestId("ward-shortlist-escalation-record");
+    expect(record.textContent).toContain(`contact: "${ESCALATION_CONTACTS[0]}"`);
+  });
+});

From e0816ea4e689a7e502df7a1c9585e5cb6e337559 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 09:11:34 +0800
Subject: [PATCH 12/54] Ward Flow: patient search, on its own page

---
 docs/codebase-index.md                        |  19 +-
 docs/design-system/ADOPTION.md                |   8 +-
 docs/design-system/adoption-contract.json     |   2 +
 docs/design-system/adoption-manifest.json     |  31 ++-
 docs/site-map.md                              |   1 +
 scripts/generate-site-map.ts                  |   2 +
 src/app/ward-management/search/page.tsx       |  12 ++
 .../ward-management/search/patient-search.tsx | 187 +++++++++++++++++
 .../ward-management/search/search.module.css  | 189 ++++++++++++++++++
 .../ward-management/ward-derivations.ts       |  47 +++++
 .../ward-management-navigation.tsx            |  19 ++
 tests/design-system-adoption.test.ts          |  14 +-
 tests/route-reachability.test.ts              |  10 +
 tests/ward-patient-search.dom.test.tsx        | 143 +++++++++++++
 tests/ward-patient-search.test.ts             | 160 +++++++++++++++
 15 files changed, 826 insertions(+), 18 deletions(-)
 create mode 100644 src/app/ward-management/search/page.tsx
 create mode 100644 src/components/ward-management/search/patient-search.tsx
 create mode 100644 src/components/ward-management/search/search.module.css
 create mode 100644 tests/ward-patient-search.dom.test.tsx
 create mode 100644 tests/ward-patient-search.test.ts

diff --git a/docs/codebase-index.md b/docs/codebase-index.md
index 3e054e9152..704e672595 100644
--- a/docs/codebase-index.md
+++ b/docs/codebase-index.md
@@ -381,7 +381,7 @@ visible reasons and a human confirms or overrides.
   officer identity" notice), `ed/ed-screen.tsx` (Task 11: one emergency department's own view —
   `/ward-management/ed/[edId]`, resolved via `ward-sites.ts`'s `edById`; both clocks (time in
   department from `openedAt`, the legal clock from `formedAt` where earlier, marked
-  `data-community-formed`), the four-hour `ED_ACCESS_TARGET_MINUTES` departmental access target
+  `data-community-formed`), the 24-hour `ED_ACCESS_TARGET_MINUTES` departmental access target
   — labelled and computed so it can never be mistaken for a legal deadline and never touches a
   `LegalForm`/`dueAt` — a police-attendance flag, and each movement's single outstanding item; a
   raise-referral form (`RAISE_REFERRAL`), a record-examination form (`RECORD_EXAMINATION`), and
@@ -403,7 +403,17 @@ visible reasons and a human confirms or overrides.
   still has nowhere eligible. Unlike the handover, this page is NOT frozen: it reads the live clock on
   every render, since a coordinator working this board wants the current picture. Records and shows
   only — it computes no near-miss, no least-bad option, and no statement of what would need to change
-  for a ward to work)
+  for a ward to work), `search/patient-search.tsx` (Phase 4 Task 7: patient search — `/ward-management/search`;
+  product owner's choice: its own page, reached from the left-hand menu, rather than a box on the
+  coordinator screen. A single live filter over `ward-derivations.ts`'s `searchMovements` — a free-text
+  field matching movement id, `originEdId`, the resolved destination unit's id/name, the stage's own
+  display label and `owner`, plus an exact-match stage `<select>` and department `<select>`, all three
+  combining as AND. Scoped to OPEN movements only (`isOpen`, applied before any other filter, so a
+  closed movement can never surface even when the query is its own id verbatim) and, like the
+  escalation board and unlike the frozen handover, reads the live `useWardFlow()` clock on every
+  render. Renders an explicit "No matches" note rather than an empty table when nothing fits. This is
+  the page's own single search composer — Ward Flow routes never mount the shared global shell
+  composer, so nothing else on the page competes with it)
 - **State layer (Phase 3):** `ward-flow-provider.tsx` (`WardFlowProvider`/`useWardFlow`, mounted at
   `src/app/ward-management/layout.tsx`), `ward-flow-reducer.ts` (the one mutation path),
   `ward-flow-events.ts` (event/role table)
@@ -412,7 +422,10 @@ visible reasons and a human confirms or overrides.
   (`handoverSnapshot`), `tests/ward-handover.dom.test.tsx` (the freeze and every section's empty
   state), `tests/ward-escalation.test.ts` (`escalationBoard`, including the standard-night
   `WF-009`/`WF-308` and scarce-night nine-movement measurements), `tests/ward-escalation.dom.test.tsx`
-  (both sections and their empty states)
+  (both sections and their empty states), `tests/ward-patient-search.test.ts` (`searchMovements`,
+  including the closed-movement exclusion proven against both a real and a constructed fixture case),
+  `tests/ward-patient-search.dom.test.tsx` (the single-composer shape, live results, and the
+  "No matches" empty state)
 
 ### Developer hub (`src/app/mockups/development/`, `src/lib/developer-area/`)
 
diff --git a/docs/design-system/ADOPTION.md b/docs/design-system/ADOPTION.md
index 88d20d2dd9..7d3fb381d6 100644
--- a/docs/design-system/ADOPTION.md
+++ b/docs/design-system/ADOPTION.md
@@ -357,12 +357,12 @@ product exclusions; the only route-only dispositions are the documented legacy-r
 surfaces. Shared shell/component roots carry their own explicit `shared-shell` disposition.
 
 Registered public components: 54
-Declared product roots: 98
+Declared product roots: 100
 Roots with a literal `.ckb-v2` opt-in: 1
-Roots inheriting `.ckb-v2` from the global `<html>`: 97
+Roots inheriting `.ckb-v2` from the global `<html>`: 99
 Production surfaces observed under v2: 17/17
 Dynamic `ckb-v2` constructions: 0
-Declared production page routes: 81/81
+Declared production page routes: 82/82
 
 Source observation and contract declaration are independent. A literal `ckb-v2` on the global `<html>` makes every production surface inherit v2, but it does not approve that adoption.
 The Proof column summarizes each surface's dark, forced-colours, 320px, print and browser declarations; exact statuses and evidence paths live in the manifest.
@@ -382,7 +382,7 @@ Observed v2 under a compatibility declaration fails closed. A declared v2 shell
 | `favourites`                                    | owned           |      1 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `tools-and-calculators`                         | owned           |      3 |     3 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `caring-contacts-workspace`                     | owned           |      1 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `ward-management`                               | owned           |     14 |    24 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `ward-management`                               | owned           |     15 |    26 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `privacy-safety-and-reference`                  | owned           |      3 |     3 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `search-results-shared`                         | shared-shell    |      0 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 | `answers-shared`                                | shared-shell    |      0 |     2 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
diff --git a/docs/design-system/adoption-contract.json b/docs/design-system/adoption-contract.json
index 84ffed3650..f3bac529bd 100644
--- a/docs/design-system/adoption-contract.json
+++ b/docs/design-system/adoption-contract.json
@@ -595,6 +595,7 @@
         "src/app/ward-management/network/page.tsx",
         "src/app/ward-management/patients/[patientId]/page.tsx",
         "src/app/ward-management/queue/page.tsx",
+        "src/app/ward-management/search/page.tsx",
         "src/app/ward-management/transport/page.tsx",
         "src/app/ward-management/transport/officer/page.tsx",
         "src/app/ward-management/ward/[unitId]/page.tsx"
@@ -606,6 +607,7 @@
         "src/components/ward-management/escalation/escalation-board.tsx",
         "src/components/ward-management/handover/handover-page.tsx",
         "src/components/ward-management/officer/officer-screen.tsx",
+        "src/components/ward-management/search/patient-search.tsx",
         "src/components/ward-management/ward-management-console.tsx",
         "src/components/ward-management/ward-management-modes.tsx",
         "src/components/ward-management/ward-management-navigation.tsx",
diff --git a/docs/design-system/adoption-manifest.json b/docs/design-system/adoption-manifest.json
index 89606913cc..0f0cb74c8d 100644
--- a/docs/design-system/adoption-manifest.json
+++ b/docs/design-system/adoption-manifest.json
@@ -3458,6 +3458,7 @@
         "src/app/ward-management/page.tsx",
         "src/app/ward-management/patients/[patientId]/page.tsx",
         "src/app/ward-management/queue/page.tsx",
+        "src/app/ward-management/search/page.tsx",
         "src/app/ward-management/transport/officer/page.tsx",
         "src/app/ward-management/transport/page.tsx",
         "src/app/ward-management/ward/[unitId]/page.tsx"
@@ -3617,6 +3618,16 @@
           "v2MountMode": "inherited-global-root",
           "sanctionedPatternsPresent": ["WardModeWorkspace"]
         },
+        {
+          "file": "src/app/ward-management/search/page.tsx",
+          "exists": true,
+          "imports": [],
+          "importedFamilies": [],
+          "literalCkbV2": false,
+          "dynamicCkbV2": false,
+          "v2MountMode": "inherited-global-root",
+          "sanctionedPatternsPresent": []
+        },
         {
           "file": "src/app/ward-management/transport/officer/page.tsx",
           "exists": true,
@@ -3697,6 +3708,16 @@
           "v2MountMode": "inherited-global-root",
           "sanctionedPatternsPresent": ["ClinicalRail"]
         },
+        {
+          "file": "src/components/ward-management/search/patient-search.tsx",
+          "exists": true,
+          "imports": [],
+          "importedFamilies": [],
+          "literalCkbV2": false,
+          "dynamicCkbV2": false,
+          "v2MountMode": "inherited-global-root",
+          "sanctionedPatternsPresent": ["ClinicalRail"]
+        },
         {
           "file": "src/components/ward-management/ward-management-console.tsx",
           "exists": true,
@@ -4084,6 +4105,7 @@
       "src/app/ward-management/page.tsx",
       "src/app/ward-management/patients/[patientId]/page.tsx",
       "src/app/ward-management/queue/page.tsx",
+      "src/app/ward-management/search/page.tsx",
       "src/app/ward-management/transport/officer/page.tsx",
       "src/app/ward-management/transport/page.tsx",
       "src/app/ward-management/ward/[unitId]/page.tsx"
@@ -4167,6 +4189,7 @@
       "src/app/ward-management/page.tsx",
       "src/app/ward-management/patients/[patientId]/page.tsx",
       "src/app/ward-management/queue/page.tsx",
+      "src/app/ward-management/search/page.tsx",
       "src/app/ward-management/transport/officer/page.tsx",
       "src/app/ward-management/transport/page.tsx",
       "src/app/ward-management/ward/[unitId]/page.tsx"
@@ -4177,7 +4200,7 @@
   },
   "adoption": {
     "literalCkbV2RootCount": 1,
-    "inheritedCkbV2RootCount": 97,
+    "inheritedCkbV2RootCount": 99,
     "dynamicCkbV2RootCount": 0,
     "v2MountedSurfaceCount": 17,
     "declaredV2SurfaceCount": 17
@@ -4186,8 +4209,8 @@
     "registeredComponentCount": 54,
     "previewCount": 54,
     "productImportedComponentCount": 34,
-    "rootCount": 98,
-    "productionRouteCount": 81,
-    "nextUiEntryCount": 142
+    "rootCount": 100,
+    "productionRouteCount": 82,
+    "nextUiEntryCount": 143
   }
 }
diff --git a/docs/site-map.md b/docs/site-map.md
index 223c65767b..9f84ad2c8a 100644
--- a/docs/site-map.md
+++ b/docs/site-map.md
@@ -68,6 +68,7 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 - `/ward-management/movements` - Scheduled and completed patient transfers and bed movements. Source: `src/app/ward-management/movements/page.tsx`.
 - `/ward-management/network` - Psychiatric bed network status and regional catchment map. Source: `src/app/ward-management/network/page.tsx`.
 - `/ward-management/queue` - Priority referral queue and triage waiting list. Source: `src/app/ward-management/queue/page.tsx`.
+- `/ward-management/search` - Synthetic patient search — find an open Ward Flow movement by id, department, destination, stage or owner. Source: `src/app/ward-management/search/page.tsx`.
 - `/ward-management/transport` - Patient inter-hospital transfer and transport logistics. Source: `src/app/ward-management/transport/page.tsx`.
 - `/ward-management/transport/officer` - Synthetic transport-officer phone screen for in-flight jobs. Source: `src/app/ward-management/transport/officer/page.tsx`.
 - `/ward-management/ward/[unitId]` - Synthetic ward-manager screen for one inpatient unit. Source: `src/app/ward-management/ward/[unitId]/page.tsx`.
diff --git a/scripts/generate-site-map.ts b/scripts/generate-site-map.ts
index 09e6700ea4..b8426c3d41 100644
--- a/scripts/generate-site-map.ts
+++ b/scripts/generate-site-map.ts
@@ -165,6 +165,8 @@ const routeDescriptions: Record<string, string> = {
   "/ward-management/network": "Psychiatric bed network status and regional catchment map.",
   "/ward-management/patients/[patientId]": "Synthetic patient placement and transfer trajectory detail.",
   "/ward-management/queue": "Priority referral queue and triage waiting list.",
+  "/ward-management/search":
+    "Synthetic patient search — find an open Ward Flow movement by id, department, destination, stage or owner.",
   "/ward-management/transport": "Patient inter-hospital transfer and transport logistics.",
   "/ward-management/transport/officer": "Synthetic transport-officer phone screen for in-flight jobs.",
   "/ward-management/ward/[unitId]": "Synthetic ward-manager screen for one inpatient unit.",
diff --git a/src/app/ward-management/search/page.tsx b/src/app/ward-management/search/page.tsx
new file mode 100644
index 0000000000..bf7cb79a16
--- /dev/null
+++ b/src/app/ward-management/search/page.tsx
@@ -0,0 +1,12 @@
+import type { Metadata } from "next";
+
+import { PatientSearchPage } from "@/components/ward-management/search/patient-search";
+
+export const metadata: Metadata = {
+  title: "Patient search — Ward Flow",
+  description: "Synthetic prototype: find an open Ward Flow movement by id, department, destination, stage or owner.",
+};
+
+export default function WardPatientSearchPage() {
+  return <PatientSearchPage />;
+}
diff --git a/src/components/ward-management/search/patient-search.tsx b/src/components/ward-management/search/patient-search.tsx
new file mode 100644
index 0000000000..1c79b7f5ab
--- /dev/null
+++ b/src/components/ward-management/search/patient-search.tsx
@@ -0,0 +1,187 @@
+"use client";
+
+import Link from "next/link";
+import { useMemo, useState } from "react";
+
+import { MOVEMENT_STAGES } from "@/components/ward-management/ward-model";
+import type { Movement, MovementStage, Unit } from "@/components/ward-management/ward-model";
+import {
+  destinationUnit,
+  elapsedLabel,
+  searchMovements,
+  stageCopy,
+  type MovementSearchQuery,
+} from "@/components/ward-management/ward-derivations";
+import { useWardFlow } from "@/components/ward-management/ward-flow-provider";
+import { ClinicalRail } from "@/components/ward-management/ward-management-navigation";
+import { allEmergencyDepartments, edById } from "@/components/ward-management/ward-sites";
+
+import styles from "./search.module.css";
+
+/**
+ * Task 7 (spec item 5): patient search — a live filter over the open caseload, on its own page
+ * (product owner's choice: "its own page, reached from the left-hand menu" over a box on the
+ * coordinator screen).
+ *
+ * ONE SEARCH COMPOSER PER PAGE (`docs/search-chrome-behaviour.md`): this page owns its own text
+ * field, a stage `<select>` and a department `<select>` as the page's single composer, and it must
+ * not also mount the shared global shell composer. It does not need to actively avoid one — every
+ * Ward Flow route (see `handover-page.tsx`, `escalation-board.tsx`, `ward-management-console.tsx`)
+ * renders only `ClinicalRail` plus its own `<main>`; none of them mount `GlobalSearchShell` /
+ * `MasterSearchHeader` at all (`src/app/ward-management/layout.tsx` wraps every route in
+ * `WardFlowProvider` alone, nothing chrome-related). So this page's own search field is the ONLY
+ * composer on the page by construction, the same way it already is on every other Ward Flow route.
+ *
+ * Query state lives in this component (`useState`), `searchMovements` itself stays a pure
+ * derivation with no clock read (see its own doc comment in `ward-derivations.ts`) — this page
+ * calls it fresh on every render against the LIVE `movements`/`units` from `useWardFlow()`, so a
+ * movement that closes or changes stage while a coordinator is searching drops out or updates
+ * immediately, exactly like the escalation board (never frozen, unlike the shift handover).
+ *
+ * The department select's options are the fixed, synthetic emergency-department reference list
+ * (`allEmergencyDepartments()`) — a static catalogue of real departments, not live capacity, so
+ * reading it once rather than through the live provider state is correct here (the same choice
+ * `ESCALATION_CONTACTS` and every other fixed-list select in this prototype makes).
+ *
+ * Conservative failure (spec constraint 4): "No matches" renders as its own explicit sentence,
+ * never a bare empty table with no explanation.
+ */
+export function PatientSearchPage() {
+  const { movements, units, now } = useWardFlow();
+  const [text, setText] = useState("");
+  const [stage, setStage] = useState<MovementStage | "">("");
+  const [edId, setEdId] = useState("");
+
+  const query: MovementSearchQuery = useMemo(
+    () => ({
+      text,
+      stage: stage === "" ? undefined : stage,
+      edId: edId === "" ? undefined : edId,
+    }),
+    [text, stage, edId],
+  );
+
+  const results = useMemo(() => searchMovements(movements, units, query), [movements, units, query]);
+
+  return (
+    <div className={styles.screen} data-testid="ward-patient-search">
+      <ClinicalRail />
+      <main className={styles.main}>
+        <div className={styles.governanceBanner} data-testid="ward-patient-search-governance">
+          <span className={styles.prototypeBadge}>Synthetic prototype</span>
+          <p>
+            This search is <strong>not a medical device</strong>. It looks up open movements already in this synthetic
+            system by id, department, destination, stage and owner — it never assesses a patient&apos;s risk, acuity or
+            treatment, and a movement that has already left the system (closed or arrived) never appears here.
+          </p>
+        </div>
+
+        <header className={styles.pageHeader}>
+          <h1 className={styles.pageTitle}>Patient search</h1>
+          <p className={styles.pageSubtitle}>Find an open movement by id, department, destination, stage or owner.</p>
+        </header>
+
+        <form className={styles.filters} onSubmit={(event) => event.preventDefault()}>
+          <label className={styles.field} htmlFor="ward-patient-search-text">
+            Search
+            <input
+              id="ward-patient-search-text"
+              type="text"
+              value={text}
+              onChange={(event) => setText(event.target.value)}
+              placeholder="Movement id, destination, owner…"
+            />
+          </label>
+          <label className={styles.field} htmlFor="ward-patient-search-stage">
+            Stage
+            <select
+              id="ward-patient-search-stage"
+              value={stage}
+              onChange={(event) => setStage(event.target.value as MovementStage | "")}
+            >
+              <option value="">All stages</option>
+              {MOVEMENT_STAGES.map((value) => (
+                <option key={value} value={value}>
+                  {stageCopy[value].label}
+                </option>
+              ))}
+            </select>
+          </label>
+          <label className={styles.field} htmlFor="ward-patient-search-department">
+            Department
+            <select id="ward-patient-search-department" value={edId} onChange={(event) => setEdId(event.target.value)}>
+              <option value="">All departments</option>
+              {allEmergencyDepartments().map((ed) => (
+                <option key={ed.id} value={ed.id}>
+                  {ed.name} ({ed.siteCode})
+                </option>
+              ))}
+            </select>
+          </label>
+        </form>
+
+        <ResultsSection results={results} units={units} now={now} />
+      </main>
+    </div>
+  );
+}
+
+export function ResultsSection({ results, units, now }: { results: Movement[]; units: Unit[]; now: number }) {
+  return (
+    <section className={styles.section} data-testid="ward-patient-search-results">
+      <h2 className={styles.resultsHeading}>{results.length === 1 ? "1 match" : `${results.length} matches`}</h2>
+      {results.length === 0 ? (
+        <p className={styles.emptyNote} data-testid="ward-patient-search-empty">
+          No matches — no open movement fits the current search.
+        </p>
+      ) : (
+        <table className={styles.table}>
+          <thead>
+            <tr>
+              <th scope="col">Movement</th>
+              <th scope="col">Stage</th>
+              <th scope="col">Department</th>
+              <th scope="col">Destination</th>
+              <th scope="col">Since arrival</th>
+              <th scope="col">
+                <span className="sr-only">Open</span>
+              </th>
+            </tr>
+          </thead>
+          <tbody>
+            {results.map((movement) => (
+              <ResultRow key={movement.id} movement={movement} units={units} now={now} />
+            ))}
+          </tbody>
+        </table>
+      )}
+    </section>
+  );
+}
+
+function ResultRow({ movement, units, now }: { movement: Movement; units: Unit[]; now: number }) {
+  const destination = destinationUnit(movement, units);
+  return (
+    <tr>
+      <td>{movement.id}</td>
+      <td>{stageCopy[movement.stage].label}</td>
+      <td>{departmentLabel(movement)}</td>
+      <td>{destination?.name ?? "No destination chosen"}</td>
+      <td>{elapsedLabel(movement, now)}</td>
+      <td>
+        <Link className={styles.resultLink} href={`/ward-management/patients/${movement.id}`}>
+          Open
+        </Link>
+      </td>
+    </tr>
+  );
+}
+
+/** Mirrors `handover-page.tsx`'s and `escalation-board.tsx`'s own origin-department fallback
+ * exactly — a raw id is a real fact about the record, never a fabricated substitute for one. */
+function departmentLabel(movement: Movement) {
+  const originEd = edById(movement.originEdId);
+  return originEd
+    ? `${originEd.name} (${originEd.siteCode})`
+    : `No synthetic department matches "${movement.originEdId}"`;
+}
diff --git a/src/components/ward-management/search/search.module.css b/src/components/ward-management/search/search.module.css
new file mode 100644
index 0000000000..5365fccb34
--- /dev/null
+++ b/src/components/ward-management/search/search.module.css
@@ -0,0 +1,189 @@
+/*
+ * Task 7: patient search. Same self-contained-tokens convention `handover.module.css` and
+ * `escalation.module.css` document on their own `.screen`: every local custom property this file
+ * needs is declared here, never borrowed from another module's scope.
+ */
+.screen {
+  --ps-space-4: 0.25rem;
+  --ps-space-6: 0.375rem;
+  --ps-space-8: 0.5rem;
+  --ps-space-10: 0.625rem;
+  --ps-space-12: 0.75rem;
+  --ps-space-14: 0.875rem;
+  --ps-space-16: 1rem;
+  --ps-space-20: 1.25rem;
+  --ps-space-24: 1.5rem;
+  --ps-space-48: var(--spacing-tap);
+  --ps-leading-body: 1.4;
+  display: grid;
+  min-height: 100dvh;
+  /* The rail track stays reserved at every supported width, same as every other Ward Flow
+     screen — see ward-management.module.css's own note on this. */
+  grid-template-columns: 4.5rem minmax(0, 1fr);
+  background: var(--surface);
+  color: var(--text);
+  font-variant-numeric: tabular-nums;
+}
+
+.main {
+  grid-column: 2;
+  display: flex;
+  min-width: 0;
+  flex-direction: column;
+  gap: var(--ps-space-20);
+  overflow-x: hidden;
+  overflow-y: auto;
+  padding: var(--ps-space-16) var(--ps-space-20) var(--ps-space-24);
+}
+
+.governanceBanner {
+  display: flex;
+  min-height: var(--ps-space-48);
+  flex-wrap: wrap;
+  align-items: center;
+  gap: var(--ps-space-12);
+  border-bottom: 0.0625rem solid var(--border);
+  background: var(--surface-chrome);
+  padding: var(--ps-space-8) var(--ps-space-12);
+}
+
+.governanceBanner p {
+  min-width: 0;
+  flex: 1 1 12rem;
+  margin: 0;
+  color: var(--text-muted);
+  font-size: var(--text-3xs);
+  line-height: var(--ps-leading-body);
+}
+
+.prototypeBadge {
+  flex-shrink: 0;
+  border: 0.0625rem solid var(--warning-border);
+  border-radius: var(--radius-sm);
+  background: var(--warning-bg);
+  padding: var(--ps-space-4) var(--ps-space-8);
+  color: var(--warning-text);
+  font-size: var(--text-3xs);
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+.pageHeader {
+  display: flex;
+  flex-direction: column;
+  gap: var(--ps-space-4);
+}
+
+.pageTitle {
+  margin: 0;
+  color: var(--text-heading);
+  font-size: var(--text-lg, 1.125rem);
+  font-weight: 700;
+}
+
+.pageSubtitle {
+  margin: 0;
+  color: var(--text-muted);
+  font-size: var(--text-xs);
+}
+
+/*
+ * The page's own single search composer — see patient-search.tsx's doc comment for why this is
+ * safe under the repo's "one search composer per page" rule: Ward Flow routes never mount the
+ * shared global shell composer at all, so this is the only composer on the page by construction,
+ * not by a rule this file has to enforce itself.
+ */
+.filters {
+  display: grid;
+  gap: var(--ps-space-8);
+  grid-template-columns: repeat(auto-fit, minmax(11rem, 1fr));
+  border: 0.0625rem solid var(--border);
+  border-radius: var(--radius-lg);
+  background: var(--surface-subtle);
+  padding: var(--ps-space-12) var(--ps-space-14);
+}
+
+.field {
+  display: grid;
+  gap: var(--ps-space-4);
+  color: var(--text-heading);
+  font-size: var(--text-3xs);
+  font-weight: 700;
+}
+
+.field input,
+.field select {
+  min-height: var(--ps-space-48);
+  border: 0.0625rem solid var(--border);
+  border-radius: var(--radius-md);
+  background: var(--surface);
+  padding: 0 var(--ps-space-10);
+  color: var(--text);
+  font-size: var(--text-xs);
+  font-weight: 400;
+}
+
+.section {
+  display: grid;
+  gap: var(--ps-space-8);
+  border: 0.0625rem solid var(--border);
+  border-radius: var(--radius-lg);
+  background: var(--surface-subtle);
+  padding: var(--ps-space-12) var(--ps-space-14);
+}
+
+.resultsHeading {
+  margin: 0;
+  color: var(--text-heading);
+  font-size: var(--text-sm, 0.875rem);
+  font-weight: 700;
+}
+
+.emptyNote {
+  margin: 0;
+  color: var(--text-muted);
+  font-size: var(--text-xs);
+  font-style: italic;
+}
+
+.table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: var(--text-xs);
+}
+
+.table th,
+.table td {
+  border-bottom: 0.0625rem solid var(--border);
+  padding: var(--ps-space-6) var(--ps-space-8);
+  text-align: left;
+  vertical-align: top;
+}
+
+.table th {
+  color: var(--text-muted);
+  font-weight: 600;
+  white-space: nowrap;
+}
+
+.table td {
+  color: var(--text);
+  overflow-wrap: anywhere;
+}
+
+.table tbody tr:last-child th,
+.table tbody tr:last-child td {
+  border-bottom: none;
+}
+
+.resultLink {
+  color: var(--clinical-accent);
+  font-weight: 600;
+  text-decoration: none;
+}
+
+.resultLink:hover,
+.resultLink:focus-visible {
+  text-decoration: underline;
+}
diff --git a/src/components/ward-management/ward-derivations.ts b/src/components/ward-management/ward-derivations.ts
index e4641cbf31..4b2df4e2bb 100644
--- a/src/components/ward-management/ward-derivations.ts
+++ b/src/components/ward-management/ward-derivations.ts
@@ -605,6 +605,53 @@ export function escalationBoard(movements: Movement[], units: Unit[], now: Insta
   return { escalated, nowhereEligible };
 }
 
+/**
+ * Task 7 (spec item 5): patient search — a plain, pure, case-insensitive filter over the OPEN
+ * caseload. Pure and synchronous: no clock read, no debounce, no fetch — the page component owns
+ * the query state and calls this on every keystroke/select change.
+ *
+ * `stage` and `edId` are exact-value filters (a coordinator picking a stage or a department wants
+ * that stage or that department, not a substring of it); `text` is the only substring match, and
+ * it is checked against five real fields: the movement id, `originEdId`, the resolved destination
+ * unit's `id` and `name` (via `destinationUnit`, so this reads the same "actual destination" every
+ * other screen does — never a mere shortlist candidate), the stage's own display label (via
+ * `stageCopy`, so a coordinator can type what the results table actually shows, e.g. "Bed held",
+ * rather than the raw enum `bed_held`), and `owner`. An empty (or whitespace-only) `text` matches
+ * every open movement, so the stage/department selects can filter alone with no text typed.
+ *
+ * ABSOLUTE RULE, enforced first and unconditionally: `isOpen` is applied before anything else.
+ * A closed movement can never reach the result set, even when every other field of the query
+ * — including the movement's own id typed verbatim — would otherwise match it. Search existing
+ * for a patient who has already left the system must read as "not found", not as a stale hit.
+ */
+export type MovementSearchQuery = {
+  text: string;
+  stage?: MovementStage;
+  edId?: string;
+};
+
+export function searchMovements(movements: Movement[], units: Unit[], query: MovementSearchQuery): Movement[] {
+  const needle = query.text.trim().toLowerCase();
+
+  return movements
+    .filter(isOpen)
+    .filter((movement) => query.stage === undefined || movement.stage === query.stage)
+    .filter((movement) => query.edId === undefined || movement.originEdId === query.edId)
+    .filter((movement) => {
+      if (needle === "") return true;
+      const destination = destinationUnit(movement, units);
+      const haystack = [
+        movement.id,
+        movement.originEdId,
+        destination?.id,
+        destination?.name,
+        stageCopy[movement.stage].label,
+        movement.owner,
+      ].filter((value): value is string => value !== undefined);
+      return haystack.some((value) => value.toLowerCase().includes(needle));
+    });
+}
+
 /** A real, per-movement audit trail built from actual fields — never generic flavour text. */
 export function movementTimeline(movement: Movement) {
   const events: Array<{ at: Instant; label: string }> = [{ at: movement.openedAt, label: "Movement opened" }];
diff --git a/src/components/ward-management/ward-management-navigation.tsx b/src/components/ward-management/ward-management-navigation.tsx
index 26bbe5dc31..c2f69f6225 100644
--- a/src/components/ward-management/ward-management-navigation.tsx
+++ b/src/components/ward-management/ward-management-navigation.tsx
@@ -16,6 +16,7 @@ import {
   MessageSquarePlus,
   Pill,
   Route,
+  Search,
   Settings,
   ShieldCheck,
   Siren,
@@ -198,6 +199,24 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
         >
           <TriangleAlert aria-hidden="true" />
         </Link>
+        {/* Task 7: `/ward-management/search` — same shape as the Handover and Escalation links
+            immediately above and for the exact same reason (see the Officer link's own comment):
+            a raw `<Link>` with a literal string `href`, never `RailLink`, because `RailLink`
+            passes its `href` through as a destructured prop, which reads as a plain `Identifier`
+            to `tests/route-reachability.test.ts`'s AST scan and would leave this route invisible
+            to it. It also sits outside the eight-link `WardModeNavigation` strip on purpose, for
+            the same reason the Officer link's comment already explains. "Patient search" collides
+            with no other accessible name in this rail or in `WardModeNavigation` as a substring,
+            so Playwright's default substring accessible-name match cannot resolve it to more than
+            one element. */}
+        <Link
+          href="/ward-management/search"
+          aria-label="Patient search"
+          title="Patient search"
+          className={shellStyles.railLink}
+        >
+          <Search aria-hidden="true" />
+        </Link>
         <RailLink href="/?mode=answer" label="Favourites">
           <HeartPulse aria-hidden="true" />
         </RailLink>
diff --git a/tests/design-system-adoption.test.ts b/tests/design-system-adoption.test.ts
index ba29829b46..17efe29f4d 100644
--- a/tests/design-system-adoption.test.ts
+++ b/tests/design-system-adoption.test.ts
@@ -1412,15 +1412,15 @@ describe("design-system adoption manifest", () => {
           ["committed", "not-committed", "not-applicable"].includes(surface.baseline.status),
       ),
     ).toBe(true);
-    // 81 = 59 + 6 + 15 + 1: the 59 production pages that preceded both changes,
+    // 82 = 59 + 6 + 16 + 1: the 59 production pages that preceded both changes,
     // the six `<mode>/search` routes home consolidation split out of the bare paths,
-    // the fifteen-route Ward Flow synthetic patient-flow prototype (mode home,
+    // the sixteen-route Ward Flow synthetic patient-flow prototype (mode home,
     // eight remaining workspace routes, ED/ward/officer role screens, the per-patient
-    // detail route, the Phase 4 shift handover and escalation board, and the retired
-    // constellation redirect), and the Caring Contacts workspace. Redirect stubs keep
-    // legacy deep links resolving and still count as declared routes. This is a census,
-    // so a route nobody intended to add still fails the contract.
-    expect(manifest.routeCoverage.discovered).toHaveLength(81);
+    // detail route, the Phase 4 shift handover, escalation board and patient search, and
+    // the retired constellation redirect), and the Caring Contacts workspace. Redirect
+    // stubs keep legacy deep links resolving and still count as declared routes. This is a
+    // census, so a route nobody intended to add still fails the contract.
+    expect(manifest.routeCoverage.discovered).toHaveLength(82);
     expect(manifest.routeCoverage.declared).toEqual(manifest.routeCoverage.discovered);
     expect(manifest.routeCoverage.undeclared).toEqual([]);
     expect(manifest.routeCoverage.missing).toEqual([]);
diff --git a/tests/route-reachability.test.ts b/tests/route-reachability.test.ts
index da38c3f3c4..0b8fc9118f 100644
--- a/tests/route-reachability.test.ts
+++ b/tests/route-reachability.test.ts
@@ -657,6 +657,16 @@ describe("route reachability", () => {
     expect(isReachable(route.route, route.file)).toBe(true);
   });
 
+  // Task 7 (Ward Flow patient search): same narrowing as the handover and escalation assertions
+  // immediately above, and for the same reason — the generic orphan sweep covers this route too,
+  // but a failure there does not name which route regressed.
+  it("/ward-management/search is linked from the clinical rail", () => {
+    const route = staticPageRoutes.find((entry) => entry.route === "/ward-management/search");
+    expect(route, "/ward-management/search must exist as a static page route").toBeDefined();
+    if (!route) return;
+    expect(isReachable(route.route, route.file)).toBe(true);
+  });
+
   it("reachability allowlist has no stale entries", () => {
     const routes = new Set(staticPageRoutes.map((entry) => entry.route));
     for (const route of REACHABILITY_ALLOWLIST.keys()) {
diff --git a/tests/ward-patient-search.dom.test.tsx b/tests/ward-patient-search.dom.test.tsx
new file mode 100644
index 0000000000..3f7834c0d8
--- /dev/null
+++ b/tests/ward-patient-search.dom.test.tsx
@@ -0,0 +1,143 @@
+import { fireEvent, render, screen, within } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+// Same reason as every sibling dom suite (ward-handover.dom.test.tsx, ward-escalation.dom.test.tsx,
+// ward-screen.dom.test.tsx): `ClinicalRail` renders next/link anchors and this suite checks the
+// result row's href directly rather than actually navigating, so a plain <a> avoids an App Router
+// context jsdom cannot provide.
+vi.mock("next/link", () => ({
+  default: ({ children, href, ...rest }: { children: ReactNode; href: string }) => (
+    <a href={href} {...rest}>
+      {children}
+    </a>
+  ),
+}));
+
+import { PatientSearchPage } from "@/components/ward-management/search/patient-search";
+import { useWardFlow, WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+import { isOpen } from "@/components/ward-management/ward-derivations";
+import { seedWardFlowState } from "@/components/ward-management/ward-flow-reducer";
+import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
+
+/** Raises the same `ADVANCE_CLOCK` demo event the real demo controls dispatch, so this suite can
+ * move the shared clock without reaching into the reducer directly — mirrors `ClockAdvancer` in
+ * ward-handover.dom.test.tsx and ward-escalation.dom.test.tsx. */
+function ClockAdvancer({ minutes }: { minutes: number }) {
+  const { now, dispatch } = useWardFlow();
+  return (
+    <button type="button" onClick={() => dispatch({ type: "ADVANCE_CLOCK", role: "demo", now, minutes })}>
+      advance clock
+    </button>
+  );
+}
+
+function renderSearch() {
+  return render(
+    <WardFlowProvider initialNow={NOW_ANCHOR}>
+      <PatientSearchPage />
+      <ClockAdvancer minutes={100} />
+    </WardFlowProvider>,
+  );
+}
+
+const { movements } = seedWardFlowState();
+const openCount = movements.filter(isOpen).length;
+
+describe("PatientSearchPage", () => {
+  it("renders the root, the three labelled fields, and the results section", () => {
+    renderSearch();
+
+    expect(screen.getByTestId("ward-patient-search")).toBeInTheDocument();
+    expect(screen.getByLabelText("Search")).toBeInTheDocument();
+    expect(screen.getByLabelText("Stage")).toBeInTheDocument();
+    expect(screen.getByLabelText("Department")).toBeInTheDocument();
+    expect(screen.getByTestId("ward-patient-search-results")).toBeInTheDocument();
+  });
+
+  // This page owns its own single search field, a stage select and a department select — never a
+  // second, shell-mounted composer. Asserted directly: exactly one text input and exactly one
+  // <form> exist anywhere on the rendered page.
+  it("owns exactly one search composer: one text input, one form", () => {
+    renderSearch();
+    expect(screen.getAllByRole("textbox")).toHaveLength(1);
+    expect(document.querySelectorAll("form")).toHaveLength(1);
+  });
+
+  it("shows every open movement with no filters applied, matching the measured open count", () => {
+    renderSearch();
+    const rows = within(screen.getByTestId("ward-patient-search-results")).getAllByRole("row");
+    // One header row plus one row per open movement.
+    expect(rows.length - 1).toBe(openCount);
+    expect(screen.getByRole("heading", { name: `${openCount} matches` })).toBeInTheDocument();
+  });
+
+  it("narrows to the matching movement when searching by id, and links to its patient page", () => {
+    renderSearch();
+
+    fireEvent.change(screen.getByLabelText("Search"), { target: { value: "wf-003" } });
+
+    const results = screen.getByTestId("ward-patient-search-results");
+    expect(within(results).getByText("WF-003")).toBeInTheDocument();
+    expect(screen.getByRole("heading", { name: "1 match" })).toBeInTheDocument();
+
+    const link = within(results).getByRole("link", { name: "Open" });
+    expect(link).toHaveAttribute("href", "/ward-management/patients/WF-003");
+  });
+
+  it('renders the explicit "No matches" note — never a bare empty table — for a query nothing fits', () => {
+    renderSearch();
+
+    fireEvent.change(screen.getByLabelText("Search"), { target: { value: "zzz-no-such-movement" } });
+
+    expect(screen.getByTestId("ward-patient-search-empty")).toHaveTextContent("No matches");
+    expect(screen.queryByRole("table")).not.toBeInTheDocument();
+    expect(screen.getByRole("heading", { name: "0 matches" })).toBeInTheDocument();
+  });
+
+  // THE ABSOLUTE RULE, proven on the rendered page rather than only against the pure function:
+  // WF-007 is closed in the real fixture (see tests/ward-patient-search.test.ts's own comment for
+  // its exact closure fields). Searching its own id, verbatim, must render the explicit "No
+  // matches" note — a closed patient must never surface as though still in the system.
+  it("never renders a closed movement, even when the query is the closed movement's own id", () => {
+    renderSearch();
+
+    fireEvent.change(screen.getByLabelText("Search"), { target: { value: "wf-007" } });
+
+    expect(screen.getByTestId("ward-patient-search-empty")).toHaveTextContent("No matches");
+    expect(screen.queryByText("WF-007")).not.toBeInTheDocument();
+  });
+
+  it("narrows by the stage select alone", () => {
+    renderSearch();
+
+    fireEvent.change(screen.getByLabelText("Stage"), { target: { value: "bed_held" } });
+
+    // Measured (tests/ward-patient-search.test.ts): exactly seven OPEN movements are "bed_held".
+    expect(screen.getByRole("heading", { name: "7 matches" })).toBeInTheDocument();
+    const results = screen.getByTestId("ward-patient-search-results");
+    expect(within(results).getAllByText("Bed held").length).toBe(7);
+  });
+
+  it("narrows by the department select alone", () => {
+    renderSearch();
+
+    fireEvent.change(screen.getByLabelText("Department"), { target: { value: "arm-ed" } });
+
+    // Measured (tests/ward-patient-search.test.ts): exactly four OPEN movements originate at
+    // "arm-ed".
+    expect(screen.getByRole("heading", { name: "4 matches" })).toBeInTheDocument();
+  });
+
+  // This board is deliberately live, like the escalation board and unlike the frozen shift
+  // handover: advancing the shared clock must move the "Since arrival" column forward.
+  it("stays live: the results table advances when the shared clock advances", () => {
+    renderSearch();
+
+    const before = screen.getByTestId("ward-patient-search-results").textContent ?? "";
+    fireEvent.click(screen.getByRole("button", { name: "advance clock" }));
+    const after = screen.getByTestId("ward-patient-search-results").textContent ?? "";
+
+    expect(after).not.toBe(before);
+  });
+});
diff --git a/tests/ward-patient-search.test.ts b/tests/ward-patient-search.test.ts
new file mode 100644
index 0000000000..ca84efd2ce
--- /dev/null
+++ b/tests/ward-patient-search.test.ts
@@ -0,0 +1,160 @@
+// tests/ward-patient-search.test.ts
+import { describe, expect, it } from "vitest";
+
+import { isOpen, searchMovements } from "../src/components/ward-management/ward-derivations";
+import { seedWardFlowState } from "../src/components/ward-management/ward-flow-reducer";
+
+const { movements, units } = seedWardFlowState();
+const openIds = movements
+  .filter(isOpen)
+  .map((movement) => movement.id)
+  .sort();
+
+describe("searchMovements", () => {
+  it("returns every open movement for an empty query, and nothing closed", () => {
+    const result = searchMovements(movements, units, { text: "" });
+    expect(result.map((movement) => movement.id).sort()).toEqual(openIds);
+  });
+
+  it("returns every open movement for a whitespace-only query", () => {
+    const result = searchMovements(movements, units, { text: "   " });
+    expect(result.map((movement) => movement.id).sort()).toEqual(openIds);
+  });
+
+  // Measured directly against the real fixture at NOW_ANCHOR (2026-08-25): WF-003 is the only
+  // 3-digit movement id containing "wf-003" as a substring, so this is exact by construction, not
+  // by luck. Uppercase-vs-lowercase both sides proves the match is case-insensitive.
+  it("matches on movement id, case-insensitively", () => {
+    const result = searchMovements(movements, units, { text: "wf-003" });
+    expect(result.map((movement) => movement.id)).toEqual(["WF-003"]);
+  });
+
+  // Measured: exactly four OPEN movements carry originEdId "arm-ed" — WF-001, WF-011, WF-315,
+  // WF-323 (a fifth, WF-307, also has "arm-ed" but is closed and must be excluded — see the
+  // dedicated "never returns a closed movement" test below for that exclusion asserted directly).
+  it("matches on originEdId, case-insensitively", () => {
+    const result = searchMovements(movements, units, { text: "ARM-ED" });
+    expect(result.map((movement) => movement.id).sort()).toEqual(["WF-001", "WF-011", "WF-315", "WF-323"]);
+  });
+
+  // Measured: WF-003 and WF-014 are the only OPEN movements whose resolved destination unit is
+  // "rph-adult-secure" (RPH Adult Secure). The query text here is the hyphenated unit ID, which
+  // does not appear anywhere in the unit's own display name ("RPH Adult Secure" uses spaces, not
+  // hyphens) — so a match here can only have come from `destinationUnit(...).id`, not `.name`.
+  it("matches on the resolved destination unit's id", () => {
+    const result = searchMovements(movements, units, { text: "rph-adult-secure" });
+    expect(result.map((movement) => movement.id).sort()).toEqual(["WF-003", "WF-014"]);
+  });
+
+  // Same two movements, but the query text here is the space-separated display name. That string
+  // does not appear anywhere in the unit's own hyphenated id ("rph-adult-secure" has no spaces),
+  // and it does not appear in either movement's originEdId, stage label, or owner either — so a
+  // match here can only have come from `destinationUnit(...).name`, not `.id`.
+  it("matches on the resolved destination unit's name", () => {
+    const result = searchMovements(movements, units, { text: "RPH Adult Secure" });
+    expect(result.map((movement) => movement.id).sort()).toEqual(["WF-003", "WF-014"]);
+  });
+
+  // Measured: exactly seven OPEN movements sit in "bed_held" — WF-004, WF-011, WF-016, WF-304,
+  // WF-311, WF-318, WF-325. The query text is the human-readable stage LABEL ("Bed held"), not the
+  // raw enum value — searching the raw enum "bed_held" (with the underscore) matches nothing,
+  // proving the match is against `stageCopy[...].label` (what the results table actually shows),
+  // not the internal MovementStage string.
+  it("matches on the stage's display label, not the raw enum value", () => {
+    const byLabel = searchMovements(movements, units, { text: "Bed held" });
+    expect(byLabel.map((movement) => movement.id).sort()).toEqual([
+      "WF-004",
+      "WF-011",
+      "WF-016",
+      "WF-304",
+      "WF-311",
+      "WF-318",
+      "WF-325",
+    ]);
+
+    const byRawEnum = searchMovements(movements, units, { text: "bed_held" });
+    expect(byRawEnum).toEqual([]);
+  });
+
+  // Measured: WF-015 is the only OPEN movement whose owner is "Ward nurse in charge". Mixed case
+  // proves case-insensitivity on this field too.
+  it("matches on owner, case-insensitively", () => {
+    const result = searchMovements(movements, units, { text: "ward NURSE in charge" });
+    expect(result.map((movement) => movement.id)).toEqual(["WF-015"]);
+  });
+
+  it("the stage filter is an exact match, not a substring match", () => {
+    const result = searchMovements(movements, units, { text: "", stage: "bed_held" });
+    expect(result.map((movement) => movement.id).sort()).toEqual([
+      "WF-004",
+      "WF-011",
+      "WF-016",
+      "WF-304",
+      "WF-311",
+      "WF-318",
+      "WF-325",
+    ]);
+    expect(result.every((movement) => movement.stage === "bed_held")).toBe(true);
+  });
+
+  it("the department (edId) filter is an exact match", () => {
+    const result = searchMovements(movements, units, { text: "", edId: "arm-ed" });
+    expect(result.map((movement) => movement.id).sort()).toEqual(["WF-001", "WF-011", "WF-315", "WF-323"]);
+    expect(result.every((movement) => movement.originEdId === "arm-ed")).toBe(true);
+  });
+
+  // stage, edId and text all narrow the same result set together (AND, not OR). WF-011 is the one
+  // OPEN movement at "arm-ed" that also sits in "bed_held" — measured against the two filters
+  // above, whose sets intersect at exactly this one id.
+  it("stage, department and text filters combine (AND), not replace one another", () => {
+    const result = searchMovements(movements, units, { text: "", stage: "bed_held", edId: "arm-ed" });
+    expect(result.map((movement) => movement.id)).toEqual(["WF-011"]);
+  });
+
+  // THE ABSOLUTE RULE. WF-007 is closed (`closure.outcome: "arrived"`, `stage: "arrived"`) and
+  // WF-008 is closed via `closure` alone while still recording `stage: "accepted_awaiting_bed"` —
+  // the exact case `isOpen`'s own doc comment calls out, where `closure` and `stage === "arrived"`
+  // must be checked independently. Both are asserted directly: searching each one's own id,
+  // verbatim, must return nothing, proving a closed movement can never surface in search results
+  // even when every other field of the query would otherwise match it perfectly.
+  it("never returns a closed movement, even when the query is the closed movement's own id", () => {
+    const closedArrived = movements.find((movement) => movement.id === "WF-007");
+    const closedViaClosureOnly = movements.find((movement) => movement.id === "WF-008");
+    if (!closedArrived || !closedViaClosureOnly) {
+      throw new Error("fixture no longer carries WF-007/WF-008 — update this test's closed-movement cases");
+    }
+    expect(isOpen(closedArrived)).toBe(false);
+    expect(isOpen(closedViaClosureOnly)).toBe(false);
+
+    expect(searchMovements(movements, units, { text: "wf-007" })).toEqual([]);
+    expect(searchMovements(movements, units, { text: "wf-008" })).toEqual([]);
+
+    // And neither appears in the unfiltered (empty-query) result set either.
+    const all = searchMovements(movements, units, { text: "" });
+    expect(all.map((movement) => movement.id)).not.toContain("WF-007");
+    expect(all.map((movement) => movement.id)).not.toContain("WF-008");
+  });
+
+  // Same absolute rule, constructed rather than relying on a fixture id staying closed forever:
+  // an otherwise-fully-matching open movement, cloned and closed, must drop out of a query that
+  // still matches every one of its other fields exactly.
+  it("never returns a closed movement — constructed case, every non-closure field still matches", () => {
+    const base = movements.find((movement) => movement.id === "WF-011");
+    if (!base) throw new Error("fixture no longer carries WF-011 to build the closed clone from");
+    expect(isOpen(base)).toBe(true);
+
+    const closedClone = {
+      ...base,
+      id: "WF-TEST-CLOSED-CLONE",
+      closure: { at: base.openedAt, outcome: "arrived" as const, reason: "Test fixture: arrived" },
+    };
+    expect(isOpen(closedClone)).toBe(false);
+
+    const withClone = [...movements, closedClone];
+    const byId = searchMovements(withClone, units, { text: "WF-TEST-CLOSED-CLONE" });
+    expect(byId).toEqual([]);
+
+    const byStageAndEd = searchMovements(withClone, units, { text: "", stage: "bed_held", edId: "arm-ed" });
+    expect(byStageAndEd.map((movement) => movement.id)).not.toContain("WF-TEST-CLOSED-CLONE");
+  });
+});

From 715880bfd9dc08e616f804d5f0ad71b0203b25d7 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 09:13:28 +0800
Subject: [PATCH 13/54] Ward Flow docs: the ED access target is 24 hours, not
 four

ED_ACCESS_TARGET_MINUTES has been 1440 (24 hours) since the product owner
superseded the spec's original four-hour figure on 2026-08-22, but two live
documents still stated four hours in the present tense.

- The Phase 3 plan's Task 11 step told a builder to render "the four-hour
  access target". Its checkboxes are unticked, so re-running the plan would
  have rebuilt the superseded figure. Corrected, with the same dated
  supersession note the design spec already carries.
- The complete ledger still listed "Is four hours the right ED access target
  for WA metro?" as an open, unanswered question. It was answered on
  2026-08-22; the entry now records the answer and points at the constant.

Historical ledgers, rulings tables and completed task briefs are left as they
are: they correctly describe the former value and the change itself.

Doc-only. ED_ACCESS_TARGET_MINUTES and every clinical/RAG surface untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../plans/2026-08-19-ward-flow-phase-3-role-screens.md   | 8 +++++++-
 docs/ward-flow-complete-ledger.md                        | 9 ++++++---
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-19-ward-flow-phase-3-role-screens.md b/docs/superpowers/plans/2026-08-19-ward-flow-phase-3-role-screens.md
index af9d04ee9b..a850bbc3cf 100644
--- a/docs/superpowers/plans/2026-08-19-ward-flow-phase-3-role-screens.md
+++ b/docs/superpowers/plans/2026-08-19-ward-flow-phase-3-role-screens.md
@@ -1429,7 +1429,13 @@ test("shows a department its own patients, both clocks, and one outstanding item
 
 - [ ] **Step 3: Build it**
 
-Its own patients, filtered on `originEdId`. Each row carries **both clocks** — time in the department from `openedAt`, and the legal clock from `formedAt` where that is earlier, marked `data-community-formed="true"` when they differ — plus the four-hour access target, a police flag where `arrivalMode` says so, and **the single outstanding item**: a form, an examination, a transport request, or handover.
+Its own patients, filtered on `originEdId`. Each row carries **both clocks** — time in the department from `openedAt`, and the legal clock from `formedAt` where that is earlier, marked `data-community-formed="true"` when they differ — plus the 24-hour access target, a police flag where `arrivalMode` says so, and **the single outstanding item**: a form, an examination, a transport request, or handover.
+
+> **Superseded 2026-08-22.** This step originally named the access target as four hours (240
+> minutes). The product owner — the spec's own author — changed it to 24 hours (1440 minutes) for
+> this prototype, in response to a direct clinical question. `ED_ACCESS_TARGET_MINUTES` in
+> `ward-model.ts` and its tests carry the current value; nothing else about how the figure is
+> counted, rendered or safeguarded changed.
 
 Two forms: **raise a referral** (cohort, security, sex, specialling, legal status, urgency — dispatching `RAISE_REFERRAL`) and **record an examination** with its outcome (dispatching `RECORD_EXAMINATION`; `revoked` closes the movement).
 
diff --git a/docs/ward-flow-complete-ledger.md b/docs/ward-flow-complete-ledger.md
index e36f878da3..7e0b3cb7d0 100644
--- a/docs/ward-flow-complete-ledger.md
+++ b/docs/ward-flow-complete-ledger.md
@@ -149,7 +149,7 @@ and refusals surface with the reducer's own reason.
 labelled "not clinical severity" that partly was is why the previous score was deleted rather than
 migrated.
 
-## 6. Three questions still open with the clinician
+## 6. Three questions raised with the clinician — two still open
 
 None blocking; all stated rather than buried.
 
@@ -158,8 +158,11 @@ None blocking; all stated rather than buried.
 2. **Should being detained and examined confer priority of its own?** Today such a patient ranks
    purely on elapsed time, exactly as described — so patients still awaiting examination tend to
    rank above them.
-3. **Is four hours the right ED access target for WA metro?** It is the national figure, not
-   confirmed for this context.
+3. **Is four hours the right ED access target for WA metro?** **Answered 2026-08-22 — no.** Four
+   hours is the national figure and was never confirmed for this context; the product owner set
+   the target to 24 hours (1440 minutes) for this prototype, because mental health patients breach
+   four hours so routinely that it stops discriminating. `ED_ACCESS_TARGET_MINUTES` in
+   `ward-model.ts` carries the current value (ruling R65(a)).
 
 Plus one raised but undecided: **the demo now leads with an accident.** The top of the coordinator
 queue is `WF-303`, a _generated_ movement whose breach comes from

From 50b37c4b72e29545f0352f7681b1e1768da132be Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 09:32:33 +0800
Subject: [PATCH 14/54] Ward Flow: the capacity board shows the three things
 that actually decide placement

---
 .../ward-management/ward-management-modes.tsx | 12 +++-
 tests/ward-capacity-view.dom.test.tsx         | 71 +++++++++++++++++++
 tests/ward-management.test.ts                 |  4 +-
 3 files changed, 85 insertions(+), 2 deletions(-)
 create mode 100644 tests/ward-capacity-view.dom.test.tsx

diff --git a/src/components/ward-management/ward-management-modes.tsx b/src/components/ward-management/ward-management-modes.tsx
index d4acf68868..5d52143958 100644
--- a/src/components/ward-management/ward-management-modes.tsx
+++ b/src/components/ward-management/ward-management-modes.tsx
@@ -389,6 +389,9 @@ function CapacityView() {
             <th scope="col">Health service</th>
             <th scope="col">Capability cue</th>
             <th scope="col">Five bed states</th>
+            <th scope="col">Sex mix</th>
+            <th scope="col">Specialling</th>
+            <th scope="col">MHA authorised</th>
             <th scope="col">Freshness</th>
           </tr>
         </thead>
@@ -396,7 +399,7 @@ function CapacityView() {
           {capacities.map(({ unit, capacity }) => {
             const fresh = now - unit.allocatable.confirmedAt <= unit.allocatable.staleAfterMinutes;
             return (
-              <tr key={unit.id}>
+              <tr key={unit.id} data-testid={`ward-capacity-row-${unit.id}`}>
                 <td>
                   <strong>{unit.name}</strong>
                   <div className={styles.microCopy}>{unit.beds} total beds</div>
@@ -424,6 +427,13 @@ function CapacityView() {
                     </span>
                   </div>
                 </td>
+                <td data-testid={`ward-capacity-sexmix-${unit.id}`}>
+                  Female {unit.sexMix.Female} · Male {unit.sexMix.Male}
+                </td>
+                <td data-testid={`ward-capacity-specialling-${unit.id}`}>{unit.speciallingCapacity}</td>
+                <td data-testid={`ward-capacity-authorised-${unit.id}`}>
+                  {unit.authorised ? "MHA-authorised" : "not MHA-authorised"}
+                </td>
                 <td>
                   <span className={fresh ? styles.statusGood : styles.statusWarning}>
                     {fresh ? "Current" : "Review soon"} · {formatInstant(unit.allocatable.confirmedAt)}
diff --git a/tests/ward-capacity-view.dom.test.tsx b/tests/ward-capacity-view.dom.test.tsx
new file mode 100644
index 0000000000..8aec45fcc5
--- /dev/null
+++ b/tests/ward-capacity-view.dom.test.tsx
@@ -0,0 +1,71 @@
+import { render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { describe, expect, it } from "vitest";
+import { vi } from "vitest";
+
+// Mirrors tests/ward-flow-clock-consistency.dom.test.tsx: WardModeWorkspace renders next/link
+// anchors and this suite never checks routing itself, so a plain <a> avoids requiring an App
+// Router context jsdom cannot provide.
+vi.mock("next/link", () => ({
+  default: ({ children, href, ...rest }: { children: ReactNode; href: string }) => (
+    <a href={href} {...rest}>
+      {children}
+    </a>
+  ),
+}));
+
+import { WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+import { WardModeWorkspace } from "@/components/ward-management/ward-management-modes";
+import { NOW_ANCHOR, unitById } from "@/components/ward-management/ward-sites";
+
+/**
+ * Task 8 (spec item 6). The capacity board already showed bed counts and freshness but not the
+ * three properties that actually gate whether a patient can go to a unit — sex mix, specialling
+ * headroom, and Mental Health Act authorisation — even though all three already exist on `Unit`
+ * and already gate placement in `ward-eligibility.ts`.
+ *
+ * SJGS Adult Secure (`sjgs-adult-secure`) is authorised: false — private and not MHA-authorised,
+ * per SJGS Adult Open's sibling fixture comment in ward-sites.ts (both SJGS units share that
+ * note). SCGH Adult Open (`scgh-adult-open`) is authorised: true. Both are chosen deliberately
+ * for an ASYMMETRIC sex mix (Female != Male) rather than the first false/true units found —
+ * SJGS Adult Open (4F/4M) and RPH Adult Secure (9F/9M) both have equal Female/Male counts, so a
+ * Female<->Male swap mutation on the render line would be invisible against them. Both units
+ * used here have distinct counts, so the "both counts" requirement actually has teeth.
+ */
+const SJGS_ADULT_SECURE = unitById("sjgs-adult-secure");
+const SCGH_ADULT_OPEN = unitById("scgh-adult-open");
+
+describe("ward capacity board", () => {
+  it("fixture assumption: SJGS Adult Secure is unauthorised with an asymmetric sex mix, SCGH Adult Open is authorised with an asymmetric sex mix", () => {
+    expect(SJGS_ADULT_SECURE?.authorised).toBe(false);
+    expect(SJGS_ADULT_SECURE?.sexMix).toEqual({ Female: 4, Male: 3 });
+    expect(SCGH_ADULT_OPEN?.authorised).toBe(true);
+    expect(SCGH_ADULT_OPEN?.sexMix).toEqual({ Female: 10, Male: 9 });
+  });
+
+  it("shows sex mix, specialling capacity, and MHA authorisation per unit row — both directions", () => {
+    render(
+      <WardFlowProvider initialNow={NOW_ANCHOR}>
+        <WardModeWorkspace mode="capacity" />
+      </WardFlowProvider>,
+    );
+
+    const unauthorisedRow = screen.getByTestId("ward-capacity-row-sjgs-adult-secure");
+    // Rendering the flag is not a legal claim — just the unit's existing state, in the
+    // codebase's own established wording ("not MHA-authorised"), nothing added.
+    expect(screen.getByTestId("ward-capacity-authorised-sjgs-adult-secure")).toHaveTextContent("not MHA-authorised");
+    expect(screen.getByTestId("ward-capacity-sexmix-sjgs-adult-secure")).toHaveTextContent("Female 4 · Male 3");
+    expect(screen.getByTestId("ward-capacity-specialling-sjgs-adult-secure")).toHaveTextContent("0");
+    expect(unauthorisedRow).toBeInTheDocument();
+
+    const authorisedRow = screen.getByTestId("ward-capacity-row-scgh-adult-open");
+    // The authorised row must NOT carry the not-authorised wording anywhere in its own cell —
+    // both directions, or this test would pass even if every row said "not MHA-authorised".
+    const authorisedCell = screen.getByTestId("ward-capacity-authorised-scgh-adult-open");
+    expect(authorisedCell).toHaveTextContent("MHA-authorised");
+    expect(authorisedCell).not.toHaveTextContent("not MHA-authorised");
+    expect(screen.getByTestId("ward-capacity-sexmix-scgh-adult-open")).toHaveTextContent("Female 10 · Male 9");
+    expect(screen.getByTestId("ward-capacity-specialling-scgh-adult-open")).toHaveTextContent("3");
+    expect(authorisedRow).toBeInTheDocument();
+  });
+});
diff --git a/tests/ward-management.test.ts b/tests/ward-management.test.ts
index eedc025054..5159e6e5ba 100644
--- a/tests/ward-management.test.ts
+++ b/tests/ward-management.test.ts
@@ -28,7 +28,9 @@ function routeFileFor(href: string) {
 describe("Ward Flow synthetic prototype", () => {
   it("declares every queue and capacity header as a column header", () => {
     const thTags = [...modesSource.matchAll(/<th(?:\s[^>]*)?>/g)].map((match) => match[0]);
-    expect(thTags).toHaveLength(12);
+    // Task 8 (spec item 6) added three capacity-board columns — Sex mix, Specialling, and MHA
+    // authorised — raising the count from 12 to 15.
+    expect(thTags).toHaveLength(15);
     expect(thTags.every((tag) => tag.includes('scope="col"'))).toBe(true);
   });
 

From ae4e68552d37868c026ccd255f39424ccea21607 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 09:45:09 +0800
Subject: [PATCH 15/54] Ward Flow: the patient page carries declines, changes
 and the escalation record

---
 .../ward-management-console.tsx               | 103 ++++++++++
 tests/ward-patient-page.dom.test.tsx          | 181 ++++++++++++++++++
 2 files changed, 284 insertions(+)
 create mode 100644 tests/ward-patient-page.dom.test.tsx

diff --git a/src/components/ward-management/ward-management-console.tsx b/src/components/ward-management/ward-management-console.tsx
index e78bcb4403..2419205748 100644
--- a/src/components/ward-management/ward-management-console.tsx
+++ b/src/components/ward-management/ward-management-console.tsx
@@ -30,10 +30,12 @@ import {
   stageSummaries,
   transportStatusLabel,
 } from "@/components/ward-management/ward-derivations";
+import { changeReasonLabels } from "@/components/ward-management/ward-change-reasons";
 import { useWardFlow } from "@/components/ward-management/ward-flow-provider";
 import { legalFormNameLabelFirst } from "@/components/ward-management/ward-legal-forms";
 import {
   MOVEMENT_STAGES,
+  type DeclineReason,
   type LegalForm,
   type Movement,
   type MovementStage,
@@ -42,6 +44,22 @@ import { ClinicalRail } from "@/components/ward-management/ward-management-navig
 
 import styles from "./ward-management.module.css";
 
+/**
+ * Task 10 (spec item 8). `changeReasonLabels` covers the four reason lists in
+ * `ward-change-reasons.ts` but not `DeclineReason` — declines are a fifth, older fixed list
+ * (`DECLINE_REASONS` in `ward-model.ts`) that predates that file. Same discipline: chosen, never
+ * typed, operational and content-free, never a raw snake_case code on screen.
+ */
+const declineReasonLabels: Record<DeclineReason, string> = {
+  no_bed: "No bed available",
+  sex_mix: "Sex mix",
+  specialling_unavailable: "Specialling unavailable",
+  acuity_mix: "Acuity mix",
+  capability_mismatch: "Capability mismatch",
+  bed_held_for_earlier_referral: "Bed held for earlier referral",
+  out_of_catchment: "Out of catchment",
+};
+
 /**
  * The "label (code) · …" line for a legal form, shared by the readiness card and the legal
  * panel below. Neither a Form 1A nor a Form 3B carries a `dueAt` in this model (see `LegalForm`'s
@@ -153,6 +171,28 @@ export function WardPatientWorkspace({ patientId }: { patientId: string }) {
     (candidate) => candidate.unit.id !== destination?.id,
   );
   const timeline = movementTimeline(patient);
+  // Reads the provider's live units, same as `destination` above — a unit renamed underneath
+  // this movement must resolve here too, not to a name frozen at import time. Falls back to the
+  // raw id (never a substituted unit) when nothing in the live set matches.
+  const unitName = (unitId: string) => units.find((unit) => unit.id === unitId)?.name ?? unitId;
+  // Task 10 (spec item 8): status and urgency changes are the same kind of fact to a reader, so
+  // they render as one chronological record rather than two disconnected lists.
+  const changeEvents = [
+    ...patient.statusChanges.map((change) => ({
+      kind: "legal" as const,
+      at: change.at,
+      by: change.by,
+      reasonLabel: changeReasonLabels[change.reason],
+      detail: `${change.from} → ${change.to}`,
+    })),
+    ...patient.urgencyChanges.map((change) => ({
+      kind: "urgency" as const,
+      at: change.at,
+      by: change.by,
+      reasonLabel: changeReasonLabels[change.reason],
+      detail: `Tier ${change.from} → Tier ${change.to}`,
+    })),
+  ].sort((a, b) => a.at - b.at);
 
   return (
     <div className={styles.patientWorkspace} data-testid="ward-patient-workspace">
@@ -349,6 +389,69 @@ export function WardPatientWorkspace({ patientId }: { patientId: string }) {
           </section>
         ) : null}
 
+        {/* Task 10 (spec item 8): always-rendered, never gated behind a tab — each section
+            carries its own explicit absence line when the movement has none of that record,
+            per the conservative-failure constraint. A hidden section that simply omits itself
+            when empty is exactly what that constraint forbids. */}
+        <section className={styles.contextPanel} data-testid="ward-patient-declines">
+          <h2>Declines</h2>
+          {patient.declines.length > 0 ? (
+            <ol className={styles.timeline}>
+              {patient.declines.map((decline, index) => (
+                <li key={`${decline.unitId}-${decline.at}-${index}`}>
+                  <time>{formatInstant(decline.at)}</time>
+                  <span>
+                    {unitName(decline.unitId)} · {declineReasonLabels[decline.reason]}
+                  </span>
+                </li>
+              ))}
+            </ol>
+          ) : (
+            <p>No declines recorded for this movement.</p>
+          )}
+        </section>
+
+        <section className={styles.contextPanel} data-testid="ward-patient-changes">
+          <h2>Status and urgency changes</h2>
+          {changeEvents.length > 0 ? (
+            <ol className={styles.timeline}>
+              {changeEvents.map((change, index) => (
+                <li key={`${change.kind}-${change.at}-${index}`}>
+                  <time>{formatInstant(change.at)}</time>
+                  <span>
+                    {change.kind === "legal" ? "Legal status" : "Urgency"} changed {change.detail} by {change.by} ·{" "}
+                    {change.reasonLabel}
+                  </span>
+                </li>
+              ))}
+            </ol>
+          ) : (
+            <p>No status or urgency changes recorded for this movement.</p>
+          )}
+        </section>
+
+        <section className={styles.contextPanel} data-testid="ward-patient-escalation">
+          <h2>Escalation</h2>
+          {patient.escalation ? (
+            <dl className={styles.factList}>
+              <div>
+                <dt>When</dt>
+                <dd>{formatInstant(patient.escalation.at)}</dd>
+              </div>
+              <div>
+                <dt>Units tried</dt>
+                <dd>{patient.escalation.triedUnitIds.map((unitId) => unitName(unitId)).join(", ")}</dd>
+              </div>
+              <div>
+                <dt>Contact</dt>
+                <dd>{patient.escalation.contact}</dd>
+              </div>
+            </dl>
+          ) : (
+            <p>No escalation recorded for this movement.</p>
+          )}
+        </section>
+
         <p className={styles.governanceNote}>
           Synthetic prototype only. Eligibility is checked automatically; an authorised human confirms every
           destination. This is not clinical severity.
diff --git a/tests/ward-patient-page.dom.test.tsx b/tests/ward-patient-page.dom.test.tsx
new file mode 100644
index 0000000000..a3331fb61c
--- /dev/null
+++ b/tests/ward-patient-page.dom.test.tsx
@@ -0,0 +1,181 @@
+import { fireEvent, render, screen, within } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+const router = vi.hoisted(() => ({
+  back: vi.fn(),
+  replace: vi.fn(),
+}));
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => router,
+}));
+
+import { useWardFlow, WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+import { WardPatientWorkspace } from "@/components/ward-management/ward-management-console";
+import { movementById } from "@/components/ward-management/ward-movements";
+import { NOW_ANCHOR, unitById } from "@/components/ward-management/ward-sites";
+
+/**
+ * Task 10 (spec item 8). The patient page showed the legal form but not three records the
+ * binding spec requires: declines, status/urgency changes, and the escalation record.
+ *
+ * WF-009 is the fixture's one movement carrying an escalation and its five declines (measured
+ * against `ward-movements.ts` directly). WF-010 is the fixture's one movement carrying a
+ * hand-authored `statusChanges` entry. Neither carries a hand-authored `urgencyChanges` entry —
+ * every fixture movement seeds that array empty — so the urgency-change half of the "changes"
+ * section is proven by dispatching a real `CHANGE_URGENCY` event against WF-010 (same technique
+ * as `tests/ward-screen.dom.test.tsx`'s `ReferWF301ToRphAdultSecure`: a real reducer dispatch,
+ * not a hand-edited fixture), rather than weakening the assertion to skip that half. WF-001
+ * carries none of the three records and is not closed, so it is the empty-state case.
+ */
+const WF_009 = movementById("WF-009");
+const WF_010 = movementById("WF-010");
+const WF_001 = movementById("WF-001");
+
+function DispatchUrgencyChangeOnWF010() {
+  const { dispatch, now } = useWardFlow();
+  return (
+    <button
+      type="button"
+      onClick={() =>
+        dispatch({
+          type: "CHANGE_URGENCY",
+          role: "coordinator",
+          now,
+          movementId: "WF-010",
+          urgency: 1,
+          reason: "reassessed",
+        })
+      }
+    >
+      raise WF-010 urgency
+    </button>
+  );
+}
+
+describe("ward patient page — declines, changes, and escalation", () => {
+  it("fixture assumptions: WF-009 carries declines and an escalation, WF-010 carries a status change, WF-001 carries none of the three and is open", () => {
+    expect(WF_009?.declines.length).toBe(5);
+    expect(WF_009?.escalation).toBeDefined();
+    expect(WF_010?.statusChanges.length).toBe(1);
+    expect(WF_010?.urgencyChanges.length).toBe(0);
+    expect(WF_010?.closure).toBeUndefined();
+    expect(WF_001?.declines.length).toBe(0);
+    expect(WF_001?.statusChanges.length).toBe(0);
+    expect(WF_001?.urgencyChanges.length).toBe(0);
+    expect(WF_001?.escalation).toBeUndefined();
+    expect(WF_001?.closure).toBeUndefined();
+  });
+
+  it("lists each decline's unit, fixed reason label, and time — never a raw snake_case reason code", () => {
+    render(
+      <WardFlowProvider initialNow={NOW_ANCHOR}>
+        <WardPatientWorkspace patientId="WF-009" />
+      </WardFlowProvider>,
+    );
+
+    const declines = screen.getByTestId("ward-patient-declines");
+    // Five declines, each naming its unit by name (never a bare unit id) and a human label for
+    // its reason (never the raw snake_case code).
+    expect(
+      within(declines).getByText(
+        (_, node) => node?.textContent === `${unitById("rph-adult-secure")?.name} · No bed available`,
+      ),
+    ).toBeInTheDocument();
+    expect(
+      within(declines).getByText(
+        (_, node) => node?.textContent === `${unitById("gry-adult-secure")?.name} · Acuity mix`,
+      ),
+    ).toBeInTheDocument();
+    expect(
+      within(declines).getByText(
+        (_, node) => node?.textContent === `${unitById("bty-adult-secure")?.name} · Bed held for earlier referral`,
+      ),
+    ).toBeInTheDocument();
+    expect(
+      within(declines).getByText(
+        (_, node) => node?.textContent === `${unitById("fsh-adult-secure")?.name} · Specialling unavailable`,
+      ),
+    ).toBeInTheDocument();
+    expect(
+      within(declines).getByText(
+        (_, node) => node?.textContent === `${unitById("rgh-adult-secure")?.name} · Capability mismatch`,
+      ),
+    ).toBeInTheDocument();
+
+    // No raw snake_case reason code anywhere in this section's rendered text.
+    const rawCodes = [
+      "no_bed",
+      "acuity_mix",
+      "bed_held_for_earlier_referral",
+      "specialling_unavailable",
+      "capability_mismatch",
+    ];
+    for (const code of rawCodes) {
+      expect(declines.textContent).not.toContain(code);
+    }
+  });
+
+  it("shows the escalation record — when, units tried, and contact", () => {
+    render(
+      <WardFlowProvider initialNow={NOW_ANCHOR}>
+        <WardPatientWorkspace patientId="WF-009" />
+      </WardFlowProvider>,
+    );
+
+    const escalation = screen.getByTestId("ward-patient-escalation");
+    expect(escalation).toHaveTextContent("State bed coordination desk");
+    expect(escalation).toHaveTextContent(unitById("rph-adult-secure")?.name ?? "");
+    expect(escalation).toHaveTextContent(unitById("rgh-adult-secure")?.name ?? "");
+  });
+
+  it("lists a status change and, once one is dispatched, an urgency change too — never a raw reason code", () => {
+    render(
+      <WardFlowProvider initialNow={NOW_ANCHOR}>
+        <DispatchUrgencyChangeOnWF010 />
+        <WardPatientWorkspace patientId="WF-010" />
+      </WardFlowProvider>,
+    );
+
+    const changes = screen.getByTestId("ward-patient-changes");
+    // WF-010's hand-authored status change: Voluntary -> Detained awaiting examination,
+    // reason "recorded_by_treating_team" -> label "Recorded by treating team".
+    expect(changes).toHaveTextContent("Voluntary");
+    expect(changes).toHaveTextContent("Detained awaiting examination");
+    expect(changes).toHaveTextContent("Recorded by treating team");
+    expect(changes.textContent).not.toContain("recorded_by_treating_team");
+
+    // Before the dispatch, no urgency change is recorded yet.
+    expect(changes.textContent).not.toContain("Tier 2 → Tier 1");
+
+    fireEvent.click(screen.getByRole("button", { name: "raise WF-010 urgency" }));
+
+    const changesAfter = screen.getByTestId("ward-patient-changes");
+    // WF-010 seeds at urgency 2 (see ward-movements.ts); the dispatched CHANGE_URGENCY event
+    // raises it to 1 with reason "reassessed" -> label "Reassessed", never the raw code.
+    expect(changesAfter).toHaveTextContent("Tier 2 → Tier 1");
+    expect(changesAfter).toHaveTextContent("Reassessed");
+    expect(changesAfter.textContent).not.toContain('reassessed"');
+  });
+
+  it("renders an explicit absence line in all three sections for a movement with none of these — not a hidden section", () => {
+    render(
+      <WardFlowProvider initialNow={NOW_ANCHOR}>
+        <WardPatientWorkspace patientId="WF-001" />
+      </WardFlowProvider>,
+    );
+
+    const declines = screen.getByTestId("ward-patient-declines");
+    const changes = screen.getByTestId("ward-patient-changes");
+    const escalation = screen.getByTestId("ward-patient-escalation");
+
+    // All three sections are present in the DOM (not hidden) and each carries its own explicit
+    // absence line rather than rendering nothing.
+    expect(declines).toBeInTheDocument();
+    expect(declines).toHaveTextContent("No declines recorded for this movement.");
+    expect(changes).toBeInTheDocument();
+    expect(changes).toHaveTextContent("No status or urgency changes recorded for this movement.");
+    expect(escalation).toBeInTheDocument();
+    expect(escalation).toHaveTextContent("No escalation recorded for this movement.");
+  });
+});

From f82661926df0b5938f3979910b6d84a40d8042d1 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 09:50:45 +0800
Subject: [PATCH 16/54] Assert the status change as an ordered pair, not two
 loose substrings

The implementer found that swapping from and to in the status-change detail string
did not kill its test, and stopped and reported rather than reshaping the test around
it. That is the correct call and it exposed a real gap: checking Voluntary and
Detained awaiting examination as independent substrings passes just as happily when
the page renders the change backwards. On a screen about a person's legal status that
is not a cosmetic slip.

Now asserted as the ordered pair, with the reversed string asserted absent. Verified by
mutation: swapping the two operands turns the test red, reverting restores green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 tests/ward-patient-page.dom.test.tsx | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/tests/ward-patient-page.dom.test.tsx b/tests/ward-patient-page.dom.test.tsx
index a3331fb61c..4d5dd446ef 100644
--- a/tests/ward-patient-page.dom.test.tsx
+++ b/tests/ward-patient-page.dom.test.tsx
@@ -140,8 +140,14 @@ describe("ward patient page — declines, changes, and escalation", () => {
     const changes = screen.getByTestId("ward-patient-changes");
     // WF-010's hand-authored status change: Voluntary -> Detained awaiting examination,
     // reason "recorded_by_treating_team" -> label "Recorded by treating team".
-    expect(changes).toHaveTextContent("Voluntary");
-    expect(changes).toHaveTextContent("Detained awaiting examination");
+    // Asserted as an ORDERED PAIR, not as two independent substrings. Checking each value
+    // separately survives a mutation that swaps `from` and `to`, which would render this patient's
+    // legal status change backwards — "Detained awaiting examination → Voluntary" instead of the
+    // reverse. On a screen about a person's legal status that is not a cosmetic slip, and the
+    // separate-substring form could not catch it. Task 8/10's implementer found the surviving
+    // mutation and reported it rather than reshaping the test, which is why this is fixed here.
+    expect(changes.textContent).toContain("Voluntary → Detained awaiting examination");
+    expect(changes.textContent).not.toContain("Detained awaiting examination → Voluntary");
     expect(changes).toHaveTextContent("Recorded by treating team");
     expect(changes.textContent).not.toContain("recorded_by_treating_team");
 

From bd6dfb54b0faad8fc7381b0122e3aa61c55733eb Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 10:55:51 +0800
Subject: [PATCH 17/54] Ward Flow: governance carries the change audit and two
 honest effectiveness numbers

---
 .../coordinator/coordinator-screen.tsx        |  10 +-
 .../ward-management/ward-derivations.ts       | 134 ++++++++++
 .../ward-management-modes.module.css          | 108 ++++++++
 .../ward-management/ward-management-modes.tsx | 117 +++++++++
 tests/ward-governance.dom.test.tsx            | 123 +++++++++
 tests/ward-governance.test.ts                 | 240 ++++++++++++++++++
 6 files changed, 727 insertions(+), 5 deletions(-)
 create mode 100644 tests/ward-governance.dom.test.tsx
 create mode 100644 tests/ward-governance.test.ts

diff --git a/src/components/ward-management/coordinator/coordinator-screen.tsx b/src/components/ward-management/coordinator/coordinator-screen.tsx
index f51ae7ccc6..930ace10d4 100644
--- a/src/components/ward-management/coordinator/coordinator-screen.tsx
+++ b/src/components/ward-management/coordinator/coordinator-screen.tsx
@@ -4,6 +4,7 @@ import { useLayoutEffect, useMemo, useState } from "react";
 
 import { buildActionInbox, isOpen } from "@/components/ward-management/ward-derivations";
 import { useWardFlow } from "@/components/ward-management/ward-flow-provider";
+import { NotAMedicalDeviceStatement } from "@/components/ward-management/ward-management-modes";
 import { ClinicalRail } from "@/components/ward-management/ward-management-navigation";
 import { queueOrder } from "@/components/ward-management/ward-priority";
 import { allEmergencyDepartments } from "@/components/ward-management/ward-sites";
@@ -152,11 +153,10 @@ export function CoordinatorScreen() {
 
         <div className={styles.governanceBanner} data-testid="ward-coordinator-governance">
           <span className={styles.prototypeBadge}>Synthetic prototype</span>
-          <p>
-            This screen is <strong>not a medical device</strong>. It orders operational placement work only — it never
-            assesses a patient&apos;s risk, acuity or treatment. A human coordinator confirms or overrides every
-            suggestion.
-          </p>
+          {/* Task 9 (spec item 7): shared verbatim with the governance board's own banner via
+           * `NotAMedicalDeviceStatement` (ward-management-modes.tsx) rather than kept as a second,
+           * independently maintained copy of the same governance claim. */}
+          <NotAMedicalDeviceStatement />
         </div>
 
         <div className={styles.body} data-testid="ward-coordinator-body">
diff --git a/src/components/ward-management/ward-derivations.ts b/src/components/ward-management/ward-derivations.ts
index 4b2df4e2bb..034b6a66df 100644
--- a/src/components/ward-management/ward-derivations.ts
+++ b/src/components/ward-management/ward-derivations.ts
@@ -21,6 +21,11 @@ import {
   requiresAuthorisedDestination,
   type EligibilityVerdict,
 } from "@/components/ward-management/ward-eligibility";
+import {
+  changeReasonLabels,
+  type CancelTransportReason,
+  type ReleaseHoldReason,
+} from "@/components/ward-management/ward-change-reasons";
 import {
   MOVEMENT_STAGES,
   PARALLEL_REFERRAL_CAP,
@@ -678,3 +683,132 @@ export function movementTimeline(movement: Movement) {
   }
   return events.sort((a, b) => a.at - b.at);
 }
+
+/**
+ * Task 9 (spec item 7): the governance board's audit of changes — every urgency change, legal
+ * status change, hold release and transport cancellation across ALL movements, not one patient's
+ * own timeline (`movementTimeline` above stays scoped to a single movement; this is the
+ * statewide counterpart). Newest first, so the most recent decision is the one a reviewer sees
+ * without scrolling.
+ */
+export type ChangeAuditEntry = {
+  at: Instant;
+  movementId: string;
+  kind: "urgency" | "legal_status" | "hold_released" | "transport_cancelled";
+  by: string;
+  detail: string;
+};
+
+export function changeAudit(movements: Movement[]): ChangeAuditEntry[] {
+  const entries: ChangeAuditEntry[] = [];
+  for (const movement of movements) {
+    for (const change of movement.statusChanges) {
+      entries.push({
+        at: change.at,
+        movementId: movement.id,
+        kind: "legal_status",
+        by: change.by,
+        detail: `${change.from} → ${change.to} · ${changeReasonLabels[change.reason]}`,
+      });
+    }
+    for (const change of movement.urgencyChanges) {
+      entries.push({
+        at: change.at,
+        movementId: movement.id,
+        kind: "urgency",
+        by: change.by,
+        detail: `Tier ${change.from} → Tier ${change.to} · ${changeReasonLabels[change.reason]}`,
+      });
+    }
+    for (const unwind of movement.unwinds) {
+      // `UnwindRecord.reason` is typed as a plain `string` on `Movement` (ward-model.ts) because
+      // `RELEASE_HOLD` and `CANCEL_TRANSPORT` share one record shape for two different fixed
+      // reason lists. The reducer only ever writes a `ReleaseHoldReason` into a "hold_released"
+      // entry and a `CancelTransportReason` into a "transport_cancelled" one (ward-flow-reducer.ts),
+      // so this assertion narrows back to that guarantee rather than inventing one — it does not
+      // widen what values can reach the screen. Never render `unwind.reason` unlabelled: that is
+      // the raw snake_case defect this file's own doc comment on `changeReasonLabels` exists to
+      // prevent.
+      const reason = unwind.reason as ReleaseHoldReason | CancelTransportReason;
+      entries.push({
+        at: unwind.at,
+        movementId: movement.id,
+        kind: unwind.kind,
+        by: unwind.by,
+        detail: changeReasonLabels[reason],
+      });
+    }
+  }
+  return entries.sort((a, b) => b.at - a.at);
+}
+
+function median(values: number[]): number | undefined {
+  if (values.length === 0) return undefined;
+  const sorted = [...values].sort((a, b) => a - b);
+  const middle = Math.floor(sorted.length / 2);
+  return sorted.length % 2 === 0 ? (sorted[middle - 1] + sorted[middle]) / 2 : sorted[middle];
+}
+
+/**
+ * Minutes from referral to a ward accepting, for one movement — `undefined` when that duration
+ * cannot be recovered from this record.
+ *
+ * There is no `acceptedAt` field on `Movement`: `ACCEPT_IN_PRINCIPLE` (ward-flow-reducer.ts) sets
+ * `acceptedUnitId` but stores no timestamp for the acceptance itself. The one place an acceptance
+ * instant survives is `withdrawnReferrals` — that same reducer branch withdraws every OTHER
+ * referred unit in the same update, stamping each withdrawal with `event.now`, so when a movement
+ * was accepted while more than one unit held a live referral, every entry it leaves in
+ * `withdrawnReferrals` carries the acceptance instant. `acceptedUnitId` can only ever be set once
+ * (a second `ACCEPT_IN_PRINCIPLE` on an already-accepted movement is rejected), so those entries
+ * are never overwritten or added to again. A movement accepted while only one unit was referred
+ * withdraws nothing and leaves no timestamp anywhere in this model — that movement reached
+ * acceptance but genuinely has no recoverable "when", so it is excluded here rather than guessed.
+ */
+function acceptanceDurationMinutes(movement: Movement): number | undefined {
+  if (movement.acceptedUnitId === undefined) return undefined;
+  if (movement.withdrawnReferrals.length === 0) return undefined;
+  return movement.withdrawnReferrals[0].at - movement.openedAt;
+}
+
+/** Distinct units this movement has ever referred to: currently referred, declined, withdrawn on
+ *  acceptance, and the accepted unit itself. `undefined` when the movement has never referred to
+ *  any unit, so it never contributes a fabricated zero to an average. */
+function unitsContactedCount(movement: Movement): number | undefined {
+  const contacted = new Set<string>([
+    ...movement.referredUnitIds,
+    ...movement.declines.map((decline) => decline.unitId),
+    ...movement.withdrawnReferrals.map((withdrawn) => withdrawn.unitId),
+  ]);
+  if (movement.acceptedUnitId !== undefined) contacted.add(movement.acceptedUnitId);
+  return contacted.size === 0 ? undefined : contacted.size;
+}
+
+/**
+ * Task 9 (spec item 7), D7: the governance board's two live effectiveness numbers. Conservative
+ * failure applies to each independently — a measure this cannot compute returns `undefined`,
+ * never `0`, because zero minutes to acceptance or zero units contacted both read as a real
+ * result rather than as "unknown". Both describe the current synthetic scenario only; nothing
+ * here is a claim about the prototype's real-world effectiveness.
+ */
+export function effectivenessNumbers(movements: Movement[]): {
+  medianMinutesToAcceptance: number | undefined;
+  averageUnitsContacted: number | undefined;
+} {
+  const acceptanceDurations = movements
+    .map((movement) => acceptanceDurationMinutes(movement))
+    .filter((minutes): minutes is number => minutes !== undefined);
+
+  const contactedCounts = movements
+    .map((movement) => unitsContactedCount(movement))
+    .filter((count): count is number => count !== undefined);
+
+  const averageUnitsContacted =
+    contactedCounts.length === 0
+      ? undefined
+      : contactedCounts.reduce((total, count) => total + count, 0) / contactedCounts.length;
+
+  return {
+    medianMinutesToAcceptance: median(acceptanceDurations),
+    averageUnitsContacted,
+  };
+}
diff --git a/src/components/ward-management/ward-management-modes.module.css b/src/components/ward-management/ward-management-modes.module.css
index 31efd948b9..4f1919a33f 100644
--- a/src/components/ward-management/ward-management-modes.module.css
+++ b/src/components/ward-management/ward-management-modes.module.css
@@ -699,6 +699,114 @@
   line-height: var(--ward-leading-prose);
 }
 
+/* Task 9 (spec item 7): the not-a-medical-device banner. Same visual language as
+ * coordinator.module.css's own `.governanceBanner` — a bordered strip with the prototype badge
+ * and the shared statement text — expressed with this file's own `--ward-*` tokens. */
+.governanceBanner {
+  display: flex;
+  min-height: 3rem;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: var(--ward-space-12);
+  border: 0.0625rem solid var(--ward-blue-border);
+  border-radius: var(--radius-lg);
+  background: var(--ward-blue-soft);
+  padding: var(--ward-space-10) var(--ward-space-14);
+  margin-bottom: var(--ward-space-10);
+}
+
+.governanceBanner p {
+  min-width: 0;
+  flex: 1 1 12rem;
+  margin: 0;
+  color: var(--ward-text);
+  font-size: var(--text-2xs);
+  line-height: var(--ward-leading-prose);
+}
+
+.governanceBanner strong {
+  color: var(--ward-heading);
+}
+
+/* Explicit-absence note, shared by the change audit's empty state and any other "nothing
+ * recorded yet" panel on this view. */
+.emptyNote {
+  border: 0.0625rem dashed var(--ward-border);
+  border-radius: var(--radius-md);
+  padding: var(--ward-space-10) var(--ward-space-12);
+  color: var(--ward-muted);
+  font-size: var(--text-2xs);
+  line-height: var(--ward-leading-prose);
+}
+
+.effectivenessList {
+  display: grid;
+  gap: var(--ward-space-10);
+}
+
+.effectivenessList > div {
+  border: 0.0625rem solid var(--ward-border);
+  border-radius: var(--radius-md);
+  padding: var(--ward-space-10) var(--ward-space-12);
+}
+
+.effectivenessList dt {
+  display: flex;
+  align-items: center;
+  gap: var(--ward-space-6);
+  color: var(--ward-muted);
+  font-size: var(--text-3xs);
+}
+
+.effectivenessList dt svg {
+  width: 1rem;
+  height: 1rem;
+  color: var(--ward-blue);
+}
+
+.effectivenessList dd {
+  margin-top: 0.25rem;
+  color: var(--ward-heading);
+  font-size: var(--text-lg);
+  font-weight: 700;
+}
+
+.effectivenessList dd small {
+  margin-left: 0.25rem;
+  color: var(--ward-muted);
+  font-size: var(--text-2xs);
+  font-weight: 500;
+}
+
+.effectivenessUnknown {
+  color: var(--ward-muted);
+  font-size: var(--text-xs);
+  font-weight: 500;
+}
+
+/* The dropped-third-measure notice. Warning tone (not the blue `.notice` tone) because this is
+ * flagging an absence the reader must not mistake for a clean two-out-of-two report. */
+.droppedMeasureNote {
+  display: flex;
+  align-items: flex-start;
+  gap: var(--ward-space-8);
+  margin-top: 0.75rem;
+  border-left: 0.1875rem solid var(--ward-warning);
+  background: var(--ward-warning-soft);
+  padding: var(--ward-space-10) var(--ward-space-12);
+  color: var(--ward-text);
+  font-size: var(--text-2xs);
+  line-height: var(--ward-leading-prose);
+}
+
+.droppedMeasureNote svg {
+  width: 1rem;
+  height: 1rem;
+  flex: 0 0 auto;
+  margin-top: 0.125rem;
+  color: var(--ward-warning);
+}
+
 @media (max-width: 78rem) {
   .headerMeta > span:not(.prototypeBadge) {
     display: none;
diff --git a/src/components/ward-management/ward-management-modes.tsx b/src/components/ward-management/ward-management-modes.tsx
index 5d52143958..034bbeb9da 100644
--- a/src/components/ward-management/ward-management-modes.tsx
+++ b/src/components/ward-management/ward-management-modes.tsx
@@ -8,10 +8,12 @@ import {
   CheckCircle2,
   ChevronDown,
   CircleAlert,
+  CircleSlash,
   Clock3,
   FileCheck2,
   FileClock,
   Fingerprint,
+  History,
   Info,
   LockKeyhole,
   MapPin,
@@ -19,6 +21,7 @@ import {
   ShieldCheck,
   Sparkles,
   Truck,
+  Users,
   UserRound,
 } from "lucide-react";
 import { useMemo, useState } from "react";
@@ -27,7 +30,9 @@ import { eligibility } from "@/components/ward-management/ward-eligibility";
 import {
   buildActionInbox,
   candidateReason,
+  changeAudit,
   destinationUnit,
+  effectivenessNumbers,
   eligibleCandidatesAmong,
   elapsedLabel,
   isOpen,
@@ -37,6 +42,7 @@ import {
   roleTaskLabel,
   stageSummaries,
   unitCapacity,
+  type ChangeAuditEntry,
   type InboxItem,
   type WardRole,
 } from "@/components/ward-management/ward-derivations";
@@ -79,6 +85,14 @@ const modeCopy: Record<WardMode, { title: string; description: string }> = {
   governance: { title: "Governance", description: "Assurance, audit and synthetic data boundary" },
 };
 
+/** Task 9: a short human label for each `ChangeAuditEntry` kind — never the raw union value on screen. */
+const auditKindLabels: Record<ChangeAuditEntry["kind"], string> = {
+  urgency: "Urgency change",
+  legal_status: "Legal status change",
+  hold_released: "Hold released",
+  transport_cancelled: "Transport cancelled",
+};
+
 /** Same role-ordering rule as the command console: human urgency order stays, role just re-sorts by owner. */
 function sortByRole(movements: Movement[], role: WardRole) {
   if (role === "flow") return movements;
@@ -635,6 +649,38 @@ function TransportView() {
   );
 }
 
+/**
+ * Task 9 (spec item 7): the not-a-medical-device statement. `coordinator-screen.tsx` carried this
+ * wording first; it is exported from here and imported there (see that file's own governance
+ * banner) so the two screens render the exact same statement rather than two independently
+ * maintained copies that could quietly drift apart — the failure mode the brief calls worse than
+ * a single missing statement.
+ */
+export function NotAMedicalDeviceStatement() {
+  return (
+    <p>
+      This screen is <strong>not a medical device</strong>. It orders operational placement work only — it never
+      assesses a patient&apos;s risk, acuity or treatment. A human coordinator confirms or overrides every suggestion.
+    </p>
+  );
+}
+
+/** Renders a computed effectiveness number, or its explicit absence — never a substituted `0`.
+ *  Rule 4 (conservative failure): a measure this cannot compute must read as unknown, not as a
+ *  suspiciously perfect result. */
+function EffectivenessValue({ value, unit }: { value: number | undefined; unit: string }) {
+  if (value === undefined) {
+    return <span className={styles.effectivenessUnknown}>Not enough data to compute</span>;
+  }
+  const rounded = Math.round(value * 10) / 10;
+  return (
+    <span>
+      {rounded}
+      <small> {unit}</small>
+    </span>
+  );
+}
+
 function GovernanceView() {
   const { movements } = useWardFlow();
   const sources = [
@@ -651,8 +697,14 @@ function GovernanceView() {
   ];
   const sample = movements[0];
   const timeline = movementTimeline(sample);
+  const audit = changeAudit(movements);
+  const effectiveness = effectivenessNumbers(movements);
   return (
     <div data-testid="ward-governance-view">
+      <div className={styles.governanceBanner} data-testid="ward-governance-medical-device-notice">
+        <span className={styles.prototypeBadge}>Synthetic prototype</span>
+        <NotAMedicalDeviceStatement />
+      </div>
       <section className={styles.assuranceGrid}>
         <article className={styles.governanceCard}>
           <Sparkles aria-hidden="true" />
@@ -742,6 +794,71 @@ function GovernanceView() {
           </ul>
         </aside>
       </div>
+      <div className={`${styles.pageGrid} ${styles.governanceLowerGrid}`}>
+        <section className={styles.panel} data-testid="ward-governance-change-audit">
+          <header className={styles.panelHeader}>
+            <div>
+              <h2>Change audit</h2>
+              <p>Every urgency change, legal status change, hold release and transport cancellation, newest first</p>
+            </div>
+          </header>
+          {audit.length > 0 ? (
+            <ol className={styles.auditList}>
+              {audit.map((entry, index) => (
+                <li key={`${entry.movementId}-${entry.kind}-${entry.at}-${index}`}>
+                  {entry.kind === "hold_released" || entry.kind === "transport_cancelled" ? (
+                    <History aria-hidden="true" />
+                  ) : (
+                    <Clock3 aria-hidden="true" />
+                  )}{" "}
+                  {formatInstant(entry.at)} · {entry.movementId} · {auditKindLabels[entry.kind]} · {entry.detail} · by{" "}
+                  {entry.by}
+                </li>
+              ))}
+            </ol>
+          ) : (
+            <p className={styles.emptyNote} data-testid="ward-governance-change-audit-empty">
+              None — no urgency change, legal status change, hold release or transport cancellation has been recorded
+              yet.
+            </p>
+          )}
+        </section>
+        <aside className={styles.panel} data-testid="ward-governance-effectiveness">
+          <header className={styles.panelHeader}>
+            <div>
+              <h2>Effectiveness</h2>
+              <p>Two measures computed from this synthetic scenario</p>
+            </div>
+          </header>
+          <dl className={styles.effectivenessList}>
+            <div data-testid="ward-governance-effectiveness-acceptance">
+              <dt>
+                <Clock3 aria-hidden="true" /> Median time, referral to a ward accepting
+              </dt>
+              <dd>
+                <EffectivenessValue value={effectiveness.medianMinutesToAcceptance} unit="min" />
+              </dd>
+            </div>
+            <div data-testid="ward-governance-effectiveness-units-contacted">
+              <dt>
+                <Users aria-hidden="true" /> Average units contacted per patient
+              </dt>
+              <dd>
+                <EffectivenessValue value={effectiveness.averageUnitsContacted} unit="units" />
+              </dd>
+            </div>
+          </dl>
+          <p className={styles.notice}>
+            Both numbers describe today&apos;s synthetic scenario only. Neither is evidence that this prototype works,
+            and neither may be read as real-world performance.
+          </p>
+          <p className={styles.droppedMeasureNote} data-testid="ward-governance-dropped-measure">
+            <CircleSlash aria-hidden="true" /> A third success measure — legal deadlines passed while a patient waits —
+            is dropped. Every legal deadline was removed from this model on the product owner&apos;s instruction, so it
+            cannot be computed and is not shown here.
+          </p>
+        </aside>
+      </div>
     </div>
   );
 }
diff --git a/tests/ward-governance.dom.test.tsx b/tests/ward-governance.dom.test.tsx
new file mode 100644
index 0000000000..2e8803514b
--- /dev/null
+++ b/tests/ward-governance.dom.test.tsx
@@ -0,0 +1,123 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+// Same reason as every sibling dom suite (ward-capacity-view.dom.test.tsx,
+// ward-escalation.dom.test.tsx, ward-screen.dom.test.tsx): `ClinicalRail` renders next/link
+// anchors and this suite never checks routing, so a plain <a> avoids requiring an App Router
+// context jsdom cannot provide.
+vi.mock("next/link", () => ({
+  default: ({ children, href, ...rest }: { children: ReactNode; href: string }) => (
+    <a href={href} {...rest}>
+      {children}
+    </a>
+  ),
+}));
+
+import { useWardFlow, WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+import { WardModeWorkspace } from "@/components/ward-management/ward-management-modes";
+import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
+
+/** Raises a real CHANGE_URGENCY event through the live reducer — mirrors `ClockAdvancer` in
+ * ward-escalation.dom.test.tsx / ward-flow-provider.dom.test.tsx — so this suite proves the
+ * governance board's change audit reacts to the same dispatch path the real screens use, not a
+ * fixture snapshot frozen at render time. */
+function UrgencyChanger({ movementId }: { movementId: string }) {
+  const { now, dispatch } = useWardFlow();
+  return (
+    <button
+      type="button"
+      onClick={() =>
+        dispatch({
+          type: "CHANGE_URGENCY",
+          role: "coordinator",
+          now,
+          movementId,
+          urgency: 1,
+          reason: "reassessed",
+        })
+      }
+    >
+      raise urgency change
+    </button>
+  );
+}
+
+function renderGovernance() {
+  return render(
+    <WardFlowProvider initialNow={NOW_ANCHOR}>
+      <WardModeWorkspace mode="governance" />
+      <UrgencyChanger movementId="WF-002" />
+    </WardFlowProvider>,
+  );
+}
+
+describe("GovernanceView", () => {
+  it("carries the not-a-medical-device statement, the same wording the coordinator screen uses", () => {
+    renderGovernance();
+    const notice = screen.getByTestId("ward-governance-medical-device-notice");
+    expect(notice).toHaveTextContent("This screen is not a medical device. It orders operational placement work only");
+    expect(notice.querySelector("strong")).toHaveTextContent("not a medical device");
+  });
+
+  // Fixture fact (Task 9 brief): exactly one movement, WF-010, carries a hand-authored
+  // statusChanges entry; no movement carries a hand-authored urgencyChanges or unwinds entry.
+  // So the board starts with exactly one row, and dispatching a real change grows the list —
+  // newest first — rather than the row count being frozen or the new entry landing at the end.
+  it("shows the real fixture's one hand-authored change (WF-010) and grows, newest first, once a new change is dispatched", () => {
+    renderGovernance();
+
+    const listBefore = screen.getByTestId("ward-governance-change-audit");
+    expect(listBefore).toHaveTextContent("WF-010");
+    // The explicit empty state must not render while at least one entry exists — both
+    // directions of the same guard ward-capacity-view.dom.test.tsx checks for its own rows.
+    expect(screen.queryByTestId("ward-governance-change-audit-empty")).not.toBeInTheDocument();
+    expect(listBefore.querySelectorAll("li")).toHaveLength(1);
+
+    fireEvent.click(screen.getByRole("button", { name: "raise urgency change" }));
+
+    const listAfter = screen.getByTestId("ward-governance-change-audit");
+    const itemsAfter = listAfter.querySelectorAll("li");
+    expect(itemsAfter).toHaveLength(2);
+    // Newest first: the just-dispatched urgency change is recorded at `now` (NOW_ANCHOR), which
+    // sorts ahead of the fixture's own WF-010 entry, timestamped NOW_ANCHOR - 40. Checked as one
+    // ordered pair per row (id + kind together), not two independent substring checks that a
+    // swapped-row mutation could still satisfy.
+    expect(itemsAfter[0]).toHaveTextContent("WF-002");
+    expect(itemsAfter[0]).toHaveTextContent("Urgency change");
+    expect(itemsAfter[1]).toHaveTextContent("WF-010");
+    expect(itemsAfter[1]).toHaveTextContent("Legal status change");
+  });
+
+  it("renders the two effectiveness numbers, the synthetic-scenario caveat, and the dropped third measure", () => {
+    renderGovernance();
+    const effectiveness = screen.getByTestId("ward-governance-effectiveness");
+    expect(effectiveness).toBeInTheDocument();
+
+    // Real fixture fact: WF-006 is the only movement with a recoverable acceptance instant —
+    // openedAt NOW_ANCHOR-500, its sole withdrawnReferrals entry at NOW_ANCHOR-470 — 30 minutes.
+    // It is the only movement in the whole 48-record fixture with a non-empty withdrawnReferrals
+    // array, so the median is exactly this one value, not the "not enough data" fallback.
+    const acceptance = screen.getByTestId("ward-governance-effectiveness-acceptance");
+    expect(acceptance).toHaveTextContent("30");
+    // A sign-flipped duration (openedAt - acceptedAt instead of acceptedAt - openedAt) would
+    // still contain the substring "30" as "-30" — guard against that directly rather than
+    // relying only on the derivation-level unit test to catch it.
+    expect(acceptance).not.toHaveTextContent("-30");
+    expect(acceptance).not.toHaveTextContent("Not enough data to compute");
+
+    // The real fixture carries several accepted/referred/declined movements, so this is
+    // computable too — asserted as present and numeric rather than pinned to an exact value
+    // this suite does not independently derive.
+    const unitsContacted = screen.getByTestId("ward-governance-effectiveness-units-contacted");
+    expect(unitsContacted).not.toHaveTextContent("Not enough data to compute");
+    expect(unitsContacted.textContent).toMatch(/\d/);
+
+    expect(effectiveness).toHaveTextContent("Neither is evidence that this prototype works");
+
+    const dropped = screen.getByTestId("ward-governance-dropped-measure");
+    expect(dropped).toHaveTextContent("legal deadlines passed while a patient waits");
+    expect(dropped).toHaveTextContent("dropped");
+    expect(dropped).toHaveTextContent("cannot be computed");
+  });
+});
diff --git a/tests/ward-governance.test.ts b/tests/ward-governance.test.ts
new file mode 100644
index 0000000000..f5c39967a3
--- /dev/null
+++ b/tests/ward-governance.test.ts
@@ -0,0 +1,240 @@
+// tests/ward-governance.test.ts
+import { describe, expect, it } from "vitest";
+
+import { changeReasonLabels } from "../src/components/ward-management/ward-change-reasons";
+import { changeAudit, effectivenessNumbers } from "../src/components/ward-management/ward-derivations";
+import { seedWardFlowState, wardFlowReducer } from "../src/components/ward-management/ward-flow-reducer";
+import type { Movement } from "../src/components/ward-management/ward-model";
+import { wardMovements } from "../src/components/ward-management/ward-movements";
+import { NOW_ANCHOR } from "../src/components/ward-management/ward-sites";
+
+// A real, valid, open fixture movement to spread from when a test needs its own movement list —
+// same approach as tests/ward-derivations.test.ts's `movementFrom`. Object.assign rather than
+// spread, because `{ ...base, ...Partial<T> }` widens every overridden field back to optional
+// under TypeScript's spread-merge rules even though every field is present at runtime.
+const baseMovement = wardMovements.find((movement) => movement.id === "WF-002");
+if (!baseMovement) throw new Error("Fixture movement WF-002 is required as a template for ward-governance tests");
+
+function movementFrom(overrides: Partial<Movement>): Movement {
+  return Object.assign({}, baseMovement, overrides);
+}
+
+describe("changeAudit", () => {
+  it("returns an empty list when no movement carries any recorded change", () => {
+    const movements = [
+      movementFrom({ id: "WF-EMPTY-A", statusChanges: [], urgencyChanges: [], unwinds: [] }),
+      movementFrom({ id: "WF-EMPTY-B", statusChanges: [], urgencyChanges: [], unwinds: [] }),
+    ];
+    expect(changeAudit(movements)).toEqual([]);
+  });
+
+  // Task 9's own "measured fixture facts": exactly one movement (WF-010) carries a
+  // hand-authored statusChanges entry, and no movement carries a hand-authored urgencyChanges
+  // or unwinds entry. This proves the real fixture surfaces that one entry, labelled, not the
+  // raw `recorded_by_treating_team` reason code.
+  it("finds the real fixture's one hand-authored legal status change (WF-010), labelled rather than as a raw reason code", () => {
+    const { movements } = seedWardFlowState();
+    const audit = changeAudit(movements);
+    expect(audit).toHaveLength(1);
+    expect(audit[0]).toMatchObject({
+      at: NOW_ANCHOR - 40,
+      movementId: "WF-010",
+      kind: "legal_status",
+      by: "Duty psychiatrist",
+    });
+    expect(audit[0].detail).toBe("Voluntary → Detained awaiting examination · Recorded by treating team");
+    expect(audit[0].detail).not.toMatch(/recorded_by_treating_team/);
+  });
+
+  it("labels a hold-released reason, never the raw snake_case value", () => {
+    const seeded = seedWardFlowState();
+    const heldTarget = seeded.movements.find((movement) => movement.stage === "bed_held");
+    if (!heldTarget) throw new Error("fixture requires a bed_held movement");
+    const after = wardFlowReducer(seeded, {
+      type: "RELEASE_HOLD",
+      role: "coordinator",
+      now: 300,
+      movementId: heldTarget.id,
+      reason: "bed_needed_for_another_patient",
+    });
+    expect(after.rejections).toHaveLength(0);
+    const entries = changeAudit(after.movements).filter((entry) => entry.kind === "hold_released");
+    expect(entries).toHaveLength(1);
+    expect(entries[0].detail).toBe(changeReasonLabels.bed_needed_for_another_patient);
+    expect(entries[0].detail).toBe("Bed needed elsewhere");
+    expect(entries[0].detail).not.toMatch(/bed_needed_for_another_patient/);
+  });
+
+  // Ordered-pair assertion by design (per the brief's own rule): each row asserts `at`, `kind`
+  // AND `movementId` together as one tuple, so a mutation that sorts correctly but attaches the
+  // wrong kind or the wrong movement id to an entry is still caught — two independent
+  // per-field checks would not catch a swap between two entries that share neither field.
+  it("collects urgency, legal status, hold-released and transport-cancelled entries across movements, newest first", () => {
+    const seeded = seedWardFlowState();
+    const urgencyTarget = seeded.movements.find((movement) => !movement.closure && movement.urgency !== 1);
+    if (!urgencyTarget) throw new Error("fixture requires an open movement with urgency !== 1");
+    const legalTarget = seeded.movements.find((movement) => !movement.closure && movement.id !== urgencyTarget.id);
+    if (!legalTarget) throw new Error("fixture requires a second open movement");
+    const heldTarget = seeded.movements.find((movement) => movement.stage === "bed_held");
+    if (!heldTarget) throw new Error("fixture requires a bed_held movement");
+    const transportTarget = seeded.movements.find(
+      (movement) =>
+        movement.transport !== undefined &&
+        movement.transport.cancelledAt === undefined &&
+        movement.transport.arrivedAt === undefined,
+    );
+    if (!transportTarget) throw new Error("fixture requires a movement with a live transport job");
+
+    let state = seeded;
+    state = wardFlowReducer(state, {
+      type: "CHANGE_URGENCY",
+      role: "coordinator",
+      now: 100,
+      movementId: urgencyTarget.id,
+      urgency: 1,
+      reason: "reassessed",
+    });
+    state = wardFlowReducer(state, {
+      type: "CHANGE_LEGAL_STATUS",
+      role: "ed",
+      now: 400,
+      movementId: legalTarget.id,
+      legalStatus: "Involuntary inpatient",
+      reason: "correcting_an_error",
+    });
+    state = wardFlowReducer(state, {
+      type: "RELEASE_HOLD",
+      role: "coordinator",
+      now: 250,
+      movementId: heldTarget.id,
+      reason: "hold_made_in_error",
+    });
+    state = wardFlowReducer(state, {
+      type: "CANCEL_TRANSPORT",
+      role: "coordinator",
+      now: 550,
+      movementId: transportTarget.id,
+      reason: "provider_unavailable",
+    });
+    expect(state.rejections).toHaveLength(0);
+
+    const audit = changeAudit(state.movements);
+    // 4 dispatched entries plus the fixture's own WF-010 legal_status entry at NOW_ANCHOR - 40
+    // (602), which every seeded state carries regardless of what this test dispatches.
+    expect(audit).toHaveLength(5);
+    expect(audit.map((entry) => [entry.at, entry.kind, entry.movementId])).toEqual([
+      [NOW_ANCHOR - 40, "legal_status", "WF-010"],
+      [550, "transport_cancelled", transportTarget.id],
+      [400, "legal_status", legalTarget.id],
+      [250, "hold_released", heldTarget.id],
+      [100, "urgency", urgencyTarget.id],
+    ]);
+  });
+});
+
+describe("effectivenessNumbers", () => {
+  // The single easiest thing to get wrong here (per the brief): a measure this cannot compute
+  // must return `undefined`, never `0` — a `0` would read as an instantaneous acceptance, the
+  // opposite of "unknown". This movement set genuinely cannot support either measure: neither
+  // movement has ever referred a unit, so there is nothing to average, and neither has an
+  // acceptance instant to measure a duration against.
+  it("returns undefined for both measures against a movement set where neither can genuinely be computed", () => {
+    const movements = [
+      movementFrom({
+        id: "WF-NR-1",
+        referredUnitIds: [],
+        declines: [],
+        withdrawnReferrals: [],
+        acceptedUnitId: undefined,
+      }),
+      movementFrom({
+        id: "WF-NR-2",
+        referredUnitIds: [],
+        declines: [],
+        withdrawnReferrals: [],
+        acceptedUnitId: undefined,
+      }),
+    ];
+    const result = effectivenessNumbers(movements);
+    expect(result.medianMinutesToAcceptance).toBeUndefined();
+    expect(result.averageUnitsContacted).toBeUndefined();
+    // Guard against a regression that substitutes 0 for undefined — the literal failure mode
+    // rule 4 exists to prevent.
+    expect(result.medianMinutesToAcceptance).not.toBe(0);
+    expect(result.averageUnitsContacted).not.toBe(0);
+  });
+
+  it("computes the median acceptance duration only over movements with a recoverable acceptance instant", () => {
+    const computableFast = movementFrom({
+      id: "WF-ACC-1",
+      openedAt: 100,
+      acceptedUnitId: "unit-a",
+      referredUnitIds: [],
+      declines: [],
+      withdrawnReferrals: [{ unitId: "unit-b", at: 140, reason: "withdrawn — placed at Unit A" }],
+    });
+    const computableSlow = movementFrom({
+      id: "WF-ACC-2",
+      openedAt: 200,
+      acceptedUnitId: "unit-c",
+      referredUnitIds: [],
+      declines: [],
+      withdrawnReferrals: [{ unitId: "unit-d", at: 260, reason: "withdrawn — placed at Unit C" }],
+    });
+    // Reached acceptance (acceptedUnitId is set) but was the only unit ever referred, so
+    // ACCEPT_IN_PRINCIPLE withdrew nothing and left no timestamp anywhere in this model. This
+    // movement must contribute nothing to the median — neither a fabricated 0 nor a NaN — and
+    // must not turn the whole measure undefined either, since the other two ARE computable.
+    const uncomputable = movementFrom({
+      id: "WF-ACC-3",
+      openedAt: 300,
+      acceptedUnitId: "unit-e",
+      referredUnitIds: [],
+      declines: [],
+      withdrawnReferrals: [],
+    });
+    const result = effectivenessNumbers([computableFast, computableSlow, uncomputable]);
+    // Durations: 140-100=40 and 260-200=60 minutes -> median (40+60)/2 = 50.
+    expect(result.medianMinutesToAcceptance).toBe(50);
+  });
+
+  it("averages units contacted only over movements with at least one referral, counting each unit once", () => {
+    const noReferral = movementFrom({
+      id: "WF-UC-0",
+      referredUnitIds: [],
+      declines: [],
+      withdrawnReferrals: [],
+      acceptedUnitId: undefined,
+    });
+    const oneUnit = movementFrom({
+      id: "WF-UC-1",
+      referredUnitIds: ["unit-a"],
+      declines: [],
+      withdrawnReferrals: [],
+      acceptedUnitId: undefined,
+    });
+    const threeUnits = movementFrom({
+      id: "WF-UC-2",
+      referredUnitIds: [],
+      declines: [{ unitId: "unit-b", at: 10, reason: "no_bed" }],
+      withdrawnReferrals: [{ unitId: "unit-c", at: 20, reason: "withdrawn — placed at Unit D" }],
+      acceptedUnitId: "unit-d",
+    });
+    const result = effectivenessNumbers([noReferral, oneUnit, threeUnits]);
+    // (1 + 3) / 2 = 2 — the zero-referral movement is excluded from the denominator entirely
+    // rather than counted as a 0-contact patient, which would silently pull the average down.
+    expect(result.averageUnitsContacted).toBe(2);
+  });
+
+  it("counts a unit once even when it appears in more than one contact category", () => {
+    const movement = movementFrom({
+      id: "WF-UC-DEDUP",
+      referredUnitIds: ["unit-x"],
+      declines: [{ unitId: "unit-x", at: 10, reason: "no_bed" }],
+      withdrawnReferrals: [],
+      acceptedUnitId: undefined,
+    });
+    const result = effectivenessNumbers([movement]);
+    expect(result.averageUnitsContacted).toBe(1);
+  });
+});

From 383f1833961bd990cc45643a52866fb2f6563673 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 11:33:44 +0800
Subject: [PATCH 18/54] Plan: make Ward Flow standalone, and repair the
 navigation it grew

Nine defects, every one measured rather than assumed. The headline: Ward Flow is
advertised in the tools catalogue as a ready, high-yield clinical tool with clinical
search keywords, AND is already a developer-hub panel. It is in both places at once,
so a clinician can find a synthetic prototype by searching for bed management.

Four more were found by fetching the rendered markup rather than reading code. The
coordinator screen - the primary screen - renders no main landmark and no skip-link
target at all. The three boards added this phase render a main with no id, so a skip
link lands nowhere. Those same three lack the Ward Flow views navigation every other
board carries, so moving between boards silently drops the nav on three of them.

The deeper structural fault is that the rail is 329 lines of hand-pasted link blocks
with no single source, which is why the routes and the nav could drift apart at all.
Three of its links point at one arbitrary synthetic ward and one arbitrary department
sitting in permanent navigation as though they were sections of the app.

No visual claim is made anywhere in this plan. The browser pane was unavailable in
this session, so a visual review is named as separate work rather than quietly assumed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ...-25-ward-flow-standalone-and-nav-repair.md | 244 ++++++++++++++++++
 1 file changed, 244 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md

diff --git a/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md b/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md
new file mode 100644
index 0000000000..1ea705bdb4
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md
@@ -0,0 +1,244 @@
+# Ward Flow — standalone prototype, and the navigation repair
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Take Ward Flow out of the clinical application entirely — reachable only from the
+developer hub — and repair the navigation, landmark and structure defects that accumulated while it
+was being built.
+
+**Architecture:** Ward Flow already has its own layout and does not mount the main app's shell, so
+separation is mostly about removing advertising, not rebuilding. The rail becomes data-driven from a
+single source, the way the main app drives its own navigation.
+
+**Tech Stack:** Next.js 16 App Router, React 19, TypeScript 6 strict, CSS modules with `@theme`
+design tokens, Vitest, Playwright (Chromium).
+
+**Product-owner decisions, 2026-08-25:**
+
+- **S1 — Addresses stay.** Ward Flow keeps `/ward-management/*`. Nothing moves under a new prefix.
+  Rejected the alternative because it rewrites every internal link, test, sitemap entry and doc, with
+  real risk of missing one, and buys only a cosmetic signal in the address bar.
+- **S2 — Remove it completely from the clinical app.** No search hit, no tools-catalogue entry, no
+  launcher tile, no category-index entry. The developer hub is the only way in.
+
+## Global Constraints
+
+1. **Never invent, infer, restate or "correct" any figure, requirement, title or classification from
+   the Mental Health Act.**
+2. **Synthetic data only.** Sex is the only permitted patient attribute. Free text counts.
+3. **Conservative failure.** An absence renders as an explicit absence, never a substituted default.
+4. **Not a medical device**, and the pages say so.
+5. Design tokens only, no raw hex. Every `<button>` has a real handler, is a submit inside a form, or
+   is a `<Link>`. Never both `disabled` and `aria-disabled`. Tap targets `3rem`/48px, never `2.75rem`.
+6. Internal navigation via `<Link>`/`router.push`, never a raw `<a href="/…">`.
+7. **One search composer per page.** Read `docs/search-chrome-behaviour.md` before touching chrome.
+8. **Mutation-test every test added or changed**; print the edited line back from the file. A
+   surviving mutation is reported, never reshaped around.
+9. Read counts, never exit codes. No Playwright, build, or provider-backed command from an
+   implementer — the controller runs those.
+
+## What is actually wrong — measured 2026-08-25, not assumed
+
+| #   | Defect                                                                                     | Evidence                                                                                                                                                                        |
+| --- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| D1  | Ward Flow is advertised as a **production clinical tool**                                  | `tools-catalog.ts` carries it as `status: "ready"`, `highYield: true`, with clinical keywords ("bed management", "patient flow", "ED transfer") that put it in universal search |
+| D2  | It is **simultaneously** a developer-hub panel                                             | `src/lib/developer-area/hub-panels.ts` → `{ id: "ward-flow", href: "/ward-management" }`                                                                                        |
+| D3  | It leaks into four more production surfaces                                                | `applications-launcher-page.tsx`, `tools/tools-search-results-page.tsx`, `category-identity.ts`, `tools-page-mockups/tool-fixtures.ts`                                          |
+| D4  | **The coordinator screen has no `<main>` landmark and no `id="main-content"`**             | `curl /ward-management` → 0 `<main>`; every other ward route has 1                                                                                                              |
+| D5  | Handover, escalation and search have a `<main>` but **no `id="main-content"`**             | `curl` each → `<main>` present, id absent; `/queue` has both                                                                                                                    |
+| D6  | Those same three pages **lack the "Ward Flow views" navigation** every other board carries | `curl` → `aria-label="Ward Flow views"` present on `/queue`, `/capacity`, `/governance`; absent on `/handover`, `/escalation`, `/search`                                        |
+| D7  | The rail is **hand-written and unsourced** — 329 lines of individually pasted link blocks  | `ward-management-navigation.tsx`; each Phase 3/4 task appended its own block                                                                                                    |
+| D8  | Three rail links point at **one arbitrary hardcoded instance**                             | `href="/ward-management/ward/rph-adult-secure"`, `href="/ward-management/ed/peel-ed"` sit in permanent navigation as though they were sections                                  |
+| D9  | The rail is labelled **"Clinical applications"**                                           | `aria-label="Clinical applications"` — wrong for a standalone prototype, and part of what makes it read as clinical software                                                    |
+
+---
+
+## Task 1: Remove Ward Flow from every clinical discovery surface (D1, D3)
+
+**Files:**
+
+- Modify: `src/lib/tools-catalog.ts`, `src/components/applications-launcher-page.tsx`,
+  `src/components/tools/tools-search-results-page.tsx`, `src/lib/category-identity.ts`
+- Test: `tests/ward-flow-not-clinical-surface.test.ts` (new)
+
+**Interfaces:**
+
+- Produces: nothing importable. Removes `"ward-management"` from the `ToolCatalogId` union and its
+  record, which is a **compile-time break** — every consumer goes red, which is the point. Follow the
+  type errors; do not silence one with a cast.
+
+- [ ] **Step 1: Write the failing guard test first.** It is the deliverable, not the removal.
+
+```ts
+import { describe, expect, it } from "vitest";
+
+import { TOOL_CATALOG } from "@/lib/tools-catalog";
+import { HUB_PANELS } from "@/lib/developer-area/hub-panels";
+
+describe("Ward Flow is a standalone prototype, not a clinical tool", () => {
+  it("appears in no clinical discovery surface", () => {
+    expect(TOOL_CATALOG.map((tool) => tool.href)).not.toContain("/ward-management");
+    expect(TOOL_CATALOG.some((tool) => tool.href.startsWith("/ward-management"))).toBe(false);
+  });
+
+  it("is still reachable from the developer hub, which is the only way in", () => {
+    const panel = HUB_PANELS.find((entry) => entry.href === "/ward-management");
+    expect(panel, "the developer hub must still carry Ward Flow").toBeDefined();
+  });
+});
+```
+
+Verify the real export names before writing this (`TOOL_CATALOG` may be named differently) — read
+`tools-catalog.ts` and use what is actually there.
+
+- [ ] **Step 2: Run it and watch the first assertion fail.**
+- [ ] **Step 3: Remove the entry** from the catalogue and the `ToolCatalogId` union, then follow every
+      resulting type error to its consumer and remove the Ward Flow branch there.
+- [ ] **Step 4: Run and watch both pass.** Then run the whole suite — this removal touches shared
+      surfaces and something unrelated will likely pin a count.
+- [ ] **Step 5: Handle the reachability gate.** `/ward-management` may now be an orphan.
+      **First check whether the developer hub renders a real `<Link>`** — if it does, the route is not
+      an orphan and no allowlist entry is needed. Only if it does not, add a `REACHABILITY_ALLOWLIST`
+      entry with the reason "standalone prototype; reachable only from the developer hub". Do not add
+      an allowlist entry you did not first prove was necessary.
+- [ ] **Step 6:** `npm run docs:update`, update `docs/codebase-index.md`, commit.
+
+---
+
+## Task 2: One source for ward navigation (D7, D8, D9)
+
+**Files:**
+
+- Create: `src/components/ward-management/ward-nav.ts`
+- Modify: `src/components/ward-management/ward-management-navigation.tsx`
+- Test: `tests/ward-nav.test.ts` (new), plus the existing reachability test
+
+**Interfaces:**
+
+- Produces:
+
+  ```ts
+  export type WardNavGroup = "role" | "board";
+  export type WardNavItem = {
+    id: string;
+    href: string;
+    label: string;
+    group: WardNavGroup;
+    /** True when the href names one specific synthetic ward or department rather than a section. */
+    exampleOnly?: boolean;
+  };
+  export const WARD_NAV: readonly WardNavItem[];
+  ```
+
+- [ ] **Step 1: Write the failing test.** Every `WARD_NAV` href resolves to a real route under
+      `src/app/ward-management/`; every static ward page route appears in `WARD_NAV` **or** is
+      explicitly recorded as intentionally unlisted with a reason. That two-way check is what stops
+      the rail and the routes drifting apart again — a one-way check would not have caught D6.
+- [ ] **Step 2: Run and watch it fail.**
+- [ ] **Step 3: Build `ward-nav.ts`** from the links currently hand-written in the rail. Group them:
+      `role` for the four role screens, `board` for the specialist boards.
+- [ ] **Step 4: Rewrite the rail to map over `WARD_NAV`**, rendering the two groups under labelled
+      headings instead of one flat list of thirteen. Keep every existing `aria-label` and `title` so
+      no current selector breaks; if one must change, name every place updated.
+- [ ] **Step 5: Deal with the hardcoded examples (D8).** `Ward — RPH Adult Secure` and `ED — Peel ED`
+      are links to one arbitrary synthetic ward and one arbitrary department. Mark them
+      `exampleOnly: true` and render them under a heading that says what they are — an example entry
+      point, not a section of the app. **Do not silently delete them**: they are the only way to reach
+      those role screens today, and removing the only route in is a worse defect than mislabelling.
+- [ ] **Step 6: Rename the rail's `aria-label`** from "Clinical applications" to a name honest for a
+      standalone prototype. Update every test asserting the old string and name them in the report.
+- [ ] **Step 7:** Run the ward suites and the reachability suite, `npm run docs:update`, commit.
+
+---
+
+## Task 3: Landmarks and skip-link targets (D4, D5)
+
+**Files:**
+
+- Modify: `src/components/ward-management/coordinator/coordinator-screen.tsx`,
+  `handover/handover-page.tsx`, `escalation/escalation-board.tsx`, `search/patient-search.tsx`
+- Test: `tests/ward-landmarks.test.ts` (new)
+
+**The defect, measured:** `/ward-management` renders **zero** `<main>` elements. Handover, escalation
+and search render a `<main>` with **no `id="main-content"`**, so a skip link lands nowhere. `/queue`
+has both and is the correct shape to copy.
+
+- [ ] **Step 1: Write the failing contract test.** For **every** static route under
+      `src/app/ward-management/`, assert the rendered output contains **exactly one**
+      `<main id="main-content">`. Not "at least one" — two main landmarks is also a defect, and
+      "at least one" would not catch it.
+
+      Render through the real component tree with `WardFlowProvider`, the way the existing ward DOM
+          tests do. **Enumerate the routes from the filesystem, not from a hand-written list** — a
+          hand-written list is what let three pages ship without the id in the first place.
+
+- [ ] **Step 2: Run it. It must fail naming at least four routes.** If it names fewer, the
+      enumeration is wrong — fix the test before touching any component.
+- [ ] **Step 3: Fix each route** to the `/queue` shape. Do not add a second `<main>` to a page that
+      already has one nested in a shared component; find the existing one and give it the id.
+- [ ] **Step 4: Run and watch it pass. Commit.**
+
+---
+
+## Task 4: Consistent in-page navigation (D6)
+
+**Files:**
+
+- Modify: `handover/handover-page.tsx`, `escalation/escalation-board.tsx`,
+  `search/patient-search.tsx`
+- Test: extend `tests/ward-nav.test.ts`
+
+**The defect, measured:** `/queue`, `/capacity` and `/governance` all render
+`<nav aria-label="Ward Flow views">`. `/handover`, `/escalation` and `/search` do not — so moving to
+any of the three new boards silently drops the navigation that exists everywhere else.
+
+- [ ] **Step 1: Decide and record which is correct, then make it uniform.** Two defensible answers:
+      the three new boards adopt the mode navigation, or the mode navigation is deliberately absent on
+      full-page boards. **Either is acceptable; the inconsistency is not.** Prefer adopting it —
+      thirteen routes where six behave one way and three another is a defect a user feels, and the
+      rail alone does not tell them which board they are on.
+- [ ] **Step 2: Write the failing test** asserting the chosen rule holds for every board route,
+      enumerated from the filesystem.
+- [ ] **Step 3: Run, fix, run, commit.**
+
+---
+
+## Task 5: Say plainly what this is (S2)
+
+**Files:**
+
+- Modify: `src/lib/developer-area/hub-panels.ts`, the ward coordinator screen's existing
+  prototype banner
+- Test: extend `tests/ward-flow-not-clinical-surface.test.ts`
+
+- [ ] **Step 1:** The developer-hub panel currently summarises Ward Flow as "Queue, capacity,
+      transport, movements" — accurate but it does not say what it is. Say that it is a synthetic
+      prototype and not clinical decision support, in the hub, where the decision to open it is made.
+- [ ] **Step 2:** Confirm the not-a-medical-device statement still renders on the coordinator screen
+      and the governance board (Phase 4 Task 9 made it a shared component). Assert it, so removing
+      Ward Flow from the clinical app cannot also remove the statement that it is not clinical.
+- [ ] **Step 3: Commit.**
+
+---
+
+## Final verification (controller)
+
+- `npx tsc --noEmit -p tsconfig.json` — quote the output.
+- Full unit suite — quote file and test counts, and account for every change against the
+  pre-plan baseline.
+- `npm run ensure`, then the ward Chromium journeys — quote the "N passed" line.
+- Re-run the `curl` landmark and nav checks that produced D4, D5 and D6, and paste the output —
+  the defects were found that way and that is how they are proved fixed.
+- `npm run docs:update`, then `npx prettier --check` on every changed file.
+- **Do not run** `verify:release`, `eval:*`, `check:supabase-project`, or anything touching OpenAI,
+  Supabase, GitHub Actions or the live database.
+
+## Explicitly not in this plan
+
+- **No visual redesign.** Every defect here is structural — a missing landmark, an absent nav, an
+  unsourced link list. I could not run a visual pass in this session (the browser pane was
+  unavailable), so **no claim is made about how any of it looks**. A visual review is separate work
+  and should be done by someone who can see the screens.
+- **No address changes** (decision S1).
+- **No change to Ward Flow's behaviour, model, or reducer.** This plan moves and relabels; it does not
+  alter what the prototype does.

From edeaba72c83a07f2c75bedde7283573e34bedeaa Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 11:47:37 +0800
Subject: [PATCH 19/54] =?UTF-8?q?Ward=20Flow=20governance:=20fix=20round?=
 =?UTF-8?q?=201=20=E2=80=94=20render=20each=20effectiveness=20number's=20s?=
 =?UTF-8?q?ample/population=20basis=20and=20stamp=20acceptedAt=20at=20the?=
 =?UTF-8?q?=20source?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A median of one, rendered bare, reads as a real measurement (the real fixture: 1 of 27
acceptances had a recoverable timestamp). effectivenessNumbers now returns an
EffectivenessMeasure { value, sampleSize, population } per measure instead of a bare
number, and GovernanceView renders the basis immediately beside the figure ("from N of
M ..."), never as a tooltip or footnote. Movement gains acceptedAt, stamped by
ACCEPT_IN_PRINCIPLE, and acceptanceDurationMinutes prefers it over the withdrawnReferrals
archaeology it used before — real for every future acceptance, without backfilling the
seed fixture with an invented timestamp.
---
 .../ward-management/ward-derivations.ts       | 59 +++++++++---
 .../ward-management/ward-flow-reducer.ts      |  4 +
 .../ward-management-modes.module.css          | 19 +++-
 .../ward-management/ward-management-modes.tsx | 59 +++++++++---
 src/components/ward-management/ward-model.ts  |  7 ++
 tests/ward-governance.dom.test.tsx            | 20 +++-
 tests/ward-governance.test.ts                 | 95 ++++++++++++++++---
 7 files changed, 219 insertions(+), 44 deletions(-)

diff --git a/src/components/ward-management/ward-derivations.ts b/src/components/ward-management/ward-derivations.ts
index 034b6a66df..f32f5b7f67 100644
--- a/src/components/ward-management/ward-derivations.ts
+++ b/src/components/ward-management/ward-derivations.ts
@@ -753,19 +753,24 @@ function median(values: number[]): number | undefined {
  * Minutes from referral to a ward accepting, for one movement — `undefined` when that duration
  * cannot be recovered from this record.
  *
- * There is no `acceptedAt` field on `Movement`: `ACCEPT_IN_PRINCIPLE` (ward-flow-reducer.ts) sets
- * `acceptedUnitId` but stores no timestamp for the acceptance itself. The one place an acceptance
- * instant survives is `withdrawnReferrals` — that same reducer branch withdraws every OTHER
- * referred unit in the same update, stamping each withdrawal with `event.now`, so when a movement
- * was accepted while more than one unit held a live referral, every entry it leaves in
- * `withdrawnReferrals` carries the acceptance instant. `acceptedUnitId` can only ever be set once
- * (a second `ACCEPT_IN_PRINCIPLE` on an already-accepted movement is rejected), so those entries
- * are never overwritten or added to again. A movement accepted while only one unit was referred
- * withdraws nothing and leaves no timestamp anywhere in this model — that movement reached
- * acceptance but genuinely has no recoverable "when", so it is excluded here rather than guessed.
+ * `Movement.acceptedAt` (added fix round 1, Task 9) is the direct, reliable source: it is
+ * stamped by `ACCEPT_IN_PRINCIPLE` (ward-flow-reducer.ts) the instant a unit is accepted, for
+ * every acceptance reached from now on. It is preferred whenever present. Before that field
+ * existed, the only place an acceptance instant survived was `withdrawnReferrals` — the same
+ * reducer branch withdraws every OTHER referred unit in the same update, stamping each
+ * withdrawal with `event.now`, so a movement accepted while more than one unit held a live
+ * referral leaves the acceptance instant behind as a side effect. That fallback still applies to
+ * the hand-authored seed fixture (`ward-movements.ts`), which sets `acceptedUnitId` directly
+ * rather than via a dispatched event and so never carries `acceptedAt` — its one recoverable
+ * acceptance (WF-006) is only found this way, and the fixture is deliberately never backfilled
+ * with an invented `acceptedAt` to manufacture a bigger sample. A movement accepted with only one
+ * referred unit and no `acceptedAt` withdraws nothing and leaves no timestamp anywhere in this
+ * model — that movement reached acceptance but genuinely has no recoverable "when", so it is
+ * excluded here rather than guessed.
  */
 function acceptanceDurationMinutes(movement: Movement): number | undefined {
   if (movement.acceptedUnitId === undefined) return undefined;
+  if (movement.acceptedAt !== undefined) return movement.acceptedAt - movement.openedAt;
   if (movement.withdrawnReferrals.length === 0) return undefined;
   return movement.withdrawnReferrals[0].at - movement.openedAt;
 }
@@ -783,17 +788,33 @@ function unitsContactedCount(movement: Movement): number | undefined {
   return contacted.size === 0 ? undefined : contacted.size;
 }
 
+/**
+ * Fix round 1 (Task 9): a computed figure alone is not honest without the basis it was drawn
+ * from. `sampleSize` is how many movements actually contributed an observation; `population` is
+ * how many movements COULD have — every acceptance for the acceptance measure, every movement
+ * passed in for the units-contacted measure. A median or average over a small `sampleSize`
+ * against a much larger `population` (this fixture: 1 of 27 acceptances) is a guess wearing the
+ * clothes of a measurement unless that gap renders next to the number.
+ */
+export type EffectivenessMeasure = {
+  value: number | undefined;
+  sampleSize: number;
+  population: number;
+};
+
 /**
  * Task 9 (spec item 7), D7: the governance board's two live effectiveness numbers. Conservative
  * failure applies to each independently — a measure this cannot compute returns `undefined`,
  * never `0`, because zero minutes to acceptance or zero units contacted both read as a real
  * result rather than as "unknown". Both describe the current synthetic scenario only; nothing
- * here is a claim about the prototype's real-world effectiveness.
+ * here is a claim about the prototype's real-world effectiveness. Both carry their own basis
+ * (`EffectivenessMeasure`) so a thin sample is never presented bare.
  */
 export function effectivenessNumbers(movements: Movement[]): {
-  medianMinutesToAcceptance: number | undefined;
-  averageUnitsContacted: number | undefined;
+  medianMinutesToAcceptance: EffectivenessMeasure;
+  averageUnitsContacted: EffectivenessMeasure;
 } {
+  const totalAcceptances = movements.filter((movement) => movement.acceptedUnitId !== undefined).length;
   const acceptanceDurations = movements
     .map((movement) => acceptanceDurationMinutes(movement))
     .filter((minutes): minutes is number => minutes !== undefined);
@@ -808,7 +829,15 @@ export function effectivenessNumbers(movements: Movement[]): {
       : contactedCounts.reduce((total, count) => total + count, 0) / contactedCounts.length;
 
   return {
-    medianMinutesToAcceptance: median(acceptanceDurations),
-    averageUnitsContacted,
+    medianMinutesToAcceptance: {
+      value: median(acceptanceDurations),
+      sampleSize: acceptanceDurations.length,
+      population: totalAcceptances,
+    },
+    averageUnitsContacted: {
+      value: averageUnitsContacted,
+      sampleSize: contactedCounts.length,
+      population: movements.length,
+    },
   };
 }
diff --git a/src/components/ward-management/ward-flow-reducer.ts b/src/components/ward-management/ward-flow-reducer.ts
index ab719e7196..98d39c612c 100644
--- a/src/components/ward-management/ward-flow-reducer.ts
+++ b/src/components/ward-management/ward-flow-reducer.ts
@@ -320,6 +320,10 @@ export function wardFlowReducer(state: WardFlowState, event: WardFlowEvent): War
       const updated: Movement = {
         ...movement,
         acceptedUnitId: event.unitId,
+        // Fix round 1 (Task 9): the instant this acceptance happened, recorded directly rather
+        // than left to survive only as an incidental `withdrawnReferrals` side effect of a
+        // multi-unit referral. See `Movement.acceptedAt`'s own doc comment.
+        acceptedAt: event.now,
         stage: "accepted_awaiting_bed",
         referredUnitIds: [],
         withdrawnReferrals: [...movement.withdrawnReferrals, ...withdrawn],
diff --git a/src/components/ward-management/ward-management-modes.module.css b/src/components/ward-management/ward-management-modes.module.css
index 4f1919a33f..18b60b5c61 100644
--- a/src/components/ward-management/ward-management-modes.module.css
+++ b/src/components/ward-management/ward-management-modes.module.css
@@ -766,12 +766,23 @@
 
 .effectivenessList dd {
   margin-top: 0.25rem;
+}
+
+/* Fix round 1 (Task 9): the figure and its basis are one visual unit, always rendered together —
+ * never a tooltip, never a footnote elsewhere on the page. */
+.effectivenessLine {
+  display: flex;
+  flex-direction: column;
+  gap: 0.125rem;
+}
+
+.effectivenessValue {
   color: var(--ward-heading);
   font-size: var(--text-lg);
   font-weight: 700;
 }
 
-.effectivenessList dd small {
+.effectivenessValue small {
   margin-left: 0.25rem;
   color: var(--ward-muted);
   font-size: var(--text-2xs);
@@ -784,6 +795,12 @@
   font-weight: 500;
 }
 
+.effectivenessBasis {
+  color: var(--ward-muted);
+  font-size: var(--text-3xs);
+  font-weight: 500;
+}
+
 /* The dropped-third-measure notice. Warning tone (not the blue `.notice` tone) because this is
  * flagging an absence the reader must not mistake for a clean two-out-of-two report. */
 .droppedMeasureNote {
diff --git a/src/components/ward-management/ward-management-modes.tsx b/src/components/ward-management/ward-management-modes.tsx
index 034bbeb9da..2d4896c5ac 100644
--- a/src/components/ward-management/ward-management-modes.tsx
+++ b/src/components/ward-management/ward-management-modes.tsx
@@ -43,6 +43,7 @@ import {
   stageSummaries,
   unitCapacity,
   type ChangeAuditEntry,
+  type EffectivenessMeasure,
   type InboxItem,
   type WardRole,
 } from "@/components/ward-management/ward-derivations";
@@ -665,18 +666,44 @@ export function NotAMedicalDeviceStatement() {
   );
 }
 
-/** Renders a computed effectiveness number, or its explicit absence — never a substituted `0`.
- *  Rule 4 (conservative failure): a measure this cannot compute must read as unknown, not as a
- *  suspiciously perfect result. */
-function EffectivenessValue({ value, unit }: { value: number | undefined; unit: string }) {
-  if (value === undefined) {
-    return <span className={styles.effectivenessUnknown}>Not enough data to compute</span>;
+/**
+ * Renders a computed effectiveness number, or its explicit absence — never a substituted `0` —
+ * always immediately beside the basis it was drawn from. Rule 4 (conservative failure): a measure
+ * this cannot compute must read as unknown, not as a suspiciously perfect result. Fix round 1: a
+ * measure computed from a thin sample must say so in the same breath as the figure, not in a
+ * tooltip or a footnote — a median of one, rendered bare, is a guess wearing the clothes of a
+ * measurement, and this board's rule is to say nothing rather than guess.
+ */
+function EffectivenessValue({
+  measure,
+  unit,
+  basisNoun,
+}: {
+  measure: EffectivenessMeasure;
+  unit: string;
+  basisNoun: string;
+}) {
+  const basis = (
+    <span className={styles.effectivenessBasis}>
+      from {measure.sampleSize} of {measure.population} {basisNoun}
+    </span>
+  );
+  if (measure.value === undefined) {
+    return (
+      <span className={styles.effectivenessLine}>
+        <span className={styles.effectivenessUnknown}>Not enough data to compute</span>
+        {basis}
+      </span>
+    );
   }
-  const rounded = Math.round(value * 10) / 10;
+  const rounded = Math.round(measure.value * 10) / 10;
   return (
-    <span>
-      {rounded}
-      <small> {unit}</small>
+    <span className={styles.effectivenessLine}>
+      <span className={styles.effectivenessValue}>
+        {rounded}
+        <small> {unit}</small>
+      </span>
+      {basis}
     </span>
   );
 }
@@ -836,7 +863,11 @@ function GovernanceView() {
                 <Clock3 aria-hidden="true" /> Median time, referral to a ward accepting
               </dt>
               <dd>
-                <EffectivenessValue value={effectiveness.medianMinutesToAcceptance} unit="min" />
+                <EffectivenessValue
+                  measure={effectiveness.medianMinutesToAcceptance}
+                  unit="min"
+                  basisNoun="recorded acceptances"
+                />
               </dd>
             </div>
             <div data-testid="ward-governance-effectiveness-units-contacted">
@@ -844,7 +875,11 @@ function GovernanceView() {
                 <Users aria-hidden="true" /> Average units contacted per patient
               </dt>
               <dd>
-                <EffectivenessValue value={effectiveness.averageUnitsContacted} unit="units" />
+                <EffectivenessValue
+                  measure={effectiveness.averageUnitsContacted}
+                  unit="units"
+                  basisNoun="movements that referred at least one unit"
+                />
               </dd>
             </div>
           </dl>
diff --git a/src/components/ward-management/ward-model.ts b/src/components/ward-management/ward-model.ts
index 3b4e5edf5c..8dc93e8be5 100644
--- a/src/components/ward-management/ward-model.ts
+++ b/src/components/ward-management/ward-model.ts
@@ -227,6 +227,13 @@ export type Movement = {
   /** Units currently holding a live referral. Never longer than PARALLEL_REFERRAL_CAP. */
   referredUnitIds: string[];
   acceptedUnitId?: string;
+  /** When `ACCEPT_IN_PRINCIPLE` (ward-flow-reducer.ts) set `acceptedUnitId`. Absent for every
+   *  movement in the seed fixture (`ward-movements.ts`), which is hand-authored with
+   *  `acceptedUnitId` already set rather than reached by dispatching that event — this field is
+   *  deliberately never backfilled onto that fixture, so its absence there is real, not a bug.
+   *  `effectivenessNumbers` (ward-derivations.ts) prefers this over the `withdrawnReferrals`
+   *  archaeology it used before this field existed, and reports honestly when neither is present. */
+  acceptedAt?: Instant;
   declines: Decline[];
   transport?: TransportJob;
   blocker: string;
diff --git a/tests/ward-governance.dom.test.tsx b/tests/ward-governance.dom.test.tsx
index 2e8803514b..c1ee50f678 100644
--- a/tests/ward-governance.dom.test.tsx
+++ b/tests/ward-governance.dom.test.tsx
@@ -97,7 +97,8 @@ describe("GovernanceView", () => {
     // Real fixture fact: WF-006 is the only movement with a recoverable acceptance instant —
     // openedAt NOW_ANCHOR-500, its sole withdrawnReferrals entry at NOW_ANCHOR-470 — 30 minutes.
     // It is the only movement in the whole 48-record fixture with a non-empty withdrawnReferrals
-    // array, so the median is exactly this one value, not the "not enough data" fallback.
+    // array (and no movement carries a hand-authored `acceptedAt`), so the median is exactly this
+    // one value, not the "not enough data" fallback.
     const acceptance = screen.getByTestId("ward-governance-effectiveness-acceptance");
     expect(acceptance).toHaveTextContent("30");
     // A sign-flipped duration (openedAt - acceptedAt instead of acceptedAt - openedAt) would
@@ -120,4 +121,21 @@ describe("GovernanceView", () => {
     expect(dropped).toHaveTextContent("dropped");
     expect(dropped).toHaveTextContent("cannot be computed");
   });
+
+  // Fix round 1, point 3: this is the honesty test, not the arithmetic test — measured directly
+  // against the real fixture (27 total acceptances, only 1 with a recoverable timestamp; 32 of
+  // 48 movements referred at least one unit). A median of one rendered bare reads as a real
+  // measurement; the basis is what tells a reader the acceptance figure is a thin, one-record
+  // sample rather than a summary of 27 real observations, and it must be immediately beside the
+  // figure — not a tooltip, not a footnote elsewhere on the page.
+  it("shows the acceptance figure beside its true basis — 1 of 27 recorded acceptances — not the figure alone", () => {
+    renderGovernance();
+    const acceptance = screen.getByTestId("ward-governance-effectiveness-acceptance");
+    // One assertion against the combined text, so a basis rendered elsewhere on the page (not
+    // immediately beside the figure) would not satisfy this check.
+    expect(acceptance).toHaveTextContent("30 minfrom 1 of 27 recorded acceptances");
+
+    const unitsContacted = screen.getByTestId("ward-governance-effectiveness-units-contacted");
+    expect(unitsContacted).toHaveTextContent("from 32 of 48 movements that referred at least one unit");
+  });
 });
diff --git a/tests/ward-governance.test.ts b/tests/ward-governance.test.ts
index f5c39967a3..6eda6905bd 100644
--- a/tests/ward-governance.test.ts
+++ b/tests/ward-governance.test.ts
@@ -138,7 +138,7 @@ describe("effectivenessNumbers", () => {
   // opposite of "unknown". This movement set genuinely cannot support either measure: neither
   // movement has ever referred a unit, so there is nothing to average, and neither has an
   // acceptance instant to measure a duration against.
-  it("returns undefined for both measures against a movement set where neither can genuinely be computed", () => {
+  it("returns undefined values, with an honest zero-sample basis, against a movement set where neither measure can genuinely be computed", () => {
     const movements = [
       movementFrom({
         id: "WF-NR-1",
@@ -146,6 +146,7 @@ describe("effectivenessNumbers", () => {
         declines: [],
         withdrawnReferrals: [],
         acceptedUnitId: undefined,
+        acceptedAt: undefined,
       }),
       movementFrom({
         id: "WF-NR-2",
@@ -153,22 +154,28 @@ describe("effectivenessNumbers", () => {
         declines: [],
         withdrawnReferrals: [],
         acceptedUnitId: undefined,
+        acceptedAt: undefined,
       }),
     ];
     const result = effectivenessNumbers(movements);
-    expect(result.medianMinutesToAcceptance).toBeUndefined();
-    expect(result.averageUnitsContacted).toBeUndefined();
+    // One assertion per measure, checking value/sampleSize/population together as a single
+    // object — not three independent checks a mutation could satisfy piecemeal (per "assert
+    // ordered pairs as ordered pairs").
+    expect(result.medianMinutesToAcceptance).toEqual({ value: undefined, sampleSize: 0, population: 0 });
+    expect(result.averageUnitsContacted).toEqual({ value: undefined, sampleSize: 0, population: 2 });
     // Guard against a regression that substitutes 0 for undefined — the literal failure mode
-    // rule 4 exists to prevent.
-    expect(result.medianMinutesToAcceptance).not.toBe(0);
-    expect(result.averageUnitsContacted).not.toBe(0);
+    // rule 4 exists to prevent, and fix round 1's whole point: a bare 0 or a bare figure with no
+    // basis both read as a real result rather than "unknown".
+    expect(result.medianMinutesToAcceptance.value).not.toBe(0);
+    expect(result.averageUnitsContacted.value).not.toBe(0);
   });
 
-  it("computes the median acceptance duration only over movements with a recoverable acceptance instant", () => {
+  it("computes the median acceptance duration, and its sample/population basis, only over movements with a recoverable acceptance instant", () => {
     const computableFast = movementFrom({
       id: "WF-ACC-1",
       openedAt: 100,
       acceptedUnitId: "unit-a",
+      acceptedAt: undefined,
       referredUnitIds: [],
       declines: [],
       withdrawnReferrals: [{ unitId: "unit-b", at: 140, reason: "withdrawn — placed at Unit A" }],
@@ -177,6 +184,7 @@ describe("effectivenessNumbers", () => {
       id: "WF-ACC-2",
       openedAt: 200,
       acceptedUnitId: "unit-c",
+      acceptedAt: undefined,
       referredUnitIds: [],
       declines: [],
       withdrawnReferrals: [{ unitId: "unit-d", at: 260, reason: "withdrawn — placed at Unit C" }],
@@ -184,21 +192,76 @@ describe("effectivenessNumbers", () => {
     // Reached acceptance (acceptedUnitId is set) but was the only unit ever referred, so
     // ACCEPT_IN_PRINCIPLE withdrew nothing and left no timestamp anywhere in this model. This
     // movement must contribute nothing to the median — neither a fabricated 0 nor a NaN — and
-    // must not turn the whole measure undefined either, since the other two ARE computable.
+    // must not turn the whole measure undefined either, since the other two ARE computable. It
+    // DOES still count toward the population — it really is a third acceptance.
     const uncomputable = movementFrom({
       id: "WF-ACC-3",
       openedAt: 300,
       acceptedUnitId: "unit-e",
+      acceptedAt: undefined,
       referredUnitIds: [],
       declines: [],
       withdrawnReferrals: [],
     });
     const result = effectivenessNumbers([computableFast, computableSlow, uncomputable]);
-    // Durations: 140-100=40 and 260-200=60 minutes -> median (40+60)/2 = 50.
-    expect(result.medianMinutesToAcceptance).toBe(50);
+    // Durations: 140-100=40 and 260-200=60 minutes -> median (40+60)/2 = 50, from 2 of the 3
+    // acceptances in this input — the thin-sample honesty fix round 1 exists for.
+    expect(result.medianMinutesToAcceptance).toEqual({ value: 50, sampleSize: 2, population: 3 });
   });
 
-  it("averages units contacted only over movements with at least one referral, counting each unit once", () => {
+  // Fix round 1, point 2: `acceptedAt` is the direct source and must be PREFERRED over the
+  // `withdrawnReferrals` archaeology when both are present — not merely consulted as a tiebreaker
+  // that happens to agree. Deliberately gives the two sources conflicting instants so a
+  // regression that reads the wrong one is caught by the resulting number, not just by which
+  // branch executed.
+  it("prefers acceptedAt over the withdrawnReferrals fallback when both are present", () => {
+    const movement = movementFrom({
+      id: "WF-ACC-PREFER",
+      openedAt: 100,
+      acceptedUnitId: "unit-a",
+      acceptedAt: 130, // real instant: 30 minutes after openedAt
+      referredUnitIds: [],
+      declines: [],
+      // A stale/incidental withdrawnReferrals entry that, if read instead, would say 900 minutes.
+      withdrawnReferrals: [{ unitId: "unit-b", at: 1000, reason: "withdrawn — placed at Unit A" }],
+    });
+    const result = effectivenessNumbers([movement]);
+    expect(result.medianMinutesToAcceptance).toEqual({ value: 30, sampleSize: 1, population: 1 });
+  });
+
+  // Fix round 1, point 2's real payoff: a movement accepted through the live reducer with only
+  // ONE referred unit — the exact shape that used to leave no recoverable timestamp anywhere —
+  // is now computable because ACCEPT_IN_PRINCIPLE stamps `acceptedAt` directly, independent of
+  // whether any other referral existed to withdraw.
+  it("makes a single-referral acceptance computable once dispatched through the live reducer, where withdrawnReferrals alone could not", () => {
+    const seeded = seedWardFlowState();
+    const target = seeded.movements.find(
+      (movement) => movement.stage === "destination_review" && movement.referredUnitIds.length === 1,
+    );
+    if (!target) throw new Error("fixture requires a movement with exactly one live referral");
+    const unitId = target.referredUnitIds[0];
+    const after = wardFlowReducer(seeded, {
+      // ACCEPT_IN_PRINCIPLE is gated to role "ward" only (EVENT_ROLE in ward-flow-events.ts) —
+      // unlike RELEASE_HOLD/CANCEL_TRANSPORT, coordinator is not a permitted caller here.
+      type: "ACCEPT_IN_PRINCIPLE",
+      role: "ward",
+      now: target.openedAt + 45,
+      movementId: target.id,
+      unitId,
+    });
+    expect(after.rejections).toHaveLength(0);
+    const updated = after.movements.find((movement) => movement.id === target.id);
+    if (!updated) throw new Error("movement missing after ACCEPT_IN_PRINCIPLE");
+    // The reducer withdrew nothing (there was only ever one referred unit), so the old
+    // withdrawnReferrals-only path would have left this movement's acceptance time unrecoverable.
+    expect(updated.withdrawnReferrals).toEqual([]);
+    expect(updated.acceptedAt).toBe(target.openedAt + 45);
+
+    const result = effectivenessNumbers([updated]);
+    expect(result.medianMinutesToAcceptance).toEqual({ value: 45, sampleSize: 1, population: 1 });
+  });
+
+  it("averages units contacted, and its sample/population basis, only over movements with at least one referral, counting each unit once", () => {
     const noReferral = movementFrom({
       id: "WF-UC-0",
       referredUnitIds: [],
@@ -221,9 +284,11 @@ describe("effectivenessNumbers", () => {
       acceptedUnitId: "unit-d",
     });
     const result = effectivenessNumbers([noReferral, oneUnit, threeUnits]);
-    // (1 + 3) / 2 = 2 — the zero-referral movement is excluded from the denominator entirely
-    // rather than counted as a 0-contact patient, which would silently pull the average down.
-    expect(result.averageUnitsContacted).toBe(2);
+    // (1 + 3) / 2 = 2, from 2 of these 3 movements — the zero-referral movement is excluded from
+    // the numerator/denominator of the AVERAGE entirely rather than counted as a 0-contact
+    // patient (which would silently pull it down), but it still counts toward the population,
+    // since it really was one of the 3 movements this figure was drawn from.
+    expect(result.averageUnitsContacted).toEqual({ value: 2, sampleSize: 2, population: 3 });
   });
 
   it("counts a unit once even when it appears in more than one contact category", () => {
@@ -235,6 +300,6 @@ describe("effectivenessNumbers", () => {
       acceptedUnitId: undefined,
     });
     const result = effectivenessNumbers([movement]);
-    expect(result.averageUnitsContacted).toBe(1);
+    expect(result.averageUnitsContacted).toEqual({ value: 1, sampleSize: 1, population: 1 });
   });
 });

From e97aa225c1e6a8a2ab2f99741041a76839680ab0 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 11:55:02 +0800
Subject: [PATCH 20/54] Plan: Ward Flow becomes its own developer-gated
 sandbox, and supersede my wrong one

I recommended leaving Ward Flow at its current addresses and merely cutting inbound
links, on the reasoning that moving them buys only a cosmetic signal in the address
bar. That was false. Unlinking leaves the prototype a fully public production route
anyone can reach by URL with no sign-in - unadvertised, but neither sandboxed nor
protected. The old plan carries a superseded banner saying so rather than being
quietly deleted.

The repository already has the mechanism, proven twice. src/proxy.ts blocks every
/mockups/** path in production except an explicit list of developer-gated prefixes,
which reach an administrator-only gate instead. Caring Contacts and Care Plan already
live there. Ward Flow becomes the third, and adding it is a one-line change to a list
whose own comment warns to add one subtree at a time and never widen to /mockups.

Eleven defects, every one measured. A full 16-route sweep of the served markup found
that the skip link is broken on eight of fifteen live routes - every route ships
href=#main-content and eight have no element with that id, so a keyboard user is told
the skip worked when it did not. The primary coordinator screen has no main landmark
at all. Two routes have no h1. Six are missing the views navigation the other nine
carry. Most of that predates this phase and Phase 4 replicated it.

Checked rather than assumed: moving under /mockups forfeits nothing real, because the
button-wiring lint exempts src/app/mockups/** while Ward Flow's buttons all live in
src/components/ward-management/**, which stays covered.

No visual claim is made. The browser preview was unavailable, so no screen was seen,
and the plan says so instead of implying otherwise.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ...-25-ward-flow-sandbox-and-design-repair.md | 364 ++++++++++++++++++
 ...-25-ward-flow-standalone-and-nav-repair.md |  10 +-
 2 files changed, 372 insertions(+), 2 deletions(-)
 create mode 100644 docs/superpowers/plans/2026-08-25-ward-flow-sandbox-and-design-repair.md

diff --git a/docs/superpowers/plans/2026-08-25-ward-flow-sandbox-and-design-repair.md b/docs/superpowers/plans/2026-08-25-ward-flow-sandbox-and-design-repair.md
new file mode 100644
index 0000000000..2b3d241d91
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-25-ward-flow-sandbox-and-design-repair.md
@@ -0,0 +1,364 @@
+# Ward Flow — its own sandbox, and the design repair
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Move Ward Flow into its own administrator-gated sandbox, reachable only through the
+developer page, and repair the navigation, landmark and structure defects it accumulated while it was
+being built.
+
+**Architecture:** This repository already has the mechanism. `src/proxy.ts` blocks every
+`/mockups/**` path in production **except** an explicit list of developer-gated prefixes, which
+instead reach `DeveloperAreaGate` — a signed-in-administrator gate using the same claim that gates
+document management. Two prototypes already live there: **Caring Contacts** and **Care Plan**. Ward
+Flow becomes the third. This plan follows that proven pattern rather than inventing a new one.
+
+**Tech Stack:** Next.js 16 App Router, React 19, TypeScript 6 strict, CSS modules with `@theme`
+design tokens, Vitest, Playwright (Chromium).
+
+**Supersedes:** `docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md`. That plan
+recommended leaving the addresses in place and cutting links. **That recommendation was wrong** — see
+decision S1 below. Do not execute the superseded plan.
+
+---
+
+## Product-owner decisions
+
+- **S1 (REVERSED 2026-08-25) — Ward Flow MOVES to `/mockups/ward-flow/*`.** The earlier plan
+  recommended leaving `/ward-management/*` and merely cutting inbound links, on the stated reasoning
+  that moving "buys only a cosmetic signal in the address bar". **That reasoning was false and the
+  recommendation was withdrawn.** Unlinking leaves the prototype a fully public production route that
+  anyone can reach by URL with no sign-in — unadvertised, but not sandboxed and not protected.
+  Moving it under a developer-gated prefix is the thing that actually enforces the separation. The
+  product owner's instruction — _"ensure each is its own sandbox only interacting via the developer
+  page, otherwise standalone app"_ — settles it.
+- **S2 — Removed completely from the clinical app.** No search hit, no tools-catalogue entry, no
+  launcher tile, no category-index entry.
+- **S3 — No redirect is left behind at `/ward-management`.** A public redirect into a gated area
+  would keep advertising that the prototype exists and would itself need a reachability allowlist
+  entry. The routes are removed. _If the product owner wants bookmarks preserved, that is a
+  one-file addition and his call — raise it, do not assume it._
+
+## Global Constraints
+
+1. **Never invent, infer, restate or "correct" any figure, requirement, title or classification from
+   the Mental Health Act.** Form titles come from `formTitleForCode` or render as the bare code.
+2. **Synthetic data only.** Sex is the only permitted patient attribute. Free text counts.
+3. **Conservative failure.** An absence renders as an explicit absence, never a substituted default.
+4. **Not a medical device**, and the pages say so. Moving Ward Flow out of the clinical app must not
+   also remove the statement that it is not clinical.
+5. Design tokens only, no raw hex. Every `<button>` has a real handler, is a submit inside a form, or
+   is a `<Link>`. Never both `disabled` and `aria-disabled`. Tap targets `3rem`/48px, never `2.75rem`.
+6. Internal navigation via `<Link>`/`router.push`, never a raw `<a href="/…">`.
+7. **One search composer per page.** Read `docs/search-chrome-behaviour.md` before touching chrome.
+8. **Mutation-test every test added or changed**; print the edited line back from the file. A
+   surviving mutation is reported, never reshaped around.
+9. Read counts, never exit codes. No Playwright, build, or provider-backed command from an
+   implementer — the controller runs those.
+
+---
+
+## What is actually wrong — every row measured on 2026-08-25, none assumed
+
+### The sandbox defects
+
+| #   | Defect                                                     | Evidence                                                                                                                                                                               |
+| --- | ---------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| D1  | Ward Flow is advertised as a **production clinical tool**  | `tools-catalog.ts`: `status: "ready"`, `highYield: true`, keywords "bed management", "patient flow", "ED transfer" — so a clinician searching any of those finds a synthetic prototype |
+| D2  | It is **simultaneously** a developer-hub panel             | `hub-panels.ts` → `{ id: "ward-flow", href: "/ward-management" }`                                                                                                                      |
+| D3  | It leaks into four more surfaces                           | `applications-launcher-page.tsx`, `tools/tools-search-results-page.tsx`, `category-identity.ts`, `tools-page-mockups/tool-fixtures.ts`                                                 |
+| D4  | **It is publicly reachable in production with no sign-in** | `/ward-management/**` is an ordinary app route; the `/mockups/**` production block and `DeveloperAreaGate` do not apply to it                                                          |
+
+### The structure defects — full 16-route sweep
+
+Fetched from the running server, every route, same checks:
+
+| Route                                    | `<main>` | `id="main-content"` | `<h1>` | skip link | navs  |
+| ---------------------------------------- | -------- | ------------------- | ------ | --------- | ----- |
+| `/ward-management`                       | **0**    | **0**               | 1      | 1         | 2     |
+| `/ward-management/capacity`              | 1        | 1                   | 1      | 1         | 2     |
+| `/ward-management/constellation`         | —        | —                   | —      | —         | —     |
+| `/ward-management/ed/peel-ed`            | 1        | **0**               | 1      | 1         | **1** |
+| `/ward-management/escalation`            | 1        | **0**               | 1      | 1         | **1** |
+| `/ward-management/exceptions`            | 1        | 1                   | 1      | 1         | 2     |
+| `/ward-management/governance`            | 1        | 1                   | 1      | 1         | 2     |
+| `/ward-management/handover`              | 1        | **0**               | 1      | 1         | **1** |
+| `/ward-management/movements`             | 1        | 1                   | 1      | 1         | 2     |
+| `/ward-management/network`               | 1        | 1                   | 1      | 1         | 2     |
+| `/ward-management/patients/WF-001`       | 1        | 1                   | 1      | 1         | 3     |
+| `/ward-management/queue`                 | 1        | 1                   | 1      | 1         | 2     |
+| `/ward-management/search`                | 1        | **0**               | 1      | 1         | **1** |
+| `/ward-management/transport`             | 1        | **0**               | **0**  | 1         | 2     |
+| `/ward-management/transport/officer`     | 1        | **0**               | **0**  | 1         | **1** |
+| `/ward-management/ward/rph-adult-secure` | 1        | **0**               | 1      | 1         | **1** |
+
+`constellation` is a deliberate 307 redirect to `/network`, documented in its own file. **Verified,
+not a defect** — recorded so nobody "fixes" it.
+
+| #   | Defect                                                                                                                                                                                                                                                                    | Extent                                                                                                                        |
+| --- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| D5  | **The skip link is broken on 8 of 15 live routes.** Every route ships `href="#main-content"`, but `id="main-content"` is missing on eight — so the skip link lands nowhere. A skip link that goes nowhere is worse than none, because a keyboard user believes it worked. | `/ward-management`, `/ed/[edId]`, `/escalation`, `/handover`, `/search`, `/transport`, `/transport/officer`, `/ward/[unitId]` |
+| D6  | **The primary screen has no `<main>` landmark at all**                                                                                                                                                                                                                    | `/ward-management`                                                                                                            |
+| D7  | **Two routes have no `<h1>`**                                                                                                                                                                                                                                             | `/transport`, `/transport/officer`                                                                                            |
+| D8  | **The "Ward Flow views" nav is missing on 6 of 15 routes**, so moving between boards silently drops the navigation                                                                                                                                                        | `/ed/[edId]`, `/escalation`, `/handover`, `/search`, `/transport/officer`, `/ward/[unitId]`                                   |
+| D9  | The rail is **hand-written and unsourced** — 329 lines of individually pasted link blocks, one appended per task, which is _why_ routes and nav could drift apart                                                                                                         | `ward-management-navigation.tsx`                                                                                              |
+| D10 | Three rail links point at **one arbitrary hardcoded instance** as though it were a section                                                                                                                                                                                | `/ward/rph-adult-secure`, `/ed/peel-ed`                                                                                       |
+| D11 | The rail is labelled **"Clinical applications"**                                                                                                                                                                                                                          | wrong for a standalone sandboxed prototype                                                                                    |
+
+**D5, D7 and D8 predate Phase 4** — the role screens (`/ed`, `/ward`, `/transport/officer`) carry
+them and were built in Phase 3. Phase 4 then replicated the pattern on three new boards. This is a
+long-standing systematic fault, not new breakage.
+
+### What moving under `/mockups/` forfeits — checked, not assumed
+
+- **Button-wiring lint:** `MOCKUP_IGNORES` is `["src/app/mockups/**", "**/*-mockups/**", …]`. Ward
+  Flow's components live in `src/components/ward-management/**`, which matches none of those, so
+  **the lint still covers every button**. Only the thin route wrappers become exempt, and they
+  contain no buttons. **Nothing real is lost.**
+- **Route-reachability gate:** mockup routes are excluded, so the orphan problem disappears rather
+  than needing an allowlist entry.
+- **Bundle budget:** ward chunks move from the `production` bucket (10% tolerance) to `mockups`
+  (25%). That is the documented intent of the split — design scratch should not be charged against a
+  user-facing ceiling.
+
+---
+
+## Task 1: Move Ward Flow into a developer-gated sandbox (S1, D4)
+
+**Files:**
+
+- Move: `src/app/ward-management/**` → `src/app/mockups/ward-flow/**` (15 page routes + layout)
+- Create: `src/app/mockups/ward-flow/layout.tsx`
+- Modify: `src/lib/developer-area/headers.ts`, `src/lib/developer-area/hub-panels.ts`
+- Modify: every internal ward link (`ward-management-navigation.tsx` and any `href="/ward-management…"`)
+- Test: `tests/ward-flow-sandbox.test.ts` (new)
+
+**Interfaces:**
+
+- Produces: routes at `/mockups/ward-flow`, `/mockups/ward-flow/queue`, … preserving every existing
+  path segment after the prefix. `DEVELOPER_GATED_PATH_PREFIXES` gains `"/mockups/ward-flow"`.
+
+- [ ] **Step 1: Write the failing sandbox test first — it is the deliverable.**
+
+```ts
+import { describe, expect, it } from "vitest";
+
+import { DEVELOPER_GATED_PATH_PREFIXES } from "@/lib/developer-area/headers";
+
+describe("Ward Flow is a developer-gated sandbox", () => {
+  it("is on the developer-gated prefix list, so production reaches the admin gate not a 404", () => {
+    expect(DEVELOPER_GATED_PATH_PREFIXES).toContain("/mockups/ward-flow");
+  });
+
+  it("no longer exists as a public app route", async () => {
+    const fs = await import("node:fs");
+    expect(fs.existsSync("src/app/ward-management")).toBe(false);
+  });
+});
+```
+
+- [ ] **Step 2: Run it and watch both assertions fail.**
+- [ ] **Step 3: Move the route tree** with `git mv` so history follows. Preserve every segment:
+      `capacity`, `constellation`, `ed/[edId]`, `escalation`, `exceptions`, `governance`, `handover`,
+      `movements`, `network`, `patients/[patientId]`, `queue`, `search`, `transport`,
+      `transport/officer`, `ward/[unitId]`.
+- [ ] **Step 4: Write the sandbox layout**, copying the **exact** shape of
+      `src/app/mockups/care-plan/layout.tsx`. **The order matters and that file says so:**
+      `DeveloperAreaGate` must be OUTERMOST, so an unauthorised visitor never renders the inner
+      content. `WardFlowProvider` goes inside it. Read that file before writing this one.
+- [ ] **Step 5: Add `"/mockups/ward-flow"` to `DEVELOPER_GATED_PATH_PREFIXES`.** That file's own
+      comment warns: exact prefixes only, one subtree at a time, **never widen to `/mockups`**. Obey it.
+- [ ] **Step 6: Update every internal link.** `grep -rn '"/ward-management' src/ tests/ docs/` and fix
+      each. Report the count found and the count changed — they must match.
+- [ ] **Step 7:** Update the hub panel href, `npm run docs:update`, `docs/codebase-index.md`, and the
+      `docs/design-system/adoption-contract.json` entries (Ward Flow's routes leave the production
+      census; the pinned count in `tests/design-system-adoption.test.ts` moves — verify the current
+      number, do not assume).
+- [ ] **Step 8: Run the full suite.** This move touches route enumeration, the sitemap, reachability
+      and the adoption census; expect several pinned counts to move and account for every one.
+- [ ] **Step 9: Commit.**
+
+---
+
+## Task 2: Remove Ward Flow from every clinical discovery surface (D1, D3)
+
+**Files:**
+
+- Modify: `src/lib/tools-catalog.ts`, `src/components/applications-launcher-page.tsx`,
+  `src/components/tools/tools-search-results-page.tsx`, `src/lib/category-identity.ts`,
+  `src/components/tools-page-mockups/tool-fixtures.ts`
+- Test: extend `tests/ward-flow-sandbox.test.ts`
+
+- [ ] **Step 1: Extend the guard test.** Assert the tools catalogue contains no entry whose `href`
+      starts with `/ward-management` **or** `/mockups/ward-flow` — both, so the entry cannot be
+      "moved" back in under the new path. Read `tools-catalog.ts` for the real export name first.
+- [ ] **Step 2: Run and watch it fail.**
+- [ ] **Step 3: Remove `"ward-management"` from the `ToolCatalogId` union and its record.** This is a
+      deliberate **compile-time break**: every consumer goes red and the compiler finds the leaks for
+      you. Follow each type error to its consumer and remove the Ward Flow branch. **Do not silence
+      one with a cast or a default case** — that would hide exactly what this step exists to find.
+- [ ] **Step 4: Run and watch it pass, then run the full suite.**
+- [ ] **Step 5: Commit.**
+
+---
+
+## Task 3: The developer page says what Ward Flow is (S2, constraint 4)
+
+**Files:**
+
+- Modify: `src/lib/developer-area/hub-panels.ts`
+- Test: extend `tests/ward-flow-sandbox.test.ts`
+
+- [ ] **Step 1:** The hub panel summarises Ward Flow as "Queue, capacity, transport, movements" —
+      accurate, but it does not say what it _is_. Say that it is a **synthetic prototype, not clinical
+      decision support**, at the point where the decision to open it is made. Follow the wording style
+      of the Caring Contacts and Care Plan panels; do not invent a new phrasing if one exists.
+- [ ] **Step 2:** Assert the panel exists, points at `/mockups/ward-flow`, and carries the prototype
+      statement — so removing Ward Flow from the clinical app can never also remove the statement that
+      it is not clinical.
+- [ ] **Step 3: Commit.**
+
+---
+
+## Task 4: One source for ward navigation (D9, D10, D11)
+
+**Files:**
+
+- Create: `src/components/ward-management/ward-nav.ts`
+- Modify: `src/components/ward-management/ward-management-navigation.tsx`
+- Test: `tests/ward-nav.test.ts` (new)
+
+**Interfaces:**
+
+- Produces:
+
+  ```ts
+  export type WardNavGroup = "role" | "board";
+  export type WardNavItem = {
+    id: string;
+    href: string;
+    label: string;
+    group: WardNavGroup;
+    /** True when the href names one specific synthetic ward or department rather than a section. */
+    exampleOnly?: boolean;
+  };
+  export const WARD_NAV: readonly WardNavItem[];
+  ```
+
+- [ ] **Step 1: Write the failing TWO-WAY test.** Every `WARD_NAV` href resolves to a real route
+      under `src/app/mockups/ward-flow/`, **and** every static ward page route appears in `WARD_NAV`
+      or is explicitly recorded as intentionally unlisted with a reason. **A one-way check is what
+      allowed D8 to happen** — three boards shipped without their nav and nothing noticed. Enumerate
+      the routes from the filesystem, never from a hand-written list.
+- [ ] **Step 2: Run and watch it fail.**
+- [ ] **Step 3: Build `ward-nav.ts`** from the links currently hand-written in the rail, grouped
+      `role` (the four role screens) and `board` (the specialist boards).
+- [ ] **Step 4: Rewrite the rail to map over `WARD_NAV`**, rendering the two groups under labelled
+      headings instead of one flat list of thirteen. Keep every existing `aria-label` and `title` so
+      no current selector breaks; if one must change, name every place you updated.
+- [ ] **Step 5: Label the hardcoded examples honestly (D10).** `Ward — RPH Adult Secure` and
+      `ED — Peel ED` link to one arbitrary synthetic ward and one arbitrary department. Mark them
+      `exampleOnly: true` and render them under a heading saying they are an example entry point, not
+      a section. **Do NOT delete them** — they are currently the only way to reach those role screens,
+      and removing the only route in is a worse defect than mislabelling.
+- [ ] **Step 6: Rename the rail's `aria-label`** from "Clinical applications" to something honest for
+      a sandboxed prototype. Update every test asserting the old string and name them in the report.
+- [ ] **Step 7: Commit.**
+
+---
+
+## Task 5: Landmarks and skip-link targets (D5, D6)
+
+**Files:**
+
+- Modify: the eight route/component trees named in D5
+- Test: `tests/ward-landmarks.test.ts` (new)
+
+**The defect, measured:** every ward route ships a skip link to `#main-content`; eight of fifteen have
+no element with that id. `/ward-management` has no `<main>` at all. `/queue` has both and is the shape
+to copy.
+
+- [ ] **Step 1: Write the failing contract test.** For **every** static route under
+      `src/app/mockups/ward-flow/`, assert the rendered output contains **exactly one**
+      `<main id="main-content">`. **Exactly one, not at least one** — two landmarks is also a defect,
+      and "at least one" would not catch it. Enumerate routes from the filesystem. Render through the
+      real component tree with `WardFlowProvider`, as the existing ward DOM tests do.
+- [ ] **Step 2: Run it. It must fail naming at least eight routes.** If it names fewer, the
+      enumeration is wrong — **fix the test before touching a single component.**
+- [ ] **Step 3: Fix each route** to the `/queue` shape. Where a page already has a `<main>` nested in a
+      shared component, give that one the id — **do not add a second `<main>`.**
+- [ ] **Step 4: Run and watch it pass. Commit.**
+
+---
+
+## Task 6: Every page has a heading (D7)
+
+**Files:** `/transport` and `/transport/officer` components. Test: extend `tests/ward-landmarks.test.ts`.
+
+- [ ] **Step 1:** Extend the contract test: every ward route renders exactly one `<h1>`. Run it; it
+      must fail naming those two routes.
+- [ ] **Step 2:** Add the heading each page is missing, named from what the page actually shows. **Do
+      not invent a title that overstates the page** — the officer view is one transport officer's job
+      list, not a transport management system.
+- [ ] **Step 3: Run, pass, commit.**
+
+---
+
+## Task 7: Consistent in-page navigation (D8)
+
+**Files:** the six routes named in D8. Test: extend `tests/ward-nav.test.ts`.
+
+**The defect, measured:** `aria-label="Ward Flow views"` renders on `/queue`, `/capacity`,
+`/governance`, `/movements`, `/network`, `/exceptions` and the patient page — and is absent on six
+others, so moving to those six silently drops the navigation.
+
+- [ ] **Step 1: Decide the rule and record it.** Two defensible answers: the six adopt the views nav,
+      or the views nav is deliberately absent on full-page boards and role screens. **Either is
+      acceptable; the inconsistency is not.** Prefer adopting it — fifteen routes where nine behave one
+      way and six another is a defect a user feels, and the rail alone does not say which board they
+      are on. If you choose the other way, the exemption must be data in `ward-nav.ts` with a reason,
+      never an accident of which file someone edited.
+- [ ] **Step 2: Write the failing test** asserting the chosen rule for every route, enumerated from
+      the filesystem.
+- [ ] **Step 3: Run, fix, run, commit.**
+
+---
+
+## Task 8: Make the sandbox impossible to undo by accident
+
+**Files:** `tests/ward-flow-sandbox.test.ts`. No source changes.
+
+- [ ] **Step 1:** Assert, in one place, the four properties that together mean "sandboxed":
+      `/mockups/ward-flow` is on the gated prefix list; `src/app/ward-management` does not exist; no
+      clinical discovery surface references either path; and the developer hub panel does.
+- [ ] **Step 2: Mutation-test each of the four** by breaking it and watching this test name the
+      break. A guard whose failure message does not say what broke is half a guard.
+- [ ] **Step 3: Commit.**
+
+---
+
+## Final verification (controller)
+
+- `npx tsc --noEmit -p tsconfig.json` — quote the output.
+- Full unit suite — quote file and test counts, account for every change against the pre-plan
+  baseline.
+- `npm run ensure`, then the ward Chromium journeys — quote the "N passed" line. **Their URLs all
+  change in Task 1; a spec still passing against `/ward-management` would prove the move incomplete.**
+- **Re-run the 16-route `curl` sweep that produced D5–D8 and paste the table.** The defects were found
+  that way; that is how they are proved fixed.
+- Confirm an unauthenticated production-mode request to `/mockups/ward-flow` reaches the gate rather
+  than the app. If that cannot be exercised locally, **say so plainly rather than implying it was
+  checked.**
+- `npm run docs:update`, then `npx prettier --check` on every changed file.
+- **Do not run** `verify:release`, `eval:*`, `check:supabase-project`, or anything touching OpenAI,
+  Supabase, GitHub Actions or the live database.
+
+## Explicitly not in this plan
+
+- **No visual redesign, and no claim about how anything looks.** Every defect here is structural and
+  was measured from served markup. The browser preview was unavailable in this session, so **not one
+  screen was seen**. "Optimised and perfected" in the visual sense is separate work needing someone
+  who can look at it.
+- **No change to Ward Flow's behaviour, model, or reducer.** This plan moves, relabels and repairs
+  structure. It does not alter what the prototype does.
+- **No redirect at the old addresses** (decision S3) — raise it with the product owner if bookmarks
+  matter.
diff --git a/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md b/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md
index 1ea705bdb4..34873a2432 100644
--- a/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md
+++ b/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md
@@ -1,5 +1,11 @@
 # Ward Flow — standalone prototype, and the navigation repair
 
+> **SUPERSEDED 2026-08-25** by `2026-08-25-ward-flow-sandbox-and-design-repair.md`. Do not execute
+> this plan. Its decision S1 — leave the addresses and merely cut inbound links — was **wrong**: it
+> would have left Ward Flow a fully public production route reachable by URL with no sign-in.
+> Unadvertised is not sandboxed. The superseding plan moves it into the developer-gated subtree the
+> repository already uses for Caring Contacts and Care Plan.
+
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
 
 **Goal:** Take Ward Flow out of the clinical application entirely — reachable only from the
@@ -169,8 +175,8 @@ has both and is the correct shape to copy.
       "at least one" would not catch it.
 
       Render through the real component tree with `WardFlowProvider`, the way the existing ward DOM
-          tests do. **Enumerate the routes from the filesystem, not from a hand-written list** — a
-          hand-written list is what let three pages ship without the id in the first place.
+              tests do. **Enumerate the routes from the filesystem, not from a hand-written list** — a
+              hand-written list is what let three pages ship without the id in the first place.
 
 - [ ] **Step 2: Run it. It must fail naming at least four routes.** If it names fewer, the
       enumeration is wrong — fix the test before touching any component.

From 4b6089a29d64927e2ae8429b696af3bb6b107e9c Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 12:01:52 +0800
Subject: [PATCH 21/54] Normalise the Phase 4 plan's table formatting

Whitespace only - my prettier glob for the two standalone plans also matched this
file. Confirmed content-identical with git diff --ignore-all-space.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ...-25-ward-flow-phase-4-specialist-boards.md | 28 +++++++++----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md b/docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md
index 99a075c112..cbcf214c35 100644
--- a/docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md
+++ b/docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md
@@ -987,8 +987,8 @@ git commit -m "Ward Flow: patient search, on its own page"
       `ward-eligibility.ts`; they are simply invisible on the board whose job is capacity.
 
       **The authorisation flag is a property the model already carries about a unit. Rendering it
-          is not a legal claim and must not be dressed as one** — no explanation of what authorisation
-          requires or means.
+              is not a legal claim and must not be dressed as one** — no explanation of what authorisation
+              requires or means.
 
 - [ ] **Step 4: Run and watch it pass. Commit.**
 
@@ -1042,16 +1042,16 @@ git commit -m "Ward Flow: the capacity board shows the three things that actuall
 - [ ] **Step 5: Extend `GovernanceView`** with three additions:
 
       1. The **not-a-medical-device** statement. `coordinator-screen.tsx` already carries the exact
-             wording — reuse it rather than writing a second version.
-          2. The **change audit**, newest first, with an explicit empty state.
-          3. The **two effectiveness numbers**, each rendering an explicit absence when `undefined`.
+                 wording — reuse it rather than writing a second version.
+              2. The **change audit**, newest first, with an explicit empty state.
+              3. The **two effectiveness numbers**, each rendering an explicit absence when `undefined`.
 
-          **The third success measure is dropped and the page says so.** The binding spec §11 lists
-          "legal deadlines passed while a patient waits" as one of three measures; it no longer exists
-          and cannot be computed. Record the drop on the page rather than silently omitting it.
+              **The third success measure is dropped and the page says so.** The binding spec §11 lists
+              "legal deadlines passed while a patient waits" as one of three measures; it no longer exists
+              and cannot be computed. Record the drop on the page rather than silently omitting it.
 
-          **Neither number may be presented as evidence the prototype works.** They describe the
-          synthetic scenario and the page must say so.
+              **Neither number may be presented as evidence the prototype works.** They describe the
+              synthetic scenario and the page must say so.
 
 - [ ] **Step 6: DOM test, then commit.**
 
@@ -1126,10 +1126,10 @@ git commit -m "Ward Flow: the patient page carries declines, changes and the esc
       not invent a blocker that describes a person.
 
       **A bed release carries nothing whatsoever about the departing patient** — no identifier, no
-          timing that could identify them, no reason relating to them. That is a privacy rule from the
-          binding spec §4 and it is not negotiable. Add a test that asserts the `BedRelease` type has
-          no field capable of carrying a patient reference, and say plainly in your report how you
-          proved it.
+              timing that could identify them, no reason relating to them. That is a privacy rule from the
+              binding spec §4 and it is not negotiable. Add a test that asserts the `BedRelease` type has
+              no field capable of carrying a patient reference, and say plainly in your report how you
+              proved it.
 
 - [ ] **Step 5: Run and watch them pass.**
 

From a2f0ef66a2cee9d4796e290b750413c35bb7794d Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 12:45:34 +0800
Subject: [PATCH 22/54] Ward Flow: a ward can flag a bed coming free

---
 .../coordinator/coordinator-screen.tsx        |   5 +-
 .../coordinator/flow-diagram.tsx              |  15 +-
 .../coordinator/shortlist-panel.tsx           |  20 ++-
 .../ward-management/ed/ed-screen.tsx          |   4 +-
 .../ward-management/ward-change-reasons.ts    |  25 ++++
 .../ward-management/ward-derivations.ts       |  10 +-
 .../ward-management/ward-flow-events.ts       |  29 +++-
 .../ward-management/ward-flow-provider.tsx    |   8 +-
 .../ward-management/ward-flow-reducer.ts      |  46 +++++-
 .../ward-management/ward-management-modes.tsx |   4 +-
 .../ward-management-network.tsx               |  23 +--
 src/components/ward-management/ward-model.ts  |  16 ++-
 .../ward-management/ward/ward-screen.tsx      | 104 +++++++++++++-
 tests/ward-bed-release.dom.test.tsx           | 119 ++++++++++++++++
 tests/ward-capacity-reconciliation.test.ts    |   5 +-
 tests/ward-flow-reducer.test.ts               | 133 ++++++++++++++++++
 tests/ward-legal-figure-guard.test.ts         |  26 +++-
 tests/ward-model.test.ts                      |   2 +-
 tests/ward-shortlist.dom.test.tsx             |   3 +-
 19 files changed, 559 insertions(+), 38 deletions(-)
 create mode 100644 tests/ward-bed-release.dom.test.tsx

diff --git a/src/components/ward-management/coordinator/coordinator-screen.tsx b/src/components/ward-management/coordinator/coordinator-screen.tsx
index 930ace10d4..b416491c99 100644
--- a/src/components/ward-management/coordinator/coordinator-screen.tsx
+++ b/src/components/ward-management/coordinator/coordinator-screen.tsx
@@ -43,7 +43,8 @@ export function CoordinatorScreen() {
   // and `ShortlistPanel` below. It was deliberately left out here on the original claim that
   // "nothing this screen renders yet reads live unit state" — false: both child components read
   // unit capacity, and both were doing it from the frozen `ward-sites.ts` fixture instead.
-  const { movements, units, rejections, now, dispatch, focusMovementId, setFocusMovementId } = useWardFlow();
+  const { movements, units, bedReleases, rejections, now, dispatch, focusMovementId, setFocusMovementId } =
+    useWardFlow();
   // Task 12: seeded from the shared `focusMovementId` (not always `undefined`) so a coordinator
   // who switched away to answer a referral as another role and switches back finds the same
   // patient still selected — this screen remounts on every route change (it is a route
@@ -193,6 +194,7 @@ export function CoordinatorScreen() {
                   movement={selectedMovement}
                   now={now}
                   units={units}
+                  bedReleases={bedReleases}
                   selectedUnitId={selectedUnitId}
                   onSelectUnit={(unitId) => setSelectedUnitId((current) => (current === unitId ? undefined : unitId))}
                 />
@@ -208,6 +210,7 @@ export function CoordinatorScreen() {
                   movement={selectedMovement}
                   now={now}
                   units={units}
+                  bedReleases={bedReleases}
                   selectedUnitId={selectedUnitId}
                   onSelectUnit={(unitId) => setSelectedUnitId((current) => (current === unitId ? undefined : unitId))}
                   dispatch={dispatch}
diff --git a/src/components/ward-management/coordinator/flow-diagram.tsx b/src/components/ward-management/coordinator/flow-diagram.tsx
index c1aac43566..8253969823 100644
--- a/src/components/ward-management/coordinator/flow-diagram.tsx
+++ b/src/components/ward-management/coordinator/flow-diagram.tsx
@@ -11,7 +11,12 @@ import {
   unitCapacity,
   wardServiceOrder,
 } from "@/components/ward-management/ward-derivations";
-import { PARALLEL_REFERRAL_CAP, type Movement, type Unit } from "@/components/ward-management/ward-model";
+import {
+  PARALLEL_REFERRAL_CAP,
+  type BedRelease,
+  type Movement,
+  type Unit,
+} from "@/components/ward-management/ward-model";
 import { edPressure } from "@/components/ward-management/ward-pressure";
 import { siteByCode } from "@/components/ward-management/ward-sites";
 
@@ -21,6 +26,7 @@ type FlowDiagramProps = {
   movement: Movement | undefined;
   now: Instant;
   units: Unit[];
+  bedReleases: BedRelease[];
   selectedUnitId: string | undefined;
   onSelectUnit: (unitId: string) => void;
 };
@@ -137,7 +143,7 @@ function hubStatusText(movement: Movement | undefined, shortlist: ShortlistCandi
  * and reruns on a `ResizeObserver` plus a window resize listener, so the diagram survives a
  * resize rather than only ever being screenshotted once.
  */
-export function FlowDiagram({ movement, now, units, selectedUnitId, onSelectUnit }: FlowDiagramProps) {
+export function FlowDiagram({ movement, now, units, bedReleases, selectedUnitId, onSelectUnit }: FlowDiagramProps) {
   const pressure = useMemo(() => edPressure(now), [now]);
   const shortlist = useMemo(
     () => (movement ? eligibleCandidatesAmong(movement, units, now, PARALLEL_REFERRAL_CAP) : []),
@@ -400,6 +406,7 @@ export function FlowDiagram({ movement, now, units, selectedUnitId, onSelectUnit
                     <UnitNode
                       key={unit.id}
                       unit={unit}
+                      bedReleases={bedReleases}
                       movement={movement}
                       candidate={shortlistByUnitId.get(unit.id)}
                       selected={selectedUnitId === unit.id}
@@ -439,6 +446,7 @@ export function FlowDiagram({ movement, now, units, selectedUnitId, onSelectUnit
 
 function UnitNode({
   unit,
+  bedReleases,
   movement,
   candidate,
   selected,
@@ -446,13 +454,14 @@ function UnitNode({
   registerUnitNode,
 }: {
   unit: Unit;
+  bedReleases: BedRelease[];
   movement: Movement | undefined;
   candidate: ShortlistCandidate | undefined;
   selected: boolean;
   onSelectUnit: (unitId: string) => void;
   registerUnitNode: (id: string, node: HTMLButtonElement | null) => void;
 }) {
-  const capacity = unitCapacity(unit);
+  const capacity = unitCapacity(unit, bedReleases);
   const routed = candidate !== undefined;
   // `destinationUnit(movement)` (`acceptedUnitId ?? referredUnitIds[0]`) conflates two different
   // facts into one badge and only ever looks at the first referral (review Important 2) -- WF-017
diff --git a/src/components/ward-management/coordinator/shortlist-panel.tsx b/src/components/ward-management/coordinator/shortlist-panel.tsx
index d52ad0e551..6a9b8b092d 100644
--- a/src/components/ward-management/coordinator/shortlist-panel.tsx
+++ b/src/components/ward-management/coordinator/shortlist-panel.tsx
@@ -31,6 +31,7 @@ import type { WardFlowEvent } from "@/components/ward-management/ward-flow-event
 import { legalFormName } from "@/components/ward-management/ward-legal-forms";
 import {
   PARALLEL_REFERRAL_CAP,
+  type BedRelease,
   type LegalStatus,
   type Movement,
   type Unit,
@@ -45,6 +46,7 @@ type ShortlistPanelProps = {
   movement: Movement | undefined;
   now: Instant;
   units: Unit[];
+  bedReleases: BedRelease[];
   selectedUnitId: string | undefined;
   onSelectUnit: (unitId: string) => void;
   dispatch: Dispatch<WardFlowEvent>;
@@ -91,8 +93,8 @@ const LEGAL_STATUS_OPTIONS: LegalStatus[] = [
 
 const URGENCY_OPTIONS = [1, 2, 3] as const;
 
-function capacityLine(unit: Unit) {
-  const capacity = unitCapacity(unit);
+function capacityLine(unit: Unit, bedReleases: BedRelease[]) {
+  const capacity = unitCapacity(unit, bedReleases);
   return `Ready ${capacity.available} · Held ${capacity.held} · Blocked ${capacity.blocked} · Occupied ${capacity.occupied}`;
 }
 
@@ -134,7 +136,15 @@ function legalFormLine(movement: Movement, now: Instant) {
  * driven by something other than the gate's own `pass` boolean. Every icon below reads directly
  * off `gate.pass`; nothing else is permitted to decide it (see the report's red/green proof).
  */
-export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectUnit, dispatch }: ShortlistPanelProps) {
+export function ShortlistPanel({
+  movement,
+  now,
+  units,
+  bedReleases,
+  selectedUnitId,
+  onSelectUnit,
+  dispatch,
+}: ShortlistPanelProps) {
   const shortlist = useMemo(
     () => (movement ? eligibleCandidatesAmong(movement, units, now, PARALLEL_REFERRAL_CAP) : []),
     [movement, units, now],
@@ -805,7 +815,9 @@ export function ShortlistPanel({ movement, now, units, selectedUnitId, onSelectU
                     }}
                   >
                     <span className={styles.shortlistCandidateName}>{candidate.unit.name}</span>
-                    <span className={styles.shortlistCandidateCapacity}>{capacityLine(candidate.unit)}</span>
+                    <span className={styles.shortlistCandidateCapacity}>
+                      {capacityLine(candidate.unit, bedReleases)}
+                    </span>
                     <span
                       className={
                         candidate.verdict.eligible
diff --git a/src/components/ward-management/ed/ed-screen.tsx b/src/components/ward-management/ed/ed-screen.tsx
index e5f41cec84..9aa54a4de3 100644
--- a/src/components/ward-management/ed/ed-screen.tsx
+++ b/src/components/ward-management/ed/ed-screen.tsx
@@ -197,7 +197,7 @@ function accessTargetLine(minutesInDepartment: number): string {
  * substituted department.
  */
 export function EdScreen({ edId }: EdScreenProps) {
-  const { movements, units, now, dispatch } = useWardFlow();
+  const { movements, units, bedReleases, now, dispatch } = useWardFlow();
   const department = edById(edId);
 
   // Declared unconditionally, before the early return below — React hooks must run in the same
@@ -772,7 +772,7 @@ export function EdScreen({ edId }: EdScreenProps) {
                   units
                     .filter((unit) => siteByCode(unit.siteCode)?.service === service)
                     .map((unit) => {
-                      const capacity = unitCapacity(unit);
+                      const capacity = unitCapacity(unit, bedReleases);
                       return (
                         <tr key={unit.id}>
                           <th scope="row">{unit.name}</th>
diff --git a/src/components/ward-management/ward-change-reasons.ts b/src/components/ward-management/ward-change-reasons.ts
index ebaa88a6e9..e0963d0f40 100644
--- a/src/components/ward-management/ward-change-reasons.ts
+++ b/src/components/ward-management/ward-change-reasons.ts
@@ -55,6 +55,31 @@ export const ESCALATION_CONTACTS = [
 ] as const;
 export type EscalationContact = (typeof ESCALATION_CONTACTS)[number];
 
+/**
+ * Task 11 (spec item 9): the blocker on a bed release, chosen never typed — same discipline as
+ * every fixed list above. This is the operational fact holding the bed up, and the privacy rule
+ * from the binding spec §4 is unconditional: never a blocker that describes a person, only the
+ * BED. Drawn from the wording `ward-movements.ts`'s existing `bedReleases` fixture already uses,
+ * generalised to fixed categories rather than copied as free-text sentences:
+ *   - "Awaiting clean" generalises the fixture's "Bed clean pending".
+ *   - "Awaiting pharmacy" matches the fixture's "Awaiting pharmacy" exactly.
+ *   - "Awaiting placement confirmation" generalises "Awaiting bed-management confirmation" and
+ *     "Awaiting external placement confirmation".
+ *   - "Awaiting service coordination" generalises "Awaiting external service coordination".
+ * The fixture's sixth entry, "Pending case review outcome", is deliberately NOT a source here —
+ * "case review" reads as being about the patient's own case, not the bed, so it is excluded
+ * rather than generalised. Like `ESCALATION_CONTACTS`, there is no separate label map: the
+ * values ARE the rendered text, because there is no clinical token to keep out of a label here
+ * to begin with.
+ */
+export const BED_RELEASE_BLOCKERS = [
+  "Awaiting clean",
+  "Awaiting pharmacy",
+  "Awaiting placement confirmation",
+  "Awaiting service coordination",
+] as const;
+export type BedReleaseBlocker = (typeof BED_RELEASE_BLOCKERS)[number];
+
 export const changeReasonLabels: Record<
   UrgencyChangeReason | LegalStatusChangeReason | ReleaseHoldReason | CancelTransportReason,
   string
diff --git a/src/components/ward-management/ward-derivations.ts b/src/components/ward-management/ward-derivations.ts
index f32f5b7f67..48a11c1eab 100644
--- a/src/components/ward-management/ward-derivations.ts
+++ b/src/components/ward-management/ward-derivations.ts
@@ -29,13 +29,13 @@ import {
 import {
   MOVEMENT_STAGES,
   PARALLEL_REFERRAL_CAP,
+  type BedRelease,
   type HealthService,
   type Movement,
   type MovementStage,
   type TransportJob,
   type Unit,
 } from "@/components/ward-management/ward-model";
-import { bedReleases } from "@/components/ward-management/ward-movements";
 import { allEmergencyDepartments, siteByCode } from "@/components/ward-management/ward-sites";
 import { REFERRABLE_MOVEMENT_STAGES } from "@/components/ward-management/ward-flow-reducer";
 
@@ -218,8 +218,14 @@ export function transportLeg(transport: TransportJob | undefined): TransportLeg
  * are clamped so authored data that already over- or under-counts (e.g. a stale `unit.held`
  * literal that no longer fits once `available` is subtracted) can never push the total past
  * `unit.beds` or leave a bed unaccounted for.
+ *
+ * `bedReleases` is now a parameter rather than a module-level import (Task 11, spec item 9):
+ * releases live in `WardFlowState.bedReleases` so a ward's own `FLAG_BED_RELEASE` actually moves
+ * `potential`, and every caller passes whichever collection it currently holds — the live
+ * reducer state where one is available, or the raw fixture for a check that has no reducer state
+ * at all (`tests/ward-capacity-reconciliation.test.ts`, `tests/ward-model.test.ts`).
  */
-export function unitCapacity(unit: Unit) {
+export function unitCapacity(unit: Unit, bedReleases: BedRelease[]) {
   const available = Math.min(unit.allocatable.value, unit.empty.value);
   const held = Math.max(unit.empty.value - available, 0);
   const notEmpty = Math.max(unit.beds - unit.empty.value, 0);
diff --git a/src/components/ward-management/ward-flow-events.ts b/src/components/ward-management/ward-flow-events.ts
index ec128f2a3f..3e73008d32 100644
--- a/src/components/ward-management/ward-flow-events.ts
+++ b/src/components/ward-management/ward-flow-events.ts
@@ -1,11 +1,19 @@
 import type { Instant } from "@/components/ward-management/ward-clock";
 import type {
+  BedReleaseBlocker,
   CancelTransportReason,
   LegalStatusChangeReason,
   ReleaseHoldReason,
   UrgencyChangeReason,
 } from "@/components/ward-management/ward-change-reasons";
-import type { Cohort, DeclineReason, LegalStatus, Security, Sex } from "@/components/ward-management/ward-model";
+import type {
+  BedReleaseConfidence,
+  Cohort,
+  DeclineReason,
+  LegalStatus,
+  Security,
+  Sex,
+} from "@/components/ward-management/ward-model";
 import type { WardScenario } from "@/components/ward-management/ward-scenarios";
 
 /**
@@ -137,6 +145,24 @@ export type WardFlowEvent =
        * constrains future callers rather than this one.
        */
       actingUnitId?: string;
+    }
+  | {
+      type: "FLAG_BED_RELEASE";
+      role: WardFlowRole;
+      now: Instant;
+      /** The unit a bed is being flagged as coming free at. */
+      unitId: string;
+      /**
+       * The unit the caller stated it was acting as, same claim-not-proof discipline as
+       * `CONFIRM_CAPACITY`'s own field (see its doc comment). `FLAG_BED_RELEASE` is `ward`-only
+       * (there is no coordinator caller to exempt), so this is always required and always
+       * compared against `unitId`.
+       */
+      actingUnitId: string;
+      confidence: BedReleaseConfidence;
+      /** Chosen from `BED_RELEASE_BLOCKERS`, never free text — an operational fact about the
+       *  BED, never about the departing patient (binding spec §4). */
+      blocker: BedReleaseBlocker;
     };
 
 /**
@@ -169,4 +195,5 @@ export const EVENT_ROLE: Record<WardFlowEvent["type"], readonly WardFlowRole[]>
   CHANGE_LEGAL_STATUS: ["coordinator", "ed"],
   RELEASE_HOLD: ["coordinator", "ward"],
   CANCEL_TRANSPORT: ["coordinator", "ward"],
+  FLAG_BED_RELEASE: ["ward"],
 };
diff --git a/src/components/ward-management/ward-flow-provider.tsx b/src/components/ward-management/ward-flow-provider.tsx
index c3bb3adc54..3d91293a13 100644
--- a/src/components/ward-management/ward-flow-provider.tsx
+++ b/src/components/ward-management/ward-flow-provider.tsx
@@ -16,7 +16,7 @@ import type { Instant } from "@/components/ward-management/ward-clock";
 import { elapsedMinutesSinceMount, wallClockNow } from "@/components/ward-management/ward-clock";
 import type { WardFlowEvent } from "@/components/ward-management/ward-flow-events";
 import { seedWardFlowState, wardFlowReducer } from "@/components/ward-management/ward-flow-reducer";
-import type { Movement, Rejection, Unit } from "@/components/ward-management/ward-model";
+import type { BedRelease, Movement, Rejection, Unit } from "@/components/ward-management/ward-model";
 import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
 import type { WardScenario } from "@/components/ward-management/ward-scenarios";
 
@@ -40,6 +40,9 @@ type WardFlowContextValue = {
   movements: Movement[];
   units: Unit[];
   rejections: Rejection[];
+  /** Task 11 (spec item 9): beds expected to free up, live from reducer state so a ward's own
+   *  `FLAG_BED_RELEASE` shows up on every screen reading `unitCapacity()`'s `potential` figure. */
+  bedReleases: BedRelease[];
   now: Instant;
   /** Which synthetic night is seeded — `ward-scenarios.ts`'s `WardScenario` — so a UI surface
    *  (`ward-demo-controls.tsx`'s scenario switch) can mark the active one without guessing it
@@ -112,13 +115,14 @@ export function WardFlowProvider({ children, initialNow }: WardFlowProviderProps
       movements: state.movements,
       units: state.units,
       rejections: state.rejections,
+      bedReleases: state.bedReleases,
       now,
       scenario: state.scenario,
       dispatch,
       focusMovementId,
       setFocusMovementId,
     }),
-    [state.movements, state.units, state.rejections, now, state.scenario, dispatch, focusMovementId],
+    [state.movements, state.units, state.rejections, state.bedReleases, now, state.scenario, dispatch, focusMovementId],
   );
 
   return <WardFlowContext.Provider value={value}>{children}</WardFlowContext.Provider>;
diff --git a/src/components/ward-management/ward-flow-reducer.ts b/src/components/ward-management/ward-flow-reducer.ts
index 98d39c612c..f3a8a781a4 100644
--- a/src/components/ward-management/ward-flow-reducer.ts
+++ b/src/components/ward-management/ward-flow-reducer.ts
@@ -1,8 +1,8 @@
 import { EVENT_ROLE, type WardFlowEvent } from "@/components/ward-management/ward-flow-events";
 import { SELECTABLE_LEGAL_FORMS } from "@/components/ward-management/ward-legal-forms";
 import { PARALLEL_REFERRAL_CAP } from "@/components/ward-management/ward-model";
-import type { Movement, MovementStage, Rejection, Unit } from "@/components/ward-management/ward-model";
-import { wardMovements } from "@/components/ward-management/ward-movements";
+import type { BedRelease, Movement, MovementStage, Rejection, Unit } from "@/components/ward-management/ward-model";
+import { bedReleases, wardMovements } from "@/components/ward-management/ward-movements";
 import { allEmergencyDepartments } from "@/components/ward-management/ward-sites";
 import { scenarioUnits, type WardScenario } from "@/components/ward-management/ward-scenarios";
 
@@ -34,6 +34,12 @@ export type WardFlowState = {
   referralSequence: number;
   /** Which synthetic night is seeded — `ward-scenarios.ts`'s operational-numbers-only variants. */
   scenario: WardScenario;
+  /**
+   * Task 11 (spec item 9): beds expected to free up, now live reducer state rather than a frozen
+   * fixture constant — `FLAG_BED_RELEASE` appends here, so a ward's own flag actually moves
+   * `unitCapacity()`'s `potential` figure. Seeded from `ward-movements.ts`'s `bedReleases`.
+   */
+  bedReleases: BedRelease[];
 };
 
 /**
@@ -50,6 +56,7 @@ export function seedWardFlowState(scenario: WardScenario = "standard"): WardFlow
     clockOffsetMinutes: 0,
     referralSequence: 0,
     scenario,
+    bedReleases: structuredClone(bedReleases),
   };
 }
 
@@ -59,6 +66,7 @@ function subjectId(event: WardFlowEvent): string {
     case "RAISE_REFERRAL":
       return event.edId;
     case "CONFIRM_CAPACITY":
+    case "FLAG_BED_RELEASE":
       return event.unitId;
     case "ADVANCE_CLOCK":
     case "RESET_SCENARIO":
@@ -530,6 +538,40 @@ export function wardFlowReducer(state: WardFlowState, event: WardFlowEvent): War
       return replaceUnit(state, unit.id, updatedUnit);
     }
 
+    case "FLAG_BED_RELEASE": {
+      // Same claim-not-proof discipline as CONFIRM_CAPACITY (see that case's own comment in
+      // full): this compares what the caller SAID it was acting as against the unit the release
+      // is being written to, and refuses when they differ. It does not authenticate anything —
+      // `FLAG_BED_RELEASE` is `ward`-only, so unlike RELEASE_HOLD/CANCEL_TRANSPORT there is no
+      // coordinator caller to exempt, and the comparison always runs.
+      if (event.actingUnitId !== event.unitId) {
+        return reject(
+          state,
+          event,
+          `FLAG_BED_RELEASE was raised acting as unit ${event.actingUnitId} but targets unit ${event.unitId}`,
+        );
+      }
+      const flaggedUnit = findUnit(state, event.unitId);
+      if (!flaggedUnit) return reject(state, event, `no unit found for id ${event.unitId}`);
+      const release: BedRelease = {
+        // "WR-9NN" mirrors `nextReferralId`'s own "9" prefix above — visibly distinct at a
+        // glance from the hand-authored "WR-00N" fixture ids, same reasoning as RAISE_REFERRAL's
+        // "WF-9NN".
+        id: `WR-9${String(state.bedReleases.length).padStart(2, "0")}`,
+        unitId: flaggedUnit.id,
+        // FLAG_BED_RELEASE carries no estimated time from its caller (see the event's own doc
+        // comment) — nothing about the departing patient's own timing is permitted onto this
+        // record (binding spec §4), so this is the moment the WARD reported the release, not a
+        // projection about the patient.
+        expectedAt: event.now,
+        confidence: event.confidence,
+        blocker: event.blocker,
+        confirmedAt: event.now,
+        confirmedBy: `NUM ${flaggedUnit.name}`,
+      };
+      return { ...state, bedReleases: [...state.bedReleases, release] };
+    }
+
     case "RECORD_ESCALATION": {
       const movement = findMovement(state, event.movementId);
       if (!movement) return reject(state, event, `no movement found for id ${event.movementId}`);
diff --git a/src/components/ward-management/ward-management-modes.tsx b/src/components/ward-management/ward-management-modes.tsx
index 2d4896c5ac..07b5718e99 100644
--- a/src/components/ward-management/ward-management-modes.tsx
+++ b/src/components/ward-management/ward-management-modes.tsx
@@ -370,8 +370,8 @@ function QueueView({ role }: { role: WardRole }) {
 }
 
 function CapacityView() {
-  const { units, now } = useWardFlow();
-  const capacities = units.map((unit) => ({ unit, capacity: unitCapacity(unit) }));
+  const { units, bedReleases, now } = useWardFlow();
+  const capacities = units.map((unit) => ({ unit, capacity: unitCapacity(unit, bedReleases) }));
   const totals = {
     available: capacities.reduce((sum, entry) => sum + entry.capacity.available, 0),
     held: capacities.reduce((sum, entry) => sum + entry.capacity.held, 0),
diff --git a/src/components/ward-management/ward-management-network.tsx b/src/components/ward-management/ward-management-network.tsx
index fbe8b30353..4b34f21a1b 100644
--- a/src/components/ward-management/ward-management-network.tsx
+++ b/src/components/ward-management/ward-management-network.tsx
@@ -21,7 +21,7 @@ import {
 import { useWardFlow } from "@/components/ward-management/ward-flow-provider";
 import { formatInstant, type Instant } from "@/components/ward-management/ward-clock";
 import { legalFormNameLabelFirst } from "@/components/ward-management/ward-legal-forms";
-import type { HealthService, Movement, Unit } from "@/components/ward-management/ward-model";
+import type { BedRelease, HealthService, Movement, Unit } from "@/components/ward-management/ward-model";
 import { siteByCode } from "@/components/ward-management/ward-sites";
 
 import styles from "./ward-management-network.module.css";
@@ -88,8 +88,8 @@ function transportTone(etaLabel: string) {
   return /requested|awaiting|not yet/i.test(etaLabel) ? "warning" : "good";
 }
 
-function BedStateChips({ unit, showTime }: { unit: Unit; showTime?: boolean }) {
-  const capacity = unitCapacity(unit);
+function BedStateChips({ unit, bedReleases, showTime }: { unit: Unit; bedReleases: BedRelease[]; showTime?: boolean }) {
+  const capacity = unitCapacity(unit, bedReleases);
   return (
     <span className={styles.bedChips}>
       {(Object.keys(bedStateCopy) as BedStateKey[]).map((key) => (
@@ -104,18 +104,20 @@ function BedStateChips({ unit, showTime }: { unit: Unit; showTime?: boolean }) {
 
 function ServiceCard({
   unit,
+  bedReleases,
   routed,
   selected,
   onSelect,
   registerRef,
 }: {
   unit: Unit;
+  bedReleases: BedRelease[];
   routed: boolean;
   selected: boolean;
   onSelect: () => void;
   registerRef: (id: string, node: HTMLButtonElement | null) => void;
 }) {
-  const capacity = unitCapacity(unit);
+  const capacity = unitCapacity(unit, bedReleases);
   return (
     <button
       type="button"
@@ -129,13 +131,13 @@ function ServiceCard({
     >
       <span className={styles.serviceName}>{unit.name}</span>
       <span className={styles.serviceCapability}>{capabilityLabel(unit)}</span>
-      <BedStateChips unit={unit} showTime />
+      <BedStateChips unit={unit} bedReleases={bedReleases} showTime />
     </button>
   );
 }
 
 export function WardNetworkWorkspace() {
-  const { movements, units, now } = useWardFlow();
+  const { movements, units, bedReleases, now } = useWardFlow();
   const [selectedPatientId, setSelectedPatientId] = useState(movements[0].id);
   const [selectedUnitId, setSelectedUnitId] = useState<string | null>(null);
   const [factorsOpen, setFactorsOpen] = useState(false);
@@ -360,6 +362,7 @@ export function WardNetworkWorkspace() {
                           <ServiceCard
                             key={unit.id}
                             unit={unit}
+                            bedReleases={bedReleases}
                             routed={routedIds.has(unit.id)}
                             selected={detail?.id === unit.id}
                             onSelect={() => setSelectedUnitId(detail?.id === unit.id ? null : unit.id)}
@@ -462,7 +465,7 @@ export function WardNetworkWorkspace() {
                   <th scope="row">Current bed state</th>
                   {candidates.map((candidate) => (
                     <td key={candidate.unit.id}>
-                      <BedStateChips unit={candidate.unit} />
+                      <BedStateChips unit={candidate.unit} bedReleases={bedReleases} />
                     </td>
                   ))}
                 </tr>
@@ -528,10 +531,10 @@ export function WardNetworkWorkspace() {
                 {siteByCode(detail.siteCode)?.service ?? "Unknown service"} · {capabilityLabel(detail)} · confirmed{" "}
                 {formatInstant(detail.allocatable.confirmedAt)}
               </p>
-              <BedStateChips unit={detail} />
+              <BedStateChips unit={detail} bedReleases={bedReleases} />
               <p className={styles.detailMeta}>
-                {unitCapacity(detail).occupied} occupied of {detail.beds} beds. Potential beds are a subset of occupied
-                and are not allocatable yet.
+                {unitCapacity(detail, bedReleases).occupied} occupied of {detail.beds} beds. Potential beds are a subset
+                of occupied and are not allocatable yet.
               </p>
             </section>
           ) : null}
diff --git a/src/components/ward-management/ward-model.ts b/src/components/ward-management/ward-model.ts
index 8dc93e8be5..56730f300d 100644
--- a/src/components/ward-management/ward-model.ts
+++ b/src/components/ward-management/ward-model.ts
@@ -266,11 +266,25 @@ export type Rejection = {
   reason: string;
 };
 
+/** Every confidence level a bed release can carry — hand-listed here (never derived) for the
+ *  same reason `DECLINE_REASONS` lives beside `DeclineReason`: a UI picker needs a runtime list,
+ *  not just the type. */
+export const BED_RELEASE_CONFIDENCE_LEVELS = ["confirmed", "likely", "possible"] as const;
+export type BedReleaseConfidence = (typeof BED_RELEASE_CONFIDENCE_LEVELS)[number];
+
+/**
+ * Task 11 (spec item 9). A bed release carries **nothing whatsoever about the departing
+ * patient** — no identifier, no timing that could identify them, no reason relating to them.
+ * That is a privacy rule from the binding spec §4 and it is not negotiable: every field below is
+ * about the BED or the confirming WARD, never about a person, and `tests/ward-flow-reducer.test.ts`
+ * asserts this structurally against the type's own field set, not just against fixture content —
+ * see that file's "bed release privacy" suite for how.
+ */
 export type BedRelease = {
   id: string;
   unitId: string;
   expectedAt: Instant;
-  confidence: "confirmed" | "likely" | "possible";
+  confidence: BedReleaseConfidence;
   blocker: string;
   confirmedAt: Instant;
   confirmedBy: string;
diff --git a/src/components/ward-management/ward/ward-screen.tsx b/src/components/ward-management/ward/ward-screen.tsx
index 11f564fa36..2be2192058 100644
--- a/src/components/ward-management/ward/ward-screen.tsx
+++ b/src/components/ward-management/ward/ward-screen.tsx
@@ -3,9 +3,11 @@
 import { useState, type FormEvent } from "react";
 
 import {
+  BED_RELEASE_BLOCKERS,
   CANCEL_TRANSPORT_REASONS,
   changeReasonLabels,
   RELEASE_HOLD_REASONS,
+  type BedReleaseBlocker,
   type CancelTransportReason,
   type ReleaseHoldReason,
 } from "@/components/ward-management/ward-change-reasons";
@@ -19,7 +21,14 @@ import {
 } from "@/components/ward-management/ward-derivations";
 import { useWardFlow } from "@/components/ward-management/ward-flow-provider";
 import { ClinicalRail } from "@/components/ward-management/ward-management-navigation";
-import { DECLINE_REASONS, type DeclineReason, type Movement, type Unit } from "@/components/ward-management/ward-model";
+import {
+  BED_RELEASE_CONFIDENCE_LEVELS,
+  DECLINE_REASONS,
+  type BedReleaseConfidence,
+  type DeclineReason,
+  type Movement,
+  type Unit,
+} from "@/components/ward-management/ward-model";
 import { siteByCode } from "@/components/ward-management/ward-sites";
 import { ignoreUnavailableActivation } from "@/components/ui-primitives";
 
@@ -83,7 +92,7 @@ function holdBlockedReason(movement: Movement, unit: Unit): string | undefined {
  * anyone else reading it.
  */
 export function WardScreen({ unitId }: WardScreenProps) {
-  const { movements, units, now, dispatch } = useWardFlow();
+  const { movements, units, bedReleases, now, dispatch } = useWardFlow();
   // Resolved from the provider's live `units`, not the frozen `unitById()` fixture — after
   // `CONFIRM_CAPACITY` or `HOLD_BED` updates `state.units`, this screen must show the current
   // bed counts (and gate `holdBlockedReason` on them) rather than the stale fixture value.
@@ -101,6 +110,11 @@ export function WardScreen({ unitId }: WardScreenProps) {
   const [releaseReason, setReleaseReason] = useState<ReleaseHoldReason | undefined>(undefined);
   const [cancelOpenFor, setCancelOpenFor] = useState<string | undefined>(undefined);
   const [cancelReason, setCancelReason] = useState<CancelTransportReason | undefined>(undefined);
+  // Task 11 (spec item 9): the bed-release flag. Not keyed by movement id — unlike decline,
+  // release and cancel above, this is not about any one referral, it is about this ward's own
+  // bed stock, so one form per screen is enough.
+  const [bedReleaseConfidence, setBedReleaseConfidence] = useState<BedReleaseConfidence | undefined>(undefined);
+  const [bedReleaseBlocker, setBedReleaseBlocker] = useState<BedReleaseBlocker | undefined>(undefined);
 
   if (!unit) {
     return (
@@ -118,7 +132,7 @@ export function WardScreen({ unitId }: WardScreenProps) {
   }
 
   const site = siteByCode(unit.siteCode);
-  const capacity = unitCapacity(unit);
+  const capacity = unitCapacity(unit, bedReleases);
   // TypeScript's narrowing of `unit` above does not reach into the `submitDecline` /
   // `submitCapacity` closures defined further down (the same reason `shortlist-panel.tsx`'s
   // `handleRefer` closes over a plain `movementId` rather than re-checking `movement`), so this
@@ -174,6 +188,25 @@ export function WardScreen({ unitId }: WardScreenProps) {
     });
   }
 
+  function submitBedRelease(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    if (!bedReleaseConfidence || !bedReleaseBlocker) return;
+    // `actingUnitId` is this screen's own route parameter, exactly like `submitCapacity` above —
+    // it states which ward the caller says it is; it does not prove it. FLAG_BED_RELEASE is
+    // ward-only, so this comparison always runs (see the reducer's own comment on the case).
+    dispatch({
+      type: "FLAG_BED_RELEASE",
+      role: "ward",
+      now,
+      unitId: wardUnitId,
+      actingUnitId: unitId,
+      confidence: bedReleaseConfidence,
+      blocker: bedReleaseBlocker,
+    });
+    setBedReleaseConfidence(undefined);
+    setBedReleaseBlocker(undefined);
+  }
+
   function toggleRelease(movementId: string) {
     setReleaseOpenFor((current) => (current === movementId ? undefined : movementId));
     setReleaseReason(undefined);
@@ -284,6 +317,71 @@ export function WardScreen({ unitId }: WardScreenProps) {
               {unit.name} only &mdash; never any other ward.
             </p>
           </form>
+
+          {/* Task 11 (spec item 9): a ward can now flag its own bed coming free, rather than
+              `potential` only ever moving through the frozen fixture. Always available — unlike
+              the incoming-referral and accepted-movement controls below, FLAG_BED_RELEASE carries
+              no movement-stage precondition to gate on, so this control renders unconditionally
+              rather than checking a `blocked` reason that does not exist. */}
+          <form className={styles.capacityForm} onSubmit={submitBedRelease} data-testid="ward-flag-bed-release">
+            <span className={styles.capacityLabel}>Flag a bed coming free at {unit.name}</span>
+            <div className={styles.capacityRow}>
+              <div>
+                <label className={styles.declineLegend} htmlFor="ward-bed-release-confidence">
+                  Confidence
+                </label>
+                <select
+                  id="ward-bed-release-confidence"
+                  required
+                  className={styles.capacityInput}
+                  value={bedReleaseConfidence ?? ""}
+                  onChange={(event) => setBedReleaseConfidence(event.target.value as BedReleaseConfidence)}
+                >
+                  <option value="" disabled>
+                    Choose confidence
+                  </option>
+                  {BED_RELEASE_CONFIDENCE_LEVELS.map((level) => (
+                    <option key={level} value={level}>
+                      {level}
+                    </option>
+                  ))}
+                </select>
+              </div>
+              <div>
+                <label className={styles.declineLegend} htmlFor="ward-bed-release-blocker">
+                  Blocker
+                </label>
+                <select
+                  id="ward-bed-release-blocker"
+                  required
+                  className={styles.capacityInput}
+                  value={bedReleaseBlocker ?? ""}
+                  onChange={(event) => setBedReleaseBlocker(event.target.value as BedReleaseBlocker)}
+                >
+                  <option value="" disabled>
+                    Choose blocker
+                  </option>
+                  {BED_RELEASE_BLOCKERS.map((item) => (
+                    <option key={item} value={item}>
+                      {item}
+                    </option>
+                  ))}
+                </select>
+              </div>
+              <button
+                type="submit"
+                data-testid="ward-flag-bed-release-submit"
+                className={styles.capacitySubmit}
+                disabled={!bedReleaseConfidence || !bedReleaseBlocker}
+              >
+                Flag bed coming free
+              </button>
+            </div>
+            <p className={styles.capacityConfirmed}>
+              Records confidence and blocker only &mdash; nothing about the departing patient. Writes to {unit.name}{" "}
+              only &mdash; never any other ward.
+            </p>
+          </form>
         </section>
 
         <section aria-label="Incoming referrals" className={styles.listSection}>
diff --git a/tests/ward-bed-release.dom.test.tsx b/tests/ward-bed-release.dom.test.tsx
new file mode 100644
index 0000000000..1779c946e5
--- /dev/null
+++ b/tests/ward-bed-release.dom.test.tsx
@@ -0,0 +1,119 @@
+import { fireEvent, render, screen, within } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { describe, expect, it, vi } from "vitest";
+
+// Mirrors tests/ward-screen.dom.test.tsx: ClinicalRail renders next/link anchors and this suite
+// never checks routing itself, so a plain <a> avoids requiring an App Router context jsdom cannot
+// provide.
+vi.mock("next/link", () => ({
+  default: ({ children, href, ...rest }: { children: ReactNode; href: string }) => (
+    <a href={href} {...rest}>
+      {children}
+    </a>
+  ),
+}));
+
+import { WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+import { WardModeWorkspace } from "@/components/ward-management/ward-management-modes";
+import { WardScreen } from "@/components/ward-management/ward/ward-screen";
+import { bedReleases } from "@/components/ward-management/ward-movements";
+import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
+
+/**
+ * Task 11 (spec item 9). Before this task bed releases were static fixture data feeding the
+ * `potential` capacity figure and no ward could flag one — this proves the control exists, is a
+ * picker rather than free text (the binding spec §4 rule this task exists to satisfy), and that a
+ * real dispatch actually moves the number shown on screen, the same "dispatch a real event and
+ * read the target component again" technique `ward-screen.dom.test.tsx`'s own capacity suite uses.
+ *
+ * rph-adult-secure carries exactly one bed release in the fixture (WR-001) — asserted below
+ * rather than assumed, so this suite fails loudly instead of silently under-covering if the
+ * fixture ever changes underneath it.
+ */
+describe("ward bed release flag", () => {
+  it("fixture assumption: rph-adult-secure starts with exactly one bed release", () => {
+    expect(bedReleases.filter((release) => release.unitId === "rph-adult-secure")).toHaveLength(1);
+  });
+
+  it("renders confidence and blocker as pickers only — never a free-text field", () => {
+    render(
+      <WardFlowProvider initialNow={NOW_ANCHOR}>
+        <WardScreen unitId="rph-adult-secure" />
+      </WardFlowProvider>,
+    );
+
+    const form = screen.getByTestId("ward-flag-bed-release");
+    // Structural proof the blocker (and confidence) is a picker, never free text: the form must
+    // contain only <select> controls plus the submit button, no <input type="text"> or
+    // <textarea> anywhere inside it.
+    expect(within(form).queryAllByRole("textbox")).toHaveLength(0);
+    expect(within(form).getAllByRole("combobox")).toHaveLength(2);
+
+    const confidenceSelect = screen.getByLabelText("Confidence");
+    const blockerSelect = screen.getByLabelText("Blocker");
+    expect(confidenceSelect.tagName).toBe("SELECT");
+    expect(blockerSelect.tagName).toBe("SELECT");
+  });
+
+  it("starts with the submit button disabled until both fields are chosen, then flags a release that raises potential by one", () => {
+    render(
+      <WardFlowProvider initialNow={NOW_ANCHOR}>
+        <WardScreen unitId="rph-adult-secure" />
+      </WardFlowProvider>,
+    );
+
+    // Baseline: one fixture-seeded release for this unit already shows as Potential 1.
+    const bedsBefore = screen.getByTestId("ward-unit-beds");
+    expect(within(bedsBefore).getByText("Potential 1")).toBeInTheDocument();
+
+    const submit = screen.getByTestId("ward-flag-bed-release-submit");
+    expect(submit).toBeDisabled();
+
+    fireEvent.change(screen.getByLabelText("Confidence"), { target: { value: "likely" } });
+    expect(submit).toBeDisabled(); // blocker still unchosen
+
+    fireEvent.change(screen.getByLabelText("Blocker"), { target: { value: "Awaiting clean" } });
+    expect(submit).not.toBeDisabled();
+
+    fireEvent.click(submit);
+
+    // After a real FLAG_BED_RELEASE dispatch updates state.bedReleases, the screen must show the
+    // new live count — resolving from the frozen fixture (as `unitCapacity` did before this task)
+    // would keep showing Potential 1 forever.
+    const bedsAfter = screen.getByTestId("ward-unit-beds");
+    expect(within(bedsAfter).getByText("Potential 2")).toBeInTheDocument();
+
+    // The form resets after a successful submit, ready for the next flag.
+    expect(screen.getByTestId("ward-flag-bed-release-submit")).toBeDisabled();
+  });
+
+  it("never moves a sibling unit's own live potential count", () => {
+    // Both surfaces share one provider instance, so a dispatch from the ward screen is read back
+    // through the SAME live state the statewide capacity board reads — not a second, disconnected
+    // copy that could never actually catch a unit-scoping bug.
+    render(
+      <WardFlowProvider initialNow={NOW_ANCHOR}>
+        <WardScreen unitId="rph-adult-secure" />
+        <WardModeWorkspace mode="capacity" />
+      </WardFlowProvider>,
+    );
+
+    // sjgm-adult-open carries no bed release in the fixture at all — asserted directly against
+    // the live capacity row rather than the static fixture constant, so a scoping bug in the
+    // reducer (writing the flagged release to every unit, or to the wrong one) would be caught
+    // here even though it could never show up in the frozen `bedReleases` array itself.
+    const sjgmRowBefore = screen.getByTestId("ward-capacity-row-sjgm-adult-open");
+    expect(sjgmRowBefore).toHaveTextContent("0Potential");
+
+    fireEvent.change(screen.getByLabelText("Confidence"), { target: { value: "confirmed" } });
+    fireEvent.change(screen.getByLabelText("Blocker"), { target: { value: "Awaiting pharmacy" } });
+    fireEvent.click(screen.getByTestId("ward-flag-bed-release-submit"));
+
+    // rph-adult-secure's own row moved to Potential 2 (the same figure proved on the ward screen
+    // above) — the sibling must not.
+    const rphRowAfter = screen.getByTestId("ward-capacity-row-rph-adult-secure");
+    expect(rphRowAfter).toHaveTextContent("2Potential");
+    const sjgmRowAfter = screen.getByTestId("ward-capacity-row-sjgm-adult-open");
+    expect(sjgmRowAfter).toHaveTextContent("0Potential");
+  });
+});
diff --git a/tests/ward-capacity-reconciliation.test.ts b/tests/ward-capacity-reconciliation.test.ts
index 373e1294b9..418ae65da8 100644
--- a/tests/ward-capacity-reconciliation.test.ts
+++ b/tests/ward-capacity-reconciliation.test.ts
@@ -2,6 +2,7 @@
 import { describe, expect, it } from "vitest";
 
 import { unitCapacity } from "../src/components/ward-management/ward-derivations";
+import { bedReleases } from "../src/components/ward-management/ward-movements";
 import { allUnits } from "../src/components/ward-management/ward-sites";
 
 /**
@@ -28,7 +29,7 @@ describe("unit bed-state reconciliation", () => {
   it.each(units.map((unit) => [unit.id, unit] as const))(
     "partitions %s's beds exactly across available, held, blocked and occupied — potential excluded",
     (_id, unit) => {
-      const capacity = unitCapacity(unit);
+      const capacity = unitCapacity(unit, bedReleases);
       // The identity ruling 3 requires. `potential` is deliberately left out of this sum: it is
       // drawn from `bedReleases`, not from `unit.beds`, and folding it in here is exactly the
       // regression shape the whole-branch review found on 10 of 22 units.
@@ -38,7 +39,7 @@ describe("unit bed-state reconciliation", () => {
 
   it("never reports a negative figure in any of the five states", () => {
     for (const unit of units) {
-      const capacity = unitCapacity(unit);
+      const capacity = unitCapacity(unit, bedReleases);
       expect(capacity.available).toBeGreaterThanOrEqual(0);
       expect(capacity.held).toBeGreaterThanOrEqual(0);
       expect(capacity.blocked).toBeGreaterThanOrEqual(0);
diff --git a/tests/ward-flow-reducer.test.ts b/tests/ward-flow-reducer.test.ts
index 14f2a13504..37aaab2f25 100644
--- a/tests/ward-flow-reducer.test.ts
+++ b/tests/ward-flow-reducer.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
 
+import { unitCapacity } from "../src/components/ward-management/ward-derivations";
 import { seedWardFlowState, wardFlowReducer } from "../src/components/ward-management/ward-flow-reducer";
 import { SELECTABLE_LEGAL_FORMS } from "../src/components/ward-management/ward-legal-forms";
 import { NOW_ANCHOR } from "../src/components/ward-management/ward-sites";
@@ -1025,3 +1026,135 @@ describe("release and cancel", () => {
     expect(updated.unwinds.at(-1)).toMatchObject({ kind: "transport_cancelled" });
   });
 });
+
+/**
+ * Task 11 (spec item 9). Bed releases move from a frozen fixture constant into reducer state so a
+ * ward can flag its own bed coming free, and `unitCapacity()`'s `potential` figure actually moves
+ * when it does. `FLAG_BED_RELEASE` is `ward`-only (see `EVENT_ROLE.FLAG_BED_RELEASE` in
+ * `ward-flow-events.ts`), so unlike `RELEASE_HOLD`/`CANCEL_TRANSPORT` there is no coordinator
+ * caller to exempt — `actingUnitId` is always required and always compared against `unitId`,
+ * exactly like `CONFIRM_CAPACITY`.
+ */
+describe("bed release flagging", () => {
+  it("appends a release for the acting unit and increases that unit's potential by one", () => {
+    const seeded = seedWardFlowState();
+    const unit = seeded.units[0];
+    const sibling = seeded.units[1];
+    const potentialBefore = unitCapacity(unit, seeded.bedReleases).potential;
+    const siblingPotentialBefore = unitCapacity(sibling, seeded.bedReleases).potential;
+
+    const after = wardFlowReducer(seeded, {
+      type: "FLAG_BED_RELEASE",
+      role: "ward",
+      now: NOW,
+      unitId: unit.id,
+      actingUnitId: unit.id,
+      confidence: "likely",
+      blocker: "Awaiting clean",
+    });
+
+    expect(after.rejections).toEqual([]);
+    expect(after.bedReleases.length).toBe(seeded.bedReleases.length + 1);
+    const flagged = after.bedReleases.at(-1)!;
+    expect(flagged.unitId).toBe(unit.id);
+    expect(flagged.confidence).toBe("likely");
+    expect(flagged.blocker).toBe("Awaiting clean");
+    expect(flagged.confirmedAt).toBe(NOW);
+    expect(flagged.expectedAt).toBe(NOW);
+
+    const unitAfter = after.units.find((candidate) => candidate.id === unit.id)!;
+    expect(unitCapacity(unitAfter, after.bedReleases).potential).toBe(potentialBefore + 1);
+    // Untouched: a sibling unit's own potential count must not move.
+    const siblingAfter = after.units.find((candidate) => candidate.id === sibling.id)!;
+    expect(unitCapacity(siblingAfter, after.bedReleases).potential).toBe(siblingPotentialBefore);
+  });
+
+  it("refuses a flag raised acting as one unit but targeting another, naming both", () => {
+    const seeded = seedWardFlowState();
+    const unit = seeded.units[0];
+    const otherUnit = seeded.units[1];
+
+    const after = wardFlowReducer(seeded, {
+      type: "FLAG_BED_RELEASE",
+      role: "ward",
+      now: NOW,
+      unitId: unit.id,
+      actingUnitId: otherUnit.id,
+      confidence: "confirmed",
+      blocker: "Awaiting pharmacy",
+    });
+
+    expect(after.rejections).toHaveLength(1);
+    expect(after.rejections[0].reason).toContain(otherUnit.id);
+    expect(after.rejections[0].reason).toContain(unit.id);
+    expect(after.rejections[0].attempted).toBe("FLAG_BED_RELEASE");
+    // Nothing was written: no release was appended for either unit.
+    expect(after.bedReleases).toEqual(seeded.bedReleases);
+  });
+
+  it("refuses a coordinator caller", () => {
+    const seeded = seedWardFlowState();
+    const unit = seeded.units[0];
+
+    const after = wardFlowReducer(seeded, {
+      type: "FLAG_BED_RELEASE",
+      role: "coordinator",
+      now: NOW,
+      unitId: unit.id,
+      actingUnitId: unit.id,
+      confidence: "possible",
+      blocker: "Awaiting service coordination",
+    });
+
+    expect(after.rejections).toHaveLength(1);
+    expect(after.rejections[0].reason).toMatch(/role/i);
+    expect(after.bedReleases).toEqual(seeded.bedReleases);
+  });
+});
+
+/**
+ * Task 11's privacy rule, from the binding spec §4, is unconditional: a bed release carries
+ * nothing whatsoever about the departing patient — no identifier, no timing that could identify
+ * them, no reason relating to them. `BedRelease` is a compile-time-only TypeScript type, so
+ * nothing can introspect it directly at runtime; the strongest available proof is structural
+ * against every REAL instance this reducer or fixture can produce — checked as an ALLOWLIST of
+ * the exact field set, not a denylist of forbidden names. A denylist (as
+ * `tests/ward-model.test.ts`'s existing "flags bed releases without any departing-patient detail"
+ * test already is, checking for `name`/`mrn`/`diagnosis` and a handful of forbidden substrings)
+ * can only catch a field whose NAME was anticipated. This allowlist instead fails on ANY
+ * unexpected field, of any name, which is what "no field capable of carrying a patient reference"
+ * actually requires — a reviewer must extend this list deliberately before a new field can ship.
+ */
+describe("bed release privacy", () => {
+  it("gives every BedRelease exactly the allowed field set — fixture and reducer-produced alike", () => {
+    const ALLOWED_BED_RELEASE_FIELDS = [
+      "id",
+      "unitId",
+      "expectedAt",
+      "confidence",
+      "blocker",
+      "confirmedAt",
+      "confirmedBy",
+    ].sort();
+
+    const seeded = seedWardFlowState();
+    const flagged = wardFlowReducer(seeded, {
+      type: "FLAG_BED_RELEASE",
+      role: "ward",
+      now: NOW,
+      unitId: seeded.units[0].id,
+      actingUnitId: seeded.units[0].id,
+      confidence: "likely",
+      blocker: "Awaiting clean",
+    });
+    const reducerProduced = flagged.bedReleases.at(-1)!;
+
+    // Non-vacuity: this must actually inspect both a fixture-seeded release AND a fresh
+    // reducer-produced one, never silently degrade to checking only one source.
+    expect(seeded.bedReleases.length).toBeGreaterThan(0);
+    const everyRelease = [...seeded.bedReleases, reducerProduced];
+    for (const release of everyRelease) {
+      expect(Object.keys(release).sort()).toEqual(ALLOWED_BED_RELEASE_FIELDS);
+    }
+  });
+});
diff --git a/tests/ward-legal-figure-guard.test.ts b/tests/ward-legal-figure-guard.test.ts
index aff9f83617..869c10d8b8 100644
--- a/tests/ward-legal-figure-guard.test.ts
+++ b/tests/ward-legal-figure-guard.test.ts
@@ -4,6 +4,7 @@ import ts from "typescript";
 import { describe, expect, it } from "vitest";
 
 import {
+  BED_RELEASE_BLOCKERS,
   CANCEL_TRANSPORT_REASONS,
   LEGAL_STATUS_CHANGE_REASONS,
   RELEASE_HOLD_REASONS,
@@ -16,7 +17,12 @@ import {
   type WardFlowState,
 } from "../src/components/ward-management/ward-flow-reducer";
 import { SELECTABLE_LEGAL_FORMS } from "../src/components/ward-management/ward-legal-forms";
-import { DECLINE_REASONS, type LegalForm, type LegalStatus } from "../src/components/ward-management/ward-model";
+import {
+  BED_RELEASE_CONFIDENCE_LEVELS,
+  DECLINE_REASONS,
+  type LegalForm,
+  type LegalStatus,
+} from "../src/components/ward-management/ward-model";
 import { wardMovements } from "../src/components/ward-management/ward-movements";
 import { WARD_SCENARIOS } from "../src/components/ward-management/ward-scenarios";
 import { allEmergencyDepartments, NOW_ANCHOR } from "../src/components/ward-management/ward-sites";
@@ -506,6 +512,24 @@ function candidateEvents(type: WardFlowEvent["type"], state: WardFlowState, now:
       return movementIds.flatMap((movementId) =>
         CANCEL_TRANSPORT_REASONS.map((reason) => ({ type, role, now, movementId, reason })),
       );
+    case "FLAG_BED_RELEASE":
+      // `actingUnitId` mirrors `unitId`, same reasoning as CONFIRM_CAPACITY above. One candidate
+      // per confidence level crossed with every blocker — the same "one candidate per real
+      // domain value" precedent CHANGE_URGENCY/CHANGE_LEGAL_STATUS/SET_SCENARIO set, so a branch
+      // keyed on either dimension is entered rather than assumed reachable.
+      return unitIds.flatMap((unitId) =>
+        BED_RELEASE_CONFIDENCE_LEVELS.flatMap((confidence) =>
+          BED_RELEASE_BLOCKERS.map((blocker) => ({
+            type,
+            role,
+            now,
+            unitId,
+            actingUnitId: unitId,
+            confidence,
+            blocker,
+          })),
+        ),
+      );
   }
 }
 
diff --git a/tests/ward-model.test.ts b/tests/ward-model.test.ts
index 3340a73e70..a939b3d071 100644
--- a/tests/ward-model.test.ts
+++ b/tests/ward-model.test.ts
@@ -75,7 +75,7 @@ describe("ward sites", () => {
     // divergent reading (`occupants + empty + blocked === beds`) that put held beds nowhere
     // and let the real UI formula double-count them without failing.
     for (const unit of allUnits()) {
-      const capacity = unitCapacity(unit);
+      const capacity = unitCapacity(unit, bedReleases);
       expect(capacity.available, `${unit.id} available is negative`).toBeGreaterThanOrEqual(0);
       expect(capacity.held, `${unit.id} held is negative`).toBeGreaterThanOrEqual(0);
       expect(capacity.blocked, `${unit.id} blocked is negative`).toBeGreaterThanOrEqual(0);
diff --git a/tests/ward-shortlist.dom.test.tsx b/tests/ward-shortlist.dom.test.tsx
index 19e17401c6..283818f06a 100644
--- a/tests/ward-shortlist.dom.test.tsx
+++ b/tests/ward-shortlist.dom.test.tsx
@@ -23,7 +23,7 @@ const TARGET_MOVEMENT_ID = "WF-308";
  * actually produce.
  */
 function ShortlistHarness() {
-  const { movements, units, now, dispatch } = useWardFlow();
+  const { movements, units, bedReleases, now, dispatch } = useWardFlow();
   const [selectedUnitId, setSelectedUnitId] = useState<string | undefined>(undefined);
   const movement = movements.find((candidate) => candidate.id === TARGET_MOVEMENT_ID);
   return (
@@ -31,6 +31,7 @@ function ShortlistHarness() {
       movement={movement}
       now={now}
       units={units}
+      bedReleases={bedReleases}
       selectedUnitId={selectedUnitId}
       onSelectUnit={setSelectedUnitId}
       dispatch={dispatch}

From a1f97b71b87650dcc3fe12df2ead847965071dcc Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 14:39:25 +0800
Subject: [PATCH 23/54] Ward Flow: move into a developer-gated sandbox at
 /mockups/ward-flow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Task 1 of the Ward Flow sandbox plan (docs/superpowers/sdd/2026-08-25-ward-flow-sandbox-and-design-repair).
Ward Flow was an ordinary public production route reachable with no sign-in.
This moves it to /mockups/ward-flow, the same developer-gated pattern already
proven by Care Plan and Caring Contacts: DEVELOPER_GATED_PATH_PREFIXES gains
the new prefix, src/proxy.ts lets it through the blanket /mockups production
block, and DeveloperAreaGate (outermost in the new layout, WardFlowProvider
inside it) requires a signed-in administrator instead of rendering the
prototype to an anonymous visitor.

- git mv every route file under src/app/ward-management/** to
  src/app/mockups/ward-flow/**, preserving history.
- Update every internal href/redirect target across the ward navigation rail,
  patient-search links, the live tracker, the mode workspaces, the network
  diagram, the role switcher, the constellation compatibility redirect
  (src/proxy.ts + the page backstop), the tools-catalog entry, and the
  developer-hub panel.
- Regenerate docs/site-map.md and the design-system adoption manifest/report;
  Ward Flow's 16 routes leave the production adoption census (declared route
  count 82 -> 66) the same way Care Plan and Caring Contacts already do, so
  their two surfaces are removed from adoption-contract.json rather than
  repointed.
- Remove three route-reachability tests and one design-system-adoption test
  whose subject (Ward Flow as a *production* route) no longer exists, and the
  now-stale reachability allowlist entry for the constellation redirect —
  mockup routes are excluded from that gate by design, so no allowlist entry
  is needed.
- tests/ward-flow-sandbox.test.ts is the new guard: DEVELOPER_GATED_PATH_PREFIXES
  contains "/mockups/ward-flow", and src/app/ward-management no longer exists
  (resolved from __dirname, not process.cwd(), so the check cannot silently
  invert depending on invocation directory).
- Update the 31 route references across the three ward Playwright specs
  (ui-ward-coordinator/ui-ward-management/ui-ward-roles); unrun here per the
  task boundary — the browser gate is their first execution against the new
  paths.

Does not change Ward Flow's behaviour, model, or reducer. Full unit suite:
848 files (845 passed, 3 skipped), 10151 tests (10077 passed, 74 skipped),
0 failed. tsc --noEmit clean.
---
 docs/codebase-index.md                        |  86 ++--
 docs/design-system/ADOPTION.md                |  44 +-
 docs/design-system/adoption-contract.json     | 113 -----
 docs/design-system/adoption-manifest.json     | 437 +-----------------
 docs/site-map.md                              |  38 +-
 docs/ward-management-mode-map.md              |  24 +-
 scripts/generate-design-system-adoption.mjs   |   4 -
 scripts/generate-site-map.ts                  |  34 +-
 .../ward-flow}/capacity/page.tsx              |   0
 .../ward-flow}/constellation/page.tsx         |   2 +-
 .../ward-flow}/ed/[edId]/page.tsx             |   0
 .../ward-flow}/escalation/page.tsx            |   0
 .../ward-flow}/exceptions/page.tsx            |   0
 .../ward-flow}/governance/page.tsx            |   0
 .../ward-flow}/handover/page.tsx              |   0
 src/app/mockups/ward-flow/layout.tsx          |  21 +
 .../ward-flow}/movements/page.tsx             |   0
 .../ward-flow}/network/page.tsx               |   0
 .../ward-flow}/page.tsx                       |   0
 .../ward-flow}/patients/[patientId]/page.tsx  |   0
 .../ward-flow}/queue/page.tsx                 |   0
 .../ward-flow}/search/page.tsx                |   0
 .../ward-flow}/transport/officer/page.tsx     |   0
 .../ward-flow}/transport/page.tsx             |   0
 .../ward-flow}/ward/[unitId]/page.tsx         |   0
 src/app/ward-management/layout.tsx            |  12 -
 .../coordinator/coordinator-screen.tsx        |   2 +-
 .../ward-management/search/patient-search.tsx |   4 +-
 .../ward-management/tracker/live-tracker.tsx  |   4 +-
 .../ward-management/ward-demo-controls.tsx    |   2 +-
 .../ward-management/ward-derivations.ts       |   2 +-
 .../ward-management/ward-flow-events.ts       |   2 +-
 .../ward-management/ward-flow-reducer.ts      |   2 +-
 .../ward-management-console.tsx               |   4 +-
 .../ward-management/ward-management-modes.tsx |  12 +-
 .../ward-management-navigation.tsx            |  53 ++-
 .../ward-management-network.tsx               |   2 +-
 .../ward-management.module.css                |   2 +-
 .../ward-management/ward-role-switcher.tsx    |   8 +-
 src/lib/developer-area/headers.ts             |   1 +
 src/lib/developer-area/hub-panels.ts          |   2 +-
 src/lib/tools-catalog.ts                      |   2 +-
 src/proxy.ts                                  |  10 +-
 tests/design-system-adoption.test.ts          |  67 ++-
 tests/proxy.test.ts                           |   4 +-
 tests/route-reachability.test.ts              |  50 +-
 tests/site-map.test.ts                        |   2 -
 tests/tools-catalog.test.ts                   |   2 +-
 tests/ui-ward-coordinator.spec.ts             |   4 +-
 tests/ui-ward-management.spec.ts              |   8 +-
 tests/ui-ward-roles.spec.ts                   |  32 +-
 tests/ward-flow-sandbox.test.ts               |  23 +
 tests/ward-management.test.ts                 |  20 +-
 tests/ward-patient-search.dom.test.tsx        |   2 +-
 54 files changed, 302 insertions(+), 841 deletions(-)
 rename src/app/{ward-management => mockups/ward-flow}/capacity/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/constellation/page.tsx (88%)
 rename src/app/{ward-management => mockups/ward-flow}/ed/[edId]/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/escalation/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/exceptions/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/governance/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/handover/page.tsx (100%)
 create mode 100644 src/app/mockups/ward-flow/layout.tsx
 rename src/app/{ward-management => mockups/ward-flow}/movements/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/network/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/patients/[patientId]/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/queue/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/search/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/transport/officer/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/transport/page.tsx (100%)
 rename src/app/{ward-management => mockups/ward-flow}/ward/[unitId]/page.tsx (100%)
 delete mode 100644 src/app/ward-management/layout.tsx
 create mode 100644 tests/ward-flow-sandbox.test.ts

diff --git a/docs/codebase-index.md b/docs/codebase-index.md
index 704e672595..c1ad99a6ee 100644
--- a/docs/codebase-index.md
+++ b/docs/codebase-index.md
@@ -69,33 +69,32 @@ Smaller top-level directories that are easy to miss:
 
 ### Product pages (`src/app/`)
 
-| Route                                                                                                                                                                                          | File                                                                                      |
-| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
-| `/`                                                                                                                                                                                            | `src/app/(search-app)/page.tsx`                                                           |
-| Shared mode-home route group (`/(search-app)`)                                                                                                                                                 | `src/app/(search-app)/`                                                                   |
-| Mode homes (`/services`, `/dsm`, `/documents/…`, …)                                                                                                                                            | `src/app/(search-app)/` shared shell group                                                |
-| `/caring-contacts` (standalone workspace; own nav, entered from Tools)                                                                                                                         | `src/app/caring-contacts/`                                                                |
-| `/applications`                                                                                                                                                                                | `src/app/applications/route.ts`                                                           |
-| `/differentials`, `/diagnoses`, `/presentations`, `/compare`                                                                                                                                   | `src/app/(search-app)/differentials/`                                                     |
-| `/dsm`, `/dsm/search`, `/dsm/compare`, `/dsm/diagnoses/[slug]`                                                                                                                                 | `src/app/(search-app)/dsm/`                                                               |
-| `/documents/search`, `/source`, `/evidence`, `/[id]`                                                                                                                                           | `src/app/(search-app)/documents/`                                                         |
-| `/factsheets`, `/factsheets/search`, `/factsheets/[slug]`                                                                                                                                      | `src/app/(search-app)/factsheets/`                                                        |
-| `/dictionary`, Terms (`/search`, one catalogue — `/browse` redirects to it), Topics, Definition, Compare, Sources                                                                              | `src/app/(search-app)/dictionary/`                                                        |
-| `/favourites`                                                                                                                                                                                  | `src/app/(search-app)/favourites/page.tsx`                                                |
-| `/forms`, `/forms/[slug]`                                                                                                                                                                      | `src/app/(search-app)/forms/`                                                             |
-| `/medications`, `/medications/[slug]`                                                                                                                                                          | `src/app/(search-app)/medications/`                                                       |
-| `/privacy`                                                                                                                                                                                     | `src/app/privacy/page.tsx` → `privacy-quiet-signal-page.tsx` + `privacy-page-content.tsx` |
-| `/reference/colour-coding`                                                                                                                                                                     | `src/app/reference/`                                                                      |
-| `/safety-plan`                                                                                                                                                                                 | `src/app/safety-plan/page.tsx`                                                            |
-| `/calculators`, `/calculators/search`                                                                                                                                                          | `src/app/(search-app)/calculators/`                                                       |
-| `/services`, `/services/[slug]`                                                                                                                                                                | `src/app/(search-app)/services/`                                                          |
-| `/therapy-compass`                                                                                                                                                                             | `src/app/(search-app)/therapy-compass/`                                                   |
-| `/tools`                                                                                                                                                                                       | `src/app/(search-app)/tools/`                                                             |
-| `/specifiers`, `/specifiers/[slug]`, `/specifiers/builder`, `/specifiers/compare`, `/specifiers/map`                                                                                           | `src/app/(search-app)/specifiers/`                                                        |
-| `/formulation`, `/formulation/[slug]`, `/formulation/builder`, `/formulation/compare`, `/formulation/map`                                                                                      | `src/app/(search-app)/formulation/`                                                       |
-| `/ward-management`, `/network`, `/queue`, `/capacity`, `/movements`, `/exceptions`, `/transport`, `/transport/officer`, `/governance`, `/ed/[edId]`, `/patients/[patientId]`, `/ward/[unitId]` | `src/app/ward-management/` — Ward Flow synthetic patient-flow prototype                   |
-| `/mockups/*`                                                                                                                                                                                   | `src/app/mockups/` (404 in production)                                                    |
-| `/auth/callback`                                                                                                                                                                               | `src/app/auth/callback/route.ts`                                                          |
+| Route                                                                                                             | File                                                                                                                                                                           |
+| ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `/`                                                                                                               | `src/app/(search-app)/page.tsx`                                                                                                                                                |
+| Shared mode-home route group (`/(search-app)`)                                                                    | `src/app/(search-app)/`                                                                                                                                                        |
+| Mode homes (`/services`, `/dsm`, `/documents/…`, …)                                                               | `src/app/(search-app)/` shared shell group                                                                                                                                     |
+| `/caring-contacts` (standalone workspace; own nav, entered from Tools)                                            | `src/app/caring-contacts/`                                                                                                                                                     |
+| `/applications`                                                                                                   | `src/app/applications/route.ts`                                                                                                                                                |
+| `/differentials`, `/diagnoses`, `/presentations`, `/compare`                                                      | `src/app/(search-app)/differentials/`                                                                                                                                          |
+| `/dsm`, `/dsm/search`, `/dsm/compare`, `/dsm/diagnoses/[slug]`                                                    | `src/app/(search-app)/dsm/`                                                                                                                                                    |
+| `/documents/search`, `/source`, `/evidence`, `/[id]`                                                              | `src/app/(search-app)/documents/`                                                                                                                                              |
+| `/factsheets`, `/factsheets/search`, `/factsheets/[slug]`                                                         | `src/app/(search-app)/factsheets/`                                                                                                                                             |
+| `/dictionary`, Terms (`/search`, one catalogue — `/browse` redirects to it), Topics, Definition, Compare, Sources | `src/app/(search-app)/dictionary/`                                                                                                                                             |
+| `/favourites`                                                                                                     | `src/app/(search-app)/favourites/page.tsx`                                                                                                                                     |
+| `/forms`, `/forms/[slug]`                                                                                         | `src/app/(search-app)/forms/`                                                                                                                                                  |
+| `/medications`, `/medications/[slug]`                                                                             | `src/app/(search-app)/medications/`                                                                                                                                            |
+| `/privacy`                                                                                                        | `src/app/privacy/page.tsx` → `privacy-quiet-signal-page.tsx` + `privacy-page-content.tsx`                                                                                      |
+| `/reference/colour-coding`                                                                                        | `src/app/reference/`                                                                                                                                                           |
+| `/safety-plan`                                                                                                    | `src/app/safety-plan/page.tsx`                                                                                                                                                 |
+| `/calculators`, `/calculators/search`                                                                             | `src/app/(search-app)/calculators/`                                                                                                                                            |
+| `/services`, `/services/[slug]`                                                                                   | `src/app/(search-app)/services/`                                                                                                                                               |
+| `/therapy-compass`                                                                                                | `src/app/(search-app)/therapy-compass/`                                                                                                                                        |
+| `/tools`                                                                                                          | `src/app/(search-app)/tools/`                                                                                                                                                  |
+| `/specifiers`, `/specifiers/[slug]`, `/specifiers/builder`, `/specifiers/compare`, `/specifiers/map`              | `src/app/(search-app)/specifiers/`                                                                                                                                             |
+| `/formulation`, `/formulation/[slug]`, `/formulation/builder`, `/formulation/compare`, `/formulation/map`         | `src/app/(search-app)/formulation/`                                                                                                                                            |
+| `/mockups/*`                                                                                                      | `src/app/mockups/` (404 in production; `/mockups/development`, `/mockups/caring-contacts`, `/mockups/care-plan`, `/mockups/ward-flow` are developer-gated instead — see below) |
+| `/auth/callback`                                                                                                  | `src/app/auth/callback/route.ts`                                                                                                                                               |
 
 ### API routes (`src/app/api/`)
 
@@ -346,13 +345,24 @@ sequenceDiagram
 - Registry modes: services, forms, medications, differentials; Formulation is a local mechanism and structured-draft workspace
 - Demo mode: synthetic data when Supabase unavailable (`demo-data.ts`, `isDemoMode()` in `env.ts`)
 
-### Ward Flow (`src/app/ward-management/`, `src/components/ward-management/`)
+### Ward Flow (`src/app/mockups/ward-flow/`, `src/components/ward-management/`)
 
 Synthetic prototype for WA metro psychiatry patient flow: getting a patient from an emergency
 department to an inpatient psychiatric bed. Offline and fixture-backed — no provider calls, no
 persistence, no patient-identifiable data. Advisory only: the system proposes destinations with
 visible reasons and a human confirms or overrides.
 
+Developer-gated sandbox, reached only through the developer page (`/mockups/development`), the
+same pattern as the Care Plan and Caring Contacts prototypes: `"/mockups/ward-flow"` is on
+`DEVELOPER_GATED_PATH_PREFIXES` (`src/lib/developer-area/headers.ts`), so `src/proxy.ts` lets it
+through the blanket `/mockups` production block and `DeveloperAreaGate`
+(`src/app/mockups/ward-flow/layout.tsx`) requires a signed-in administrator instead of rendering
+the prototype to an anonymous visitor. The move only relocated and re-gated the route tree; the
+Tools catalogue entry (`src/lib/tools-catalog.ts`, id `ward-management`) still exists and now
+points at the gated path rather than being removed — a separate, not-yet-landed task drops it
+(and the applications-launcher, tools-search-results, and category-identity mentions that key off
+it) from clinical discovery entirely.
+
 - **Design spec:** `docs/superpowers/specs/2026-08-18-ward-flow-metro-patient-flow-design.md`
 - **Glossary:** `docs/ward-management-context.md` · **Decisions:** `docs/ward-management-decisions.md`
 - **Route/role map:** `docs/ward-management-mode-map.md`
@@ -363,23 +373,23 @@ visible reasons and a human confirms or overrides.
   derivations)
 - **Surfaces:** `ward-management-console.tsx` (command), `ward-management-modes.tsx` (mode
   workspaces), `ward-management-network.tsx` (network diagram), `ward-management-navigation.tsx`,
-  `src/app/ward-management/constellation/page.tsx` (retired constellation; server redirect to
-  `/ward-management/network`), `coordinator/coordinator-screen.tsx` (Phase 3 live coordinator screen — priority queue, statewide
+  `src/app/mockups/ward-flow/constellation/page.tsx` (retired constellation; server redirect to
+  `/mockups/ward-flow/network`), `coordinator/coordinator-screen.tsx` (Phase 3 live coordinator screen — priority queue, statewide
   flow diagram, explainable shortlist), `ward/ward-screen.tsx` (Task 8: one inpatient unit's own
-  view — `/ward-management/ward/[unitId]`; capacity confirmation, incoming-referral accept/hold/
+  view — `/mockups/ward-flow/ward/[unitId]`; capacity confirmation, incoming-referral accept/hold/
   decline, restriction notices, withdrawn referrals), `officer/officer-screen.tsx` (Task 9: the
-  transport officer's phone — `/ward-management/transport/officer`; every transport job not yet
+  transport officer's phone — `/mockups/ward-flow/transport/officer`; every transport job not yet
   arrived, since `TransportJob` carries a `provider` organisation and no officer identity;
   queue-plus-pinned-action-bar pattern inherited from `shortlist-panel.tsx`, one job "active" at a
   time with its four transport actions — accepted, en route, collected, arrived — pinned to the
   viewport bottom on phone widths), `tracker/live-tracker.tsx` (Task 10: the coordinator's live
-  tracker, rewriting the existing route — `/ward-management/transport`; every open movement that
+  tracker, rewriting the existing route — `/mockups/ward-flow/transport`; every open movement that
   carries a transport job, its leg via `tracker/tracker-derivations.ts`'s `trackerRowState`
   (delegating to `transportLeg`) and how long since that leg's own stamp via `stampAgeText`; a
   movement with no transport job at all is never listed as a row — the banner states the excluded
   count in real text instead, the same on-screen-honesty discipline as the officer screen's "no
   officer identity" notice), `ed/ed-screen.tsx` (Task 11: one emergency department's own view —
-  `/ward-management/ed/[edId]`, resolved via `ward-sites.ts`'s `edById`; both clocks (time in
+  `/mockups/ward-flow/ed/[edId]`, resolved via `ward-sites.ts`'s `edById`; both clocks (time in
   department from `openedAt`, the legal clock from `formedAt` where earlier, marked
   `data-community-formed`), the 24-hour `ED_ACCESS_TARGET_MINUTES` departmental access target
   — labelled and computed so it can never be mistaken for a legal deadline and never touches a
@@ -387,13 +397,13 @@ visible reasons and a human confirms or overrides.
   raise-referral form (`RAISE_REFERRAL`), a record-examination form (`RECORD_EXAMINATION`), and
   the mark-handover-ready control (`HANDOVER_READY`) that is the only producer of a transport job;
   statewide capacity shown read-only), `handover/handover-page.tsx` (Phase 4 Task 4: the shift
-  handover — `/ward-management/handover`; four fixed, product-owner-approved sections in a fixed
+  handover — `/mockups/ward-flow/handover`; four fixed, product-owner-approved sections in a fixed
   order (longest waits, beds held, in transit, placement gone wrong) built by `ward-derivations.ts`'s
   `handoverSnapshot`; read once from `useWardFlow()` inside a `useState` initialiser so the page is
   frozen at the moment it is opened and never re-derives on the 30-second clock tick; every section
   renders an explicit "None" line rather than hiding itself when empty; a Print button calls
   `window.print()`, styled by `handover.module.css`'s own `@media print` block), `escalation/escalation-board.tsx`
-  (Phase 4 Task 5: the escalation board — `/ward-management/escalation`; one place showing every
+  (Phase 4 Task 5: the escalation board — `/mockups/ward-flow/escalation`; one place showing every
   patient whose placement has gone wrong, via `ward-derivations.ts`'s `escalationBoard`; two
   independently-computed, read-only sections — `escalated` (movements carrying a recorded
   `Movement.escalation`: when, `triedUnitIds` resolved to real `Unit` objects, contact, wait) and
@@ -403,7 +413,7 @@ visible reasons and a human confirms or overrides.
   still has nowhere eligible. Unlike the handover, this page is NOT frozen: it reads the live clock on
   every render, since a coordinator working this board wants the current picture. Records and shows
   only — it computes no near-miss, no least-bad option, and no statement of what would need to change
-  for a ward to work), `search/patient-search.tsx` (Phase 4 Task 7: patient search — `/ward-management/search`;
+  for a ward to work), `search/patient-search.tsx` (Phase 4 Task 7: patient search — `/mockups/ward-flow/search`;
   product owner's choice: its own page, reached from the left-hand menu, rather than a box on the
   coordinator screen. A single live filter over `ward-derivations.ts`'s `searchMovements` — a free-text
   field matching movement id, `originEdId`, the resolved destination unit's id/name, the stage's own
@@ -415,7 +425,7 @@ visible reasons and a human confirms or overrides.
   the page's own single search composer — Ward Flow routes never mount the shared global shell
   composer, so nothing else on the page competes with it)
 - **State layer (Phase 3):** `ward-flow-provider.tsx` (`WardFlowProvider`/`useWardFlow`, mounted at
-  `src/app/ward-management/layout.tsx`), `ward-flow-reducer.ts` (the one mutation path),
+  `src/app/mockups/ward-flow/layout.tsx`), `ward-flow-reducer.ts` (the one mutation path),
   `ward-flow-events.ts` (event/role table)
 - **Tests:** `tests/ward-management.test.ts`, `tests/ui-ward-management.spec.ts`,
   `tests/ui-ward-coordinator.spec.ts`, `tests/ui-ward-roles.spec.ts`, `tests/ward-handover.test.ts`
diff --git a/docs/design-system/ADOPTION.md b/docs/design-system/ADOPTION.md
index 7d3fb381d6..136ee8fabd 100644
--- a/docs/design-system/ADOPTION.md
+++ b/docs/design-system/ADOPTION.md
@@ -357,35 +357,33 @@ product exclusions; the only route-only dispositions are the documented legacy-r
 surfaces. Shared shell/component roots carry their own explicit `shared-shell` disposition.
 
 Registered public components: 54
-Declared product roots: 100
+Declared product roots: 74
 Roots with a literal `.ckb-v2` opt-in: 1
-Roots inheriting `.ckb-v2` from the global `<html>`: 99
-Production surfaces observed under v2: 17/17
+Roots inheriting `.ckb-v2` from the global `<html>`: 73
+Production surfaces observed under v2: 15/15
 Dynamic `ckb-v2` constructions: 0
-Declared production page routes: 82/82
+Declared production page routes: 66/66
 
 Source observation and contract declaration are independent. A literal `ckb-v2` on the global `<html>` makes every production surface inherit v2, but it does not approve that adoption.
 The Proof column summarizes each surface's dark, forced-colours, 320px, print and browser declarations; exact statuses and evidence paths live in the manifest.
 Observed v2 under a compatibility declaration fails closed. A declared v2 shell also fails closed unless every proof is passed with evidence and its visual baseline is committed or explicitly not-committed (pending Linux screenshot approval).
 
-| Surface                                         | Disposition     | Routes | Roots | Declared shell | Observed shell (mount)     | Proof          | Baseline       |
-| ----------------------------------------------- | --------------- | -----: | ----: | -------------- | -------------------------- | -------------- | -------------- |
-| `root-shell-and-settings`                       | shared-shell    |      3 |     6 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `catalogues-forms-and-info`                     | owned           |     23 |    23 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `differentials`                                 | owned           |      7 |     7 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `formulation`                                   | owned           |      6 |     6 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `specifiers`                                    | owned           |      6 |     6 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `therapy-compass`                               | owned           |      9 |    10 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `documents-and-source-evidence`                 | owned           |      3 |     4 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `documents-source-legacy-redirect`              | legacy-redirect |      1 |     0 | v2             | v2 (inherited-global-root) | not-applicable | not-applicable |
-| `ward-management-constellation-legacy-redirect` | legacy-redirect |      1 |     0 | v2             | v2 (inherited-global-root) | not-applicable | not-applicable |
-| `favourites`                                    | owned           |      1 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `tools-and-calculators`                         | owned           |      3 |     3 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `caring-contacts-workspace`                     | owned           |      1 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `ward-management`                               | owned           |     15 |    26 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `privacy-safety-and-reference`                  | owned           |      3 |     3 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `search-results-shared`                         | shared-shell    |      0 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `answers-shared`                                | shared-shell    |      0 |     2 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
-| `source-preview-shared`                         | shared-shell    |      0 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| Surface                            | Disposition     | Routes | Roots | Declared shell | Observed shell (mount)     | Proof          | Baseline       |
+| ---------------------------------- | --------------- | -----: | ----: | -------------- | -------------------------- | -------------- | -------------- |
+| `root-shell-and-settings`          | shared-shell    |      3 |     6 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `catalogues-forms-and-info`        | owned           |     23 |    23 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `differentials`                    | owned           |      7 |     7 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `formulation`                      | owned           |      6 |     6 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `specifiers`                       | owned           |      6 |     6 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `therapy-compass`                  | owned           |      9 |    10 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `documents-and-source-evidence`    | owned           |      3 |     4 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `documents-source-legacy-redirect` | legacy-redirect |      1 |     0 | v2             | v2 (inherited-global-root) | not-applicable | not-applicable |
+| `favourites`                       | owned           |      1 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `tools-and-calculators`            | owned           |      3 |     3 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `caring-contacts-workspace`        | owned           |      1 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `privacy-safety-and-reference`     | owned           |      3 |     3 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `search-results-shared`            | shared-shell    |      0 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `answers-shared`                   | shared-shell    |      0 |     2 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
+| `source-preview-shared`            | shared-shell    |      0 |     1 | v2             | v2 (inherited-global-root) | passed         | not-committed  |
 
 <!-- adoption-manifest:adoption:end -->
diff --git a/docs/design-system/adoption-contract.json b/docs/design-system/adoption-contract.json
index f3bac529bd..15058dde8b 100644
--- a/docs/design-system/adoption-contract.json
+++ b/docs/design-system/adoption-contract.json
@@ -10,10 +10,6 @@
     "documents-source-legacy-redirect": {
       "route": "src/app/(search-app)/documents/source/page.tsx",
       "kind": "next-redirect-only"
-    },
-    "ward-management-constellation-legacy-redirect": {
-      "route": "src/app/ward-management/constellation/page.tsx",
-      "kind": "next-redirect-only"
     }
   },
   "proofEvidencePolicy": {
@@ -431,43 +427,6 @@
       "sanctionedSpecialPatterns": [],
       "documentedDisposition": "Legacy source URLs validate the document id and redirect to the canonical /documents/[id] route; they do not own a visual surface."
     },
-    {
-      "id": "ward-management-constellation-legacy-redirect",
-      "disposition": "legacy-redirect",
-      "routes": ["src/app/ward-management/constellation/page.tsx"],
-      "routeRoots": false,
-      "roots": [],
-      "permittedComponentFamilies": [],
-      "expectedShellState": "v2",
-      "proof": {
-        "dark": {
-          "status": "not-applicable",
-          "evidence": []
-        },
-        "forcedColours": {
-          "status": "not-applicable",
-          "evidence": []
-        },
-        "compact320": {
-          "status": "not-applicable",
-          "evidence": []
-        },
-        "print": {
-          "status": "not-applicable",
-          "evidence": []
-        },
-        "browser": {
-          "status": "not-applicable",
-          "evidence": []
-        }
-      },
-      "baseline": {
-        "status": "not-applicable",
-        "files": []
-      },
-      "sanctionedSpecialPatterns": [],
-      "documentedDisposition": "Retired Phase 1 constellation URLs redirect to /ward-management/network; they do not own a visual surface."
-    },
     {
       "id": "favourites",
       "disposition": "owned",
@@ -580,78 +539,6 @@
       },
       "sanctionedSpecialPatterns": ["CaringContactsShell"]
     },
-    {
-      "id": "ward-management",
-      "disposition": "owned",
-      "routes": [
-        "src/app/ward-management/page.tsx",
-        "src/app/ward-management/capacity/page.tsx",
-        "src/app/ward-management/ed/[edId]/page.tsx",
-        "src/app/ward-management/escalation/page.tsx",
-        "src/app/ward-management/exceptions/page.tsx",
-        "src/app/ward-management/governance/page.tsx",
-        "src/app/ward-management/handover/page.tsx",
-        "src/app/ward-management/movements/page.tsx",
-        "src/app/ward-management/network/page.tsx",
-        "src/app/ward-management/patients/[patientId]/page.tsx",
-        "src/app/ward-management/queue/page.tsx",
-        "src/app/ward-management/search/page.tsx",
-        "src/app/ward-management/transport/page.tsx",
-        "src/app/ward-management/transport/officer/page.tsx",
-        "src/app/ward-management/ward/[unitId]/page.tsx"
-      ],
-      "routeRoots": true,
-      "roots": [
-        "src/components/ward-management/coordinator/coordinator-screen.tsx",
-        "src/components/ward-management/ed/ed-screen.tsx",
-        "src/components/ward-management/escalation/escalation-board.tsx",
-        "src/components/ward-management/handover/handover-page.tsx",
-        "src/components/ward-management/officer/officer-screen.tsx",
-        "src/components/ward-management/search/patient-search.tsx",
-        "src/components/ward-management/ward-management-console.tsx",
-        "src/components/ward-management/ward-management-modes.tsx",
-        "src/components/ward-management/ward-management-navigation.tsx",
-        "src/components/ward-management/ward-management-network.tsx",
-        "src/components/ward-management/ward/ward-screen.tsx"
-      ],
-      "permittedComponentFamilies": ["controls", "feedback", "layout"],
-      "expectedShellState": "v2",
-      "proof": {
-        "dark": {
-          "status": "passed",
-          "evidence": ["tests/ui-style-contract.spec.ts"]
-        },
-        "forcedColours": {
-          "status": "passed",
-          "evidence": ["tests/ckb-v2-token-contract.test.ts"]
-        },
-        "compact320": {
-          "status": "passed",
-          "evidence": ["tests/ui-smoke.spec.ts"]
-        },
-        "print": {
-          "status": "passed",
-          "evidence": ["tests/global-v2-activation.test.ts"]
-        },
-        "browser": {
-          "status": "passed",
-          "evidence": ["tests/ui-visual-baseline.spec.ts"]
-        }
-      },
-      "baseline": {
-        "status": "not-committed",
-        "files": []
-      },
-      "sanctionedSpecialPatterns": [
-        "CoordinatorScreen",
-        "PatientMovementWorkspace",
-        "WardModeWorkspace",
-        "WardModeNavigation",
-        "ClinicalRail",
-        "WardNetworkWorkspace"
-      ],
-      "documentedDisposition": "Ward Flow is a synthetic operational coordination surface with a coordinator command home, statewide flow diagram and explainable shortlist, rail-based mode navigation, role-aware queue-first phone fallback, linked operational workspaces, and an explainable human-confirmed destination workflow."
-    },
     {
       "id": "privacy-safety-and-reference",
       "disposition": "owned",
diff --git a/docs/design-system/adoption-manifest.json b/docs/design-system/adoption-manifest.json
index 0f0cb74c8d..1a84721fb6 100644
--- a/docs/design-system/adoption-manifest.json
+++ b/docs/design-system/adoption-manifest.json
@@ -21,10 +21,6 @@
       "documents-source-legacy-redirect": {
         "route": "src/app/(search-app)/documents/source/page.tsx",
         "kind": "next-redirect-only"
-      },
-      "ward-management-constellation-legacy-redirect": {
-        "route": "src/app/ward-management/constellation/page.tsx",
-        "kind": "next-redirect-only"
       }
     },
     "evidence": {
@@ -3196,63 +3192,6 @@
       "sanctionedSpecialPatterns": [],
       "roots": []
     },
-    {
-      "id": "ward-management-constellation-legacy-redirect",
-      "disposition": "legacy-redirect",
-      "documentedDisposition": "Retired Phase 1 constellation URLs redirect to /ward-management/network; they do not own a visual surface.",
-      "routes": ["src/app/ward-management/constellation/page.tsx"],
-      "routeRoots": false,
-      "proofApplicability": "not-applicable",
-      "nonVisualRoute": {
-        "contract": {
-          "route": "src/app/ward-management/constellation/page.tsx",
-          "kind": "next-redirect-only"
-        },
-        "source": {
-          "importsNextRedirect": true,
-          "hasDefaultFunction": true,
-          "hasJsx": false,
-          "terminalOutcomes": ["redirect"],
-          "redirectOnly": true
-        },
-        "topologyMatches": true
-      },
-      "declaredShellState": "v2",
-      "observedShellState": "v2",
-      "v2ShellMounted": true,
-      "v2MountMode": "inherited-global-root",
-      "inheritedFrom": "src/app/layout.tsx",
-      "directV2MountFiles": [],
-      "proof": {
-        "browser": {
-          "status": "not-applicable",
-          "evidence": []
-        },
-        "compact320": {
-          "status": "not-applicable",
-          "evidence": []
-        },
-        "dark": {
-          "status": "not-applicable",
-          "evidence": []
-        },
-        "forcedColours": {
-          "status": "not-applicable",
-          "evidence": []
-        },
-        "print": {
-          "status": "not-applicable",
-          "evidence": []
-        }
-      },
-      "baseline": {
-        "status": "not-applicable",
-        "files": []
-      },
-      "permittedComponentFamilies": [],
-      "sanctionedSpecialPatterns": [],
-      "roots": []
-    },
     {
       "id": "favourites",
       "disposition": "owned",
@@ -3442,334 +3381,6 @@
         }
       ]
     },
-    {
-      "id": "ward-management",
-      "disposition": "owned",
-      "documentedDisposition": "Ward Flow is a synthetic operational coordination surface with a coordinator command home, statewide flow diagram and explainable shortlist, rail-based mode navigation, role-aware queue-first phone fallback, linked operational workspaces, and an explainable human-confirmed destination workflow.",
-      "routes": [
-        "src/app/ward-management/capacity/page.tsx",
-        "src/app/ward-management/ed/[edId]/page.tsx",
-        "src/app/ward-management/escalation/page.tsx",
-        "src/app/ward-management/exceptions/page.tsx",
-        "src/app/ward-management/governance/page.tsx",
-        "src/app/ward-management/handover/page.tsx",
-        "src/app/ward-management/movements/page.tsx",
-        "src/app/ward-management/network/page.tsx",
-        "src/app/ward-management/page.tsx",
-        "src/app/ward-management/patients/[patientId]/page.tsx",
-        "src/app/ward-management/queue/page.tsx",
-        "src/app/ward-management/search/page.tsx",
-        "src/app/ward-management/transport/officer/page.tsx",
-        "src/app/ward-management/transport/page.tsx",
-        "src/app/ward-management/ward/[unitId]/page.tsx"
-      ],
-      "routeRoots": true,
-      "proofApplicability": "required",
-      "nonVisualRoute": null,
-      "declaredShellState": "v2",
-      "observedShellState": "v2",
-      "v2ShellMounted": true,
-      "v2MountMode": "inherited-global-root",
-      "inheritedFrom": "src/app/layout.tsx",
-      "directV2MountFiles": [],
-      "proof": {
-        "browser": {
-          "status": "passed",
-          "evidence": ["tests/ui-visual-baseline.spec.ts"]
-        },
-        "compact320": {
-          "status": "passed",
-          "evidence": ["tests/ui-smoke.spec.ts"]
-        },
-        "dark": {
-          "status": "passed",
-          "evidence": ["tests/ui-style-contract.spec.ts"]
-        },
-        "forcedColours": {
-          "status": "passed",
-          "evidence": ["tests/ckb-v2-token-contract.test.ts"]
-        },
-        "print": {
-          "status": "passed",
-          "evidence": ["tests/global-v2-activation.test.ts"]
-        }
-      },
-      "baseline": {
-        "status": "not-committed",
-        "files": []
-      },
-      "permittedComponentFamilies": ["controls", "feedback", "layout"],
-      "sanctionedSpecialPatterns": [
-        "ClinicalRail",
-        "CoordinatorScreen",
-        "PatientMovementWorkspace",
-        "WardModeNavigation",
-        "WardModeWorkspace",
-        "WardNetworkWorkspace"
-      ],
-      "roots": [
-        {
-          "file": "src/app/ward-management/capacity/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["WardModeWorkspace"]
-        },
-        {
-          "file": "src/app/ward-management/ed/[edId]/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": []
-        },
-        {
-          "file": "src/app/ward-management/escalation/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": []
-        },
-        {
-          "file": "src/app/ward-management/exceptions/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["WardModeWorkspace"]
-        },
-        {
-          "file": "src/app/ward-management/governance/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["WardModeWorkspace"]
-        },
-        {
-          "file": "src/app/ward-management/handover/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": []
-        },
-        {
-          "file": "src/app/ward-management/movements/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["WardModeWorkspace"]
-        },
-        {
-          "file": "src/app/ward-management/network/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["WardModeWorkspace"]
-        },
-        {
-          "file": "src/app/ward-management/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["CoordinatorScreen"]
-        },
-        {
-          "file": "src/app/ward-management/patients/[patientId]/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": []
-        },
-        {
-          "file": "src/app/ward-management/queue/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["WardModeWorkspace"]
-        },
-        {
-          "file": "src/app/ward-management/search/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": []
-        },
-        {
-          "file": "src/app/ward-management/transport/officer/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": []
-        },
-        {
-          "file": "src/app/ward-management/transport/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": []
-        },
-        {
-          "file": "src/app/ward-management/ward/[unitId]/page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": []
-        },
-        {
-          "file": "src/components/ward-management/coordinator/coordinator-screen.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["CoordinatorScreen", "ClinicalRail"]
-        },
-        {
-          "file": "src/components/ward-management/ed/ed-screen.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["ClinicalRail"]
-        },
-        {
-          "file": "src/components/ward-management/escalation/escalation-board.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["ClinicalRail"]
-        },
-        {
-          "file": "src/components/ward-management/handover/handover-page.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["ClinicalRail"]
-        },
-        {
-          "file": "src/components/ward-management/officer/officer-screen.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["ClinicalRail"]
-        },
-        {
-          "file": "src/components/ward-management/search/patient-search.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["ClinicalRail"]
-        },
-        {
-          "file": "src/components/ward-management/ward-management-console.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["ClinicalRail"]
-        },
-        {
-          "file": "src/components/ward-management/ward-management-modes.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["WardModeWorkspace", "ClinicalRail", "WardNetworkWorkspace"]
-        },
-        {
-          "file": "src/components/ward-management/ward-management-navigation.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["WardModeNavigation", "ClinicalRail"]
-        },
-        {
-          "file": "src/components/ward-management/ward-management-network.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["WardNetworkWorkspace"]
-        },
-        {
-          "file": "src/components/ward-management/ward/ward-screen.tsx",
-          "exists": true,
-          "imports": [],
-          "importedFamilies": [],
-          "literalCkbV2": false,
-          "dynamicCkbV2": false,
-          "v2MountMode": "inherited-global-root",
-          "sanctionedPatternsPresent": ["ClinicalRail"]
-        }
-      ]
-    },
     {
       "id": "privacy-safety-and-reference",
       "disposition": "owned",
@@ -4092,23 +3703,7 @@
       "src/app/caring-contacts/page.tsx",
       "src/app/privacy/page.tsx",
       "src/app/reference/colour-coding/page.tsx",
-      "src/app/safety-plan/page.tsx",
-      "src/app/ward-management/capacity/page.tsx",
-      "src/app/ward-management/constellation/page.tsx",
-      "src/app/ward-management/ed/[edId]/page.tsx",
-      "src/app/ward-management/escalation/page.tsx",
-      "src/app/ward-management/exceptions/page.tsx",
-      "src/app/ward-management/governance/page.tsx",
-      "src/app/ward-management/handover/page.tsx",
-      "src/app/ward-management/movements/page.tsx",
-      "src/app/ward-management/network/page.tsx",
-      "src/app/ward-management/page.tsx",
-      "src/app/ward-management/patients/[patientId]/page.tsx",
-      "src/app/ward-management/queue/page.tsx",
-      "src/app/ward-management/search/page.tsx",
-      "src/app/ward-management/transport/officer/page.tsx",
-      "src/app/ward-management/transport/page.tsx",
-      "src/app/ward-management/ward/[unitId]/page.tsx"
+      "src/app/safety-plan/page.tsx"
     ],
     "declared": [
       "src/app/(search-app)/calculators/page.tsx",
@@ -4176,23 +3771,7 @@
       "src/app/caring-contacts/page.tsx",
       "src/app/privacy/page.tsx",
       "src/app/reference/colour-coding/page.tsx",
-      "src/app/safety-plan/page.tsx",
-      "src/app/ward-management/capacity/page.tsx",
-      "src/app/ward-management/constellation/page.tsx",
-      "src/app/ward-management/ed/[edId]/page.tsx",
-      "src/app/ward-management/escalation/page.tsx",
-      "src/app/ward-management/exceptions/page.tsx",
-      "src/app/ward-management/governance/page.tsx",
-      "src/app/ward-management/handover/page.tsx",
-      "src/app/ward-management/movements/page.tsx",
-      "src/app/ward-management/network/page.tsx",
-      "src/app/ward-management/page.tsx",
-      "src/app/ward-management/patients/[patientId]/page.tsx",
-      "src/app/ward-management/queue/page.tsx",
-      "src/app/ward-management/search/page.tsx",
-      "src/app/ward-management/transport/officer/page.tsx",
-      "src/app/ward-management/transport/page.tsx",
-      "src/app/ward-management/ward/[unitId]/page.tsx"
+      "src/app/safety-plan/page.tsx"
     ],
     "undeclared": [],
     "missing": [],
@@ -4200,17 +3779,17 @@
   },
   "adoption": {
     "literalCkbV2RootCount": 1,
-    "inheritedCkbV2RootCount": 99,
+    "inheritedCkbV2RootCount": 73,
     "dynamicCkbV2RootCount": 0,
-    "v2MountedSurfaceCount": 17,
-    "declaredV2SurfaceCount": 17
+    "v2MountedSurfaceCount": 15,
+    "declaredV2SurfaceCount": 15
   },
   "summary": {
     "registeredComponentCount": 54,
     "previewCount": 54,
     "productImportedComponentCount": 34,
-    "rootCount": 100,
-    "productionRouteCount": 82,
-    "nextUiEntryCount": 143
+    "rootCount": 74,
+    "productionRouteCount": 66,
+    "nextUiEntryCount": 126
   }
 }
diff --git a/docs/site-map.md b/docs/site-map.md
index 9f84ad2c8a..4c9343f7b7 100644
--- a/docs/site-map.md
+++ b/docs/site-map.md
@@ -57,21 +57,6 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 - `/therapy-compass/review` - Therapy records awaiting qualified-clinician source review. Source: `src/app/(search-app)/therapy-compass/review/page.tsx`.
 - `/therapy-compass/search` - Therapy library search surface. Source: `src/app/(search-app)/therapy-compass/search/page.tsx`.
 - `/tools` - Clinical tools and applications launcher directory. Source: `src/app/(search-app)/tools/page.tsx`.
-- `/ward-management` - Statewide psychiatry ward demand, bed capacity, and patient flow console. Source: `src/app/ward-management/page.tsx`.
-- `/ward-management/capacity` - Ward bed availability, unit occupancy, and staffing capacity. Source: `src/app/ward-management/capacity/page.tsx`.
-- `/ward-management/constellation` - Compatibility redirect to `/ward-management/network`. Phase 2 retired the constellation command view. Source: `src/app/ward-management/constellation/page.tsx`.
-- `/ward-management/ed/[edId]` - Synthetic emergency-department role screen for one origin department. Source: `src/app/ward-management/ed/[edId]/page.tsx`.
-- `/ward-management/escalation` - One place showing every synthetic Ward Flow patient whose placement has gone wrong. Records and shows only. Source: `src/app/ward-management/escalation/page.tsx`.
-- `/ward-management/exceptions` - Patient flow exceptions, delays, and escalation alerts. Source: `src/app/ward-management/exceptions/page.tsx`.
-- `/ward-management/governance` - Ward coordination governance, compliance, and audit log. Source: `src/app/ward-management/governance/page.tsx`.
-- `/ward-management/handover` - Synthetic, point-in-time, printable shift handover, frozen at the moment it is opened. Source: `src/app/ward-management/handover/page.tsx`.
-- `/ward-management/movements` - Scheduled and completed patient transfers and bed movements. Source: `src/app/ward-management/movements/page.tsx`.
-- `/ward-management/network` - Psychiatric bed network status and regional catchment map. Source: `src/app/ward-management/network/page.tsx`.
-- `/ward-management/queue` - Priority referral queue and triage waiting list. Source: `src/app/ward-management/queue/page.tsx`.
-- `/ward-management/search` - Synthetic patient search — find an open Ward Flow movement by id, department, destination, stage or owner. Source: `src/app/ward-management/search/page.tsx`.
-- `/ward-management/transport` - Patient inter-hospital transfer and transport logistics. Source: `src/app/ward-management/transport/page.tsx`.
-- `/ward-management/transport/officer` - Synthetic transport-officer phone screen for in-flight jobs. Source: `src/app/ward-management/transport/officer/page.tsx`.
-- `/ward-management/ward/[unitId]` - Synthetic ward-manager screen for one inpatient unit. Source: `src/app/ward-management/ward/[unitId]/page.tsx`.
 
 ## Mode/query routes
 
@@ -1143,10 +1128,6 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 
 - `/documents/[id]` - Document viewer/detail page. Individual document IDs are intentionally not enumerated in this sitemap.
 
-## Ward management patient route
-
-- `/ward-management/patients/[patientId]` - Synthetic patient placement and transfer trajectory detail. Synthetic patient IDs are generated runtime data and intentionally not enumerated in this sitemap.
-
 ## Mockup/prototype routes
 
 - `/mockups/accessible-table-browser-fixture` - Route discovered from app directory Source: `src/app/mockups/accessible-table-browser-fixture/page.tsx`.
@@ -1265,6 +1246,22 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 - `/mockups/universal-search-command` - Route discovered from app directory Source: `src/app/mockups/universal-search-command/page.tsx`.
 - `/mockups/universal-search-redesign` - Route discovered from app directory Source: `src/app/mockups/universal-search-redesign/page.tsx`.
 - `/mockups/verification-notice-subtle` - Route discovered from app directory Source: `src/app/mockups/verification-notice-subtle/page.tsx`.
+- `/mockups/ward-flow` - Route discovered from app directory Source: `src/app/mockups/ward-flow/page.tsx`.
+- `/mockups/ward-flow/capacity` - Route discovered from app directory Source: `src/app/mockups/ward-flow/capacity/page.tsx`.
+- `/mockups/ward-flow/constellation` - Route discovered from app directory Source: `src/app/mockups/ward-flow/constellation/page.tsx`.
+- `/mockups/ward-flow/ed/[edId]` - Route discovered from app directory Source: `src/app/mockups/ward-flow/ed/[edId]/page.tsx`.
+- `/mockups/ward-flow/escalation` - Route discovered from app directory Source: `src/app/mockups/ward-flow/escalation/page.tsx`.
+- `/mockups/ward-flow/exceptions` - Route discovered from app directory Source: `src/app/mockups/ward-flow/exceptions/page.tsx`.
+- `/mockups/ward-flow/governance` - Route discovered from app directory Source: `src/app/mockups/ward-flow/governance/page.tsx`.
+- `/mockups/ward-flow/handover` - Route discovered from app directory Source: `src/app/mockups/ward-flow/handover/page.tsx`.
+- `/mockups/ward-flow/movements` - Route discovered from app directory Source: `src/app/mockups/ward-flow/movements/page.tsx`.
+- `/mockups/ward-flow/network` - Route discovered from app directory Source: `src/app/mockups/ward-flow/network/page.tsx`.
+- `/mockups/ward-flow/patients/[patientId]` - Route discovered from app directory Source: `src/app/mockups/ward-flow/patients/[patientId]/page.tsx`.
+- `/mockups/ward-flow/queue` - Route discovered from app directory Source: `src/app/mockups/ward-flow/queue/page.tsx`.
+- `/mockups/ward-flow/search` - Route discovered from app directory Source: `src/app/mockups/ward-flow/search/page.tsx`.
+- `/mockups/ward-flow/transport` - Route discovered from app directory Source: `src/app/mockups/ward-flow/transport/page.tsx`.
+- `/mockups/ward-flow/transport/officer` - Route discovered from app directory Source: `src/app/mockups/ward-flow/transport/officer/page.tsx`.
+- `/mockups/ward-flow/ward/[unitId]` - Route discovered from app directory Source: `src/app/mockups/ward-flow/ward/[unitId]/page.tsx`.
 - `/mockups/warning-consolidation` - Route discovered from app directory Source: `src/app/mockups/warning-consolidation/page.tsx`.
 - `/mockups/warning-line` - Route discovered from app directory Source: `src/app/mockups/warning-line/page.tsx`.
 
@@ -1347,10 +1344,10 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 - `/formulation` - Redirects to `/?mode=formulation`. Source: `src/app/(search-app)/formulation/page.tsx`.
 - `/mockups/favourites-hub` - Redirects to `/favourites`. Source: `src/app/mockups/favourites-hub/page.tsx`.
 - `/mockups/medication-prescribing` - Redirects to `/medications/acamprosate`. Source: `src/app/mockups/medication-prescribing/page.tsx`.
+- `/mockups/ward-flow/constellation` - Redirects to `/mockups/ward-flow/network`. Source: `src/app/mockups/ward-flow/constellation/page.tsx`.
 - `/services` - Redirects to `/?mode=services`. Source: `src/app/(search-app)/services/page.tsx`.
 - `/specifiers` - Redirects to `/?mode=specifiers`. Source: `src/app/(search-app)/specifiers/page.tsx`.
 - `/therapy-compass` - Redirects to `/?mode=therapy-compass`. Source: `src/app/(search-app)/therapy-compass/page.tsx`.
-- `/ward-management/constellation` - Redirects to `/ward-management/network`. Source: `src/app/ward-management/constellation/page.tsx`.
 
 ## Known caveats and stale-path flags
 
@@ -1380,7 +1377,6 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 | Therapy Compass                | `src/app/(search-app)/therapy-compass, src/lib/therapies.ts`                                               |
 | Factsheets                     | `src/app/(search-app)/factsheets, src/components/factsheets`                                               |
 | Dictionary                     | `src/app/(search-app)/dictionary, src/lib/dictionary.ts`                                                   |
-| Ward Management                | `src/app/ward-management, src/components/ward-management`                                                  |
 | Safety Plan                    | `src/app/safety-plan, src/components/patient-safety-plan.tsx`                                              |
 | Privacy                        | `src/app/privacy`                                                                                          |
 | Tools                          | `src/components/applications-launcher-page.tsx`                                                            |
diff --git a/docs/ward-management-mode-map.md b/docs/ward-management-mode-map.md
index 41c15eb1ba..3e1bb3f77a 100644
--- a/docs/ward-management-mode-map.md
+++ b/docs/ward-management-mode-map.md
@@ -7,8 +7,8 @@ That design has not been built yet — Phase 2 is what actually retires these mo
 document still describes the routes as they exist today. Read the design spec for where the
 product is headed; read this document for what is currently live.
 
-**Phase 2 update (Task 9):** Constellation (`/ward-management/constellation`) is retired. The
-route remains as a server `redirect()` to `/ward-management/network` so live-main bookmarks do
+**Phase 2 update (Task 9):** Constellation (`/mockups/ward-flow/constellation`) is retired. The
+route remains as a server `redirect()` to `/mockups/ward-flow/network` so live-main bookmarks do
 not 404. Command
 is rebuilt as the coordinator screen (`CoordinatorScreen`) — priority queue, statewide flow
 diagram and explainable shortlist in one view — and absorbs the working-surface role Constellation
@@ -38,16 +38,16 @@ The public WA sources used to ground the wireframes establish five important con
 
 ## Primary route system
 
-| Mode           | Route                         | Primary question                                                            | Dominant visual                                                        | Primary owner         |
-| -------------- | ----------------------------- | --------------------------------------------------------------------------- | ---------------------------------------------------------------------- | --------------------- |
-| Command        | `/ward-management`            | What needs a decision now?                                                  | Priority queue + statewide flow diagram + explainable shortlist        | Flow coordinator      |
-| Network        | `/ward-management/network`    | Where is bed pressure concentrated, and which movements cross a catchment?  | Schematic node/edge diagram: fill is bed pressure, edges are movements | Flow coordinator      |
-| Priority queue | `/ward-management/queue`      | Which placement-ready movement should be reviewed next, and why?            | Sortable queue with tier, operational score and current blocker        | Flow coordinator / ED |
-| Capacity       | `/ward-management/capacity`   | Which currently confirmed bed states could support a review?                | Hospital and ward capacity matrix with freshness and capability        | Ward manager          |
-| Movements      | `/ward-management/movements`  | Where is every patient movement in the six-stage pathway?                   | Stage board with owned next action and elapsed time                    | All roles             |
-| Exceptions     | `/ward-management/exceptions` | Which time-sensitive exception needs an owner action?                       | Action inbox organised by overdue, expiring and stale state            | All roles             |
-| Transport      | `/ward-management/transport`  | Is the legal/document/booking chain ready for safe transfer?                | Transport readiness board and metro/country pathway cues               | ED / Flow coordinator |
-| Governance     | `/ward-management/governance` | Why did the system recommend this, who confirmed it, and what is synthetic? | AI assurance, audit trail, data boundary and source register           | Authorised reviewers  |
+| Mode           | Route                           | Primary question                                                            | Dominant visual                                                        | Primary owner         |
+| -------------- | ------------------------------- | --------------------------------------------------------------------------- | ---------------------------------------------------------------------- | --------------------- |
+| Command        | `/mockups/ward-flow`            | What needs a decision now?                                                  | Priority queue + statewide flow diagram + explainable shortlist        | Flow coordinator      |
+| Network        | `/mockups/ward-flow/network`    | Where is bed pressure concentrated, and which movements cross a catchment?  | Schematic node/edge diagram: fill is bed pressure, edges are movements | Flow coordinator      |
+| Priority queue | `/mockups/ward-flow/queue`      | Which placement-ready movement should be reviewed next, and why?            | Sortable queue with tier, operational score and current blocker        | Flow coordinator / ED |
+| Capacity       | `/mockups/ward-flow/capacity`   | Which currently confirmed bed states could support a review?                | Hospital and ward capacity matrix with freshness and capability        | Ward manager          |
+| Movements      | `/mockups/ward-flow/movements`  | Where is every patient movement in the six-stage pathway?                   | Stage board with owned next action and elapsed time                    | All roles             |
+| Exceptions     | `/mockups/ward-flow/exceptions` | Which time-sensitive exception needs an owner action?                       | Action inbox organised by overdue, expiring and stale state            | All roles             |
+| Transport      | `/mockups/ward-flow/transport`  | Is the legal/document/booking chain ready for safe transfer?                | Transport readiness board and metro/country pathway cues               | ED / Flow coordinator |
+| Governance     | `/mockups/ward-flow/governance` | Why did the system recommend this, who confirmed it, and what is synthetic? | AI assurance, audit trail, data boundary and source register           | Authorised reviewers  |
 
 **Navigation:** the left `ClinicalRail` carries both the global Clinical KB application switcher
 and, below it, Ward Flow's own eight mode links (icon-only, each with its own accessible name) —
diff --git a/scripts/generate-design-system-adoption.mjs b/scripts/generate-design-system-adoption.mjs
index 22e306d9fc..2c2be78332 100644
--- a/scripts/generate-design-system-adoption.mjs
+++ b/scripts/generate-design-system-adoption.mjs
@@ -81,10 +81,6 @@ const CANONICAL_NON_VISUAL_ROUTES = Object.freeze({
     route: "src/app/(search-app)/documents/source/page.tsx",
     kind: "next-redirect-only",
   },
-  "ward-management-constellation-legacy-redirect": {
-    route: "src/app/ward-management/constellation/page.tsx",
-    kind: "next-redirect-only",
-  },
 });
 
 const toPosix = (value) => value.split(path.sep).join("/");
diff --git a/scripts/generate-site-map.ts b/scripts/generate-site-map.ts
index b8426c3d41..104d1ce0e8 100644
--- a/scripts/generate-site-map.ts
+++ b/scripts/generate-site-map.ts
@@ -80,7 +80,7 @@ const documentedRedirectTargets: Record<string, string> = {
   // Pinned because the page forwards the incoming query string, so its
   // `redirect()` argument is a template literal the regex above cannot read.
   "/dictionary/browse": "/dictionary/search",
-  "/ward-management/constellation": "/ward-management/network",
+  "/mockups/ward-flow/constellation": "/mockups/ward-flow/network",
 };
 
 const routeDescriptions: Record<string, string> = {
@@ -151,25 +151,11 @@ const routeDescriptions: Record<string, string> = {
   "/therapy-compass/review": "Therapy records awaiting qualified-clinician source review.",
   "/therapy-compass/search": "Therapy library search surface.",
   "/tools": "Clinical tools and applications launcher directory.",
-  "/ward-management": "Statewide psychiatry ward demand, bed capacity, and patient flow console.",
-  "/ward-management/capacity": "Ward bed availability, unit occupancy, and staffing capacity.",
-  "/ward-management/constellation":
-    "Compatibility redirect to `/ward-management/network`. Phase 2 retired the constellation command view.",
-  "/ward-management/ed/[edId]": "Synthetic emergency-department role screen for one origin department.",
-  "/ward-management/escalation":
-    "One place showing every synthetic Ward Flow patient whose placement has gone wrong. Records and shows only.",
-  "/ward-management/exceptions": "Patient flow exceptions, delays, and escalation alerts.",
-  "/ward-management/governance": "Ward coordination governance, compliance, and audit log.",
-  "/ward-management/handover": "Synthetic, point-in-time, printable shift handover, frozen at the moment it is opened.",
-  "/ward-management/movements": "Scheduled and completed patient transfers and bed movements.",
-  "/ward-management/network": "Psychiatric bed network status and regional catchment map.",
-  "/ward-management/patients/[patientId]": "Synthetic patient placement and transfer trajectory detail.",
-  "/ward-management/queue": "Priority referral queue and triage waiting list.",
-  "/ward-management/search":
-    "Synthetic patient search — find an open Ward Flow movement by id, department, destination, stage or owner.",
-  "/ward-management/transport": "Patient inter-hospital transfer and transport logistics.",
-  "/ward-management/transport/officer": "Synthetic transport-officer phone screen for in-flight jobs.",
-  "/ward-management/ward/[unitId]": "Synthetic ward-manager screen for one inpatient unit.",
+  // Ward Flow's routes moved under /mockups/ward-flow/** in the sandbox move (see
+  // src/lib/developer-area/headers.ts). Mockup routes deliberately carry no curated
+  // description here — Care Plan and Caring Contacts, the two other developer-gated
+  // prototypes, have none either — so they render with the generic "Route discovered
+  // from app directory" fallback in the Mockup/prototype routes section below.
 };
 
 const publicRouteHandlerDescriptions: Record<string, string> = {
@@ -244,7 +230,6 @@ const routeOwnershipRows = [
   ["Therapy Compass", "src/app/(search-app)/therapy-compass, src/lib/therapies.ts"],
   ["Factsheets", "src/app/(search-app)/factsheets, src/components/factsheets"],
   ["Dictionary", "src/app/(search-app)/dictionary, src/lib/dictionary.ts"],
-  ["Ward Management", "src/app/ward-management, src/components/ward-management"],
   ["Safety Plan", "src/app/safety-plan, src/components/patient-safety-plan.tsx"],
   ["Privacy", "src/app/privacy"],
   ["Tools", "src/components/applications-launcher-page.tsx"],
@@ -574,7 +559,6 @@ function renderSiteMapRaw(data = collectSiteMapData()) {
         "/dictionary/[slug]",
         "/dictionary/topics/[slug]",
         "/factsheets/[slug]",
-        "/ward-management/patients/[patientId]",
       ].includes(route.route),
   );
   const mockupRoutes = data.pageRoutes.filter((route) => route.route.startsWith("/mockups"));
@@ -668,12 +652,6 @@ function renderSiteMapRaw(data = collectSiteMapData()) {
         "Document viewer/detail page. Individual document IDs are intentionally not enumerated in this sitemap.",
       ),
     ]),
-    ...section("Ward management patient route", [
-      bullet(
-        "/ward-management/patients/[patientId]",
-        "Synthetic patient placement and transfer trajectory detail. Synthetic patient IDs are generated runtime data and intentionally not enumerated in this sitemap.",
-      ),
-    ]),
     ...section("Mockup/prototype routes", [
       ...mockupRoutes.map((route) => routeLine(route, routeDescriptions)),
       ...(data.nonRoutedMockupArtifacts.length
diff --git a/src/app/ward-management/capacity/page.tsx b/src/app/mockups/ward-flow/capacity/page.tsx
similarity index 100%
rename from src/app/ward-management/capacity/page.tsx
rename to src/app/mockups/ward-flow/capacity/page.tsx
diff --git a/src/app/ward-management/constellation/page.tsx b/src/app/mockups/ward-flow/constellation/page.tsx
similarity index 88%
rename from src/app/ward-management/constellation/page.tsx
rename to src/app/mockups/ward-flow/constellation/page.tsx
index 5e22b91530..c4c094d7cc 100644
--- a/src/app/ward-management/constellation/page.tsx
+++ b/src/app/mockups/ward-flow/constellation/page.tsx
@@ -6,5 +6,5 @@ import { redirect } from "next/navigation";
  * live main URL does not 404 after Phase 3 lands.
  */
 export default function WardConstellationRedirect() {
-  redirect("/ward-management/network");
+  redirect("/mockups/ward-flow/network");
 }
diff --git a/src/app/ward-management/ed/[edId]/page.tsx b/src/app/mockups/ward-flow/ed/[edId]/page.tsx
similarity index 100%
rename from src/app/ward-management/ed/[edId]/page.tsx
rename to src/app/mockups/ward-flow/ed/[edId]/page.tsx
diff --git a/src/app/ward-management/escalation/page.tsx b/src/app/mockups/ward-flow/escalation/page.tsx
similarity index 100%
rename from src/app/ward-management/escalation/page.tsx
rename to src/app/mockups/ward-flow/escalation/page.tsx
diff --git a/src/app/ward-management/exceptions/page.tsx b/src/app/mockups/ward-flow/exceptions/page.tsx
similarity index 100%
rename from src/app/ward-management/exceptions/page.tsx
rename to src/app/mockups/ward-flow/exceptions/page.tsx
diff --git a/src/app/ward-management/governance/page.tsx b/src/app/mockups/ward-flow/governance/page.tsx
similarity index 100%
rename from src/app/ward-management/governance/page.tsx
rename to src/app/mockups/ward-flow/governance/page.tsx
diff --git a/src/app/ward-management/handover/page.tsx b/src/app/mockups/ward-flow/handover/page.tsx
similarity index 100%
rename from src/app/ward-management/handover/page.tsx
rename to src/app/mockups/ward-flow/handover/page.tsx
diff --git a/src/app/mockups/ward-flow/layout.tsx b/src/app/mockups/ward-flow/layout.tsx
new file mode 100644
index 0000000000..291a4e7d6d
--- /dev/null
+++ b/src/app/mockups/ward-flow/layout.tsx
@@ -0,0 +1,21 @@
+import type { ReactNode } from "react";
+
+import { DeveloperAreaGate } from "@/components/developer-area/developer-area-gate";
+import { WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+
+/**
+ * Holds the shared reducer state and clock above every ward route, same as the
+ * pre-move layout. The order matters, matching
+ * `src/app/mockups/care-plan/layout.tsx` and `src/app/mockups/caring-contacts/layout.tsx`:
+ * `DeveloperAreaGate` is outermost, so an unauthorised visitor meets the sign-in
+ * screen and never reaches `WardFlowProvider` or any prototype content. No
+ * screen wires the provider itself: a route rendered without this layout in its
+ * path must throw via `useWardFlow` rather than render a substituted empty world.
+ */
+export default function WardFlowMockupLayout({ children }: { children: ReactNode }) {
+  return (
+    <DeveloperAreaGate>
+      <WardFlowProvider>{children}</WardFlowProvider>
+    </DeveloperAreaGate>
+  );
+}
diff --git a/src/app/ward-management/movements/page.tsx b/src/app/mockups/ward-flow/movements/page.tsx
similarity index 100%
rename from src/app/ward-management/movements/page.tsx
rename to src/app/mockups/ward-flow/movements/page.tsx
diff --git a/src/app/ward-management/network/page.tsx b/src/app/mockups/ward-flow/network/page.tsx
similarity index 100%
rename from src/app/ward-management/network/page.tsx
rename to src/app/mockups/ward-flow/network/page.tsx
diff --git a/src/app/ward-management/page.tsx b/src/app/mockups/ward-flow/page.tsx
similarity index 100%
rename from src/app/ward-management/page.tsx
rename to src/app/mockups/ward-flow/page.tsx
diff --git a/src/app/ward-management/patients/[patientId]/page.tsx b/src/app/mockups/ward-flow/patients/[patientId]/page.tsx
similarity index 100%
rename from src/app/ward-management/patients/[patientId]/page.tsx
rename to src/app/mockups/ward-flow/patients/[patientId]/page.tsx
diff --git a/src/app/ward-management/queue/page.tsx b/src/app/mockups/ward-flow/queue/page.tsx
similarity index 100%
rename from src/app/ward-management/queue/page.tsx
rename to src/app/mockups/ward-flow/queue/page.tsx
diff --git a/src/app/ward-management/search/page.tsx b/src/app/mockups/ward-flow/search/page.tsx
similarity index 100%
rename from src/app/ward-management/search/page.tsx
rename to src/app/mockups/ward-flow/search/page.tsx
diff --git a/src/app/ward-management/transport/officer/page.tsx b/src/app/mockups/ward-flow/transport/officer/page.tsx
similarity index 100%
rename from src/app/ward-management/transport/officer/page.tsx
rename to src/app/mockups/ward-flow/transport/officer/page.tsx
diff --git a/src/app/ward-management/transport/page.tsx b/src/app/mockups/ward-flow/transport/page.tsx
similarity index 100%
rename from src/app/ward-management/transport/page.tsx
rename to src/app/mockups/ward-flow/transport/page.tsx
diff --git a/src/app/ward-management/ward/[unitId]/page.tsx b/src/app/mockups/ward-flow/ward/[unitId]/page.tsx
similarity index 100%
rename from src/app/ward-management/ward/[unitId]/page.tsx
rename to src/app/mockups/ward-flow/ward/[unitId]/page.tsx
diff --git a/src/app/ward-management/layout.tsx b/src/app/ward-management/layout.tsx
deleted file mode 100644
index f439617776..0000000000
--- a/src/app/ward-management/layout.tsx
+++ /dev/null
@@ -1,12 +0,0 @@
-import type { ReactNode } from "react";
-
-import { WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
-
-/**
- * Holds the shared reducer state and clock above every ward route. No screen wires this
- * itself: a route rendered without this layout in its path must throw via `useWardFlow`
- * rather than render a substituted empty world.
- */
-export default function WardManagementLayout({ children }: { children: ReactNode }) {
-  return <WardFlowProvider>{children}</WardFlowProvider>;
-}
diff --git a/src/components/ward-management/coordinator/coordinator-screen.tsx b/src/components/ward-management/coordinator/coordinator-screen.tsx
index b416491c99..bbffc0d599 100644
--- a/src/components/ward-management/coordinator/coordinator-screen.tsx
+++ b/src/components/ward-management/coordinator/coordinator-screen.tsx
@@ -37,7 +37,7 @@ const PHONE_DIAGRAM_MEDIA_QUERY = "(max-width: 48rem)";
 export function CoordinatorScreen() {
   // Task 5: the screen's props stop being derived from the frozen `wardMovements` fixture and
   // `NOW_ANCHOR` constant and start coming from the shared provider (`WardFlowProvider`, already
-  // wrapping every `/ward-management` route via `src/app/ward-management/layout.tsx`).
+  // wrapping every `/mockups/ward-flow` route via `src/app/mockups/ward-flow/layout.tsx`).
   //
   // Whole-branch review Critical 1: `units` IS now destructured and threaded into `FlowDiagram`
   // and `ShortlistPanel` below. It was deliberately left out here on the original claim that
diff --git a/src/components/ward-management/search/patient-search.tsx b/src/components/ward-management/search/patient-search.tsx
index 1c79b7f5ab..8a0f9a494f 100644
--- a/src/components/ward-management/search/patient-search.tsx
+++ b/src/components/ward-management/search/patient-search.tsx
@@ -28,7 +28,7 @@ import styles from "./search.module.css";
  * not also mount the shared global shell composer. It does not need to actively avoid one — every
  * Ward Flow route (see `handover-page.tsx`, `escalation-board.tsx`, `ward-management-console.tsx`)
  * renders only `ClinicalRail` plus its own `<main>`; none of them mount `GlobalSearchShell` /
- * `MasterSearchHeader` at all (`src/app/ward-management/layout.tsx` wraps every route in
+ * `MasterSearchHeader` at all (`src/app/mockups/ward-flow/layout.tsx` wraps every route in
  * `WardFlowProvider` alone, nothing chrome-related). So this page's own search field is the ONLY
  * composer on the page by construction, the same way it already is on every other Ward Flow route.
  *
@@ -169,7 +169,7 @@ function ResultRow({ movement, units, now }: { movement: Movement; units: Unit[]
       <td>{destination?.name ?? "No destination chosen"}</td>
       <td>{elapsedLabel(movement, now)}</td>
       <td>
-        <Link className={styles.resultLink} href={`/ward-management/patients/${movement.id}`}>
+        <Link className={styles.resultLink} href={`/mockups/ward-flow/patients/${movement.id}`}>
           Open
         </Link>
       </td>
diff --git a/src/components/ward-management/tracker/live-tracker.tsx b/src/components/ward-management/tracker/live-tracker.tsx
index 81708fee62..e048c3cfb1 100644
--- a/src/components/ward-management/tracker/live-tracker.tsx
+++ b/src/components/ward-management/tracker/live-tracker.tsx
@@ -31,7 +31,7 @@ const LEG_BADGE_CLASS: Record<TrackerLeg, string> = {
 };
 
 /**
- * Task 10: the coordinator's live tracker (`/ward-management/transport`, rewritten — spec §7:
+ * Task 10: the coordinator's live tracker (`/mockups/ward-flow/transport`, rewritten — spec §7:
  * "the existing route... the coordinator's view of every vehicle: which patient, which leg, how
  * long since the last stamp").
  *
@@ -130,7 +130,7 @@ export function LiveTracker() {
                       <dd>{stampAgeText(stampAt, now)}</dd>
                     </div>
                   </dl>
-                  <Link className={styles.reviewLink} href={`/ward-management/patients/${movement.id}`}>
+                  <Link className={styles.reviewLink} href={`/mockups/ward-flow/patients/${movement.id}`}>
                     Review patient
                   </Link>
                 </li>
diff --git a/src/components/ward-management/ward-demo-controls.tsx b/src/components/ward-management/ward-demo-controls.tsx
index 5ad6440701..0552ed006d 100644
--- a/src/components/ward-management/ward-demo-controls.tsx
+++ b/src/components/ward-management/ward-demo-controls.tsx
@@ -19,7 +19,7 @@ import styles from "./ward-demo-controls.module.css";
  * watched expiring, the one thing §5 says the control exists to demonstrate.
  *
  * Mounted once in `ClinicalRail` (`ward-management-navigation.tsx`, next to `WardRoleSwitcher`),
- * so it is present on every `/ward-management/*` route without any per-screen wiring — the clock
+ * so it is present on every `/mockups/ward-flow/*` route without any per-screen wiring — the clock
  * is shared state, not a per-screen concern.
  *
  * **This must never be mistaken for a clinical action.** Three distinct signals carry that,
diff --git a/src/components/ward-management/ward-derivations.ts b/src/components/ward-management/ward-derivations.ts
index 48a11c1eab..97ae2b5e0c 100644
--- a/src/components/ward-management/ward-derivations.ts
+++ b/src/components/ward-management/ward-derivations.ts
@@ -315,7 +315,7 @@ export function eligibleCandidatesAmong(movement: Movement, units: Unit[], now:
   // than one combined sort. A single combined sort could pull in a unit that was previously
   // outside the top `limit` (a candidate ranked 4th purely because it is restrictive would climb
   // into a 3-slot shortlist ahead of one that was already in it) — a real membership change, not
-  // just a reorder, and `/ward-management/network` shows this same shortlist. Truncating on
+  // just a reorder, and `/mockups/ward-flow/network` shows this same shortlist. Truncating on
   // eligibility alone first keeps the returned SET identical to before this ordering rule
   // existed; only the ORDER within that set can move.
   const eligibleFirst = units
diff --git a/src/components/ward-management/ward-flow-events.ts b/src/components/ward-management/ward-flow-events.ts
index 3e73008d32..4bf762132f 100644
--- a/src/components/ward-management/ward-flow-events.ts
+++ b/src/components/ward-management/ward-flow-events.ts
@@ -79,7 +79,7 @@ export type WardFlowEvent =
       unitId: string;
       /**
        * The unit the caller stated it was acting as. The ward screen is routed as
-       * `/ward-management/ward/[unitId]`, so a caller always has one to state; the reducer
+       * `/mockups/ward-flow/ward/[unitId]`, so a caller always has one to state; the reducer
        * refuses the event when this and `unitId` differ.
        *
        * This is a claim the caller makes about itself, recorded and compared. It is **not** an
diff --git a/src/components/ward-management/ward-flow-reducer.ts b/src/components/ward-management/ward-flow-reducer.ts
index f3a8a781a4..bf8e3ef298 100644
--- a/src/components/ward-management/ward-flow-reducer.ts
+++ b/src/components/ward-management/ward-flow-reducer.ts
@@ -518,7 +518,7 @@ export function wardFlowReducer(state: WardFlowState, event: WardFlowEvent): War
       // What this check does: it compares the unit the caller said it was acting as against the
       // unit being written to, and refuses the event when they differ. What it does not do: prove
       // the claim. `actingUnitId` is whatever the call site put on the event — the ward screen
-      // reads it from its own `/ward-management/ward/[unitId]` route, but nothing here verifies
+      // reads it from its own `/mockups/ward-flow/ward/[unitId]` route, but nothing here verifies
       // that, and this prototype carries no authenticated actor identity to verify it against.
       // This is a recorded assertion by the caller, not an authorisation decision, and must not
       // be described or extended as one.
diff --git a/src/components/ward-management/ward-management-console.tsx b/src/components/ward-management/ward-management-console.tsx
index 2419205748..3766eba481 100644
--- a/src/components/ward-management/ward-management-console.tsx
+++ b/src/components/ward-management/ward-management-console.tsx
@@ -143,7 +143,7 @@ export function WardPatientWorkspace({ patientId }: { patientId: string }) {
       <div className={styles.patientWorkspace} data-testid="ward-patient-workspace">
         <ClinicalRail />
         <header className={styles.workspaceHeader}>
-          <ContextualBackLink fallbackHref="/ward-management" aria-label="Back to Ward Flow">
+          <ContextualBackLink fallbackHref="/mockups/ward-flow" aria-label="Back to Ward Flow">
             <ArrowLeft aria-hidden="true" />
           </ContextualBackLink>
           <div>
@@ -198,7 +198,7 @@ export function WardPatientWorkspace({ patientId }: { patientId: string }) {
     <div className={styles.patientWorkspace} data-testid="ward-patient-workspace">
       <ClinicalRail />
       <header className={styles.workspaceHeader}>
-        <ContextualBackLink fallbackHref="/ward-management" aria-label="Back to Ward Flow">
+        <ContextualBackLink fallbackHref="/mockups/ward-flow" aria-label="Back to Ward Flow">
           <ArrowLeft aria-hidden="true" />
         </ContextualBackLink>
         <div>
diff --git a/src/components/ward-management/ward-management-modes.tsx b/src/components/ward-management/ward-management-modes.tsx
index 07b5718e99..a0b67b1815 100644
--- a/src/components/ward-management/ward-management-modes.tsx
+++ b/src/components/ward-management/ward-management-modes.tsx
@@ -279,7 +279,7 @@ function DecisionPanel({
           {confirmed ? <Check aria-hidden="true" /> : <ShieldCheck aria-hidden="true" />}
           {confirmed ? "Match confirmed" : roleTaskLabel[role]}
         </button>
-        <Link className={styles.secondaryButton} href={`/ward-management/patients/${patient.id}`}>
+        <Link className={styles.secondaryButton} href={`/mockups/ward-flow/patients/${patient.id}`}>
           Full record <ArrowRight aria-hidden="true" />
         </Link>
       </div>
@@ -490,7 +490,11 @@ function MovementsView() {
               .filter((patient) => patient.stage === stage.id)
               .slice(0, 4)
               .map((patient) => (
-                <Link className={styles.movementCard} href={`/ward-management/patients/${patient.id}`} key={patient.id}>
+                <Link
+                  className={styles.movementCard}
+                  href={`/mockups/ward-flow/patients/${patient.id}`}
+                  key={patient.id}
+                >
                   <span className={styles.rowTop}>
                     <strong>{patient.id}</strong>
                     <span className={toneClass(patient.urgency === 1 ? "danger" : "neutral")}>P{patient.urgency}</span>
@@ -543,7 +547,7 @@ function ExceptionsView() {
                 <span className={toneClass(item.tone)}>{item.detail}</span>
                 <small>{item.owner}</small>
               </div>
-              <Link className={styles.secondaryButton} href={`/ward-management/patients/${item.movementId}`}>
+              <Link className={styles.secondaryButton} href={`/mockups/ward-flow/patients/${item.movementId}`}>
                 Open <ArrowRight aria-hidden="true" />
               </Link>
             </article>
@@ -612,7 +616,7 @@ function TransportView() {
                     {patient.legalForm ? legalFormNameLabelFirst(patient.legalForm) : "No legal form recorded"}
                   </small>
                 </div>
-                <Link className={styles.secondaryButton} href={`/ward-management/patients/${patient.id}`}>
+                <Link className={styles.secondaryButton} href={`/mockups/ward-flow/patients/${patient.id}`}>
                   Review <ArrowRight aria-hidden="true" />
                 </Link>
               </article>
diff --git a/src/components/ward-management/ward-management-navigation.tsx b/src/components/ward-management/ward-management-navigation.tsx
index c2f69f6225..d6e1320783 100644
--- a/src/components/ward-management/ward-management-navigation.tsx
+++ b/src/components/ward-management/ward-management-navigation.tsx
@@ -69,7 +69,7 @@ function RailLink({
  * (not the global app shell), so it is Ward Flow's own to extend rather than a shared surface
  * this task would be overreaching to touch.
  *
- * `activeMode` is optional: the patient workspace route (`/ward-management/patients/[id]`) is
+ * `activeMode` is optional: the patient workspace route (`/mockups/ward-flow/patients/[id]`) is
  * not one of the eight modes, so it renders the rail without the mode section at all rather than
  * forcing an arbitrary "active" choice.
  */
@@ -84,7 +84,7 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
         <RailLink href="/?mode=answer" label="Clinical Answers">
           <MessageSquarePlus aria-hidden="true" />
         </RailLink>
-        <RailLink href="/ward-management" label="Ward Flow" active>
+        <RailLink href="/mockups/ward-flow" label="Ward Flow" active>
           <Activity aria-hidden="true" />
         </RailLink>
         <RailLink href="/documents" label="Documents">
@@ -117,16 +117,16 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
             selected — see `ward-role-switcher.tsx`'s own doc comment). */}
         <WardRoleSwitcher />
         <div className={shellStyles.railRule} aria-hidden="true" />
-        {/* Task 8: the ward screen's own route (`/ward-management/ward/[unitId]`) is not one of
+        {/* Task 8: the ward screen's own route (`/mockups/ward-flow/ward/[unitId]`) is not one of
             the eight `WardModeNavigation` links above — that nav's own Playwright test
             (`tests/ui-ward-management.spec.ts`) asserts an exact count of 8 links, so a ninth
             entry there would break it. This is a literal, static href (never built from a
             variable or a loop) so `tests/route-reachability.test.ts`'s AST scan can find it —
             see that test's comment and R39c. RPH Adult Secure is a real, resolvable unit id. */}
-        <RailLink href="/ward-management/ward/rph-adult-secure" label="Ward — RPH Adult Secure">
+        <RailLink href="/mockups/ward-flow/ward/rph-adult-secure" label="Ward — RPH Adult Secure">
           <Building2 aria-hidden="true" />
         </RailLink>
-        {/* Task 9: unlike the ward link immediately above, `/ward-management/transport/officer`
+        {/* Task 9: unlike the ward link immediately above, `/mockups/ward-flow/transport/officer`
             is a STATIC route (no `[unitId]`-style bracket segment), so it falls inside
             `tests/route-reachability.test.ts`'s scanned scope rather than being exempt as a
             dynamic detail route. That scanner's AST walk only registers a JSX element literally
@@ -138,19 +138,19 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
             report). This is a raw `<Link>`, not `RailLink`, for exactly that reason. Labelled
             "Officer" rather than "Transport officer": Playwright's default accessible-name match
             is a substring match, and the eight-mode strip already has a "Transport" link (the
-            live tracker, `/ward-management/transport`) — a name containing "Transport" makes
+            live tracker, `/mockups/ward-flow/transport`) — a name containing "Transport" makes
             `getByRole("link", { name: "Transport" })` resolve to two elements and breaks
             `tests/ui-ward-management.spec.ts`'s existing "opens every Ward Flow mode" walk, which
             is not scoped by exact match (also confirmed by running that spec). */}
         <Link
-          href="/ward-management/transport/officer"
+          href="/mockups/ward-flow/transport/officer"
           aria-label="Officer"
           title="Officer"
           className={shellStyles.railLink}
         >
           <Ambulance aria-hidden="true" />
         </Link>
-        {/* Task 11: `/ward-management/ed/[edId]` is a dynamic detail route, same shape as the
+        {/* Task 11: `/mockups/ward-flow/ed/[edId]` is a dynamic detail route, same shape as the
             ward link above — a raw `<Link>` with a literal string `href`, not `RailLink`, for the
             exact reason documented on the Officer link immediately above: `RailLink` passes
             `href` through as a destructured prop, which reads as a plain `Identifier` to
@@ -160,14 +160,14 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
             of which contain that string as a substring, so Playwright's default substring
             accessible-name match cannot collide with it the way "Transport officer" once did. */}
         <Link
-          href="/ward-management/ed/peel-ed"
+          href="/mockups/ward-flow/ed/peel-ed"
           aria-label="Emergency department"
           title="Emergency department"
           className={shellStyles.railLink}
         >
           <Siren aria-hidden="true" />
         </Link>
-        {/* Task 4: `/ward-management/handover` — same shape as the Officer and Emergency
+        {/* Task 4: `/mockups/ward-flow/handover` — same shape as the Officer and Emergency
             department links immediately above and for the exact same reason (see the Officer
             link's own comment): a raw `<Link>` with a literal string `href`, never `RailLink`,
             because `RailLink` passes its `href` through as a destructured prop, which reads as a
@@ -178,10 +178,15 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
             explains. "Handover" collides with no other accessible name in this rail or in
             `WardModeNavigation` as a substring, so Playwright's default substring accessible-name
             match cannot resolve it to more than one element. */}
-        <Link href="/ward-management/handover" aria-label="Handover" title="Handover" className={shellStyles.railLink}>
+        <Link
+          href="/mockups/ward-flow/handover"
+          aria-label="Handover"
+          title="Handover"
+          className={shellStyles.railLink}
+        >
           <ClipboardList aria-hidden="true" />
         </Link>
-        {/* Task 5: `/ward-management/escalation` — same shape as the Handover, Officer and
+        {/* Task 5: `/mockups/ward-flow/escalation` — same shape as the Handover, Officer and
             Emergency department links immediately above and for the exact same reason (see the
             Officer link's own comment): a raw `<Link>` with a literal string `href`, never
             `RailLink`, because `RailLink` passes its `href` through as a destructured prop,
@@ -192,14 +197,14 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
             in `WardModeNavigation` as a substring, so Playwright's default substring
             accessible-name match cannot resolve it to more than one element. */}
         <Link
-          href="/ward-management/escalation"
+          href="/mockups/ward-flow/escalation"
           aria-label="Escalation"
           title="Escalation"
           className={shellStyles.railLink}
         >
           <TriangleAlert aria-hidden="true" />
         </Link>
-        {/* Task 7: `/ward-management/search` — same shape as the Handover and Escalation links
+        {/* Task 7: `/mockups/ward-flow/search` — same shape as the Handover and Escalation links
             immediately above and for the exact same reason (see the Officer link's own comment):
             a raw `<Link>` with a literal string `href`, never `RailLink`, because `RailLink`
             passes its `href` through as a destructured prop, which reads as a plain `Identifier`
@@ -210,7 +215,7 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
             so Playwright's default substring accessible-name match cannot resolve it to more than
             one element. */}
         <Link
-          href="/ward-management/search"
+          href="/mockups/ward-flow/search"
           aria-label="Patient search"
           title="Patient search"
           className={shellStyles.railLink}
@@ -225,7 +230,7 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
         </RailLink>
         <div className={shellStyles.railRule} aria-hidden="true" />
         {/* Whole-branch review I3: the demo jump-forward clock (spec §2 decision 5, §5) and
-            scenario reset, mounted once here so every `/ward-management/*` route gets them
+            scenario reset, mounted once here so every `/mockups/ward-flow/*` route gets them
             without per-screen wiring — the clock is shared provider state, not a per-screen
             concern. Placed last, after a rule and visually separated from every real navigation
             link above, and given its own warning-toned trigger (`ward-demo-controls.module.css`)
@@ -253,7 +258,7 @@ export function WardModeNavigation({ active }: { active: WardMode }) {
   return (
     <nav className={modeStyles.modeNavigation} aria-label="Ward Flow views">
       <Link
-        href="/ward-management"
+        href="/mockups/ward-flow"
         aria-label="Command"
         title="Command"
         aria-current={active === "command" ? "page" : undefined}
@@ -262,7 +267,7 @@ export function WardModeNavigation({ active }: { active: WardMode }) {
         <LayoutDashboard aria-hidden="true" />
       </Link>
       <Link
-        href="/ward-management/network"
+        href="/mockups/ward-flow/network"
         aria-label="Network"
         title="Network"
         aria-current={active === "network" ? "page" : undefined}
@@ -271,7 +276,7 @@ export function WardModeNavigation({ active }: { active: WardMode }) {
         <Waypoints aria-hidden="true" />
       </Link>
       <Link
-        href="/ward-management/queue"
+        href="/mockups/ward-flow/queue"
         aria-label="Priority queue"
         title="Priority queue"
         aria-current={active === "queue" ? "page" : undefined}
@@ -280,7 +285,7 @@ export function WardModeNavigation({ active }: { active: WardMode }) {
         <ListFilter aria-hidden="true" />
       </Link>
       <Link
-        href="/ward-management/capacity"
+        href="/mockups/ward-flow/capacity"
         aria-label="Capacity"
         title="Capacity"
         aria-current={active === "capacity" ? "page" : undefined}
@@ -289,7 +294,7 @@ export function WardModeNavigation({ active }: { active: WardMode }) {
         <BedSingle aria-hidden="true" />
       </Link>
       <Link
-        href="/ward-management/movements"
+        href="/mockups/ward-flow/movements"
         aria-label="Movements"
         title="Movements"
         aria-current={active === "movements" ? "page" : undefined}
@@ -298,7 +303,7 @@ export function WardModeNavigation({ active }: { active: WardMode }) {
         <Route aria-hidden="true" />
       </Link>
       <Link
-        href="/ward-management/exceptions"
+        href="/mockups/ward-flow/exceptions"
         aria-label="Exceptions"
         title="Exceptions"
         aria-current={active === "exceptions" ? "page" : undefined}
@@ -307,7 +312,7 @@ export function WardModeNavigation({ active }: { active: WardMode }) {
         <CircleAlert aria-hidden="true" />
       </Link>
       <Link
-        href="/ward-management/transport"
+        href="/mockups/ward-flow/transport"
         aria-label="Transport"
         title="Transport"
         aria-current={active === "transport" ? "page" : undefined}
@@ -316,7 +321,7 @@ export function WardModeNavigation({ active }: { active: WardMode }) {
         <Truck aria-hidden="true" />
       </Link>
       <Link
-        href="/ward-management/governance"
+        href="/mockups/ward-flow/governance"
         aria-label="Governance"
         title="Governance"
         aria-current={active === "governance" ? "page" : undefined}
diff --git a/src/components/ward-management/ward-management-network.tsx b/src/components/ward-management/ward-management-network.tsx
index 4b34f21a1b..268fae1cc4 100644
--- a/src/components/ward-management/ward-management-network.tsx
+++ b/src/components/ward-management/ward-management-network.tsx
@@ -519,7 +519,7 @@ export function WardNetworkWorkspace() {
             <span>Next action: {patient.blocker}</span>
           </div>
 
-          <Link className={styles.primaryLink} href={`/ward-management/patients/${patient.id}`}>
+          <Link className={styles.primaryLink} href={`/mockups/ward-flow/patients/${patient.id}`}>
             Open movement workspace
           </Link>
           <p className={styles.assurance}>System suggests, you decide. No automatic allocation.</p>
diff --git a/src/components/ward-management/ward-management.module.css b/src/components/ward-management/ward-management.module.css
index bf1b09cf2b..46e61e6767 100644
--- a/src/components/ward-management/ward-management.module.css
+++ b/src/components/ward-management/ward-management.module.css
@@ -55,7 +55,7 @@
    * them. `.console`/`.consoleCollapsed`/`.patientWorkspace` (this file) and `.modeShell`
    * (ward-management-modes.module.css) each declare `--ward-*`, but `.screen`
    * (coordinator.module.css) uses an unrelated `--co-*` prefix and never did — so on the
-   * coordinator route (`/ward-management`) every `var(--ward-*)` below was silently invalid
+   * coordinator route (`/mockups/ward-flow`) every `var(--ward-*)` below was silently invalid
    * (computed background transparent, border 0px, z-index auto, padding 0px, nav gap `normal`),
    * found empirically while verifying Task 9's rail-nav move — a real pre-existing gap, not
    * something this task introduced, but one this task's own new `.modeNavigation` gap would
diff --git a/src/components/ward-management/ward-role-switcher.tsx b/src/components/ward-management/ward-role-switcher.tsx
index e14e3d60f1..63426f3e39 100644
--- a/src/components/ward-management/ward-role-switcher.tsx
+++ b/src/components/ward-management/ward-role-switcher.tsx
@@ -10,8 +10,8 @@ import { edById } from "@/components/ward-management/ward-sites";
 
 import styles from "./ward-role-switcher.module.css";
 
-const COORDINATOR_HREF = "/ward-management";
-const OFFICER_HREF = "/ward-management/transport/officer";
+const COORDINATOR_HREF = "/mockups/ward-flow";
+const OFFICER_HREF = "/mockups/ward-flow/transport/officer";
 
 /**
  * Task 12 (addendum R41/R42/R48/R52/R67). The role switcher: four roles, one control, and the
@@ -124,7 +124,7 @@ export function WardRoleSwitcher() {
               wardCandidates.map((unit) => (
                 <Link
                   key={unit.id}
-                  href={`/ward-management/ward/${unit.id}`}
+                  href={`/mockups/ward-flow/ward/${unit.id}`}
                   role="menuitem"
                   className={styles.menuItem}
                   onClick={close}
@@ -156,7 +156,7 @@ export function WardRoleSwitcher() {
             <span className={styles.menuGroupLabel}>Emergency department</span>
             {edCandidate ? (
               <Link
-                href={`/ward-management/ed/${edCandidate.id}`}
+                href={`/mockups/ward-flow/ed/${edCandidate.id}`}
                 role="menuitem"
                 className={styles.menuItem}
                 onClick={close}
diff --git a/src/lib/developer-area/headers.ts b/src/lib/developer-area/headers.ts
index d9670ba806..44d91711d7 100644
--- a/src/lib/developer-area/headers.ts
+++ b/src/lib/developer-area/headers.ts
@@ -27,4 +27,5 @@ export const DEVELOPER_GATED_PATH_PREFIXES = [
   "/mockups/development",
   "/mockups/caring-contacts",
   "/mockups/care-plan",
+  "/mockups/ward-flow",
 ] as const;
diff --git a/src/lib/developer-area/hub-panels.ts b/src/lib/developer-area/hub-panels.ts
index a23542db09..80d9488270 100644
--- a/src/lib/developer-area/hub-panels.ts
+++ b/src/lib/developer-area/hub-panels.ts
@@ -110,7 +110,7 @@ export const HUB_PANELS: readonly HubPanel[] = [
     summary: "Queue, capacity, transport, movements",
     group: "reference",
     phase: 1,
-    href: "/ward-management",
+    href: "/mockups/ward-flow",
   },
   { id: "commands", name: "Commands", summary: "What each repository command does", group: "reference", phase: 4 },
 ];
diff --git a/src/lib/tools-catalog.ts b/src/lib/tools-catalog.ts
index f4c793abc2..e20709ac73 100644
--- a/src/lib/tools-catalog.ts
+++ b/src/lib/tools-catalog.ts
@@ -220,7 +220,7 @@ export const toolCatalogRecords: ToolCatalogRecord[] = [
     bestFor: "Statewide mental-health patient flow",
     detail:
       "Review a synthetic priority queue, scan current ward capacity, inspect explainable destination matches, and confirm the next owned movement action.",
-    href: "/ward-management",
+    href: "/mockups/ward-flow",
     area: "coordination",
     status: "ready",
     sourceBacked: false,
diff --git a/src/proxy.ts b/src/proxy.ts
index 70533525e7..b2c3e3eae9 100644
--- a/src/proxy.ts
+++ b/src/proxy.ts
@@ -52,10 +52,12 @@ const staticRouteRedirects: Record<string, string> = {
   // thing there, so the query string travels unchanged.
   "/dictionary/browse": "/dictionary/search",
   // Ward Flow Constellation was retired in Phase 2; keep
-  // /ward-management/constellation as an intentional unlinked compatibility
-  // redirect to /ward-management/network so historical deep-links match the
-  // page backstop (PR #2303).
-  "/ward-management/constellation": "/ward-management/network",
+  // /mockups/ward-flow/constellation as an intentional unlinked compatibility
+  // redirect to /mockups/ward-flow/network so historical deep-links match the
+  // page backstop (PR #2303). Ward Flow moved under the developer-gated
+  // /mockups/ward-flow prefix in the sandbox move (see
+  // src/lib/developer-area/headers.ts); the constellation redirect moved with it.
+  "/mockups/ward-flow/constellation": "/mockups/ward-flow/network",
 };
 
 const publicPwaPaths = new Set(["/sw.js", "/offline.html", "/manifest.webmanifest", "/apple-icon", "/icon.svg"]);
diff --git a/tests/design-system-adoption.test.ts b/tests/design-system-adoption.test.ts
index 17efe29f4d..928030885d 100644
--- a/tests/design-system-adoption.test.ts
+++ b/tests/design-system-adoption.test.ts
@@ -34,10 +34,14 @@ function writeFixtureFile(fixtureRoot: string, relativePath: string, content: st
   fs.writeFileSync(absolutePath, content);
 }
 
-const NON_VISUAL_REDIRECT_PAGES = [
-  "src/app/(search-app)/documents/source/page.tsx",
-  "src/app/ward-management/constellation/page.tsx",
-] as const;
+// Mirrors CANONICAL_NON_VISUAL_ROUTES / adoption-contract.json's `nonVisualRouteContracts`.
+// The Ward Flow constellation redirect used to be the second entry here; it left this list
+// (not merely repointed to its new /mockups/ward-flow path) when Ward Flow's sandbox move took
+// every one of its routes out of the production census — see the "66 = 59 + 6 + 1" comment
+// below. `analyzeNextRedirectOnlyRoute` is still exercised against the moved file directly in
+// "recognises the retired constellation route as redirect-only" below; this list is only the
+// fixture set for declared, census-tracked non-visual routes.
+const NON_VISUAL_REDIRECT_PAGES = ["src/app/(search-app)/documents/source/page.tsx"] as const;
 
 function writeNonVisualRedirectFixtures(fixtureRoot: string) {
   for (const relativePath of NON_VISUAL_REDIRECT_PAGES) {
@@ -416,8 +420,8 @@ describe("design-system adoption manifest", () => {
   it("recognises the retired constellation route as redirect-only", () => {
     expect(
       analyzeNextRedirectOnlyRoute(
-        "src/app/ward-management/constellation/page.tsx",
-        read("src/app/ward-management/constellation/page.tsx"),
+        "src/app/mockups/ward-flow/constellation/page.tsx",
+        read("src/app/mockups/ward-flow/constellation/page.tsx"),
       ).redirectOnly,
     ).toBe(true);
   });
@@ -468,34 +472,22 @@ describe("design-system adoption manifest", () => {
     const manifest = {
       ...current,
       surfaces: current.surfaces.map((surface: { id: string }) =>
-        surface.id === "documents-source-legacy-redirect" ||
-        surface.id === "ward-management-constellation-legacy-redirect"
-          ? { ...surface, documentedDisposition: null }
-          : surface,
+        surface.id === "documents-source-legacy-redirect" ? { ...surface, documentedDisposition: null } : surface,
       ),
     };
 
     const failures = checkAdoptionManifest(manifest);
     expect(failures).toContain("documents-source-legacy-redirect legacy-redirect disposition is undocumented");
-    expect(failures).toContain(
-      "ward-management-constellation-legacy-redirect legacy-redirect disposition is undocumented",
-    );
   });
 
-  it("models the retired constellation route as a non-visual legacy redirect", () => {
-    const manifest = JSON.parse(read("docs/design-system/adoption-manifest.json"));
-    const redirect = manifest.surfaces.find(
-      (surface: { id: string }) => surface.id === "ward-management-constellation-legacy-redirect",
-    );
-    const owned = manifest.surfaces.find((surface: { id: string }) => surface.id === "ward-management");
-
-    expect(redirect).toMatchObject({
-      disposition: "legacy-redirect",
-      proofApplicability: "not-applicable",
-      routes: ["src/app/ward-management/constellation/page.tsx"],
-    });
-    expect(owned.routes).not.toContain("src/app/ward-management/constellation/page.tsx");
-  });
+  // The "models the retired constellation route as a non-visual legacy redirect" test that used
+  // to live here asserted the shape of the "ward-management-constellation-legacy-redirect" and
+  // "ward-management" surfaces. Both left docs/design-system/adoption-contract.json (and the
+  // manifest it generates) when Ward Flow's sandbox move took the whole prototype out of the
+  // production census — see the "66 = 59 + 6 + 1" comment above. Care Plan and Caring Contacts,
+  // the two other developer-gated mockups, were never declared as surfaces here at all, so Ward
+  // Flow leaving this contract is convergence with the existing pattern, not a new gap: nothing
+  // else in this file asserts a per-mockup surface shape for them either.
 
   it("does not let a visual catalogue opt out by relabelling itself as a legacy redirect", () => {
     const current = JSON.parse(read("docs/design-system/adoption-manifest.json"));
@@ -1412,15 +1404,18 @@ describe("design-system adoption manifest", () => {
           ["committed", "not-committed", "not-applicable"].includes(surface.baseline.status),
       ),
     ).toBe(true);
-    // 82 = 59 + 6 + 16 + 1: the 59 production pages that preceded both changes,
-    // the six `<mode>/search` routes home consolidation split out of the bare paths,
-    // the sixteen-route Ward Flow synthetic patient-flow prototype (mode home,
-    // eight remaining workspace routes, ED/ward/officer role screens, the per-patient
-    // detail route, the Phase 4 shift handover, escalation board and patient search, and
-    // the retired constellation redirect), and the Caring Contacts workspace. Redirect
-    // stubs keep legacy deep links resolving and still count as declared routes. This is a
-    // census, so a route nobody intended to add still fails the contract.
-    expect(manifest.routeCoverage.discovered).toHaveLength(82);
+    // 66 = 59 + 6 + 1: the 59 production pages that preceded both changes, the six
+    // `<mode>/search` routes home consolidation split out of the bare paths, and the Caring
+    // Contacts workspace. The sixteen-route Ward Flow synthetic patient-flow prototype (mode
+    // home, eight remaining workspace routes, ED/ward/officer role screens, the per-patient
+    // detail route, the Phase 4 shift handover, escalation board and patient search, and the
+    // retired constellation redirect) that used to bring this to 82 left the production census
+    // entirely in the sandbox move: it now lives at `/mockups/ward-flow/**`, developer-gated
+    // like Care Plan and Caring Contacts, and `discoveredRoutes` excludes every `/mockups`
+    // route the same way it always excluded theirs. Redirect stubs keep legacy deep links
+    // resolving and still count as declared routes. This is a census, so a route nobody
+    // intended to add still fails the contract.
+    expect(manifest.routeCoverage.discovered).toHaveLength(66);
     expect(manifest.routeCoverage.declared).toEqual(manifest.routeCoverage.discovered);
     expect(manifest.routeCoverage.undeclared).toEqual([]);
     expect(manifest.routeCoverage.missing).toEqual([]);
diff --git a/tests/proxy.test.ts b/tests/proxy.test.ts
index 30ce7ba4a5..f8dac28aee 100644
--- a/tests/proxy.test.ts
+++ b/tests/proxy.test.ts
@@ -223,10 +223,10 @@ describe("developer-area header (x-developer-area)", () => {
 
 describe("static compatibility redirects", () => {
   it("forwards retired constellation deep-links to the network destination", async () => {
-    const response = await proxy(requestFor("/ward-management/constellation"));
+    const response = await proxy(requestFor("/mockups/ward-flow/constellation"));
     expect(response.status).toBe(307);
     const location = new URL(response.headers.get("location")!);
-    expect(location.pathname).toBe("/ward-management/network");
+    expect(location.pathname).toBe("/mockups/ward-flow/network");
   });
 });
 
diff --git a/tests/route-reachability.test.ts b/tests/route-reachability.test.ts
index 0b8fc9118f..071853797c 100644
--- a/tests/route-reachability.test.ts
+++ b/tests/route-reachability.test.ts
@@ -43,10 +43,11 @@ const REACHABILITY_ALLOWLIST = new Map<string, string>([
     "/dictionary/browse",
     "Retired half of the merged Dictionary catalogue. It redirects to /dictionary/search (proxy fast path plus a page backstop), so in-app navigation deliberately links the surviving route directly rather than routing readers through a redirect.",
   ],
-  [
-    "/ward-management/constellation",
-    "Retired Phase 1 constellation view. It redirects to /ward-management/network so live-main bookmarks keep working; in-app navigation uses the eight remaining rail modes and does not send readers through the redirect.",
-  ],
+  // The former "/ward-management/constellation" entry was removed, not repointed at
+  // "/mockups/ward-flow/constellation": Ward Flow's sandbox move put every one of its routes
+  // under /mockups, and staticPageRoutes below excludes every /mockups route outright, so the
+  // constellation redirect is no longer a static page route at all and an allowlist entry for it
+  // would trip "reachability allowlist has no stale entries" below.
 ]);
 
 function isMockupPath(relPosix: string) {
@@ -635,37 +636,16 @@ describe("route reachability", () => {
     ).toEqual([]);
   });
 
-  // Task 4 (Ward Flow shift handover): the generic orphan sweep above already covers this route,
-  // but it covers every static route at once and a failure there does not name which route
-  // regressed. This is the same assertion, narrowed to the one route this task added, so a
-  // future edit that drops the rail link (or the page itself) fails with an unambiguous message
-  // rather than only showing up buried in a combined orphan list.
-  it("/ward-management/handover is linked from the clinical rail", () => {
-    const route = staticPageRoutes.find((entry) => entry.route === "/ward-management/handover");
-    expect(route, "/ward-management/handover must exist as a static page route").toBeDefined();
-    if (!route) return;
-    expect(isReachable(route.route, route.file)).toBe(true);
-  });
-
-  // Task 5 (Ward Flow escalation board): same narrowing as the handover assertion immediately
-  // above, and for the same reason — the generic orphan sweep covers this route too, but a
-  // failure there does not name which route regressed.
-  it("/ward-management/escalation is linked from the clinical rail", () => {
-    const route = staticPageRoutes.find((entry) => entry.route === "/ward-management/escalation");
-    expect(route, "/ward-management/escalation must exist as a static page route").toBeDefined();
-    if (!route) return;
-    expect(isReachable(route.route, route.file)).toBe(true);
-  });
-
-  // Task 7 (Ward Flow patient search): same narrowing as the handover and escalation assertions
-  // immediately above, and for the same reason — the generic orphan sweep covers this route too,
-  // but a failure there does not name which route regressed.
-  it("/ward-management/search is linked from the clinical rail", () => {
-    const route = staticPageRoutes.find((entry) => entry.route === "/ward-management/search");
-    expect(route, "/ward-management/search must exist as a static page route").toBeDefined();
-    if (!route) return;
-    expect(isReachable(route.route, route.file)).toBe(true);
-  });
+  // The three narrowed reachability assertions that used to live here (handover, escalation,
+  // search — Tasks 4, 5, 7) each pinned one Ward Flow route into `staticPageRoutes` so a
+  // regression named the exact route rather than surfacing in the combined orphan list. Ward
+  // Flow's sandbox move put every one of its routes under `/mockups/ward-flow/**`, and
+  // `staticPageRoutes` deliberately excludes every `/mockups` route (mockups are design-scratch
+  // and not required to be linked — see the file header comment), the same way no such narrowed
+  // test exists for Care Plan or Caring Contacts. The property these three tests asserted no
+  // longer applies, so they are removed rather than repointed at the new path, which would
+  // silently fail `toBeDefined()` on every run since the route can never appear in
+  // `staticPageRoutes` again.
 
   it("reachability allowlist has no stale entries", () => {
     const routes = new Set(staticPageRoutes.map((entry) => entry.route));
diff --git a/tests/site-map.test.ts b/tests/site-map.test.ts
index 372bfd695b..6388b789b0 100644
--- a/tests/site-map.test.ts
+++ b/tests/site-map.test.ts
@@ -56,7 +56,6 @@ const acceptedDynamicPatterns = [
   /^\/formulation\/[^/?#]+(?:[?#].*)?$/,
   /^\/specifiers\/[^/?#]+(?:[?#].*)?$/,
   /^\/therapy-compass\/[^/?#]+(?:[?#].*)?$/,
-  /^\/ward-management\/patients\/[^/?#]+(?:[?#].*)?$/,
 ];
 
 function pathOnly(href: string) {
@@ -85,7 +84,6 @@ function routePatternForHref(href: string) {
     if (pathname.startsWith("/formulation/")) return "/formulation/[slug]";
     if (pathname.startsWith("/specifiers/")) return "/specifiers/[slug]";
     if (pathname.startsWith("/therapy-compass/")) return "/therapy-compass/[slug]";
-    if (pathname.startsWith("/ward-management/patients/")) return "/ward-management/patients/[patientId]";
   }
   return pathname;
 }
diff --git a/tests/tools-catalog.test.ts b/tests/tools-catalog.test.ts
index 0afb4ae968..a3b53e2607 100644
--- a/tests/tools-catalog.test.ts
+++ b/tests/tools-catalog.test.ts
@@ -30,7 +30,7 @@ describe("tools catalog", () => {
 
   it("links Ward Flow to its production workspace", () => {
     const wardFlow = toolCatalogRecordById("ward-management");
-    expect(wardFlow.href).toBe("/ward-management");
+    expect(wardFlow.href).toBe("/mockups/ward-flow");
     expect(wardFlow.sourceBacked).toBe(false);
   });
 
diff --git a/tests/ui-ward-coordinator.spec.ts b/tests/ui-ward-coordinator.spec.ts
index 3c51d760d1..40ff99be61 100644
--- a/tests/ui-ward-coordinator.spec.ts
+++ b/tests/ui-ward-coordinator.spec.ts
@@ -12,7 +12,7 @@ import { movementById, wardMovements } from "@/components/ward-management/ward-m
 import { allUnits, NOW_ANCHOR } from "@/components/ward-management/ward-sites";
 
 async function gotoCoordinator(page: Page) {
-  await page.goto("/ward-management", { waitUntil: "domcontentloaded" });
+  await page.goto("/mockups/ward-flow", { waitUntil: "domcontentloaded" });
   // A second same-URL navigation can leave a hidden duplicate of the screen
   // in the tree. Strict getByTestId then fails even though one copy is visible
   // — match the command-view helper, which waits for a single visible screen.
@@ -107,7 +107,7 @@ test.describe("Ward Flow coordinator screen", () => {
   });
 
   // The equivalent coverage for these two lived on WardManagementConsole, which Task 3 stopped
-  // rendering at /ward-management. Task 9 deletes that component; until then the behaviour has
+  // rendering at /mockups/ward-flow. Task 9 deletes that component; until then the behaviour has
   // no home on the coordinator screen and these stay fixme so the gap is visible in the runner
   // (not just in a ledger row) rather than silently dropped.
 
diff --git a/tests/ui-ward-management.spec.ts b/tests/ui-ward-management.spec.ts
index d9c654d93a..3bc4a303a1 100644
--- a/tests/ui-ward-management.spec.ts
+++ b/tests/ui-ward-management.spec.ts
@@ -1,6 +1,6 @@
 import { expect, test, type Page } from "playwright/test";
 
-const PATH = "/ward-management";
+const PATH = "/mockups/ward-flow";
 
 async function gotoWardFlow(page: Page) {
   await page.goto(PATH, { waitUntil: "domcontentloaded" });
@@ -24,7 +24,7 @@ async function expectNoPageOverflow(page: Page) {
  * `document.documentElement` can never report an overflow on the coordinator route — `.screen`
  * sets `overflow: hidden` — so `expectNoPageOverflow` alone cannot catch a track inside the
  * region grid running wider than its box (Task 3 review Important 1). Only meaningful on
- * /ward-management itself, where the region grid testid exists.
+ * /mockups/ward-flow itself, where the region grid testid exists.
  */
 async function expectNoRegionGridOverflow(page: Page) {
   const overflow = await page.evaluate(() => {
@@ -41,7 +41,7 @@ test.describe("Ward Flow command view", () => {
 
   // "supports role-aware queue review and human-confirmed destination choice" and "collapses
   // the queue, opens the action inbox, and reaches the patient workspace" asserted against
-  // WardManagementConsole, which Task 3 stopped rendering at /ward-management. That component is
+  // WardManagementConsole, which Task 3 stopped rendering at /mockups/ward-flow. That component is
   // unreferenced and Task 9 deletes it; the equivalent coverage on the coordinator screen has no
   // home yet. See the fixme placeholders in tests/ui-ward-coordinator.spec.ts.
   //
@@ -115,7 +115,7 @@ test.describe("Ward Flow command view", () => {
 
   test("routes a selected movement across the network diagram and explains the shortlist", async ({ page }) => {
     await page.setViewportSize({ width: 1600, height: 1100 });
-    await page.goto("/ward-management/network", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/network", { waitUntil: "domcontentloaded" });
 
     const network = page.getByTestId("ward-network-view");
     await expect(network).toBeVisible({ timeout: 15_000 });
diff --git a/tests/ui-ward-roles.spec.ts b/tests/ui-ward-roles.spec.ts
index 6648f670cb..82b821d92a 100644
--- a/tests/ui-ward-roles.spec.ts
+++ b/tests/ui-ward-roles.spec.ts
@@ -3,7 +3,7 @@ import { expect, test, type Page } from "playwright/test";
 import { edById, unitById } from "@/components/ward-management/ward-sites";
 
 async function gotoWard(page: Page, unitId: string) {
-  await page.goto(`/ward-management/ward/${unitId}`, { waitUntil: "domcontentloaded" });
+  await page.goto(`/mockups/ward-flow/ward/${unitId}`, { waitUntil: "domcontentloaded" });
   await expect(page.getByTestId("ward-unit-screen")).toBeVisible({ timeout: 15_000 });
   await page.waitForLoadState("networkidle");
 }
@@ -48,7 +48,7 @@ test.describe("Ward screen", () => {
     const bogusUnitId = "nonexistent-unit-does-not-exist";
     expect(unitById(bogusUnitId), "fixture assumption: this id resolves to no real unit").toBeUndefined();
 
-    await page.goto(`/ward-management/ward/${bogusUnitId}`, { waitUntil: "domcontentloaded" });
+    await page.goto(`/mockups/ward-flow/ward/${bogusUnitId}`, { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-unit-screen")).toBeVisible({ timeout: 15_000 });
 
     // Names the id, in real visible text — never a generic "not found" with the id swallowed.
@@ -137,7 +137,7 @@ test.describe("Transport officer screen", () => {
    */
   test("gives the officer four actions and nothing else", async ({ page }) => {
     await page.setViewportSize({ width: 390, height: 844 });
-    await page.goto("/ward-management/transport/officer", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/transport/officer", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-officer-screen")).toBeVisible({ timeout: 15_000 });
     await page.waitForLoadState("networkidle");
 
@@ -165,7 +165,7 @@ test.describe("Transport officer screen", () => {
    */
   test("states it is showing every job rather than inventing an officer to own them", async ({ page }) => {
     await page.setViewportSize({ width: 390, height: 844 });
-    await page.goto("/ward-management/transport/officer", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/transport/officer", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-officer-screen")).toBeVisible({ timeout: 15_000 });
 
     await expect(page.getByTestId("ward-officer-governance")).toContainText(/every/i);
@@ -182,7 +182,7 @@ test.describe("Transport officer screen", () => {
   test("retains its operating structure in dark, forced-colours, and print modes", async ({ page }) => {
     await page.setViewportSize({ width: 390, height: 844 });
     await page.emulateMedia({ colorScheme: "dark" });
-    await page.goto("/ward-management/transport/officer", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/transport/officer", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-officer-screen")).toBeVisible({ timeout: 15_000 });
     await page.waitForLoadState("networkidle");
     await expect(page.getByTestId("ward-officer-governance")).toBeVisible();
@@ -216,7 +216,7 @@ test.describe("Live tracker", () => {
    */
   test("tracks every vehicle by leg and by how long since the last stamp", async ({ page }) => {
     await page.setViewportSize({ width: 1440, height: 1024 });
-    await page.goto("/ward-management/transport", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/transport", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-live-tracker")).toBeVisible({ timeout: 15_000 });
 
     const rows = page.locator('[data-testid^="ward-tracker-row-"]');
@@ -242,7 +242,7 @@ test.describe("Live tracker", () => {
    */
   test("lists exactly the movements that carry a transport job, and states the rest explicitly", async ({ page }) => {
     await page.setViewportSize({ width: 1440, height: 1024 });
-    await page.goto("/ward-management/transport", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/transport", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-live-tracker")).toBeVisible({ timeout: 15_000 });
 
     await expect(page.locator('[data-testid^="ward-tracker-row-"]')).toHaveCount(8);
@@ -259,7 +259,7 @@ test.describe("Live tracker", () => {
   test("retains its operating structure in dark, forced-colours, and print modes", async ({ page }) => {
     await page.setViewportSize({ width: 1280, height: 900 });
     await page.emulateMedia({ colorScheme: "dark" });
-    await page.goto("/ward-management/transport", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/transport", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-live-tracker")).toBeVisible({ timeout: 15_000 });
     await page.waitForLoadState("networkidle");
     await expect(page.getByTestId("ward-tracker-governance")).toBeVisible();
@@ -283,7 +283,7 @@ test.describe("Emergency department screen", () => {
    */
   test("shows a department its own patients, both clocks, and one outstanding item each", async ({ page }) => {
     await page.setViewportSize({ width: 1440, height: 1024 });
-    await page.goto("/ward-management/ed/peel-ed", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/ed/peel-ed", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-ed-screen")).toBeVisible({ timeout: 15_000 });
     await page.waitForLoadState("networkidle");
 
@@ -317,7 +317,7 @@ test.describe("Emergency department screen", () => {
     const bogusEdId = "nonexistent-ed-does-not-exist";
     expect(edById(bogusEdId), "fixture assumption: this id resolves to no real department").toBeUndefined();
 
-    await page.goto(`/ward-management/ed/${bogusEdId}`, { waitUntil: "domcontentloaded" });
+    await page.goto(`/mockups/ward-flow/ed/${bogusEdId}`, { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-ed-screen")).toBeVisible({ timeout: 15_000 });
     await page.waitForLoadState("networkidle");
 
@@ -338,7 +338,7 @@ test.describe("Emergency department screen", () => {
   test("never renders a community-formed patient's legal clock as shorter than their time in department", async ({
     page,
   }) => {
-    await page.goto("/ward-management/ed/peel-ed", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/ed/peel-ed", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-ed-screen")).toBeVisible({ timeout: 15_000 });
     await page.waitForLoadState("networkidle");
 
@@ -362,7 +362,7 @@ test.describe("Emergency department screen", () => {
    * comment in `ed-screen.tsx`). Pinned by id, per the task's own warning not to assume.
    */
   test("names transport, not examination, as WF-005's honest outstanding item", async ({ page }) => {
-    await page.goto("/ward-management/ed/peel-ed", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/ed/peel-ed", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-ed-screen")).toBeVisible({ timeout: 15_000 });
     await page.waitForLoadState("networkidle");
 
@@ -379,7 +379,7 @@ test.describe("Emergency department screen", () => {
    * refuse — `aria-disabled`, never native `disabled`, naming the movement's real stage.
    */
   test("marks handover ready only once a bed is held, mirroring the reducer's own precondition", async ({ page }) => {
-    await page.goto("/ward-management/ed/peel-ed", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/ed/peel-ed", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-ed-screen")).toBeVisible({ timeout: 15_000 });
     // Interacting (the click below) before hydration completes silently no-ops — a plain DOM
     // click with no React listener attached yet throws nothing and changes nothing. Every other
@@ -419,7 +419,7 @@ test.describe("Emergency department screen", () => {
    * a fixture change that removes it fails loudly rather than this count silently reading zero.
    */
   test("flags exactly the one police arrival at peel-ed, and no other patient", async ({ page }) => {
-    await page.goto("/ward-management/ed/peel-ed", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/ed/peel-ed", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-ed-screen")).toBeVisible({ timeout: 15_000 });
     await page.waitForLoadState("networkidle");
 
@@ -435,7 +435,7 @@ test.describe("Emergency department screen", () => {
   test("retains its operating structure in dark, forced-colours, and print modes", async ({ page }) => {
     await page.setViewportSize({ width: 1280, height: 900 });
     await page.emulateMedia({ colorScheme: "dark" });
-    await page.goto("/ward-management/ed/peel-ed", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/ed/peel-ed", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-ed-screen")).toBeVisible({ timeout: 15_000 });
     await page.waitForLoadState("networkidle");
     await expect(page.getByTestId("ward-ed-governance")).toBeVisible();
@@ -505,7 +505,7 @@ test.describe("Role switcher — the loop", () => {
     }
 
     // --- Step 1: ED — record the examination (R67). The one permitted `goto`. ---
-    await page.goto("/ward-management/ed/arm-ed", { waitUntil: "domcontentloaded" });
+    await page.goto("/mockups/ward-flow/ed/arm-ed", { waitUntil: "domcontentloaded" });
     await expect(page.getByTestId("ward-ed-screen")).toBeVisible({ timeout: 15_000 });
     await page.waitForLoadState("networkidle");
 
diff --git a/tests/ward-flow-sandbox.test.ts b/tests/ward-flow-sandbox.test.ts
new file mode 100644
index 0000000000..2aea448758
--- /dev/null
+++ b/tests/ward-flow-sandbox.test.ts
@@ -0,0 +1,23 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { DEVELOPER_GATED_PATH_PREFIXES } from "@/lib/developer-area/headers";
+
+// Anchored on this file's own location (`__dirname`), never on `process.cwd()`.
+// A cwd-relative `fs.existsSync("src/app/ward-management")` passes or fails
+// depending on where the test runner happened to start — a half-finished move
+// could report clean if vitest's cwd ever drifted from the repo root. Resolving
+// from `__dirname` makes the check independent of invocation directory, matching
+// the pattern already proven in tests/search-results-band-adoption.test.ts.
+const REPO_ROOT = path.resolve(__dirname, "..");
+
+describe("Ward Flow is a developer-gated sandbox", () => {
+  it("is on the developer-gated prefix list, so production reaches the admin gate not a 404", () => {
+    expect(DEVELOPER_GATED_PATH_PREFIXES).toContain("/mockups/ward-flow");
+  });
+
+  it("no longer exists as a public app route", () => {
+    expect(existsSync(path.join(REPO_ROOT, "src", "app", "ward-management"))).toBe(false);
+  });
+});
diff --git a/tests/ward-management.test.ts b/tests/ward-management.test.ts
index 5159e6e5ba..aa0483e3a2 100644
--- a/tests/ward-management.test.ts
+++ b/tests/ward-management.test.ts
@@ -18,7 +18,7 @@ const modesSource = readFileSync("src/components/ward-management/ward-management
 function wardModeHrefs() {
   const source = readFileSync("src/components/ward-management/ward-management-navigation.tsx", "utf8");
   const modeStrip = source.slice(source.indexOf("export function WardModeNavigation"));
-  return [...modeStrip.matchAll(/href="(\/ward-management[^"]*)"/g)].map((match) => match[1]);
+  return [...modeStrip.matchAll(/href="(\/mockups\/ward-flow[^"]*)"/g)].map((match) => match[1]);
 }
 
 function routeFileFor(href: string) {
@@ -35,20 +35,20 @@ describe("Ward Flow synthetic prototype", () => {
   });
 
   it("keeps the production route reachable from the Tools catalogue", () => {
-    expect(toolCatalogRecordById("ward-management").href).toBe("/ward-management");
+    expect(toolCatalogRecordById("ward-management").href).toBe("/mockups/ward-flow");
   });
 
   it("maps every Ward Flow view to a distinct reachable route", () => {
     const hrefs = wardModeHrefs();
     expect(hrefs).toEqual([
-      "/ward-management",
-      "/ward-management/network",
-      "/ward-management/queue",
-      "/ward-management/capacity",
-      "/ward-management/movements",
-      "/ward-management/exceptions",
-      "/ward-management/transport",
-      "/ward-management/governance",
+      "/mockups/ward-flow",
+      "/mockups/ward-flow/network",
+      "/mockups/ward-flow/queue",
+      "/mockups/ward-flow/capacity",
+      "/mockups/ward-flow/movements",
+      "/mockups/ward-flow/exceptions",
+      "/mockups/ward-flow/transport",
+      "/mockups/ward-flow/governance",
     ]);
     expect(new Set(hrefs).size).toBe(hrefs.length);
     for (const href of hrefs) {
diff --git a/tests/ward-patient-search.dom.test.tsx b/tests/ward-patient-search.dom.test.tsx
index 3f7834c0d8..ddf10af3db 100644
--- a/tests/ward-patient-search.dom.test.tsx
+++ b/tests/ward-patient-search.dom.test.tsx
@@ -82,7 +82,7 @@ describe("PatientSearchPage", () => {
     expect(screen.getByRole("heading", { name: "1 match" })).toBeInTheDocument();
 
     const link = within(results).getByRole("link", { name: "Open" });
-    expect(link).toHaveAttribute("href", "/ward-management/patients/WF-003");
+    expect(link).toHaveAttribute("href", "/mockups/ward-flow/patients/WF-003");
   });
 
   it('renders the explicit "No matches" note — never a bare empty table — for a query nothing fits', () => {

From d0bdf37490bd206cb5ec703385d6f9193a11c261 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 15:11:52 +0800
Subject: [PATCH 24/54] Remove Ward Flow from every clinical discovery surface
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Product owner decision: Ward Flow, a synthetic offline prototype for WA
metro psychiatry patient flow, must disappear from the clinical app
completely rather than being reachable (with status: "ready",
highYield: true, and clinical-sounding keywords like "bed management"
and "ED transfer") through the Tools catalogue, launcher, search
results, or category-identity glyph registry.

- Remove "ward-management" from ToolCatalogId and its catalogue record
  (tools-catalog.ts). This is a deliberate compile-time break: the
  compiler found one real consumer, category-identity.ts's exhaustive
  TOOL_ICON map, which no longer has anywhere to route the "activity"
  glyph.
- Remove the now-orphaned "activity" glyph key end to end
  (category-identity.ts's CATEGORY_ICON_KEYS and
  category-identity-icons.ts's resolution map + Lucide import) rather
  than leaving a key nothing references — caught by
  tests/category-identity.test.ts's "declares no glyph key nothing
  uses" guard.
- Remove the fixtureExtras mockup entry and its Activity icon import
  in tool-fixtures.ts. toolCatalogRecordById() falls back silently to
  toolCatalogRecords[0] for an unknown id, so leaving this entry in
  place would have made the tools mockup grid quietly render
  clinical-kb-search's identity under Ward Flow's old icon instead of
  failing loudly.
- Update stale comments in applications-launcher-page.tsx and
  tools-search-results-page.tsx that named ward-management as a
  worked example of the shared icon registry.
- Retire the two test assertions that pinned the removed behavior
  (tools-catalog.test.ts's "ward-management" staple + "links Ward Flow
  to its production workspace"; ward-management.test.ts's "keeps the
  production route reachable from the Tools catalogue") since they
  asserted exactly the reachability this change removes.
- Add the guard test tools-catalog.test.ts/ward-flow-sandbox.test.ts
  needs going forward: no tools-catalog entry's href may start with
  "/ward-management" or "/mockups/ward-flow", so the entry cannot
  simply be moved back in under the new sandbox path.

RAG impact: no retrieval behaviour change — this only touches the
Tools catalogue, launcher, search-results, and category-identity glyph
registry; no file under src/lib/rag/**, retrieval-selection,
ranking-config, or the eval harness was touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/components/applications-launcher-page.tsx |  5 +--
 .../tools-page-mockups/tool-fixtures.ts       | 10 -----
 .../tools/tools-search-results-page.tsx       |  8 ++--
 src/lib/category-identity-icons.ts            |  2 -
 src/lib/category-identity.ts                  |  2 -
 src/lib/tools-catalog.ts                      | 43 +------------------
 tests/tools-catalog.test.ts                   | 10 ++---
 tests/ward-flow-sandbox.test.ts               | 16 +++++++
 tests/ward-management.test.ts                 |  8 ++--
 9 files changed, 31 insertions(+), 73 deletions(-)

diff --git a/src/components/applications-launcher-page.tsx b/src/components/applications-launcher-page.tsx
index cdbbde1ce6..540340ab09 100644
--- a/src/components/applications-launcher-page.tsx
+++ b/src/components/applications-launcher-page.tsx
@@ -77,9 +77,8 @@ const statusLabels: Record<LauncherStatus, string> = {
 // 8-entry copy with a different fallback, so five tools showed one glyph on the
 // launcher and a generic grid glyph in results, and every results tile was
 // painted the same purple regardless of area. Both surfaces now read the one
-// registry, so a tool looks like itself wherever it is reached — including
-// Ward Flow's `ward-management` tool, which is keyed through the same registry
-// rather than a local map.
+// registry, so a tool looks like itself wherever it is reached, rather than
+// through a local map.
 function launcherAppsForSession(canAccessFavourites: boolean): LauncherApp[] {
   return toolCatalogRecordsForSession({
     authenticated: canAccessFavourites,
diff --git a/src/components/tools-page-mockups/tool-fixtures.ts b/src/components/tools-page-mockups/tool-fixtures.ts
index 4b6bdf6158..8587800c03 100644
--- a/src/components/tools-page-mockups/tool-fixtures.ts
+++ b/src/components/tools-page-mockups/tool-fixtures.ts
@@ -1,5 +1,4 @@
 import {
-  Activity,
   Brain,
   Calculator,
   ClipboardList,
@@ -91,15 +90,6 @@ const fixtureExtras: ToolFixtureExtras[] = [
     primaryAction: "Refer",
     secondary: "Access pathways, criteria, contacts",
   },
-  {
-    id: "ward-management",
-    icon: Activity,
-    area: "coordination",
-    status: "ready",
-    lastUsed: "Not yet opened",
-    primaryAction: "Coordinate",
-    secondary: "Patient flow, bed capacity, destination matching",
-  },
   {
     id: "forms",
     icon: FileCheck2,
diff --git a/src/components/tools/tools-search-results-page.tsx b/src/components/tools/tools-search-results-page.tsx
index 5d317c7eb4..a270807abe 100644
--- a/src/components/tools/tools-search-results-page.tsx
+++ b/src/components/tools/tools-search-results-page.tsx
@@ -44,10 +44,10 @@ import {
 
 // A partial second copy of the launcher's icon map used to live here: 8 of the
 // 14 tools, with a `?? Grid2X2` fallback that silently gave `guidelines`,
-// `care-plans`, `safety-plan`, `calculators`, `monitoring`, and `ward-management`
-// a generic grid glyph on this page while the launcher showed them a real one.
-// Identity now comes from `src/lib/category-identity.ts`, where the record is
-// exhaustive by type, so the partial copy cannot come back.
+// `care-plans`, `safety-plan`, `calculators`, and `monitoring` a generic grid
+// glyph on this page while the launcher showed them a real one. Identity now
+// comes from `src/lib/category-identity.ts`, where the record is exhaustive by
+// type, so the partial copy cannot come back.
 
 const filterOptions = [
   { id: "all", label: "All tools" },
diff --git a/src/lib/category-identity-icons.ts b/src/lib/category-identity-icons.ts
index 72d4705140..36662936f6 100644
--- a/src/lib/category-identity-icons.ts
+++ b/src/lib/category-identity-icons.ts
@@ -1,5 +1,4 @@
 import {
-  Activity,
   BookMarked,
   BookOpenCheck,
   BookOpenText,
@@ -40,7 +39,6 @@ import type { CategoryIconKey } from "@/lib/category-identity";
  * that binds them to components. `factsheets-icons.ts` established the pattern.
  */
 const categoryIcons: Record<CategoryIconKey, LucideIcon> = {
-  activity: Activity,
   sparkles: Sparkles,
   fileText: FileText,
   route: Route,
diff --git a/src/lib/category-identity.ts b/src/lib/category-identity.ts
index c3f51340d5..12c4a6f54f 100644
--- a/src/lib/category-identity.ts
+++ b/src/lib/category-identity.ts
@@ -96,7 +96,6 @@ export const CATEGORY_ICON_KEYS = [
   "waves",
   "star",
   "chat",
-  "activity",
 ] as const;
 
 export type CategoryIconKey = (typeof CATEGORY_ICON_KEYS)[number];
@@ -175,7 +174,6 @@ export const TOOL_ICON: Record<ToolCatalogId, CategoryIconKey> = {
   monitoring: "waves",
   "caring-contacts": "heartHandshake",
   favourites: "star",
-  "ward-management": "activity",
 };
 
 /**
diff --git a/src/lib/tools-catalog.ts b/src/lib/tools-catalog.ts
index e20709ac73..866ae9679e 100644
--- a/src/lib/tools-catalog.ts
+++ b/src/lib/tools-catalog.ts
@@ -35,8 +35,7 @@ export type ToolCatalogId =
   | "calculators"
   | "monitoring"
   | "caring-contacts"
-  | "favourites"
-  | "ward-management";
+  | "favourites";
 
 export type ToolCatalogRecord = {
   id: ToolCatalogId;
@@ -212,46 +211,6 @@ export const toolCatalogRecords: ToolCatalogRecord[] = [
     neededInput: ["Patient location or catchment", "Clinical need", "Urgency and pathway requirements"],
     output: "Referral pathway, eligibility notes, service record, and source link.",
   },
-  {
-    id: "ward-management",
-    title: "Ward Flow",
-    mobileTitle: "Ward Flow",
-    description: "Coordinate synthetic psychiatry demand, bed capacity, referrals, and patient movement across WA.",
-    bestFor: "Statewide mental-health patient flow",
-    detail:
-      "Review a synthetic priority queue, scan current ward capacity, inspect explainable destination matches, and confirm the next owned movement action.",
-    href: "/mockups/ward-flow",
-    area: "coordination",
-    status: "ready",
-    sourceBacked: false,
-    highYield: true,
-    actionLabel: "Coordinate",
-    keywords: [
-      "ward",
-      "ward flow",
-      "bed management",
-      "bed availability",
-      "psychiatry",
-      "patient flow",
-      "hospital coordination",
-      "ED transfer",
-      "catchment",
-      "MHPF",
-      "WACHS",
-    ],
-    checkFirst: [
-      "Human urgency tier and elapsed wait",
-      "Catchment and required ward setting",
-      "Legal, handover, and transport readiness",
-      "Last-confirmed ward capacity",
-    ],
-    neededInput: [
-      "Synthetic movement identifier",
-      "Cohort, catchment, and open or secure setting",
-      "Referral, legal, and transport status",
-    ],
-    output: "An explainable destination shortlist and human-confirmed patient movement plan.",
-  },
   {
     id: "forms",
     title: "Forms",
diff --git a/tests/tools-catalog.test.ts b/tests/tools-catalog.test.ts
index a3b53e2607..0b25ae78cb 100644
--- a/tests/tools-catalog.test.ts
+++ b/tests/tools-catalog.test.ts
@@ -16,7 +16,6 @@ describe("tools catalog", () => {
       "documents",
       "medication-prescribing",
       "services",
-      "ward-management",
       "forms",
       "calculators",
     ]) {
@@ -28,11 +27,10 @@ describe("tools catalog", () => {
     expect(toolCatalogRecordById("calculators").href).toBe("/calculators");
   });
 
-  it("links Ward Flow to its production workspace", () => {
-    const wardFlow = toolCatalogRecordById("ward-management");
-    expect(wardFlow.href).toBe("/mockups/ward-flow");
-    expect(wardFlow.sourceBacked).toBe(false);
-  });
+  // Ward Flow is deliberately absent from this catalogue — see
+  // tests/ward-flow-sandbox.test.ts, which asserts no entry's href starts with
+  // "/ward-management" or "/mockups/ward-flow" (the old and new sandbox paths).
+  // A test here asserting it WAS reachable would fight that guard directly.
 
   it("ranks title matches above keyword-only matches", () => {
     const matches = rankToolRecords("forms");
diff --git a/tests/ward-flow-sandbox.test.ts b/tests/ward-flow-sandbox.test.ts
index 2aea448758..60bcab5e4a 100644
--- a/tests/ward-flow-sandbox.test.ts
+++ b/tests/ward-flow-sandbox.test.ts
@@ -2,7 +2,9 @@ import { existsSync } from "node:fs";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
 
+import { HUB_PANELS } from "@/lib/developer-area/hub-panels";
 import { DEVELOPER_GATED_PATH_PREFIXES } from "@/lib/developer-area/headers";
+import { toolCatalogRecords } from "@/lib/tools-catalog";
 
 // Anchored on this file's own location (`__dirname`), never on `process.cwd()`.
 // A cwd-relative `fs.existsSync("src/app/ward-management")` passes or fails
@@ -20,4 +22,18 @@ describe("Ward Flow is a developer-gated sandbox", () => {
   it("no longer exists as a public app route", () => {
     expect(existsSync(path.join(REPO_ROOT, "src", "app", "ward-management"))).toBe(false);
   });
+
+  it("has no clinical tools-catalogue entry under either the old or new path — moving it back under the new path does not count as keeping it out", () => {
+    const leaks = toolCatalogRecords.filter(
+      (tool) => tool.href.startsWith("/ward-management") || tool.href.startsWith("/mockups/ward-flow"),
+    );
+    expect(leaks).toEqual([]);
+  });
+
+  it("the developer-hub panel says what it is, at the point the decision to open it is made", () => {
+    const panel = HUB_PANELS.find((entry) => entry.href === "/mockups/ward-flow");
+    expect(panel).toBeDefined();
+    expect(panel?.summary).toContain("synthetic prototype");
+    expect(panel?.summary).toContain("not clinical decision support");
+  });
 });
diff --git a/tests/ward-management.test.ts b/tests/ward-management.test.ts
index aa0483e3a2..95794eda26 100644
--- a/tests/ward-management.test.ts
+++ b/tests/ward-management.test.ts
@@ -6,7 +6,6 @@ import { legalFormName } from "../src/components/ward-management/ward-legal-form
 import { MOVEMENT_STAGES, PARALLEL_REFERRAL_CAP } from "../src/components/ward-management/ward-model";
 import { movementById, wardMovements } from "../src/components/ward-management/ward-movements";
 import { NOW_ANCHOR, allUnits } from "../src/components/ward-management/ward-sites";
-import { toolCatalogRecordById } from "../src/lib/tools-catalog";
 
 const modesSource = readFileSync("src/components/ward-management/ward-management-modes.tsx", "utf8");
 
@@ -34,9 +33,10 @@ describe("Ward Flow synthetic prototype", () => {
     expect(thTags.every((tag) => tag.includes('scope="col"'))).toBe(true);
   });
 
-  it("keeps the production route reachable from the Tools catalogue", () => {
-    expect(toolCatalogRecordById("ward-management").href).toBe("/mockups/ward-flow");
-  });
+  // Ward Flow is deliberately absent from the Tools catalogue — see
+  // tests/ward-flow-sandbox.test.ts, which asserts no catalogue entry's href
+  // starts with "/ward-management" or "/mockups/ward-flow". Reachability here
+  // is instead through the developer-gated hub panel (also asserted there).
 
   it("maps every Ward Flow view to a distinct reachable route", () => {
     const hrefs = wardModeHrefs();

From cdfbdd99a3656262b9eb567312d1bec0548df616 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 15:18:48 +0800
Subject: [PATCH 25/54] Say what Ward Flow is on the developer hub panel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hub panel summarised Ward Flow as "Queue, capacity, transport,
movements" — accurate, but it never said what it is, at exactly the
point (the developer hub card) where the decision to open it gets
made. Now that Ward Flow is gone from every clinical discovery
surface, this panel is its only remaining door into the app, so this
is where the statement has to land.

- Prepend "Synthetic prototype, not clinical decision support: " to
  the ward-flow panel's summary in hub-panels.ts, following the same
  "<qualifier> prototype: <detail>" shape already used by the Care
  Plan ("Stage B prototype: ...") and Caring Contact ("Coordination
  prototype: ...") panels immediately above it, rather than inventing
  a new phrasing or a new HubPanel field. HubPanel's summary is
  already free text read by every panel, so a new field would only
  ever be populated for these three prototype entries; reusing summary
  keeps the type and the render path exactly as they are.
- Extend tests/ward-flow-sandbox.test.ts with an assertion that the
  panel pointing at "/mockups/ward-flow" exists and its summary
  carries both "Synthetic prototype" and "not clinical decision
  support" — so removing Ward Flow from the clinical app (previous
  commit) can never also silently remove the statement that it is not
  clinical.

Confirmed unchanged by this commit: the shared
`NotAMedicalDeviceStatement` component (defined in
ward-management-modes.tsx) still renders on both the coordinator
screen (coordinator-screen.tsx imports and renders it) and the
governance board route (which renders WardModeWorkspace from
ward-management-modes.tsx, where the same component is rendered
again) — neither file was touched by this change.

RAG impact: no retrieval behaviour change — this only edits a
developer-hub panel summary string and its test; no file under
src/lib/rag/**, retrieval-selection, ranking-config, or the eval
harness was touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/lib/developer-area/hub-panels.ts | 2 +-
 tests/ward-flow-sandbox.test.ts      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/lib/developer-area/hub-panels.ts b/src/lib/developer-area/hub-panels.ts
index 80d9488270..42d7608cd2 100644
--- a/src/lib/developer-area/hub-panels.ts
+++ b/src/lib/developer-area/hub-panels.ts
@@ -107,7 +107,7 @@ export const HUB_PANELS: readonly HubPanel[] = [
   {
     id: "ward-flow",
     name: "Ward flow",
-    summary: "Queue, capacity, transport, movements",
+    summary: "Synthetic prototype, not clinical decision support: queue, capacity, transport, movements",
     group: "reference",
     phase: 1,
     href: "/mockups/ward-flow",
diff --git a/tests/ward-flow-sandbox.test.ts b/tests/ward-flow-sandbox.test.ts
index 60bcab5e4a..91ebec6f6b 100644
--- a/tests/ward-flow-sandbox.test.ts
+++ b/tests/ward-flow-sandbox.test.ts
@@ -33,7 +33,7 @@ describe("Ward Flow is a developer-gated sandbox", () => {
   it("the developer-hub panel says what it is, at the point the decision to open it is made", () => {
     const panel = HUB_PANELS.find((entry) => entry.href === "/mockups/ward-flow");
     expect(panel).toBeDefined();
-    expect(panel?.summary).toContain("synthetic prototype");
+    expect(panel?.summary).toContain("Synthetic prototype");
     expect(panel?.summary).toContain("not clinical decision support");
   });
 });

From c66350fe61de5142ea8ed8c95cfc5285a8dcc578 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 15:57:13 +0800
Subject: [PATCH 26/54] One source for ward navigation (D9, D10, D11)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduces ward-nav.ts as the single source for Ward Flow's rail-specific
destinations (role screens and specialist boards), replacing 329 lines of
hand-pasted link blocks in ward-management-navigation.tsx that let three
boards ship with no rail entry unnoticed (D8/D9).

tests/ward-nav.test.ts enforces a two-way property, enumerated from the
filesystem: every WARD_NAV href resolves to a real route, and every static
Ward Flow route appears in WARD_NAV or WARD_NAV_INTENTIONALLY_UNLISTED with a
stated reason (including constellation's deliberate redirect and the eight
routes WardModeNavigation already covers separately).

The two hardcoded single-instance links (Ward — RPH Adult Secure, Emergency
department — Peel ED) are marked exampleOnly and rendered under their own
labelled group explaining they name one arbitrary synthetic instance, not a
section of the app (D10) — neither link was removed.

The rail's aria-label changes from "Clinical applications" to "Applications"
(D11), honest for a developer-gated sandboxed prototype that is not a
clinical application. No other file referenced the old string.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../ward-management-navigation.tsx            | 177 +++++++-----------
 .../ward-management.module.css                |  11 ++
 src/components/ward-management/ward-nav.ts    | 109 +++++++++++
 tests/ward-nav.test.ts                        | 139 ++++++++++++++
 4 files changed, 330 insertions(+), 106 deletions(-)
 create mode 100644 src/components/ward-management/ward-nav.ts
 create mode 100644 tests/ward-nav.test.ts

diff --git a/src/components/ward-management/ward-management-navigation.tsx b/src/components/ward-management/ward-management-navigation.tsx
index d6e1320783..b841a50d1a 100644
--- a/src/components/ward-management/ward-management-navigation.tsx
+++ b/src/components/ward-management/ward-management-navigation.tsx
@@ -25,6 +25,7 @@ import {
   Truck,
   Waypoints,
   Wrench,
+  type LucideIcon,
 } from "lucide-react";
 
 import { BrandMark } from "@/components/clinical-dashboard/brand";
@@ -33,6 +34,27 @@ import shellStyles from "./ward-management.module.css";
 import modeStyles from "./ward-management-modes.module.css";
 import { WardDemoControls } from "./ward-demo-controls";
 import { WardRoleSwitcher } from "./ward-role-switcher";
+import { WARD_NAV, type WardNavItem } from "./ward-nav";
+
+/** Icon per `WARD_NAV` item id — kept out of `ward-nav.ts` so that single source of truth stays
+ *  plain data, checkable by `tests/ward-nav.test.ts` without a JSX/React dependency. */
+const WARD_NAV_ICONS: Record<string, LucideIcon> = {
+  ward: Building2,
+  officer: Ambulance,
+  ed: Siren,
+  handover: ClipboardList,
+  escalation: TriangleAlert,
+  search: Search,
+};
+
+function WardNavLink({ item }: { item: WardNavItem }) {
+  const Icon = WARD_NAV_ICONS[item.id];
+  return (
+    <RailLink href={item.href} label={item.label}>
+      <Icon aria-hidden="true" />
+    </RailLink>
+  );
+}
 
 export type WardMode =
   "command" | "network" | "queue" | "capacity" | "movements" | "exceptions" | "transport" | "governance";
@@ -80,7 +102,13 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
         <BrandMark className={shellStyles.brandGlyph} />
       </Link>
       <div className={shellStyles.railRule} aria-hidden="true" />
-      <nav className={shellStyles.railNav} aria-label="Clinical applications">
+      {/* Task 4 (D11): this nav's aria-label used to claim every entry was a clinical
+          application — wrong once Ward Flow moved into its own developer-gated sandbox
+          (constraint 4: "not a medical device"). This nav is Ward Flow's own copy of the
+          cross-app switcher, not a claim that everything it lists — including the synthetic
+          prototype itself — belongs to the clinical toolset. Only this file used the old label
+          (checked before renaming), so this is the only place it needed to change. */}
+      <nav className={shellStyles.railNav} aria-label="Applications">
         <RailLink href="/?mode=answer" label="Clinical Answers">
           <MessageSquarePlus aria-hidden="true" />
         </RailLink>
@@ -117,111 +145,48 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
             selected — see `ward-role-switcher.tsx`'s own doc comment). */}
         <WardRoleSwitcher />
         <div className={shellStyles.railRule} aria-hidden="true" />
-        {/* Task 8: the ward screen's own route (`/mockups/ward-flow/ward/[unitId]`) is not one of
-            the eight `WardModeNavigation` links above — that nav's own Playwright test
-            (`tests/ui-ward-management.spec.ts`) asserts an exact count of 8 links, so a ninth
-            entry there would break it. This is a literal, static href (never built from a
-            variable or a loop) so `tests/route-reachability.test.ts`'s AST scan can find it —
-            see that test's comment and R39c. RPH Adult Secure is a real, resolvable unit id. */}
-        <RailLink href="/mockups/ward-flow/ward/rph-adult-secure" label="Ward — RPH Adult Secure">
-          <Building2 aria-hidden="true" />
-        </RailLink>
-        {/* Task 9: unlike the ward link immediately above, `/mockups/ward-flow/transport/officer`
-            is a STATIC route (no `[unitId]`-style bracket segment), so it falls inside
-            `tests/route-reachability.test.ts`'s scanned scope rather than being exempt as a
-            dynamic detail route. That scanner's AST walk only registers a JSX element literally
-            named `Link` (imported from `next/link`) whose OWN `href` attribute is a string
-            literal — `RailLink` below passes `href` through as a destructured prop, so a
-            `RailLink`-wrapped href reads as a plain `Identifier` to the scanner, not a literal,
-            and stays invisible to it (confirmed: swapping this back to `<RailLink href="...">`
-            reproduces the orphan-route failure this comment exists to prevent — see the task
-            report). This is a raw `<Link>`, not `RailLink`, for exactly that reason. Labelled
-            "Officer" rather than "Transport officer": Playwright's default accessible-name match
-            is a substring match, and the eight-mode strip already has a "Transport" link (the
-            live tracker, `/mockups/ward-flow/transport`) — a name containing "Transport" makes
-            `getByRole("link", { name: "Transport" })` resolve to two elements and breaks
-            `tests/ui-ward-management.spec.ts`'s existing "opens every Ward Flow mode" walk, which
-            is not scoped by exact match (also confirmed by running that spec). */}
-        <Link
-          href="/mockups/ward-flow/transport/officer"
-          aria-label="Officer"
-          title="Officer"
-          className={shellStyles.railLink}
-        >
-          <Ambulance aria-hidden="true" />
-        </Link>
-        {/* Task 11: `/mockups/ward-flow/ed/[edId]` is a dynamic detail route, same shape as the
-            ward link above — a raw `<Link>` with a literal string `href`, not `RailLink`, for the
-            exact reason documented on the Officer link immediately above: `RailLink` passes
-            `href` through as a destructured prop, which reads as a plain `Identifier` to
-            `tests/route-reachability.test.ts`'s AST scan and stays invisible to it. Peel is a
-            real, resolvable emergency department id. Labelled "Emergency department" — checked
-            against every other accessible name in this rail and `WardModeNavigation` below, none
-            of which contain that string as a substring, so Playwright's default substring
-            accessible-name match cannot collide with it the way "Transport officer" once did. */}
-        <Link
-          href="/mockups/ward-flow/ed/peel-ed"
-          aria-label="Emergency department"
-          title="Emergency department"
-          className={shellStyles.railLink}
-        >
-          <Siren aria-hidden="true" />
-        </Link>
-        {/* Task 4: `/mockups/ward-flow/handover` — same shape as the Officer and Emergency
-            department links immediately above and for the exact same reason (see the Officer
-            link's own comment): a raw `<Link>` with a literal string `href`, never `RailLink`,
-            because `RailLink` passes its `href` through as a destructured prop, which reads as a
-            plain `Identifier` to `tests/route-reachability.test.ts`'s AST scan and would leave
-            this route invisible to it. It also sits outside the eight-link `WardModeNavigation`
-            strip on purpose — that nav's own Playwright spec asserts an exact count of 8 links,
-            so a ninth entry there would break it, exactly as the Officer link's comment already
-            explains. "Handover" collides with no other accessible name in this rail or in
-            `WardModeNavigation` as a substring, so Playwright's default substring accessible-name
-            match cannot resolve it to more than one element. */}
-        <Link
-          href="/mockups/ward-flow/handover"
-          aria-label="Handover"
-          title="Handover"
-          className={shellStyles.railLink}
-        >
-          <ClipboardList aria-hidden="true" />
-        </Link>
-        {/* Task 5: `/mockups/ward-flow/escalation` — same shape as the Handover, Officer and
-            Emergency department links immediately above and for the exact same reason (see the
-            Officer link's own comment): a raw `<Link>` with a literal string `href`, never
-            `RailLink`, because `RailLink` passes its `href` through as a destructured prop,
-            which reads as a plain `Identifier` to `tests/route-reachability.test.ts`'s AST scan
-            and would leave this route invisible to it. It also sits outside the eight-link
-            `WardModeNavigation` strip on purpose, for the same reason the Officer link's comment
-            already explains. "Escalation" collides with no other accessible name in this rail or
-            in `WardModeNavigation` as a substring, so Playwright's default substring
-            accessible-name match cannot resolve it to more than one element. */}
-        <Link
-          href="/mockups/ward-flow/escalation"
-          aria-label="Escalation"
-          title="Escalation"
-          className={shellStyles.railLink}
-        >
-          <TriangleAlert aria-hidden="true" />
-        </Link>
-        {/* Task 7: `/mockups/ward-flow/search` — same shape as the Handover and Escalation links
-            immediately above and for the exact same reason (see the Officer link's own comment):
-            a raw `<Link>` with a literal string `href`, never `RailLink`, because `RailLink`
-            passes its `href` through as a destructured prop, which reads as a plain `Identifier`
-            to `tests/route-reachability.test.ts`'s AST scan and would leave this route invisible
-            to it. It also sits outside the eight-link `WardModeNavigation` strip on purpose, for
-            the same reason the Officer link's comment already explains. "Patient search" collides
-            with no other accessible name in this rail or in `WardModeNavigation` as a substring,
-            so Playwright's default substring accessible-name match cannot resolve it to more than
-            one element. */}
-        <Link
-          href="/mockups/ward-flow/search"
-          aria-label="Patient search"
-          title="Patient search"
-          className={shellStyles.railLink}
-        >
-          <Search aria-hidden="true" />
-        </Link>
+        {/*
+         * Task 4 (D9/D10): every link from here down through the "Patient search" equivalent used
+         * to be an individually hand-pasted block — 329 lines of them, accreted one per task, with
+         * nothing checking the rail and the real route tree against each other. That is *why* three
+         * boards (`/handover`, `/escalation`, `/search`) could ship with no rail entry and stay
+         * that way unnoticed (D8). They now render from `WARD_NAV`
+         * (`ward-nav.ts`), the single source `tests/ward-nav.test.ts` checks both ways: every href
+         * here resolves to a real route, and every static Ward Flow route appears either here or
+         * in `WARD_NAV_INTENTIONALLY_UNLISTED` with a stated reason.
+         *
+         * The old per-link comments about `RailLink` vs a raw `<Link>` (to stay visible to
+         * `tests/route-reachability.test.ts`'s literal-href AST scan) no longer apply: that test's
+         * `staticPageRoutes` excludes every `/mockups/**` route outright (Ward Flow's sandbox move
+         * — see that test's header comment), so nothing under `/mockups/ward-flow/**` needs a
+         * literal string href for that scanner to find it any more. Re-run `route-reachability` on
+         * any future change here to confirm that is still true rather than assuming it.
+         *
+         * "Ward Flow role screens" holds the one non-arbitrary role entry point (Officer); the
+         * nested group holds the two that name one arbitrary synthetic instance rather than a
+         * section of the app (D10) and says so in its own aria-label. Coordinator is deliberately
+         * absent from both — see `WARD_NAV_INTENTIONALLY_UNLISTED`'s entry for `/mockups/ward-flow`.
+         */}
+        <div className={shellStyles.railGroup} role="group" aria-label="Ward Flow role screens">
+          {WARD_NAV.filter((item) => item.group === "role" && !item.exampleOnly).map((item) => (
+            <WardNavLink key={item.id} item={item} />
+          ))}
+          <div
+            className={shellStyles.railGroup}
+            role="group"
+            aria-label="Example ward and emergency department — one arbitrary synthetic instance each, not a section of the app"
+          >
+            {WARD_NAV.filter((item) => item.group === "role" && item.exampleOnly).map((item) => (
+              <WardNavLink key={item.id} item={item} />
+            ))}
+          </div>
+        </div>
+        <div className={shellStyles.railRule} aria-hidden="true" />
+        <div className={shellStyles.railGroup} role="group" aria-label="Ward Flow specialist boards">
+          {WARD_NAV.filter((item) => item.group === "board").map((item) => (
+            <WardNavLink key={item.id} item={item} />
+          ))}
+        </div>
         <RailLink href="/?mode=answer" label="Favourites">
           <HeartPulse aria-hidden="true" />
         </RailLink>
diff --git a/src/components/ward-management/ward-management.module.css b/src/components/ward-management/ward-management.module.css
index 46e61e6767..9385aa249d 100644
--- a/src/components/ward-management/ward-management.module.css
+++ b/src/components/ward-management/ward-management.module.css
@@ -123,6 +123,17 @@
   margin-top: auto;
 }
 
+/*
+ * Task 4 (D9): wraps each WARD_NAV group (`role`, `board`, and the nested example-only subset of
+ * `role`) so `.railBottom`'s own grid keeps treating each group as a single item while the links
+ * inside a group keep the same centred, gapped column the flat list used to have directly.
+ */
+.railGroup {
+  display: grid;
+  justify-items: center;
+  gap: var(--ward-space-6);
+}
+
 .railLink,
 .railLinkActive {
   display: grid;
diff --git a/src/components/ward-management/ward-nav.ts b/src/components/ward-management/ward-nav.ts
new file mode 100644
index 0000000000..51f1899763
--- /dev/null
+++ b/src/components/ward-management/ward-nav.ts
@@ -0,0 +1,109 @@
+/**
+ * The single source for Ward Flow's own rail navigation — see `ward-management-navigation.tsx`'s
+ * `ClinicalRail`. Before this file, the rail's Ward-Flow-specific destinations (everything beyond
+ * the eight views `WardModeNavigation` already sources statically) were 329 lines of individually
+ * hand-pasted link blocks, one appended per task over two phases. Nothing enumerated the two
+ * sides — nav links and real routes — against each other, which is *why* three boards
+ * (`/handover`, `/escalation`, `/search`) could ship with no rail entry and nothing noticed
+ * (plan defects D8/D9).
+ *
+ * `tests/ward-nav.test.ts` enforces the two-way property this file exists to make possible:
+ * every href below must resolve to a real route under `src/app/mockups/ward-flow/`, **and**
+ * every *static* route under that tree must appear here or in `WARD_NAV_INTENTIONALLY_UNLISTED`
+ * with a stated reason. A one-way check ("every nav link is a real route") is exactly what let
+ * D8 happen — it says nothing about a route with no link pointing at it at all.
+ */
+
+export type WardNavGroup = "role" | "board";
+
+export type WardNavItem = {
+  id: string;
+  href: string;
+  label: string;
+  group: WardNavGroup;
+  /** True when the href names one specific synthetic ward or department rather than a section. */
+  exampleOnly?: boolean;
+};
+
+/**
+ * `role` — entry points for the role screens `WardRoleSwitcher` offers (Coordinator, Ward,
+ * Officer, Emergency department — see that component's own doc comment). Coordinator is
+ * deliberately absent here: it is `/mockups/ward-flow` itself, already reachable via
+ * `WardModeNavigation`'s "Command" view and the app-switcher's own "Ward Flow" link one section
+ * up in the same rail — see `WARD_NAV_INTENTIONALLY_UNLISTED` below, which is where that
+ * reasoning is recorded and checked. Ward and Emergency department are dynamic detail routes
+ * (`ward/[unitId]`, `ed/[edId]`); the rail can only ever link to one concrete instance of each,
+ * so both carry `exampleOnly: true` (D10) — the rail must present them as an example entry point
+ * into that role screen, never as though they were a section of the app in their own right.
+ * **Do not delete either** — they are currently the only way to reach those two role screens.
+ *
+ * `board` — the specialist boards that sit outside `WardModeNavigation`'s eight-view strip.
+ */
+export const WARD_NAV: readonly WardNavItem[] = [
+  {
+    id: "ward",
+    href: "/mockups/ward-flow/ward/rph-adult-secure",
+    label: "Ward — RPH Adult Secure",
+    group: "role",
+    exampleOnly: true,
+  },
+  { id: "officer", href: "/mockups/ward-flow/transport/officer", label: "Officer", group: "role" },
+  {
+    id: "ed",
+    href: "/mockups/ward-flow/ed/peel-ed",
+    label: "Emergency department",
+    group: "role",
+    exampleOnly: true,
+  },
+  { id: "handover", href: "/mockups/ward-flow/handover", label: "Handover", group: "board" },
+  { id: "escalation", href: "/mockups/ward-flow/escalation", label: "Escalation", group: "board" },
+  { id: "search", href: "/mockups/ward-flow/search", label: "Patient search", group: "board" },
+];
+
+/**
+ * Static Ward Flow routes intentionally absent from `WARD_NAV`, each with the reason it is
+ * exempt — mirrors `REACHABILITY_ALLOWLIST` in `tests/route-reachability.test.ts`. Every key must
+ * be a real static route under `src/app/mockups/ward-flow/` (checked by `tests/ward-nav.test.ts`,
+ * which fails on a stale entry) and must never also appear in `WARD_NAV` — a route belongs in
+ * exactly one of the two.
+ */
+export const WARD_NAV_INTENTIONALLY_UNLISTED: ReadonlyMap<string, string> = new Map([
+  [
+    "/mockups/ward-flow",
+    "Coordinator's own entry point — already reachable via WardModeNavigation's \"Command\" view " +
+      'and the app-switcher\'s "Ward Flow" link; not duplicated in the role/board rail groups.',
+  ],
+  [
+    "/mockups/ward-flow/network",
+    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
+  ],
+  [
+    "/mockups/ward-flow/queue",
+    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
+  ],
+  [
+    "/mockups/ward-flow/capacity",
+    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
+  ],
+  [
+    "/mockups/ward-flow/movements",
+    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
+  ],
+  [
+    "/mockups/ward-flow/exceptions",
+    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
+  ],
+  [
+    "/mockups/ward-flow/transport",
+    "One of WardModeNavigation's eight views (the live tracker) — sourced, rendered and tested " +
+      "separately from this file. Distinct from /transport/officer, which is in WARD_NAV.",
+  ],
+  [
+    "/mockups/ward-flow/governance",
+    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
+  ],
+  [
+    "/mockups/ward-flow/constellation",
+    "A deliberate 307 redirect to /network, documented in its own route file (constellation/page.tsx) — not a destination.",
+  ],
+]);
diff --git a/tests/ward-nav.test.ts b/tests/ward-nav.test.ts
new file mode 100644
index 0000000000..c6dc6fb73d
--- /dev/null
+++ b/tests/ward-nav.test.ts
@@ -0,0 +1,139 @@
+import { readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+import { WARD_NAV, WARD_NAV_INTENTIONALLY_UNLISTED } from "../src/components/ward-management/ward-nav";
+
+const REPO_ROOT = path.resolve(__dirname, "..");
+const WARD_FLOW_ROOT = path.join(REPO_ROOT, "src", "app", "mockups", "ward-flow");
+const ROUTE_PREFIX = "/mockups/ward-flow";
+
+type WardFlowRoute = { route: string; dynamic: boolean };
+
+/**
+ * Recursively collects every `page.tsx` under the Ward Flow route tree and converts its file path
+ * into the route it serves. Enumerated straight from the filesystem, **never** a hand-written
+ * list — a hand-written list of routes is exactly the shape of the D8 defect this file exists to
+ * prevent from recurring: a route that nobody remembered to add to the list stays invisible to
+ * both sides of the check.
+ */
+function collectWardFlowRoutes(dir: string, segments: string[] = []): WardFlowRoute[] {
+  const routes: WardFlowRoute[] = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      routes.push(...collectWardFlowRoutes(path.join(dir, entry.name), [...segments, entry.name]));
+    } else if (entry.name === "page.tsx") {
+      const dynamic = segments.some((segment) => segment.startsWith("[") && segment.endsWith("]"));
+      const route = segments.length === 0 ? ROUTE_PREFIX : `${ROUTE_PREFIX}/${segments.join("/")}`;
+      routes.push({ route, dynamic });
+    }
+  }
+  return routes;
+}
+
+function escapeRegex(value: string) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** Converts a dynamic route like `/mockups/ward-flow/ward/[unitId]` into a matcher for any one
+ *  concrete instance, e.g. `/mockups/ward-flow/ward/rph-adult-secure`. */
+function routeToPattern(route: string): RegExp {
+  const pattern = route
+    .split("/")
+    .map((segment) => (/^\[.+\]$/.test(segment) ? "[^/]+" : escapeRegex(segment)))
+    .join("/");
+  return new RegExp(`^${pattern}$`);
+}
+
+const wardFlowRoutes = collectWardFlowRoutes(WARD_FLOW_ROOT);
+const staticRoutes = wardFlowRoutes.filter((entry) => !entry.dynamic).map((entry) => entry.route);
+const dynamicPatterns = wardFlowRoutes.filter((entry) => entry.dynamic).map((entry) => routeToPattern(entry.route));
+
+describe("Ward Flow route enumeration (sanity check on the scan itself)", () => {
+  it("finds every known page.tsx under src/app/mockups/ward-flow, both static and dynamic", () => {
+    // 16 page.tsx files measured on this branch at HEAD: 13 static + 3 dynamic
+    // (ed/[edId], patients/[patientId], ward/[unitId]). A silently broken scan (e.g. resolving
+    // the wrong directory) would collapse this to 0 or a handful, and every assertion below would
+    // then vacuously pass — so this is checked before trusting any of them.
+    expect(wardFlowRoutes.length).toBe(16);
+    expect(staticRoutes).toContain(ROUTE_PREFIX);
+    expect(staticRoutes).toContain(`${ROUTE_PREFIX}/handover`);
+    expect(staticRoutes).toContain(`${ROUTE_PREFIX}/escalation`);
+    expect(staticRoutes).toContain(`${ROUTE_PREFIX}/search`);
+    expect(staticRoutes).toContain(`${ROUTE_PREFIX}/transport/officer`);
+    expect(dynamicPatterns.some((pattern) => pattern.test(`${ROUTE_PREFIX}/ward/rph-adult-secure`))).toBe(true);
+    expect(dynamicPatterns.some((pattern) => pattern.test(`${ROUTE_PREFIX}/ed/peel-ed`))).toBe(true);
+  });
+});
+
+describe("Ward Flow navigation — single source (ward-nav.ts)", () => {
+  // Direction 1: every WARD_NAV href must be a real route (static or one instance of a dynamic
+  // route). This is the direction a purely "does every link work" check would already cover.
+  it("every WARD_NAV href resolves to a real route under src/app/mockups/ward-flow/", () => {
+    const unresolved = WARD_NAV.filter(
+      (item) => !staticRoutes.includes(item.href) && !dynamicPatterns.some((pattern) => pattern.test(item.href)),
+    ).map((item) => item.href);
+    expect(unresolved, `WARD_NAV href(s) with no matching route: ${unresolved.join(", ")}`).toEqual([]);
+  });
+
+  // Direction 2: every real STATIC route must appear in WARD_NAV or be recorded as intentionally
+  // unlisted with a reason. This is the direction a one-way "is every link real" check cannot
+  // see — and its absence is exactly how D8 shipped three boards with no rail entry.
+  it("every static Ward Flow route appears in WARD_NAV or is recorded as intentionally unlisted", () => {
+    const navHrefs = new Set(WARD_NAV.map((item) => item.href));
+    const missing = staticRoutes.filter((route) => !navHrefs.has(route) && !WARD_NAV_INTENTIONALLY_UNLISTED.has(route));
+    expect(
+      missing,
+      `Static Ward Flow route(s) in neither WARD_NAV nor WARD_NAV_INTENTIONALLY_UNLISTED: ${missing.join(", ")}`,
+    ).toEqual([]);
+  });
+
+  it("WARD_NAV_INTENTIONALLY_UNLISTED has no stale entries, no empty reasons, and never overlaps WARD_NAV", () => {
+    const navHrefs = new Set(WARD_NAV.map((item) => item.href));
+    for (const [route, reason] of WARD_NAV_INTENTIONALLY_UNLISTED) {
+      expect(
+        staticRoutes,
+        `${route} is recorded as intentionally unlisted but is no longer a static Ward Flow route`,
+      ).toContain(route);
+      expect(reason.trim().length, `${route}'s intentionally-unlisted reason is empty`).toBeGreaterThan(0);
+      expect(navHrefs.has(route), `${route} is in both WARD_NAV and WARD_NAV_INTENTIONALLY_UNLISTED — pick one`).toBe(
+        false,
+      );
+    }
+  });
+
+  it("WARD_NAV item ids and hrefs are each unique", () => {
+    expect(new Set(WARD_NAV.map((item) => item.id)).size).toBe(WARD_NAV.length);
+    expect(new Set(WARD_NAV.map((item) => item.href)).size).toBe(WARD_NAV.length);
+  });
+
+  it("marks exactly the two arbitrary hardcoded instances exampleOnly (D10), and nothing else", () => {
+    const exampleOnlyHrefs = WARD_NAV.filter((item) => item.exampleOnly)
+      .map((item) => item.href)
+      .sort();
+    expect(exampleOnlyHrefs).toEqual(
+      ["/mockups/ward-flow/ed/peel-ed", "/mockups/ward-flow/ward/rph-adult-secure"].sort(),
+    );
+  });
+
+  it("groups every item as either a role screen or a specialist board", () => {
+    for (const item of WARD_NAV) {
+      expect(["role", "board"]).toContain(item.group);
+    }
+  });
+});
+
+describe("ClinicalRail's aria-label is honest for a sandboxed prototype (D11)", () => {
+  const source = readFileSync(
+    path.join(REPO_ROOT, "src/components/ward-management/ward-management-navigation.tsx"),
+    "utf8",
+  );
+
+  it("no longer claims Ward Flow is a clinical application", () => {
+    expect(source).not.toContain("Clinical applications");
+  });
+
+  it("labels the app-switcher nav with an honest, non-clinical name", () => {
+    expect(source).toContain('aria-label="Applications"');
+  });
+});

From 69cc823b012067866118ad0854541b99faf8acfb Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:19:05 +0800
Subject: [PATCH 27/54] Give every Ward Flow route a real #main-content
 landmark (D5, D6)

Every Ward Flow route ships a skip link to #main-content (src/app/layout.tsx),
but 8 of 15 live routes had no element carrying that id, so the link landed
nowhere -- worse than no skip link, since a keyboard user believes it worked.
The root coordinator screen (/mockups/ward-flow) rendered no <main> at all.

tests/ward-landmarks.test.ts enumerates every page.tsx under
src/app/mockups/ward-flow/ from the filesystem (never a hand-written list),
renders each real route component (via WardFlowProvider, matching the
existing ward DOM-test pattern) with react-dom/server's renderToStaticMarkup,
and asserts exactly one <main id="main-content"> in the output -- "exactly
one", not "at least one", since a duplicated landmark is also a defect. Run
red before any fix, it named precisely the 8 broken routes: the coordinator
root, ed/[edId], escalation, handover, search, transport, transport/officer,
and ward/[unitId].

Fixed each to the /queue shape: the coordinator screen's <div
className={styles.main}> became a real <main id="main-content">; the other
seven already had a <main> and only needed the id added (ed-screen.tsx and
ward-screen.tsx each render one of two mutually exclusive <main> branches,
both now carry the id).

Mutation-tested: adding a second <main id="main-content"> to
ward-management-modes.tsx's shared WardModeWorkspace caused all 6 of its
routes to fail with "found 2"; removing an entry from the test's own
RENDERABLE_ROUTES coverage map caused the coverage-sanity tests to fail.
Both reverted after confirming red, suite is green again (18/18).

RAG impact: none -- no file under src/lib/rag/**, clinical-search,
retrieval-selection, ranking-config, or answer-ranking touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../coordinator/coordinator-screen.tsx        |   4 +-
 .../ward-management/ed/ed-screen.tsx          |   4 +-
 .../escalation/escalation-board.tsx           |   2 +-
 .../handover/handover-page.tsx                |   2 +-
 .../officer/officer-screen.tsx                |   2 +-
 .../ward-management/search/patient-search.tsx |   2 +-
 .../ward-management/tracker/live-tracker.tsx  |   2 +-
 .../ward-management/ward/ward-screen.tsx      |   4 +-
 tests/ward-landmarks.test.ts                  | 161 ++++++++++++++++++
 9 files changed, 172 insertions(+), 11 deletions(-)
 create mode 100644 tests/ward-landmarks.test.ts

diff --git a/src/components/ward-management/coordinator/coordinator-screen.tsx b/src/components/ward-management/coordinator/coordinator-screen.tsx
index bbffc0d599..64729a3ef9 100644
--- a/src/components/ward-management/coordinator/coordinator-screen.tsx
+++ b/src/components/ward-management/coordinator/coordinator-screen.tsx
@@ -149,7 +149,7 @@ export function CoordinatorScreen() {
   return (
     <div className={styles.screen} data-testid="ward-coordinator">
       <ClinicalRail activeMode="command" />
-      <div className={styles.main}>
+      <main id="main-content" className={styles.main}>
         <h1 className="sr-only">Ward Flow coordinator</h1>
 
         <div className={styles.governanceBanner} data-testid="ward-coordinator-governance">
@@ -234,7 +234,7 @@ export function CoordinatorScreen() {
             setExceptionsOpen(false);
           }}
         />
-      </div>
+      </main>
     </div>
   );
 }
diff --git a/src/components/ward-management/ed/ed-screen.tsx b/src/components/ward-management/ed/ed-screen.tsx
index 9aa54a4de3..bb165f6de8 100644
--- a/src/components/ward-management/ed/ed-screen.tsx
+++ b/src/components/ward-management/ed/ed-screen.tsx
@@ -228,7 +228,7 @@ export function EdScreen({ edId }: EdScreenProps) {
     return (
       <div className={styles.screen} data-testid="ward-ed-screen">
         <ClinicalRail />
-        <main className={styles.main}>
+        <main id="main-content" className={styles.main}>
           <h1 className={styles.notFoundHeading}>Emergency department not found</h1>
           <p className={styles.notFoundBody} data-testid="ward-ed-unresolved">
             No synthetic emergency department matches &ldquo;{edId}&rdquo;. It may have been renamed or removed, or the
@@ -311,7 +311,7 @@ export function EdScreen({ edId }: EdScreenProps) {
   return (
     <div className={styles.screen} data-testid="ward-ed-screen">
       <ClinicalRail />
-      <main className={styles.main}>
+      <main id="main-content" className={styles.main}>
         <div className={styles.governanceBanner} data-testid="ward-ed-governance">
           <span className={styles.prototypeBadge}>Synthetic prototype</span>
           <p>
diff --git a/src/components/ward-management/escalation/escalation-board.tsx b/src/components/ward-management/escalation/escalation-board.tsx
index 5bde11dbae..0507d1bcf6 100644
--- a/src/components/ward-management/escalation/escalation-board.tsx
+++ b/src/components/ward-management/escalation/escalation-board.tsx
@@ -36,7 +36,7 @@ export function EscalationBoardPage() {
   return (
     <div className={styles.screen} data-testid="ward-escalation-page">
       <ClinicalRail />
-      <main className={styles.main}>
+      <main id="main-content" className={styles.main}>
         <div className={styles.governanceBanner} data-testid="ward-escalation-governance">
           <span className={styles.prototypeBadge}>Synthetic prototype</span>
           <p>
diff --git a/src/components/ward-management/handover/handover-page.tsx b/src/components/ward-management/handover/handover-page.tsx
index 45b5bf6315..e82aee53f4 100644
--- a/src/components/ward-management/handover/handover-page.tsx
+++ b/src/components/ward-management/handover/handover-page.tsx
@@ -53,7 +53,7 @@ export function HandoverPage() {
   return (
     <div className={styles.screen} data-testid="ward-handover-page">
       <ClinicalRail />
-      <main className={styles.main}>
+      <main id="main-content" className={styles.main}>
         <div className={styles.governanceBanner} data-testid="ward-handover-governance">
           <span className={styles.prototypeBadge}>Synthetic prototype</span>
           <p>
diff --git a/src/components/ward-management/officer/officer-screen.tsx b/src/components/ward-management/officer/officer-screen.tsx
index 01633c5878..5c9ff62d9e 100644
--- a/src/components/ward-management/officer/officer-screen.tsx
+++ b/src/components/ward-management/officer/officer-screen.tsx
@@ -122,7 +122,7 @@ export function OfficerScreen() {
   return (
     <div className={styles.screen} data-testid="ward-officer-screen">
       <ClinicalRail />
-      <main className={styles.main}>
+      <main id="main-content" className={styles.main}>
         <div className={styles.governanceBanner} data-testid="ward-officer-governance">
           <span className={styles.prototypeBadge}>Synthetic prototype</span>
           <p>
diff --git a/src/components/ward-management/search/patient-search.tsx b/src/components/ward-management/search/patient-search.tsx
index 8a0f9a494f..b508382b13 100644
--- a/src/components/ward-management/search/patient-search.tsx
+++ b/src/components/ward-management/search/patient-search.tsx
@@ -66,7 +66,7 @@ export function PatientSearchPage() {
   return (
     <div className={styles.screen} data-testid="ward-patient-search">
       <ClinicalRail />
-      <main className={styles.main}>
+      <main id="main-content" className={styles.main}>
         <div className={styles.governanceBanner} data-testid="ward-patient-search-governance">
           <span className={styles.prototypeBadge}>Synthetic prototype</span>
           <p>
diff --git a/src/components/ward-management/tracker/live-tracker.tsx b/src/components/ward-management/tracker/live-tracker.tsx
index e048c3cfb1..7f958516f3 100644
--- a/src/components/ward-management/tracker/live-tracker.tsx
+++ b/src/components/ward-management/tracker/live-tracker.tsx
@@ -66,7 +66,7 @@ export function LiveTracker() {
   return (
     <div className={styles.screen} data-testid="ward-mode-transport">
       <ClinicalRail activeMode="transport" />
-      <main className={styles.main} data-testid="ward-live-tracker">
+      <main id="main-content" className={styles.main} data-testid="ward-live-tracker">
         <div className={styles.governanceBanner} data-testid="ward-tracker-governance">
           <span className={styles.prototypeBadge}>Synthetic prototype</span>
           <p>
diff --git a/src/components/ward-management/ward/ward-screen.tsx b/src/components/ward-management/ward/ward-screen.tsx
index 2be2192058..f9dd935be3 100644
--- a/src/components/ward-management/ward/ward-screen.tsx
+++ b/src/components/ward-management/ward/ward-screen.tsx
@@ -120,7 +120,7 @@ export function WardScreen({ unitId }: WardScreenProps) {
     return (
       <div className={styles.screen} data-testid="ward-unit-screen">
         <ClinicalRail />
-        <main className={styles.main}>
+        <main id="main-content" className={styles.main}>
           <h1 className={styles.notFoundHeading}>Ward not found</h1>
           <p className={styles.notFoundBody} data-testid="ward-unit-unresolved">
             No synthetic unit matches &ldquo;{unitId}&rdquo;. It may have been renamed or removed, or the id in the
@@ -252,7 +252,7 @@ export function WardScreen({ unitId }: WardScreenProps) {
   return (
     <div className={styles.screen} data-testid="ward-unit-screen">
       <ClinicalRail />
-      <main className={styles.main}>
+      <main id="main-content" className={styles.main}>
         <div className={styles.governanceBanner} data-testid="ward-unit-governance">
           <span className={styles.prototypeBadge}>Synthetic prototype</span>
           <p>
diff --git a/tests/ward-landmarks.test.ts b/tests/ward-landmarks.test.ts
new file mode 100644
index 0000000000..0c973878a2
--- /dev/null
+++ b/tests/ward-landmarks.test.ts
@@ -0,0 +1,161 @@
+import { readdirSync } from "node:fs";
+import path from "node:path";
+import { createElement, type ReactNode } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it, vi } from "vitest";
+
+/**
+ * Task 5/6 (D5, D6, D7). This file is `.test.ts`, not `.dom.test.tsx`, so it collects under
+ * vitest.config.mts's "node" project (no jsdom, no DOM globals) rather than the "jsdom" project
+ * the sibling `*.dom.test.tsx` suites use. `renderToStaticMarkup` renders the real component tree
+ * to an HTML string without needing `document` — the same "SSR-string component test" pattern
+ * already established in this repo (see tests/route-error-boundary.test.ts and vitest.config.mts's
+ * own "pure logic + route + SSR-string component tests" comment) — and the landmark/heading counts
+ * are read back from that string. `.ts` cannot contain JSX, so every element below is built with
+ * `createElement` instead, exactly like route-error-boundary.test.ts does.
+ *
+ * `renderToStaticMarkup` never runs effects (`useEffect`/`useLayoutEffect`), so any `window.`/
+ * `document.` access confined to an effect or an event handler is safe here — checked directly
+ * against every file in RENDERABLE_ROUTES below (coordinator-screen.tsx's `window.matchMedia`,
+ * handover-page.tsx's `window.print`, ward-role-switcher.tsx's and ward-demo-controls.tsx's
+ * `document.addEventListener`, all effect/handler-only). `next/navigation`'s `useRouter` is
+ * different: `ContextualBackLink` (used by `WardPatientWorkspace`) calls it synchronously during
+ * render, so it needs the same module mock tests/ward-patient-page.dom.test.tsx already uses.
+ */
+vi.mock("next/link", () => ({
+  default: ({ children, href, ...rest }: { children: ReactNode; href: string; [key: string]: unknown }) =>
+    createElement("a", { href, ...rest }, children),
+}));
+
+const router = vi.hoisted(() => ({
+  back: vi.fn(),
+  replace: vi.fn(),
+}));
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => router,
+}));
+
+import { WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+import { CoordinatorScreen } from "@/components/ward-management/coordinator/coordinator-screen";
+import { WardModeWorkspace } from "@/components/ward-management/ward-management-modes";
+import { EdScreen } from "@/components/ward-management/ed/ed-screen";
+import { EscalationBoardPage } from "@/components/ward-management/escalation/escalation-board";
+import { HandoverPage } from "@/components/ward-management/handover/handover-page";
+import { PatientSearchPage } from "@/components/ward-management/search/patient-search";
+import { LiveTracker } from "@/components/ward-management/tracker/live-tracker";
+import { OfficerScreen } from "@/components/ward-management/officer/officer-screen";
+import { WardScreen } from "@/components/ward-management/ward/ward-screen";
+import { WardPatientWorkspace } from "@/components/ward-management/ward-management-console";
+import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
+
+const REPO_ROOT = path.resolve(__dirname, "..");
+const WARD_FLOW_ROOT = path.join(REPO_ROOT, "src", "app", "mockups", "ward-flow");
+const ROUTE_PREFIX = "/mockups/ward-flow";
+
+type WardFlowRoute = { route: string; dynamic: boolean };
+
+/**
+ * Same scan as tests/ward-nav.test.ts's `collectWardFlowRoutes` — deliberately duplicated rather
+ * than imported, matching that file's own established pattern of every structural-contract test
+ * owning its own filesystem scan, so a change to one enumeration can never silently blind the
+ * other. Enumerated straight from the filesystem, never a hand-written list.
+ */
+function collectWardFlowRoutes(dir: string, segments: string[] = []): WardFlowRoute[] {
+  const routes: WardFlowRoute[] = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      routes.push(...collectWardFlowRoutes(path.join(dir, entry.name), [...segments, entry.name]));
+    } else if (entry.name === "page.tsx") {
+      const dynamic = segments.some((segment) => segment.startsWith("[") && segment.endsWith("]"));
+      const route = segments.length === 0 ? ROUTE_PREFIX : `${ROUTE_PREFIX}/${segments.join("/")}`;
+      routes.push({ route, dynamic });
+    }
+  }
+  return routes;
+}
+
+const wardFlowRoutes = collectWardFlowRoutes(WARD_FLOW_ROOT);
+
+/**
+ * `/mockups/ward-flow/constellation` is a `redirect()`-only stub (its own doc comment: "Phase 2
+ * retired the constellation command view into the coordinator screen and the network diagram. The
+ * route stays as a bookmark/deep-link backstop..."). It renders no landmark, no heading, and no
+ * nav of its own — it is not one of the 15 live routes the D5/D7/D8 measurements are about.
+ * Recorded here, by name, with a reason, rather than silently missing from RENDERABLE_ROUTES: the
+ * coverage test below fails loudly if this set and the filesystem scan ever disagree on anything
+ * else.
+ */
+const REDIRECT_ONLY_ROUTES = new Set<string>([`${ROUTE_PREFIX}/constellation`]);
+
+type RouteRender = { route: string; render: () => ReactNode };
+
+/**
+ * One entry per real, renderable Ward Flow page — the same component each page.tsx under
+ * src/app/mockups/ward-flow/ actually mounts (checked against every page.tsx file directly), with
+ * real fixture ids standing in for the two dynamic segments: `peel-ed` and `rph-adult-secure`, the
+ * same instances tests/ward-nav.test.ts and the sibling `*.dom.test.tsx` suites already use, and
+ * `WF-001` for the patient workspace's movement id (tests/ward-patient-page.dom.test.tsx uses the
+ * same fixture movement as `patientId`). This mapping is checked against the filesystem scan in
+ * the coverage test below — a route with no entry here, or an entry with no matching route, fails
+ * that test rather than silently under- or over-counting.
+ */
+const RENDERABLE_ROUTES: RouteRender[] = [
+  { route: ROUTE_PREFIX, render: () => createElement(CoordinatorScreen) },
+  { route: `${ROUTE_PREFIX}/queue`, render: () => createElement(WardModeWorkspace, { mode: "queue" }) },
+  { route: `${ROUTE_PREFIX}/capacity`, render: () => createElement(WardModeWorkspace, { mode: "capacity" }) },
+  { route: `${ROUTE_PREFIX}/governance`, render: () => createElement(WardModeWorkspace, { mode: "governance" }) },
+  { route: `${ROUTE_PREFIX}/movements`, render: () => createElement(WardModeWorkspace, { mode: "movements" }) },
+  { route: `${ROUTE_PREFIX}/network`, render: () => createElement(WardModeWorkspace, { mode: "network" }) },
+  { route: `${ROUTE_PREFIX}/exceptions`, render: () => createElement(WardModeWorkspace, { mode: "exceptions" }) },
+  { route: `${ROUTE_PREFIX}/ed/[edId]`, render: () => createElement(EdScreen, { edId: "peel-ed" }) },
+  { route: `${ROUTE_PREFIX}/escalation`, render: () => createElement(EscalationBoardPage) },
+  { route: `${ROUTE_PREFIX}/handover`, render: () => createElement(HandoverPage) },
+  { route: `${ROUTE_PREFIX}/search`, render: () => createElement(PatientSearchPage) },
+  { route: `${ROUTE_PREFIX}/transport`, render: () => createElement(LiveTracker) },
+  { route: `${ROUTE_PREFIX}/transport/officer`, render: () => createElement(OfficerScreen) },
+  { route: `${ROUTE_PREFIX}/ward/[unitId]`, render: () => createElement(WardScreen, { unitId: "rph-adult-secure" }) },
+  {
+    route: `${ROUTE_PREFIX}/patients/[patientId]`,
+    render: () => createElement(WardPatientWorkspace, { patientId: "WF-001" }),
+  },
+];
+
+describe("Ward Flow route/render-map coverage (sanity check on the scan and the map)", () => {
+  it("finds every known page.tsx under src/app/mockups/ward-flow: 16 measured on this branch (15 renderable + 1 redirect-only)", () => {
+    // A silently broken scan (wrong directory, wrong glob) would collapse this to 0 or a handful,
+    // and every assertion below would then vacuously pass — so this is checked before trusting
+    // any of them. Mirrors tests/ward-nav.test.ts's own sanity count.
+    expect(wardFlowRoutes.length).toBe(16);
+  });
+
+  it("RENDERABLE_ROUTES plus REDIRECT_ONLY_ROUTES covers every route the scan found, and nothing else", () => {
+    const scanned = new Set(wardFlowRoutes.map((entry) => entry.route));
+    const mapped = new Set<string>([...RENDERABLE_ROUTES.map((entry) => entry.route), ...REDIRECT_ONLY_ROUTES]);
+    const uncovered = [...scanned].filter((route) => !mapped.has(route));
+    const stale = [...mapped].filter((route) => !scanned.has(route));
+    expect(uncovered, `route(s) on disk with no test coverage: ${uncovered.join(", ")}`).toEqual([]);
+    expect(stale, `mapped route(s) no longer on disk: ${stale.join(", ")}`).toEqual([]);
+  });
+
+  it("RENDERABLE_ROUTES has exactly 15 entries, one per live route", () => {
+    expect(RENDERABLE_ROUTES.length).toBe(15);
+  });
+});
+
+function renderRoute(entry: RouteRender): string {
+  return renderToStaticMarkup(createElement(WardFlowProvider, { initialNow: NOW_ANCHOR, children: entry.render() }));
+}
+
+describe("Every Ward Flow route has exactly one #main-content skip-link target (D5, D6)", () => {
+  for (const entry of RENDERABLE_ROUTES) {
+    it(`renders exactly one <main id="main-content"> on ${entry.route}`, () => {
+      const markup = renderRoute(entry);
+      const matches = markup.match(/<main\b[^>]*\bid="main-content"/g) ?? [];
+      expect(
+        matches.length,
+        `expected exactly one <main id="main-content"> on ${entry.route}, found ${matches.length}`,
+      ).toBe(1);
+    });
+  }
+});

From 1d51b1a8493e79319bf9652a82209e2480a4b9cf Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:22:57 +0800
Subject: [PATCH 28/54] Add the missing heading on /transport and
 /transport/officer (D7)

Extends tests/ward-landmarks.test.ts (Task 5) with a second contract over the
same RENDERABLE_ROUTES map: every Ward Flow route renders exactly one <h1>.
Run red before any fix, it named precisely the two routes D7 measured --
/transport and /transport/officer -- and nothing else, confirming the other
13 routes were already fine.

Added a screen-reader-only <h1>, matching the pattern coordinator-screen.tsx
already uses for its own root route:
- live-tracker.tsx: "Live tracker" -- the metadata title and the component's
  own doc comment ("the coordinator's live tracker... of every vehicle") both
  already use that name.
- officer-screen.tsx: "Transport officer job list" -- deliberately not
  "Transport management system" or similar: the component's own doc comment
  is explicit that this shows one officer's list of open jobs, nothing
  fleet- or roster-wide, and the model has no officer identity to justify a
  bigger claim (see acceptedBlockedReason and the governance banner already
  on that screen).

Mutation-tested: duplicating escalation-board.tsx's already-passing <h1>
(a route Task 5 already covers) failed exactly that route's assertion with
"found 2"; reverted, suite green again (33/33). The two real fixes are
independently proven by the red run above naming exactly those two routes
before either was touched.

RAG impact: none -- no file under src/lib/rag/**, clinical-search,
retrieval-selection, ranking-config, or answer-ranking touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../ward-management/officer/officer-screen.tsx      |  2 ++
 .../ward-management/tracker/live-tracker.tsx        |  2 ++
 tests/ward-landmarks.test.ts                        | 13 +++++++++++++
 3 files changed, 17 insertions(+)

diff --git a/src/components/ward-management/officer/officer-screen.tsx b/src/components/ward-management/officer/officer-screen.tsx
index 5c9ff62d9e..4135ecc749 100644
--- a/src/components/ward-management/officer/officer-screen.tsx
+++ b/src/components/ward-management/officer/officer-screen.tsx
@@ -123,6 +123,8 @@ export function OfficerScreen() {
     <div className={styles.screen} data-testid="ward-officer-screen">
       <ClinicalRail />
       <main id="main-content" className={styles.main}>
+        <h1 className="sr-only">Transport officer job list</h1>
+
         <div className={styles.governanceBanner} data-testid="ward-officer-governance">
           <span className={styles.prototypeBadge}>Synthetic prototype</span>
           <p>
diff --git a/src/components/ward-management/tracker/live-tracker.tsx b/src/components/ward-management/tracker/live-tracker.tsx
index 7f958516f3..f709192b4f 100644
--- a/src/components/ward-management/tracker/live-tracker.tsx
+++ b/src/components/ward-management/tracker/live-tracker.tsx
@@ -67,6 +67,8 @@ export function LiveTracker() {
     <div className={styles.screen} data-testid="ward-mode-transport">
       <ClinicalRail activeMode="transport" />
       <main id="main-content" className={styles.main} data-testid="ward-live-tracker">
+        <h1 className="sr-only">Live tracker</h1>
+
         <div className={styles.governanceBanner} data-testid="ward-tracker-governance">
           <span className={styles.prototypeBadge}>Synthetic prototype</span>
           <p>
diff --git a/tests/ward-landmarks.test.ts b/tests/ward-landmarks.test.ts
index 0c973878a2..4195f3722e 100644
--- a/tests/ward-landmarks.test.ts
+++ b/tests/ward-landmarks.test.ts
@@ -159,3 +159,16 @@ describe("Every Ward Flow route has exactly one #main-content skip-link target (
     });
   }
 });
+
+// Task 6 (D7). Every Ward Flow route needs a heading a screen reader can jump straight to, and
+// exactly one — a second <h1> is as much a defect as none, for the same reason a duplicated
+// #main-content landmark is (see the describe block above).
+describe("Every Ward Flow route has exactly one <h1> (D7)", () => {
+  for (const entry of RENDERABLE_ROUTES) {
+    it(`renders exactly one <h1> on ${entry.route}`, () => {
+      const markup = renderRoute(entry);
+      const matches = markup.match(/<h1\b/g) ?? [];
+      expect(matches.length, `expected exactly one <h1> on ${entry.route}, found ${matches.length}`).toBe(1);
+    });
+  }
+});

From e40228980d73434dc49a609df58be2673b0dbdba Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:29:56 +0800
Subject: [PATCH 29/54] Render the 'Ward Flow views' nav on every route, not
 just eight (D8)

WardModeNavigation (aria-label="Ward Flow views") is Ward Flow's in-page
navigation between boards. ClinicalRail used to mount it only when a caller
passed activeMode, which the eight WardModeWorkspace screens, the coordinator
root, and the live tracker did -- every other route called <ClinicalRail />
with no activeMode and silently got no in-page nav, so moving to one of those
routes dropped the navigation without any signal that it had happened.

Extends tests/ward-nav.test.ts (reusing its own collectWardFlowRoutes rather
than writing a second enumeration) with a render-based check: every route's
real component tree must contain the nav's aria-label exactly once. Run red
before the fix, it named 7 routes -- ed/[edId], escalation, handover, search,
transport/officer, ward/[unitId], and patients/[patientId] -- one more than
the plan's original D8 measurement (which listed 6 and did not include
patients). The prior commit in this same plan (D9-D11, "One source for ward
navigation") rewrote ClinicalRail's rail between that measurement and this
task and evidently changed which routes passed activeMode along the way;
re-measuring against the current HEAD rather than trusting the stale list is
exactly what this task's briefing called for.

Ruling (recorded in ClinicalRail's own doc comment, the one place this
decision needs to live): adopt the nav everywhere rather than carve out an
exemption. Nine of fifteen routes behaving one way and six or seven another
is a defect a user feels -- the rail alone never says which board they are
on. Fixed by making ClinicalRail always render WardModeNavigation instead of
gating it on activeMode, and widening WardModeNavigation's active prop to
optional: a route with no natural eight-mode equivalent (a role detail
screen, a board, the patient workspace) renders the nav with no link marked
current, rather than being denied the nav altogether. No per-route changes
were needed -- the fix is centralized in ClinicalRail.

Mutation-tested: reverting ClinicalRail's render back behind its old
activeMode conditional reproduced exactly the same 7 failures as the pre-fix
red run; removing an entry from the test's own RENDERABLE_ROUTES coverage
map failed the coverage-sanity test. Both reverted after confirming red,
suite green again (25/25).

RAG impact: none -- no file under src/lib/rag/**, clinical-search,
retrieval-selection, ranking-config, or answer-ranking touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../ward-management-navigation.tsx            |  31 +++--
 tests/ward-nav.test.ts                        | 107 +++++++++++++++++-
 2 files changed, 127 insertions(+), 11 deletions(-)

diff --git a/src/components/ward-management/ward-management-navigation.tsx b/src/components/ward-management/ward-management-navigation.tsx
index b841a50d1a..17e5f5fe7b 100644
--- a/src/components/ward-management/ward-management-navigation.tsx
+++ b/src/components/ward-management/ward-management-navigation.tsx
@@ -91,9 +91,18 @@ function RailLink({
  * (not the global app shell), so it is Ward Flow's own to extend rather than a shared surface
  * this task would be overreaching to touch.
  *
- * `activeMode` is optional: the patient workspace route (`/mockups/ward-flow/patients/[id]`) is
- * not one of the eight modes, so it renders the rail without the mode section at all rather than
- * forcing an arbitrary "active" choice.
+ * Task 7 (D8) ruling: `WardModeNavigation` now always renders, whether or not the caller passes
+ * `activeMode`. It used to render only when `activeMode` was set, which every one-off detail
+ * screen and board that had no natural eight-mode equivalent — the role detail screens
+ * (`ed/[edId]`, `ward/[unitId]`, the officer screen) and three boards (`handover`, `escalation`,
+ * `search`) plus the patient workspace — simply never passed, so those routes silently lost the
+ * in-page navigation other boards kept. Nine of fifteen routes behaving one way and six (later,
+ * after this file's own Task 9 rewrite, seven) behaving another is a defect a user feels: the
+ * rail alone never says which board they are on. `tests/ward-nav.test.ts`'s "Every Ward Flow
+ * route carries the 'Ward Flow views' in-page nav (D8)" suite enforces this for every route,
+ * rendered straight from the filesystem enumeration — never a hand-written list. `activeMode`
+ * stays optional: routes with no natural eight-mode equivalent still render the nav with no link
+ * marked current, rather than forcing an arbitrary "active" choice.
  */
 export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
   return (
@@ -131,12 +140,8 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
           <LayoutGrid aria-hidden="true" />
         </RailLink>
       </nav>
-      {activeMode ? (
-        <>
-          <div className={shellStyles.railRule} aria-hidden="true" />
-          <WardModeNavigation active={activeMode} />
-        </>
-      ) : null}
+      <div className={shellStyles.railRule} aria-hidden="true" />
+      <WardModeNavigation active={activeMode} />
       <div className={shellStyles.railBottom}>
         {/* Task 12: the role switcher — the one control the proof journey (spec §14) uses to
             move between all four roles without ever reloading the page. Placed first among the
@@ -218,8 +223,14 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
  * function's own source text — see that test's comment. Rendered icon-only inside `ClinicalRail`
  * now (Task 9 Ruling 4); each link still carries its own accessible name via `aria-label` since
  * its only visible content is an icon.
+ *
+ * `active` is optional (Task 7, D8): `ClinicalRail` now renders this nav unconditionally, and a
+ * route with no natural eight-mode equivalent (a role detail screen, a board, the patient
+ * workspace) passes no `activeMode` through — every `aria-current` comparison below is simply
+ * false for all eight links in that case, which is correct: the nav still orients the user
+ * without falsely claiming one of the eight views is the current page.
  */
-export function WardModeNavigation({ active }: { active: WardMode }) {
+export function WardModeNavigation({ active }: { active?: WardMode }) {
   return (
     <nav className={modeStyles.modeNavigation} aria-label="Ward Flow views">
       <Link
diff --git a/tests/ward-nav.test.ts b/tests/ward-nav.test.ts
index c6dc6fb73d..4c24fbe913 100644
--- a/tests/ward-nav.test.ts
+++ b/tests/ward-nav.test.ts
@@ -1,6 +1,44 @@
 import { readFileSync, readdirSync } from "node:fs";
 import path from "node:path";
-import { describe, expect, it } from "vitest";
+import { createElement, type ReactNode } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it, vi } from "vitest";
+
+/**
+ * Task 7 (D8). Same "SSR-string component test" pattern tests/ward-landmarks.test.ts uses (see
+ * that file's own header comment for the full reasoning): this file is `.test.ts`, so it
+ * collects under vitest.config.mts's "node" project rather than jsdom, and `renderToStaticMarkup`
+ * renders each route's real component tree to a string without needing `document`. The two
+ * mocks below are the same ones that file needs for the same reasons: `ClinicalRail` renders
+ * `next/link` anchors, and `ContextualBackLink` (mounted by `WardPatientWorkspace`) calls
+ * `next/navigation`'s `useRouter` synchronously during render.
+ */
+vi.mock("next/link", () => ({
+  default: ({ children, href, ...rest }: { children: ReactNode; href: string; [key: string]: unknown }) =>
+    createElement("a", { href, ...rest }, children),
+}));
+
+const router = vi.hoisted(() => ({
+  back: vi.fn(),
+  replace: vi.fn(),
+}));
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => router,
+}));
+
+import { WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+import { CoordinatorScreen } from "@/components/ward-management/coordinator/coordinator-screen";
+import { WardModeWorkspace } from "@/components/ward-management/ward-management-modes";
+import { EdScreen } from "@/components/ward-management/ed/ed-screen";
+import { EscalationBoardPage } from "@/components/ward-management/escalation/escalation-board";
+import { HandoverPage } from "@/components/ward-management/handover/handover-page";
+import { PatientSearchPage } from "@/components/ward-management/search/patient-search";
+import { LiveTracker } from "@/components/ward-management/tracker/live-tracker";
+import { OfficerScreen } from "@/components/ward-management/officer/officer-screen";
+import { WardScreen } from "@/components/ward-management/ward/ward-screen";
+import { WardPatientWorkspace } from "@/components/ward-management/ward-management-console";
+import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
 
 import { WARD_NAV, WARD_NAV_INTENTIONALLY_UNLISTED } from "../src/components/ward-management/ward-nav";
 
@@ -137,3 +175,70 @@ describe("ClinicalRail's aria-label is honest for a sandboxed prototype (D11)",
     expect(source).toContain('aria-label="Applications"');
   });
 });
+
+/**
+ * Task 7 (D8). `aria-label="Ward Flow views"` is `WardModeNavigation`'s nav, mounted inside
+ * `ClinicalRail` — the in-page navigation between Ward Flow's boards. It used to render only when
+ * a screen passed `ClinicalRail` an `activeMode`, which only the eight `WardModeWorkspace`
+ * screens plus the coordinator root and the live tracker did; the other six screens (the four
+ * detail/role screens and two boards below) called `<ClinicalRail />` with no `activeMode` and
+ * silently got no nav at all — a defect a user feels, because the rail alone never says which
+ * board they are on.
+ *
+ * **Ruling (recorded here, the one place this decision needs to live): adopt the nav on every
+ * route rather than carve out an exemption.** `ClinicalRail` now renders `WardModeNavigation`
+ * unconditionally (see its own doc comment) instead of only when `activeMode` is set — no route
+ * is exempt, so `WARD_NAV_INTENTIONALLY_UNLISTED`-style exemption data was not needed for this
+ * decision. If a future screen needs to opt out, that exemption must be added here as data with a
+ * reason, not created by a screen quietly omitting `activeMode` again.
+ */
+type RouteRender = { route: string; render: () => ReactNode };
+
+const RENDERABLE_ROUTES: RouteRender[] = [
+  { route: ROUTE_PREFIX, render: () => createElement(CoordinatorScreen) },
+  { route: `${ROUTE_PREFIX}/queue`, render: () => createElement(WardModeWorkspace, { mode: "queue" }) },
+  { route: `${ROUTE_PREFIX}/capacity`, render: () => createElement(WardModeWorkspace, { mode: "capacity" }) },
+  { route: `${ROUTE_PREFIX}/governance`, render: () => createElement(WardModeWorkspace, { mode: "governance" }) },
+  { route: `${ROUTE_PREFIX}/movements`, render: () => createElement(WardModeWorkspace, { mode: "movements" }) },
+  { route: `${ROUTE_PREFIX}/network`, render: () => createElement(WardModeWorkspace, { mode: "network" }) },
+  { route: `${ROUTE_PREFIX}/exceptions`, render: () => createElement(WardModeWorkspace, { mode: "exceptions" }) },
+  { route: `${ROUTE_PREFIX}/ed/[edId]`, render: () => createElement(EdScreen, { edId: "peel-ed" }) },
+  { route: `${ROUTE_PREFIX}/escalation`, render: () => createElement(EscalationBoardPage) },
+  { route: `${ROUTE_PREFIX}/handover`, render: () => createElement(HandoverPage) },
+  { route: `${ROUTE_PREFIX}/search`, render: () => createElement(PatientSearchPage) },
+  { route: `${ROUTE_PREFIX}/transport`, render: () => createElement(LiveTracker) },
+  { route: `${ROUTE_PREFIX}/transport/officer`, render: () => createElement(OfficerScreen) },
+  { route: `${ROUTE_PREFIX}/ward/[unitId]`, render: () => createElement(WardScreen, { unitId: "rph-adult-secure" }) },
+  {
+    route: `${ROUTE_PREFIX}/patients/[patientId]`,
+    render: () => createElement(WardPatientWorkspace, { patientId: "WF-001" }),
+  },
+];
+
+describe("Ward Flow route/render-map coverage (D8 nav check — sanity check on the map)", () => {
+  it("RENDERABLE_ROUTES covers every route the filesystem scan found except the redirect-only stub, and nothing else", () => {
+    const scanned = new Set(wardFlowRoutes.map((entry) => entry.route));
+    const mapped = new Set(RENDERABLE_ROUTES.map((entry) => entry.route));
+    const redirectOnly = `${ROUTE_PREFIX}/constellation`;
+    const uncovered = [...scanned].filter((route) => route !== redirectOnly && !mapped.has(route));
+    const stale = [...mapped].filter((route) => !scanned.has(route));
+    expect(uncovered, `route(s) on disk with no test coverage: ${uncovered.join(", ")}`).toEqual([]);
+    expect(stale, `mapped route(s) no longer on disk: ${stale.join(", ")}`).toEqual([]);
+    expect(RENDERABLE_ROUTES.length).toBe(15);
+  });
+});
+
+describe("Every Ward Flow route carries the 'Ward Flow views' in-page nav (D8)", () => {
+  for (const entry of RENDERABLE_ROUTES) {
+    it(`renders the Ward Flow views nav on ${entry.route}`, () => {
+      const markup = renderToStaticMarkup(
+        createElement(WardFlowProvider, { initialNow: NOW_ANCHOR, children: entry.render() }),
+      );
+      const matches = markup.match(/aria-label="Ward Flow views"/g) ?? [];
+      expect(
+        matches.length,
+        `expected exactly one "Ward Flow views" nav on ${entry.route}, found ${matches.length}`,
+      ).toBe(1);
+    });
+  }
+});

From f954721395c589cc4206c2ad162b245f59deee67 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:52:38 +0800
Subject: [PATCH 30/54] Mutation-test the ward-flow sandbox guard's failure
 messages

Task 8: the four sandbox properties were already consolidated in one
describe block from Tasks 1-3. Mutation-tested each by breaking it and
reading the failure message. Three came back as unnamed generic
assertion failures ("expected true to be false", "expected undefined
to be defined") - exactly the half-a-guard failure mode this task
exists to catch - so each now carries a custom message naming the
path or record that broke. No assertion was removed, weakened, or
made unable to fail; only the messages changed.
---
 tests/ward-flow-sandbox.test.ts | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/tests/ward-flow-sandbox.test.ts b/tests/ward-flow-sandbox.test.ts
index 91ebec6f6b..504d1b13b9 100644
--- a/tests/ward-flow-sandbox.test.ts
+++ b/tests/ward-flow-sandbox.test.ts
@@ -20,20 +20,23 @@ describe("Ward Flow is a developer-gated sandbox", () => {
   });
 
   it("no longer exists as a public app route", () => {
-    expect(existsSync(path.join(REPO_ROOT, "src", "app", "ward-management"))).toBe(false);
+    const oldRouteDir = path.join(REPO_ROOT, "src", "app", "ward-management");
+    expect(existsSync(oldRouteDir), `${oldRouteDir} still exists — it must be gone, not just unlinked`).toBe(false);
   });
 
   it("has no clinical tools-catalogue entry under either the old or new path — moving it back under the new path does not count as keeping it out", () => {
-    const leaks = toolCatalogRecords.filter(
-      (tool) => tool.href.startsWith("/ward-management") || tool.href.startsWith("/mockups/ward-flow"),
-    );
-    expect(leaks).toEqual([]);
+    const leaks = toolCatalogRecords
+      .filter((tool) => tool.href.startsWith("/ward-management") || tool.href.startsWith("/mockups/ward-flow"))
+      .map((tool) => `${tool.id} -> ${tool.href}`);
+    expect(leaks, "these catalogue entries leak a sandbox path into clinical discovery").toEqual([]);
   });
 
   it("the developer-hub panel says what it is, at the point the decision to open it is made", () => {
     const panel = HUB_PANELS.find((entry) => entry.href === "/mockups/ward-flow");
-    expect(panel).toBeDefined();
-    expect(panel?.summary).toContain("Synthetic prototype");
-    expect(panel?.summary).toContain("not clinical decision support");
+    expect(panel, "no developer-hub panel links to /mockups/ward-flow").toBeDefined();
+    expect(panel?.summary, `panel "${panel?.id}" summary: ${panel?.summary}`).toContain("Synthetic prototype");
+    expect(panel?.summary, `panel "${panel?.id}" summary: ${panel?.summary}`).toContain(
+      "not clinical decision support",
+    );
   });
 });

From 85968c8a8c62a14b02336f3085c772d478e3f972 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 17:16:00 +0800
Subject: [PATCH 31/54] Correct two false claims in the Phase 4 spec, in place
 rather than quietly

Both were mine and both were the same mistake - reading something adjacent to a
property and calling it the property.

The measurement table said no open movement lacks an eligible ward and the scarcest
has six. Wrong. That came from the LENGTH of eligibleCandidatesAmong(), which sorts
eligible-first and truncates to its limit and never filters to eligible - so it was
counting same-cohort units. Measured properly: 337 eligible pairs, and WF-009 and
WF-308 already have nowhere to go. The escalation board therefore had real content
from day one, not the empty state I described to the product owner.

Item 11 said the escalation contact was the only free-text input left and that after
the fix the synthetic-data promise would be true by construction. There were two
textareas, not one. The override-reason box remains, and it can still carry a name or
a diagnosis. It is left open deliberately: unlike escalation contacts, a fixed list of
override reasons cannot be grounded in anything the model already holds, and inventing
one is the exact move this project punishes. It goes to the product owner.

Corrections written in place, marked as corrections, rather than edited away.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ...d-flow-phase-4-specialist-boards-design.md | 35 +++++++++++++++----
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md b/docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md
index 4dd0b6b997..032cf30451 100644
--- a/docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md
+++ b/docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md
@@ -45,7 +45,7 @@ Everything below was measured against the code, not read from a plan.
 | -------------------------------------------- | -------------------------------------------------------- |
 | Movements in the fixture                     | 48 (18 authored + 30 generated), **41 open**             |
 | Reducer events that exist                    | **15**, every one of them forward-only                   |
-| Open movements with **no** eligible ward     | **0** — the scarcest has six                             |
+| Open movements with **no** eligible ward     | **2** — WF-009 and WF-308 (corrected, see below)         |
 | Movements with a recorded escalation         | **1**                                                    |
 | Movements with any decline                   | **2**                                                    |
 | Beds held                                    | **7** — 1 hold already expired, 6 expire within the hour |
@@ -56,9 +56,18 @@ Everything below was measured against the code, not read from a plan.
 
 Four gaps follow from that table and drive most of this phase:
 
-- **The synthetic night is easy.** Every open patient has at least six eligible wards, so the
-  escalation board, the handover's "placement gone wrong" section and the whole scarcity story have
-  nothing to show. Item 2 fixes the data, not the boards.
+- **The synthetic night is easy — but not as easy as this document first claimed.**
+  **CORRECTION, 2026-08-25.** This section originally read "every open patient has at least six
+  eligible wards", and concluded the escalation board and the handover's placement-gone-wrong
+  section would have nothing to show. **Both statements were false.** The number came from counting
+  the LENGTH of `eligibleCandidatesAmong(...)`, which sorts eligible-first and **truncates to its
+  `limit`**; it never filters to eligible, so that length is the count of same-cohort units. Measured
+  properly at `NOW_ANCHOR` by counting `eligibility(...).eligible` across all 22 units: 337 eligible
+  movement/unit pairs, distribution `{0:2, 4:11, 5:6, 6:3, 11:1, 12:9, 14:9}`, and **two movements,
+  WF-009 and WF-308, already have nowhere eligible.** The escalation board therefore has real content
+  from day one. `tests/ward-scenarios.test.ts` now pins this and records the whole story in a comment.
+  The scarce scenario (item 2) is still worth building — it takes the stranded count from 2 to 9 and
+  total eligible pairs from 337 to 123 — but it is a widening of the problem, not the creation of it.
 - **Nothing can be undone.** All fifteen events move a patient forwards. The _only_ path that
   releases a held bed or cancels a transport job is closing the movement entirely — recording an
   examination with outcome `community_order` or `revoked`. A coordinator who holds the wrong bed
@@ -332,8 +341,22 @@ provider**, and **Other service**. No typing. Every entry except "Other service"
 language the model already uses; none is invented.
 
 **Why it matters more than its size.** The synthetic-data promise currently depends on a user
-reading a label and complying. After this it is true by construction — the same reasoning that made
-decline reasons a fixed list.
+reading a label and complying. After this **that particular box** is safe by construction — the same
+reasoning that made decline reasons a fixed list.
+
+**CORRECTION, 2026-08-25 — this item said "the only free-text input left in the prototype" and
+"after this it is true by construction". Both overstated.** Measured across the whole ward tree
+rather than from a single early grep: there were **two** `<textarea>` elements, not one. The other
+four `<input>` elements are checkbox, radio and number, so they are not free text. After this item
+**one free-text box remains: the override-reason `<textarea>` in `shortlist-panel.tsx`**, where a
+coordinator types why they overrode the shortlist. Free text counts under the synthetic-data rule,
+so that box can still carry a name, a diagnosis or a narrative.
+
+**It is deliberately not closed here, and the reason is rule 1 rather than scope.** Escalation
+contacts could be grounded in language the model already held. Override reasons cannot: why a
+coordinator overrides a placement shortlist is a clinical and operational judgement, and inventing
+that list is exactly the move this project punishes. **It goes to the product owner as a decision,
+with the measurement behind it.**
 
 **Migration:** the one authored escalation in the fixture uses "State bed coordination desk", which
 is on the list, so no fixture data is lost.

From 3b1f0cea349adb5c9bea26dfbb4acdbb4ffdebc4 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 17:16:36 +0800
Subject: [PATCH 32/54] Two more places in the Phase 4 spec that said one
 free-text box, not two

Same correction as the previous commit, applied where it was restated: the standing
constraints block and the gaps list. Both said item 11 removes the last free-text
input. It removes one of two.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ...6-08-25-ward-flow-phase-4-specialist-boards-design.md | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md b/docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md
index 032cf30451..57843bc852 100644
--- a/docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md
+++ b/docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md
@@ -23,7 +23,8 @@ no patient data, no OpenAI call, no server. Every number is invented.
    Psychiatrist's official register or render as the bare code.
 2. **Synthetic data only.** No name, date of birth, medical record number, address, diagnosis,
    narrative history or treatment. **Sex is the only permitted patient attribute. Free text
-   counts** — see item 11, which removes the last free-text input in the prototype.
+   counts** — see item 11, which removes the escalation form's free-text input. **One free-text box
+   still remains after this phase** (the override reason); see item 11's correction note.
 3. **Advisory only.** The system proposes; a human confirms or overrides, always, with the reason
    recorded. Nothing auto-allocates and nothing defaults after a timeout.
 4. **Conservative failure.** Missing data narrows what is shown. An absence renders as an explicit
@@ -75,8 +76,10 @@ Four gaps follow from that table and drive most of this phase:
 - **Nothing can change after referral.** No event writes `movement.statusChanges`, and urgency is
   fixed at `RAISE_REFERRAL`. The binding spec §7 says explicitly that urgency is editable
   mid-movement with a record of who changed it. Item 3 fixes this.
-- **One free-text box survives.** The escalation contact is a `<textarea>` whose label asks for
-  "a role or service only, never a person's name". Nothing enforces it. Item 11 fixes this.
+- **Two free-text boxes survive** (corrected — this row originally said one). The escalation contact
+  is a `<textarea>` whose label asks for "a role or service only, never a person's name" and enforces
+  nothing; item 11 fixes that one. The override-reason `<textarea>` in `shortlist-panel.tsx` is the
+  other, and it is deliberately left for the product owner — see item 11's correction note.
 
 ## 3. Product-owner decisions settled for this phase
 

From d836095c49b068eeb6585883153a01502535f72a Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 17:32:11 +0800
Subject: [PATCH 33/54] Ward Flow draws its own shell, so suppress the shared
 mockup chrome

Moving under /mockups meant inheriting MockupsLayoutClient, which wraps children in
GlobalMockupSearchShell unless the path opts out. Ward Flow owns a complete
operational shell - its own rail, its own in-page view nav, and a single search slot
on the patient-search board - so the shared composer rendered a second real search bar
over it. Care Plan and Caring Contacts each already carry this opt-out with a comment
saying why; Ward Flow now does too.

The symptom is written into the comment because it is not obvious: the coordinator
element was plainly present in the served markup while every browser test failed on
it resolving to zero visible elements. Ten thousand unit tests passed throughout,
because they render components directly and never see the wrapper.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/app/mockups/mockups-layout-client.tsx | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/app/mockups/mockups-layout-client.tsx b/src/app/mockups/mockups-layout-client.tsx
index 077c1c6830..ec92084cfc 100644
--- a/src/app/mockups/mockups-layout-client.tsx
+++ b/src/app/mockups/mockups-layout-client.tsx
@@ -103,6 +103,14 @@ export function MockupsLayoutClient({ children }: { children: ReactNode }) {
   // single search slot of its own. It is not a search mode, and its synthetic
   // patient context must never enter shared search.
   const isCarePlanMockup = pathname === "/mockups/care-plan" || pathname.startsWith("/mockups/care-plan/");
+  // Ward Flow owns a complete operational shell — its own rail, its own in-page view navigation,
+  // and a single search slot of its own on the patient-search board. It is not a search mode, and
+  // its synthetic patient context must never enter shared search. Without this entry the shared
+  // composer renders a SECOND real search bar over the prototype and the coordinator screen stops
+  // being visible at all: every test in `ui-ward-management.spec.ts` failed on
+  // `[data-testid="ward-coordinator"]:visible` resolving to zero elements, while that element was
+  // plainly present in the served markup. Added when Ward Flow moved under `/mockups/ward-flow`.
+  const isWardFlowMockup = pathname === "/mockups/ward-flow" || pathname.startsWith("/mockups/ward-flow/");
 
   return (
     <GlobalMockupSearchShell
@@ -152,6 +160,7 @@ export function MockupsLayoutClient({ children }: { children: ReactNode }) {
         !isSidebarLiveMockup &&
         !isCaringContactMockup &&
         !isCarePlanMockup &&
+        !isWardFlowMockup &&
         !isDictionaryBrowseHeaderMockup &&
         !isDictionaryControlRowMockup
       }
@@ -181,6 +190,7 @@ export function MockupsLayoutClient({ children }: { children: ReactNode }) {
         !isSidebarLiveMockup &&
         !isCaringContactMockup &&
         !isCarePlanMockup &&
+        !isWardFlowMockup &&
         !isDictionaryBrowseHeaderMockup &&
         !isDictionaryControlRowMockup
       }

From f919c8cb69be9e72644484f2c8a5c97715bb966f Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 18:01:02 +0800
Subject: [PATCH 34/54] Reclassify Ward Flow Playwright specs into the advisory
 mockup project

Ward Flow's routes moved behind the /mockups/ward-flow developer gate, but
its three Playwright specs still ran under the required chromium project,
which starts an isolated production server with the mockups flag off. Every
ward test therefore failed against the gate's sign-in screen, not against
Ward Flow itself.

Follow the ui-caring-contact-mockup.spec.ts precedent exactly: move the
ward-(?:management|coordinator|roles) file pattern from productionSpecPattern
to mockupSpecPattern in playwright.config.ts, and tag every test.describe
block across the three spec files with @mockup so the chromium-mockups
project's grep selects them.

scripts/playwright-pr-shards.mjs duplicates productionSpecPattern (documented
"keep in sync") and assigned the three ward files to the required PR shard 2.
Left alone, that shard's own --grep-invert "@quarantine|@mockup" would have
silently dropped all 46 ward tests from the required Production UI job while
the shard bookkeeping still claimed to cover them. Removed the ward entries
from prUiSpecProfiles and re-synced productionSpecFilePattern so
`node scripts/playwright-pr-shards.mjs --validate` stays accurate.

Net effect (matching the caring-contact-mockup precedent): Ward Flow's
browser proof now runs under chromium-mockups only, in the same conditional
"Full browser UI matrix" CI job as the other gated mockups, not in every PR's
required Production UI job.

Verified: node scripts/run-playwright.mjs <each ward spec> --project=chromium-mockups
- ui-ward-management: 4 passed / 1 failed (pointer-event interception, pre-existing)
- ui-ward-coordinator: 21 passed / 1 failed (select fill mismatch, pre-existing)
- ui-ward-roles: 19 passed
Total 46 tests still collected and executed (same count as before reclassification).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 playwright.config.ts              |  4 ++--
 scripts/playwright-pr-shards.mjs  | 11 +++++------
 tests/ui-ward-coordinator.spec.ts |  2 +-
 tests/ui-ward-management.spec.ts  |  2 +-
 tests/ui-ward-roles.spec.ts       | 12 ++++++------
 5 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/playwright.config.ts b/playwright.config.ts
index 2cad99d77b..4aa0dd8779 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -23,9 +23,9 @@ const chromiumExecutablePath = process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH;
 // `tests/playwright-project-isolation.test.ts` asserts every such file on disk is
 // matched here.
 const productionSpecPattern =
-  /.*(?:answer-progress-ui-smoke|dsm-ui-smoke|ui-(smoke|stress|accessibility|caring-contacts-workspace|clinical-ask|dictionary|document-canvas|tools|ward-(?:management|coordinator|roles)|overlap|universal-search|specifiers|formulation(?:-result-cards)?|forms-section-nav|chrome-scroll|therapy-nav-scroll|mode-nav-density|phone-motion|phone-scroll(?:-[a-z0-9-]+)?|pwa|route-coverage|style-contract|visual-artifacts|hydration))\.spec\.ts/;
+  /.*(?:answer-progress-ui-smoke|dsm-ui-smoke|ui-(smoke|stress|accessibility|caring-contacts-workspace|clinical-ask|dictionary|document-canvas|tools|overlap|universal-search|specifiers|formulation(?:-result-cards)?|forms-section-nav|chrome-scroll|therapy-nav-scroll|mode-nav-density|phone-motion|phone-scroll(?:-[a-z0-9-]+)?|pwa|route-coverage|style-contract|visual-artifacts|hydration))\.spec\.ts/;
 const mockupSpecPattern =
-  /.*ui-(answer-chat-perfected-mockup|caring-contact-mockup|document-top-navigation-mockup|sidebar-live-mockup|therapy-navigation-mockup|tools|tools-collapse|tools-search-mode-mockup|tools-task-directory)\.spec\.ts/;
+  /.*ui-(answer-chat-perfected-mockup|caring-contact-mockup|document-top-navigation-mockup|sidebar-live-mockup|therapy-navigation-mockup|tools|tools-collapse|tools-search-mode-mockup|tools-task-directory|ward-(?:management|coordinator|roles))\.spec\.ts/;
 const mockupTag = /@mockup/;
 
 export default defineConfig({
diff --git a/scripts/playwright-pr-shards.mjs b/scripts/playwright-pr-shards.mjs
index 3e38323640..0784808898 100644
--- a/scripts/playwright-pr-shards.mjs
+++ b/scripts/playwright-pr-shards.mjs
@@ -19,7 +19,7 @@ import { childProcessExitCode } from "./child-process-result.mjs";
 
 /** Same matcher as playwright.config.ts `productionSpecPattern` (keep in sync). */
 export const productionSpecFilePattern =
-  /^(?:answer-progress-ui-smoke|dsm-ui-smoke|ui-(?:smoke|stress|accessibility|caring-contacts-workspace|clinical-ask|dictionary|document-canvas|tools|ward-(?:management|coordinator|roles)|overlap|universal-search|specifiers|formulation(?:-result-cards)?|forms-section-nav|chrome-scroll|therapy-nav-scroll|mode-nav-density|phone-motion|phone-scroll(?:-[a-z0-9-]+)?|pwa|route-coverage|style-contract|visual-artifacts|hydration))\.spec\.ts$/;
+  /^(?:answer-progress-ui-smoke|dsm-ui-smoke|ui-(?:smoke|stress|accessibility|caring-contacts-workspace|clinical-ask|dictionary|document-canvas|tools|overlap|universal-search|specifiers|formulation(?:-result-cards)?|forms-section-nav|chrome-scroll|therapy-nav-scroll|mode-nav-density|phone-motion|phone-scroll(?:-[a-z0-9-]+)?|pwa|route-coverage|style-contract|visual-artifacts|hydration))\.spec\.ts$/;
 
 /**
  * One source of truth for shard membership and its latest hosted timing sample.
@@ -61,11 +61,10 @@ export const prUiSpecProfiles = Object.freeze([
   // `tests/playwright-pr-shards.test.ts`. Two small specs moved out to lift the
   // other two shards instead of packing this one.
   { file: "tests/ui-caring-contacts-workspace.spec.ts", shard: 2, fullSeconds: 34.2, criticalSeconds: 0 },
-  // New ward-management/ward-coordinator suites; keep on the lightest measured
-  // shard until hosted timing is available.
-  { file: "tests/ui-ward-coordinator.spec.ts", shard: 2, fullSeconds: 0, criticalSeconds: 0 },
-  { file: "tests/ui-ward-management.spec.ts", shard: 2, fullSeconds: 0, criticalSeconds: 0 },
-  { file: "tests/ui-ward-roles.spec.ts", shard: 2, fullSeconds: 0, criticalSeconds: 0 },
+  // ui-ward-{management,coordinator,roles}.spec.ts moved out of this required PR
+  // shard: Ward Flow now lives behind the /mockups/ward-flow developer gate, so
+  // (like ui-caring-contact-mockup.spec.ts) it runs only under the advisory
+  // chromium-mockups project, not here. See playwright.config.ts mockupSpecPattern.
 
   // Moved here from shard 2 by Task 19 to offset the re-measured Caring Contacts
   // workspace spec; its own timing is unchanged.
diff --git a/tests/ui-ward-coordinator.spec.ts b/tests/ui-ward-coordinator.spec.ts
index 40ff99be61..3dea3e54a5 100644
--- a/tests/ui-ward-coordinator.spec.ts
+++ b/tests/ui-ward-coordinator.spec.ts
@@ -90,7 +90,7 @@ async function expectNoRegionGridOverflow(page: Page) {
   expect(overflow).toBeLessThanOrEqual(2);
 }
 
-test.describe("Ward Flow coordinator screen", () => {
+test.describe("@mockup Ward Flow coordinator screen", () => {
   test.describe.configure({ timeout: 45_000 });
 
   test("presents the five coordination regions", async ({ page }) => {
diff --git a/tests/ui-ward-management.spec.ts b/tests/ui-ward-management.spec.ts
index 3bc4a303a1..9105cf27cd 100644
--- a/tests/ui-ward-management.spec.ts
+++ b/tests/ui-ward-management.spec.ts
@@ -36,7 +36,7 @@ async function expectNoRegionGridOverflow(page: Page) {
   expect(overflow).toBeLessThanOrEqual(2);
 }
 
-test.describe("Ward Flow command view", () => {
+test.describe("@mockup Ward Flow command view", () => {
   test.describe.configure({ timeout: 45_000 });
 
   // "supports role-aware queue review and human-confirmed destination choice" and "collapses
diff --git a/tests/ui-ward-roles.spec.ts b/tests/ui-ward-roles.spec.ts
index 82b821d92a..4647fe4a0d 100644
--- a/tests/ui-ward-roles.spec.ts
+++ b/tests/ui-ward-roles.spec.ts
@@ -8,7 +8,7 @@ async function gotoWard(page: Page, unitId: string) {
   await page.waitForLoadState("networkidle");
 }
 
-test.describe("Ward screen", () => {
+test.describe("@mockup Ward screen", () => {
   test.describe.configure({ timeout: 45_000 });
 
   test("shows one unit's own capacity and answers an incoming referral", async ({ page }) => {
@@ -124,7 +124,7 @@ test.describe("Ward screen", () => {
   });
 });
 
-test.describe("Transport officer screen", () => {
+test.describe("@mockup Transport officer screen", () => {
   test.describe.configure({ timeout: 45_000 });
 
   /**
@@ -200,7 +200,7 @@ test.describe("Transport officer screen", () => {
   });
 });
 
-test.describe("Live tracker", () => {
+test.describe("@mockup Live tracker", () => {
   test.describe.configure({ timeout: 45_000 });
 
   /**
@@ -275,7 +275,7 @@ test.describe("Live tracker", () => {
   });
 });
 
-test.describe("Emergency department screen", () => {
+test.describe("@mockup Emergency department screen", () => {
   test.describe.configure({ timeout: 45_000 });
 
   /**
@@ -453,7 +453,7 @@ test.describe("Emergency department screen", () => {
   });
 });
 
-test.describe("Role switcher — the loop", () => {
+test.describe("@mockup Role switcher — the loop", () => {
   test.describe.configure({ timeout: 60_000 });
 
   /**
@@ -617,7 +617,7 @@ test.describe("Role switcher — the loop", () => {
  * whole-branch review found it was wrong for the entirety of Phase 3's development without a
  * single existing test noticing.
  */
-test.describe("Live capacity — a ward's own action reaches every screen that reads it", () => {
+test.describe("@mockup Live capacity — a ward's own action reaches every screen that reads it", () => {
   test.describe.configure({ timeout: 45_000 });
 
   test("a ward confirming zero allocatable beds updates its own screen, then the coordinator, without ever reloading", async ({

From 6bc7c9ff39fbe47f07fd800fff1e1c8028e821b4 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 18:23:02 +0800
Subject: [PATCH 35/54] The escalation browser test selects a contact instead
 of typing one

Phase 4 item 11 replaced the escalation contact textarea with a fixed picker, so the
synthetic-data promise holds by construction rather than by a label asking nicely. This
spec still called .fill() with a free-text sentence - the exact class of value the
picker exists to make impossible - and Playwright cannot fill a select. My Phase 4 work
should have updated it and did not; it only surfaced once the specs could reach the app
again after the sandbox move.

Now selects Duty psychiatrist, asserted up front to differ from the fixture's authored
State bed coordination desk, because a test that sets the value it already had proves
nothing. Both assertions on the new contact were updated - the second one, checking the
record survives a selection change, still carried the old literal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 tests/ui-ward-coordinator.spec.ts | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/tests/ui-ward-coordinator.spec.ts b/tests/ui-ward-coordinator.spec.ts
index 3dea3e54a5..fbb18297f3 100644
--- a/tests/ui-ward-coordinator.spec.ts
+++ b/tests/ui-ward-coordinator.spec.ts
@@ -1226,15 +1226,21 @@ test.describe("@mockup Ward Flow coordinator screen", () => {
     await expect(toggle).toHaveText("Update escalation");
 
     await toggle.click();
-    await shortlist
-      .getByTestId("ward-shortlist-escalation-contact")
-      .fill("State-wide bed coordination line — on-call psychiatry registrar");
+    // The escalation contact became a fixed picker (Phase 4 item 11): the coordinator chooses a
+    // role or service rather than typing one, so the synthetic-data promise holds by construction
+    // instead of by a label asking nicely. This step used to `.fill()` a free-text sentence — the
+    // exact class of value the picker exists to make impossible — so it selects instead. "Duty
+    // psychiatrist" is deliberately a DIFFERENT option from the fixture's authored "State bed
+    // coordination desk", which is what makes the change below observable.
+    const NEW_CONTACT = "Duty psychiatrist";
+    expect(NEW_CONTACT, "the test must change the contact, or it proves nothing").not.toBe(wf009.escalation!.contact);
+    await shortlist.getByTestId("ward-shortlist-escalation-contact").selectOption(NEW_CONTACT);
     await shortlist.getByTestId("ward-shortlist-escalation-submit").click();
 
-    // A real dispatch, not a local echo of the typed text: the record now reads the NEW contact,
+    // A real dispatch, not a local echo of the chosen option: the record now reads the NEW contact,
     // and `triedUnitIds` is `movement.declines` (never the panel's capped `shortlist`), so the
     // count matches the real five declines exactly.
-    await expect(record).toContainText("State-wide bed coordination line");
+    await expect(record).toContainText(NEW_CONTACT);
     await expect(record).not.toContainText(wf009.escalation!.contact);
     await expect(record).toContainText(`tried ${wf009.declines.length} unit`);
 
@@ -1242,9 +1248,7 @@ test.describe("@mockup Ward Flow coordinator screen", () => {
     // (`movement.escalation`), not local component state that a re-render could lose.
     await queue.locator('[data-testid="ward-queue-row-WF-017"]').click();
     await queue.locator('[data-testid="ward-queue-row-WF-009"]').click();
-    await expect(shortlist.getByTestId("ward-shortlist-escalation-record")).toContainText(
-      "State-wide bed coordination line",
-    );
+    await expect(shortlist.getByTestId("ward-shortlist-escalation-record")).toContainText(NEW_CONTACT);
     await expect(shortlist.getByTestId("ward-shortlist-escalation-toggle")).toHaveText("Update escalation");
   });
 });

From f272aa451d426e5bc4428728abae2c2f9da78c21 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 18:45:29 +0800
Subject: [PATCH 36/54] Ward Flow bypasses the clinical app shell rather than
 hiding its chrome

GlobalMockupSearchShell is a re-export of GlobalSearchShell - the clinical
application's own shell. Every other entry in this file renders inside it with the
chrome switched off, which hides the header and composer but still nests the prototype
inside the application it is meant to stand apart from. The product owner's instruction
is that each prototype is its own sandbox, otherwise a standalone app, and a standalone
app does not render inside the shell of the app it is separate from.

This does NOT fix the remaining rail-click failure, and I am not claiming it does. I
established that by elimination, each with a run: the pre-grouping rail fails
identically, so the sidebar rewrite did not cause it; reverting a speculative CSS
overflow fix changes nothing, so that was not it either; and bypassing the shell here
leaves 45 of 46 ward browser tests passing with the same one red. The cause is visible
in the failure screenshot instead - the rail's icons run past the bottom of a 1024px
viewport and railBottom overlaps the last links.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/app/mockups/mockups-layout-client.tsx | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/app/mockups/mockups-layout-client.tsx b/src/app/mockups/mockups-layout-client.tsx
index ec92084cfc..043b6ac2e9 100644
--- a/src/app/mockups/mockups-layout-client.tsx
+++ b/src/app/mockups/mockups-layout-client.tsx
@@ -112,6 +112,27 @@ export function MockupsLayoutClient({ children }: { children: ReactNode }) {
   // plainly present in the served markup. Added when Ward Flow moved under `/mockups/ward-flow`.
   const isWardFlowMockup = pathname === "/mockups/ward-flow" || pathname.startsWith("/mockups/ward-flow/");
 
+  /*
+   * Ward Flow is not wrapped at all — it BYPASSES the shell rather than rendering inside it with
+   * the chrome switched off, which is what every other entry above does.
+   *
+   * `GlobalMockupSearchShell` is a re-export of `GlobalSearchShell`, the clinical application's
+   * own shell. Hiding its chrome hides the header and composer but still nests the prototype
+   * inside the application it is meant to be separate from, and the wrapper it leaves behind
+   * intercepts pointer events: with the chrome hidden, `ui-ward-management.spec.ts`'s
+   * "opens every Ward Flow mode" still failed because clicking a rail link timed out. Verified
+   * this is not the rail's fault by re-running that test against the pre-grouping rail — it fails
+   * identically — and not a CSS overflow problem either, by reverting a speculative fix and
+   * getting the same failure.
+   *
+   * The product owner's instruction is that each prototype is "its own sandbox only interacting
+   * via the developer page, otherwise standalone app". A standalone app does not render inside
+   * the shell of the application it stands apart from.
+   */
+  if (isWardFlowMockup) {
+    return <>{children}</>;
+  }
+
   return (
     <GlobalMockupSearchShell
       initialMode={

From 01a4165491f39d1ed35aefdab9dbaeeb08509612 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 18:55:06 +0800
Subject: [PATCH 37/54] A sandbox has one way out: remove eight links back into
 the clinical app

Ward Flow's rail carried its own copy of the clinical application's app switcher -
Clinical Answers, Documents, Services, Medication, Tools, All applications - plus
Favourites and Settings in the bottom block. Eight links routing out of the sandbox and
into the application it is meant to stand apart from. The product owner's instruction
is that each prototype is its own sandbox only interacting via the developer page,
otherwise a standalone app. They are replaced by a single link back to the developer
hub, which is the sandbox's one legitimate exit.

This also fixes the last red browser test, and the mechanism is worth recording. The
rail is a fixed-height flex column; those eight icons pushed its content past a 1024px
viewport, so railBottom overlapped the last nav links and swallowed their clicks. The
links stayed in the DOM and stayed keyboard-reachable, which is exactly why ~10,000
unit tests passed while one browser test timed out clicking a visible link.

Three wrong theories preceded this one, each retired by a run rather than an argument:
the grouped rail (the pre-grouping rail fails identically), a CSS overflow fix
(reverted, no change), and the mockup shell wrapper (bypassed, no change). Ward
Chromium journeys: 46 passed, 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../ward-management-navigation.tsx            | 56 +++++++------------
 1 file changed, 20 insertions(+), 36 deletions(-)

diff --git a/src/components/ward-management/ward-management-navigation.tsx b/src/components/ward-management/ward-management-navigation.tsx
index 17e5f5fe7b..4aecd79f7a 100644
--- a/src/components/ward-management/ward-management-navigation.tsx
+++ b/src/components/ward-management/ward-management-navigation.tsx
@@ -8,23 +8,16 @@ import {
   Building2,
   CircleAlert,
   ClipboardList,
-  FileCheck2,
-  HeartPulse,
   LayoutDashboard,
   LayoutGrid,
   ListFilter,
-  MessageSquarePlus,
-  Pill,
   Route,
   Search,
-  Settings,
   ShieldCheck,
   Siren,
-  SlidersHorizontal,
   TriangleAlert,
   Truck,
   Waypoints,
-  Wrench,
   type LucideIcon,
 } from "lucide-react";
 
@@ -111,32 +104,25 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
         <BrandMark className={shellStyles.brandGlyph} />
       </Link>
       <div className={shellStyles.railRule} aria-hidden="true" />
-      {/* Task 4 (D11): this nav's aria-label used to claim every entry was a clinical
-          application — wrong once Ward Flow moved into its own developer-gated sandbox
-          (constraint 4: "not a medical device"). This nav is Ward Flow's own copy of the
-          cross-app switcher, not a claim that everything it lists — including the synthetic
-          prototype itself — belongs to the clinical toolset. Only this file used the old label
-          (checked before renaming), so this is the only place it needed to change. */}
-      <nav className={shellStyles.railNav} aria-label="Applications">
-        <RailLink href="/?mode=answer" label="Clinical Answers">
-          <MessageSquarePlus aria-hidden="true" />
-        </RailLink>
+      {/* A sandbox has exactly one way out, and it is the developer page it was opened from.
+          This nav used to be Ward Flow's own copy of the clinical application's app switcher —
+          Clinical Answers, Documents, Services, Medication, Tools, All applications — six links
+          routing straight back into the application Ward Flow is meant to stand apart from. The
+          product owner's instruction is that each prototype is "its own sandbox only interacting
+          via the developer page, otherwise standalone app", so they are gone.
+
+          Removing them also fixes a real, browser-only defect. The rail is a fixed-height flex
+          column, and those six links pushed its content past a 1024px viewport, so `.railBottom`
+          overlapped the last nav links and swallowed their clicks. Every link stayed in the DOM
+          and stayed keyboard-reachable, so all ~10,000 unit tests passed while
+          `ui-ward-management.spec.ts`'s "opens every Ward Flow mode" timed out clicking one.
+          Established by elimination that it was neither the grouped rail (the pre-grouping rail
+          fails identically) nor the mockup shell (bypassing it changes nothing). */}
+      <nav className={shellStyles.railNav} aria-label="Ward Flow">
         <RailLink href="/mockups/ward-flow" label="Ward Flow" active>
           <Activity aria-hidden="true" />
         </RailLink>
-        <RailLink href="/documents" label="Documents">
-          <FileCheck2 aria-hidden="true" />
-        </RailLink>
-        <RailLink href="/services" label="Services">
-          <SlidersHorizontal aria-hidden="true" />
-        </RailLink>
-        <RailLink href="/medications" label="Medication">
-          <Pill aria-hidden="true" />
-        </RailLink>
-        <RailLink href="/tools" label="Tools">
-          <Wrench aria-hidden="true" />
-        </RailLink>
-        <RailLink href="/tools" label="All applications">
+        <RailLink href="/mockups/development" label="Back to the developer hub">
           <LayoutGrid aria-hidden="true" />
         </RailLink>
       </nav>
@@ -192,12 +178,10 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
             <WardNavLink key={item.id} item={item} />
           ))}
         </div>
-        <RailLink href="/?mode=answer" label="Favourites">
-          <HeartPulse aria-hidden="true" />
-        </RailLink>
-        <RailLink href="/tools" label="Settings">
-          <Settings aria-hidden="true" />
-        </RailLink>
+        {/* Favourites (`/?mode=answer`) and Settings (`/tools`) were removed with the app switcher
+            above, and for the same reason: both routed out of the sandbox and into the clinical
+            application. Neither had any Ward Flow meaning — Favourites pointed at the answer mode's
+            home and Settings at the tools catalogue, which no longer even lists Ward Flow. */}
         <div className={shellStyles.railRule} aria-hidden="true" />
         {/* Whole-branch review I3: the demo jump-forward clock (spec §2 decision 5, §5) and
             scenario reset, mounted once here so every `/mockups/ward-flow/*` route gets them

From a9e8f3aae86173d4a491879dc0c65ade2d9ef318 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 25 Aug 2026 18:57:07 +0800
Subject: [PATCH 38/54] Assert the sandbox rule instead of trusting it

The old test pinned the rail's aria-label as Applications, which described a nav that
no longer exists. Replaced with the property that actually matters: the rail links
nowhere in the clinical application, and the developer hub is its only way out.

Deliberately a source scan rather than a render assertion, because the defect it
prevents is invisible to rendering - the eight clinical links it forbids stayed in the
DOM and stayed keyboard-reachable while overflowing the rail and swallowing clicks on
the links beneath them. Carries a non-vacuity check so it cannot pass on a rail with no
links at all. Mutation-tested by pointing the one legitimate exit at /documents and
watching it go red.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 tests/ward-nav.test.ts | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/tests/ward-nav.test.ts b/tests/ward-nav.test.ts
index 4c24fbe913..ff536b6e88 100644
--- a/tests/ward-nav.test.ts
+++ b/tests/ward-nav.test.ts
@@ -171,8 +171,31 @@ describe("ClinicalRail's aria-label is honest for a sandboxed prototype (D11)",
     expect(source).not.toContain("Clinical applications");
   });
 
-  it("labels the app-switcher nav with an honest, non-clinical name", () => {
-    expect(source).toContain('aria-label="Applications"');
+  it("labels the rail's own nav for Ward Flow, not for a set of applications", () => {
+    expect(source).toContain('aria-label="Ward Flow"');
+  });
+
+  /**
+   * The sandbox rule, asserted rather than trusted. The rail used to carry Ward Flow's own copy of
+   * the clinical application's app switcher — Clinical Answers, Documents, Services, Medication,
+   * Tools, All applications — plus Favourites and Settings in the bottom block: eight links routing
+   * out of the sandbox and into the application it is meant to stand apart from. The product
+   * owner's instruction is that each prototype is "its own sandbox only interacting via the
+   * developer page, otherwise standalone app".
+   *
+   * Removing them also fixed the last red browser test. The rail is a fixed-height flex column;
+   * those eight icons pushed its content past a 1024px viewport, so `.railBottom` overlapped the
+   * final nav links and swallowed their clicks — while every link stayed in the DOM and stayed
+   * keyboard-reachable, so no unit test could see it. **That is why this guard is a source scan
+   * rather than a render assertion: the defect it prevents is invisible to rendering.**
+   */
+  it("routes nowhere in the clinical application — the developer hub is the only way out", () => {
+    const clinicalExits = ["/documents", "/services", "/medications", "/tools", "/?mode=answer"];
+    const found = clinicalExits.filter((href) => source.includes(`href="${href}"`));
+    expect(found, `the rail must not link into the clinical app, but found: ${found.join(", ")}`).toEqual([]);
+    // Non-vacuity: the one legitimate exit must still be there, or this test would also pass on a
+    // rail with no links at all.
+    expect(source).toContain('href="/mockups/development"');
   });
 });
 

From 41ca93dee10c36894e06c0e5ad35e1a9e5eb35f5 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 01:20:31 +0800
Subject: [PATCH 39/54] Clear the three lint problems the push guard caught

All three came from work I dispatched and none had been run through lint before the
push guard stopped it.

The scenario switcher used role=menuitem with aria-pressed. menuitem does not support
aria-pressed at all, so the active scenario was being announced to nobody. The two
scenarios are mutually exclusive, which is what menuitemradio means, so it is now
menuitemradio + aria-checked inside a radiogroup. Nothing asserted the old attribute -
checked before changing it.

The two landmark/nav contract tests passed children as a prop to createElement rather
than as an argument. Behaviourally identical, but the rule exists and both are now
written the normal way.

Ward suites after the change: 38 files, 428 passed, 0 failed. Lint clean across src and
tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/components/ward-management/ward-demo-controls.tsx | 11 ++++++++---
 tests/ward-landmarks.test.ts                          |  2 +-
 tests/ward-nav.test.ts                                |  4 +---
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/src/components/ward-management/ward-demo-controls.tsx b/src/components/ward-management/ward-demo-controls.tsx
index 0552ed006d..1d41fb73ed 100644
--- a/src/components/ward-management/ward-demo-controls.tsx
+++ b/src/components/ward-management/ward-demo-controls.tsx
@@ -119,15 +119,20 @@ export function WardDemoControls() {
               +1 hour
             </button>
           </div>
-          <div className={styles.scenarioRow} role="group" aria-label="Demo scenario">
+          {/* `menuitemradio` + `aria-checked`, not `menuitem` + `aria-pressed`. The scenarios are
+              mutually exclusive — exactly one night is loaded — which is what `menuitemradio`
+              means, and `menuitem` does not support `aria-pressed` at all, so the state was being
+              announced to nobody. `role="radiogroup"` on the wrapper is what makes the set
+              coherent to a screen reader rather than two unrelated checkable items. */}
+          <div className={styles.scenarioRow} role="radiogroup" aria-label="Demo scenario">
             {WARD_SCENARIOS.map((candidate) => (
               <button
                 type="button"
-                role="menuitem"
+                role="menuitemradio"
                 key={candidate}
                 data-testid={`ward-demo-scenario-${candidate}`}
                 className={styles.scenarioButton}
-                aria-pressed={scenario === candidate}
+                aria-checked={scenario === candidate}
                 onClick={() => selectScenario(candidate)}
               >
                 {scenarioLabels[candidate]}
diff --git a/tests/ward-landmarks.test.ts b/tests/ward-landmarks.test.ts
index 4195f3722e..e430a24b4a 100644
--- a/tests/ward-landmarks.test.ts
+++ b/tests/ward-landmarks.test.ts
@@ -144,7 +144,7 @@ describe("Ward Flow route/render-map coverage (sanity check on the scan and the
 });
 
 function renderRoute(entry: RouteRender): string {
-  return renderToStaticMarkup(createElement(WardFlowProvider, { initialNow: NOW_ANCHOR, children: entry.render() }));
+  return renderToStaticMarkup(createElement(WardFlowProvider, { initialNow: NOW_ANCHOR }, entry.render()));
 }
 
 describe("Every Ward Flow route has exactly one #main-content skip-link target (D5, D6)", () => {
diff --git a/tests/ward-nav.test.ts b/tests/ward-nav.test.ts
index ff536b6e88..e81562d9bb 100644
--- a/tests/ward-nav.test.ts
+++ b/tests/ward-nav.test.ts
@@ -254,9 +254,7 @@ describe("Ward Flow route/render-map coverage (D8 nav check — sanity check on
 describe("Every Ward Flow route carries the 'Ward Flow views' in-page nav (D8)", () => {
   for (const entry of RENDERABLE_ROUTES) {
     it(`renders the Ward Flow views nav on ${entry.route}`, () => {
-      const markup = renderToStaticMarkup(
-        createElement(WardFlowProvider, { initialNow: NOW_ANCHOR, children: entry.render() }),
-      );
+      const markup = renderToStaticMarkup(createElement(WardFlowProvider, { initialNow: NOW_ANCHOR }, entry.render()));
       const matches = markup.match(/aria-label="Ward Flow views"/g) ?? [];
       expect(
         matches.length,

From 138cf7812a482c43716ce64a680a2de753fb9ae5 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 01:25:51 +0800
Subject: [PATCH 40/54] Resolve the lint rule against the type contract,
 explicitly

WardFlowProviderProps declares children required, so passing it positionally to
createElement fails the type (TS2769) - which is what my first attempt at satisfying
react/no-children-prop produced. These two files cannot use JSX instead: both are
deliberately .test.ts rather than .test.tsx so they collect under vitest's node project
rather than jsdom, and renderToStaticMarkup needs no DOM.

So the rule and the type genuinely disagree here and the type wins, with a narrow
eslint-disable carrying that reason rather than a silent workaround. I did not restructure
the call through a variable to dodge the rule - that would have hidden the disagreement
instead of recording it.

Lint clean across src and tests, typecheck:source clean, both files 59 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 tests/ward-landmarks.test.ts | 9 ++++++++-
 tests/ward-nav.test.ts       | 8 +++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/tests/ward-landmarks.test.ts b/tests/ward-landmarks.test.ts
index e430a24b4a..b308fd5122 100644
--- a/tests/ward-landmarks.test.ts
+++ b/tests/ward-landmarks.test.ts
@@ -144,7 +144,14 @@ describe("Ward Flow route/render-map coverage (sanity check on the scan and the
 });
 
 function renderRoute(entry: RouteRender): string {
-  return renderToStaticMarkup(createElement(WardFlowProvider, { initialNow: NOW_ANCHOR }, entry.render()));
+  // `children` goes in the props object, not as a third argument, because `WardFlowProviderProps`
+  // declares it REQUIRED — passing it positionally leaves the props object failing the type
+  // (TS2769). The lint rule below prefers the positional form for JSX ergonomics, but this file
+  // cannot use JSX: it is deliberately `.test.ts` rather than `.test.tsx` so it collects under
+  // vitest's "node" project instead of jsdom (see this file's header), and `renderToStaticMarkup`
+  // needs no DOM. So the rule and the type contract genuinely disagree here, and the type wins.
+  // eslint-disable-next-line react/no-children-prop -- see above: WardFlowProviderProps requires `children`
+  return renderToStaticMarkup(createElement(WardFlowProvider, { initialNow: NOW_ANCHOR, children: entry.render() }));
 }
 
 describe("Every Ward Flow route has exactly one #main-content skip-link target (D5, D6)", () => {
diff --git a/tests/ward-nav.test.ts b/tests/ward-nav.test.ts
index e81562d9bb..c542d1364f 100644
--- a/tests/ward-nav.test.ts
+++ b/tests/ward-nav.test.ts
@@ -254,7 +254,13 @@ describe("Ward Flow route/render-map coverage (D8 nav check — sanity check on
 describe("Every Ward Flow route carries the 'Ward Flow views' in-page nav (D8)", () => {
   for (const entry of RENDERABLE_ROUTES) {
     it(`renders the Ward Flow views nav on ${entry.route}`, () => {
-      const markup = renderToStaticMarkup(createElement(WardFlowProvider, { initialNow: NOW_ANCHOR }, entry.render()));
+      // `children` in the props object, not positional — `WardFlowProviderProps` declares it
+      // required, so the positional form fails the type (TS2769). This file cannot use JSX
+      // instead: it is deliberately `.test.ts` so it collects under vitest's "node" project
+      // rather than jsdom (see the header). Same exception as tests/ward-landmarks.test.ts.
+      // eslint-disable-next-line react/no-children-prop -- WardFlowProviderProps requires `children`
+      const element = createElement(WardFlowProvider, { initialNow: NOW_ANCHOR, children: entry.render() });
+      const markup = renderToStaticMarkup(element);
       const matches = markup.match(/aria-label="Ward Flow views"/g) ?? [];
       expect(
         matches.length,

From 6c6418dc6b81b0c1650d12c4618f98a2013f8859 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 01:27:23 +0800
Subject: [PATCH 41/54] Format the two plan documents

Whitespace only. The push guard checks the pushed commit in an isolated worktree, not
the working copy, which is how these two slipped through my per-file prettier runs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ...-25-ward-flow-phase-4-specialist-boards.md | 28 +++++++++----------
 ...-25-ward-flow-standalone-and-nav-repair.md |  4 +--
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md b/docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md
index cbcf214c35..4aecaf03e2 100644
--- a/docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md
+++ b/docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md
@@ -987,8 +987,8 @@ git commit -m "Ward Flow: patient search, on its own page"
       `ward-eligibility.ts`; they are simply invisible on the board whose job is capacity.
 
       **The authorisation flag is a property the model already carries about a unit. Rendering it
-              is not a legal claim and must not be dressed as one** — no explanation of what authorisation
-              requires or means.
+                  is not a legal claim and must not be dressed as one** — no explanation of what authorisation
+                  requires or means.
 
 - [ ] **Step 4: Run and watch it pass. Commit.**
 
@@ -1042,16 +1042,16 @@ git commit -m "Ward Flow: the capacity board shows the three things that actuall
 - [ ] **Step 5: Extend `GovernanceView`** with three additions:
 
       1. The **not-a-medical-device** statement. `coordinator-screen.tsx` already carries the exact
-                 wording — reuse it rather than writing a second version.
-              2. The **change audit**, newest first, with an explicit empty state.
-              3. The **two effectiveness numbers**, each rendering an explicit absence when `undefined`.
+                     wording — reuse it rather than writing a second version.
+                  2. The **change audit**, newest first, with an explicit empty state.
+                  3. The **two effectiveness numbers**, each rendering an explicit absence when `undefined`.
 
-              **The third success measure is dropped and the page says so.** The binding spec §11 lists
-              "legal deadlines passed while a patient waits" as one of three measures; it no longer exists
-              and cannot be computed. Record the drop on the page rather than silently omitting it.
+                  **The third success measure is dropped and the page says so.** The binding spec §11 lists
+                  "legal deadlines passed while a patient waits" as one of three measures; it no longer exists
+                  and cannot be computed. Record the drop on the page rather than silently omitting it.
 
-              **Neither number may be presented as evidence the prototype works.** They describe the
-              synthetic scenario and the page must say so.
+                  **Neither number may be presented as evidence the prototype works.** They describe the
+                  synthetic scenario and the page must say so.
 
 - [ ] **Step 6: DOM test, then commit.**
 
@@ -1126,10 +1126,10 @@ git commit -m "Ward Flow: the patient page carries declines, changes and the esc
       not invent a blocker that describes a person.
 
       **A bed release carries nothing whatsoever about the departing patient** — no identifier, no
-              timing that could identify them, no reason relating to them. That is a privacy rule from the
-              binding spec §4 and it is not negotiable. Add a test that asserts the `BedRelease` type has
-              no field capable of carrying a patient reference, and say plainly in your report how you
-              proved it.
+                  timing that could identify them, no reason relating to them. That is a privacy rule from the
+                  binding spec §4 and it is not negotiable. Add a test that asserts the `BedRelease` type has
+                  no field capable of carrying a patient reference, and say plainly in your report how you
+                  proved it.
 
 - [ ] **Step 5: Run and watch them pass.**
 
diff --git a/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md b/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md
index 34873a2432..8d2458c78c 100644
--- a/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md
+++ b/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md
@@ -175,8 +175,8 @@ has both and is the correct shape to copy.
       "at least one" would not catch it.
 
       Render through the real component tree with `WardFlowProvider`, the way the existing ward DOM
-              tests do. **Enumerate the routes from the filesystem, not from a hand-written list** — a
-              hand-written list is what let three pages ship without the id in the first place.
+                  tests do. **Enumerate the routes from the filesystem, not from a hand-written list** — a
+                  hand-written list is what let three pages ship without the id in the first place.
 
 - [ ] **Step 2: Run it. It must fail naming at least four routes.** If it names fewer, the
       enumeration is wrong — fix the test before touching any component.

From 44638266fcff301efb017e2f4c3ddf0745e7eeff Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 01:39:45 +0800
Subject: [PATCH 42/54] Stabilise the superseded plan's formatting; the other
 cannot be stabilised

The standalone plan had continuation lines inside a checklist item that Prettier kept
re-indenting; normalising them fixes it and it now passes.

The Phase 4 plan cannot be fixed the same way, and this is a Prettier bug rather than a
formatting mistake: running prettier --write twice on it produces 30 differing lines.
It never converges, so --check can never pass whatever is committed. Measured, not
assumed. It is a planning document, so no code is affected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../plans/2026-08-25-ward-flow-standalone-and-nav-repair.md  | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md b/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md
index 8d2458c78c..1d017472e0 100644
--- a/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md
+++ b/docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md
@@ -173,10 +173,9 @@ has both and is the correct shape to copy.
       `src/app/ward-management/`, assert the rendered output contains **exactly one**
       `<main id="main-content">`. Not "at least one" — two main landmarks is also a defect, and
       "at least one" would not catch it.
-
       Render through the real component tree with `WardFlowProvider`, the way the existing ward DOM
-                  tests do. **Enumerate the routes from the filesystem, not from a hand-written list** — a
-                  hand-written list is what let three pages ship without the id in the first place.
+      tests do. **Enumerate the routes from the filesystem, not from a hand-written list** — a
+      hand-written list is what let three pages ship without the id in the first place.
 
 - [ ] **Step 2: Run it. It must fail naming at least four routes.** If it names fewer, the
       enumeration is wrong — fix the test before touching any component.

From 9270d63c3a69661e7e2eb7d58146fe2448a66f4d Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Tue, 25 Aug 2026 17:52:57 +0000
Subject: [PATCH 43/54] Start the advisory UI lane for Ward Flow specs and
 components
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The three ui-ward-*.spec.ts files moved into chromium-mockups, but
mockupPatterns never matched those specs or src/components/ward-management,
so a component-only PR left advisory_ui_changed=false and the 46 journeys
ran in neither lane. Flatten the nested ward-(?:…) group so
assertMockupSpecParity can extract the three real spec paths.
---
 playwright.config.ts        |  2 +-
 scripts/ci-change-scope.mjs | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/playwright.config.ts b/playwright.config.ts
index 4aa0dd8779..e430aa32ed 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -25,7 +25,7 @@ const chromiumExecutablePath = process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH;
 const productionSpecPattern =
   /.*(?:answer-progress-ui-smoke|dsm-ui-smoke|ui-(smoke|stress|accessibility|caring-contacts-workspace|clinical-ask|dictionary|document-canvas|tools|overlap|universal-search|specifiers|formulation(?:-result-cards)?|forms-section-nav|chrome-scroll|therapy-nav-scroll|mode-nav-density|phone-motion|phone-scroll(?:-[a-z0-9-]+)?|pwa|route-coverage|style-contract|visual-artifacts|hydration))\.spec\.ts/;
 const mockupSpecPattern =
-  /.*ui-(answer-chat-perfected-mockup|caring-contact-mockup|document-top-navigation-mockup|sidebar-live-mockup|therapy-navigation-mockup|tools|tools-collapse|tools-search-mode-mockup|tools-task-directory|ward-(?:management|coordinator|roles))\.spec\.ts/;
+  /.*ui-(answer-chat-perfected-mockup|caring-contact-mockup|document-top-navigation-mockup|sidebar-live-mockup|therapy-navigation-mockup|tools|tools-collapse|tools-search-mode-mockup|tools-task-directory|ward-management|ward-coordinator|ward-roles)\.spec\.ts/;
 const mockupTag = /@mockup/;
 
 export default defineConfig({
diff --git a/scripts/ci-change-scope.mjs b/scripts/ci-change-scope.mjs
index 36bdf37601..ac3cc1ddab 100644
--- a/scripts/ci-change-scope.mjs
+++ b/scripts/ci-change-scope.mjs
@@ -104,6 +104,13 @@ const mockupPatterns = [
   // below holds this list to `mockupSpecPattern` in playwright.config.ts.
   /^tests\/.*mockup.*\.spec\.ts$/,
   /^tests\/ui-tools(?:-collapse|-task-directory)?\.spec\.ts$/,
+  // Ward Flow is a gated /mockups/ward-flow prototype. Its implementation tree
+  // and the three ui-ward-*.spec.ts journeys carry no "mockup" in the path, so
+  // every rule above misses them. After those specs moved into chromium-mockups,
+  // a component-only or spec-only edit left advisory_ui_changed=false and the
+  // 46 journeys ran in neither lane.
+  "src/components/ward-management",
+  /^tests\/ui-ward-(?:management|coordinator|roles)\.spec\.ts$/,
 ];
 
 function quarantineLedgerHasEntries(readLedger) {
@@ -759,6 +766,23 @@ function selfTest() {
   assertScope("advisory-on-for-tools-task-directory-spec", ["tests/ui-tools-task-directory.spec.ts"], {
     advisory_ui_changed: true,
   });
+  // Ward Flow: gated prototype whose specs and implementation tree have no
+  // "mockup" in the path. Both a spec-only edit and a component edit without
+  // the route wrapper must start the advisory lane; a vitest file must not.
+  assertScope("advisory-on-for-ward-spec", ["tests/ui-ward-management.spec.ts"], {
+    advisory_ui_changed: true,
+  });
+  assertScope(
+    "advisory-on-for-ward-management-component",
+    ["src/components/ward-management/coordinator/coordinator-screen.tsx"],
+    {
+      ui_changed: true,
+      advisory_ui_changed: true,
+    },
+  );
+  assertScope("advisory-off-for-ward-unit-test", ["tests/ward-management.test.ts"], {
+    advisory_ui_changed: false,
+  });
   // The directory rule must not swallow ordinary component paths.
   assertScope("advisory-off-for-non-mockup-component-directory", ["src/components/clinical-dashboard/mode-nav.tsx"], {
     ui_changed: true,

From 1f476c13364e55f5dc5a10c91172916b53c6db1b Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 02:09:15 +0800
Subject: [PATCH 44/54] Ward Flow wears its own name, and the logo stops
 leading out of the sandbox

Two defects found by looking at a screenshot, after every measurement-based pass had
missed both. Neither was structurally wrong, which is exactly why grep could not see them.

The header read "Clinical KB / Source-backed clinical search" on every board - the host
application's name and its tagline - on a sandboxed synthetic prototype that does no
searching and is not source-backed. It now reads "Ward Flow / Synthetic patient-flow
prototype".

The logo was the NINTH exit out of the sandbox and the most prominent one, pointing at the
clinical application's home. I removed eight exits by reading source and did not see this
one, because a brand mark linking to the site root looks unremarkable in source and only
reads as wrong once you see it sitting above the prototype's own rail. It now points at
Ward Flow's own home, and the site root is added to the sandbox guard's forbidden-exit
list so it cannot return.

The rail's own aria-label said "Clinical KB" too; it now says "Ward Flow".

Ward suites: 38 files, 428 passed, 0 failed. No browser spec asserted the old wording -
checked before changing it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/components/ward-management/ward-management-modes.tsx | 9 +++++++--
 .../ward-management/ward-management-navigation.tsx       | 9 +++++++--
 tests/ward-nav.test.ts                                   | 6 +++++-
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/src/components/ward-management/ward-management-modes.tsx b/src/components/ward-management/ward-management-modes.tsx
index a0b67b1815..92b4873ba2 100644
--- a/src/components/ward-management/ward-management-modes.tsx
+++ b/src/components/ward-management/ward-management-modes.tsx
@@ -132,9 +132,14 @@ function ModeHeader({
   return (
     <header className={styles.modeHeader}>
       <div className={styles.modeIdentity}>
+        {/* Ward Flow's own identity, not the host application's. This read "Clinical KB /
+            Source-backed clinical search" on every board of a sandboxed synthetic prototype that
+            does no searching and is not source-backed. Found by looking at a screenshot — every
+            measurement run against this codebase missed it, because nothing was structurally
+            wrong with it. */}
         <span>
-          <strong>Clinical KB</strong>
-          <small>Source-backed clinical search</small>
+          <strong>Ward Flow</strong>
+          <small>Synthetic patient-flow prototype</small>
         </span>
         <div className={styles.modeTitle}>
           <h1>{copy.title}</h1>
diff --git a/src/components/ward-management/ward-management-navigation.tsx b/src/components/ward-management/ward-management-navigation.tsx
index 4aecd79f7a..1a14e78821 100644
--- a/src/components/ward-management/ward-management-navigation.tsx
+++ b/src/components/ward-management/ward-management-navigation.tsx
@@ -99,8 +99,13 @@ function RailLink({
  */
 export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
   return (
-    <aside className={shellStyles.clinicalRail} aria-label="Clinical KB">
-      <Link href="/" className={shellStyles.railBrand} aria-label="Clinical KB home">
+    <aside className={shellStyles.clinicalRail} aria-label="Ward Flow">
+      {/* The NINTH link out of the sandbox, and the most prominent one: the logo pointed at `/`,
+          the clinical application's home. I removed eight others by reading the source and did not
+          see this one, because a logo linking home looks entirely normal in source. It showed up
+          the moment a screenshot was looked at. It now points at Ward Flow's own home, which is
+          what a standalone application's logo does. */}
+      <Link href="/mockups/ward-flow" className={shellStyles.railBrand} aria-label="Ward Flow home">
         <BrandMark className={shellStyles.brandGlyph} />
       </Link>
       <div className={shellStyles.railRule} aria-hidden="true" />
diff --git a/tests/ward-nav.test.ts b/tests/ward-nav.test.ts
index c542d1364f..39141c02f9 100644
--- a/tests/ward-nav.test.ts
+++ b/tests/ward-nav.test.ts
@@ -190,7 +190,11 @@ describe("ClinicalRail's aria-label is honest for a sandboxed prototype (D11)",
    * rather than a render assertion: the defect it prevents is invisible to rendering.**
    */
   it("routes nowhere in the clinical application — the developer hub is the only way out", () => {
-    const clinicalExits = ["/documents", "/services", "/medications", "/tools", "/?mode=answer"];
+    // `"/"` is the clinical application's home, and it is in this list because it was the NINTH
+    // exit — the logo. Eight were found by reading the source; the logo was missed, because a
+    // brand mark linking to `/` looks completely unremarkable in source and only reads as wrong
+    // once you see it sitting above a sandboxed prototype's own rail.
+    const clinicalExits = ["/", "/documents", "/services", "/medications", "/tools", "/?mode=answer"];
     const found = clinicalExits.filter((href) => source.includes(`href="${href}"`));
     expect(found, `the rail must not link into the clinical app, but found: ${found.join(", ")}`).toEqual([]);
     // Non-vacuity: the one legitimate exit must still be there, or this test would also pass on a

From 57af859eaace886e8692c86924331cebbb8d3276 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 03:30:18 +0800
Subject: [PATCH 45/54] Phone: stop the boards crushing their tables and
 spilling their filters

Found by looking at screenshots on a production build. Both defects passed every
structural check in the repository, because neither is structurally wrong.

On a 390px phone the patient-search and escalation tables were width:100% with no
wrapper, so the browser squeezed the columns until words broke mid-syllable -
"Place/ment reque/sted", "Desti/natio/n revie/w" - and the right-hand column still ran
off the screen. They now keep a readable minimum width inside a horizontally scrolling
wrapper, which is the standard treatment for a wide table on a narrow screen.

The Department filter was a grid item containing a select. Grid items do not shrink
below their content width by default and a select is as wide as its widest option, so
it rendered wider than its own card and spilled past the card's right edge. Fixed with
min-width: 0 on the field and width: 100% on the control.

Verified by re-capturing the search board at 390px after each change: "Destination
review", "Accepted, awaiting bed" and "Handover ready" now read as words, and the
dropdown sits inside its card. The identical table change was applied to the escalation
board.

Typecheck clean. Ward suites 38 files, 428 passed, 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../escalation/escalation-board.tsx           | 86 ++++++++++---------
 .../escalation/escalation.module.css          | 17 ++++
 .../ward-management/search/patient-search.tsx | 40 +++++----
 .../ward-management/search/search.module.css  | 24 ++++++
 4 files changed, 108 insertions(+), 59 deletions(-)

diff --git a/src/components/ward-management/escalation/escalation-board.tsx b/src/components/ward-management/escalation/escalation-board.tsx
index 0507d1bcf6..9cd2a68c12 100644
--- a/src/components/ward-management/escalation/escalation-board.tsx
+++ b/src/components/ward-management/escalation/escalation-board.tsx
@@ -67,28 +67,32 @@ export function EscalatedSection({ board, now }: { board: EscalationBoard; now:
           None — no open movement carries a recorded escalation.
         </p>
       ) : (
-        <table className={styles.table}>
-          <thead>
-            <tr>
-              <th scope="col">Movement</th>
-              <th scope="col">When</th>
-              <th scope="col">Units tried</th>
-              <th scope="col">Contact</th>
-              <th scope="col">Wait</th>
-            </tr>
-          </thead>
-          <tbody>
-            {board.escalated.map((entry) => (
-              <tr key={entry.movement.id}>
-                <td>{entry.movement.id}</td>
-                <td>{entry.movement.escalation ? formatInstant(entry.movement.escalation.at) : "No time recorded"}</td>
-                <td>{triedUnitsLabel(entry.triedUnits)}</td>
-                <td>{entry.movement.escalation?.contact ?? "No contact recorded"}</td>
-                <td>{elapsedLabel(entry.movement, now)}</td>
+        <div className={styles.tableScroll}>
+          <table className={styles.table}>
+            <thead>
+              <tr>
+                <th scope="col">Movement</th>
+                <th scope="col">When</th>
+                <th scope="col">Units tried</th>
+                <th scope="col">Contact</th>
+                <th scope="col">Wait</th>
               </tr>
-            ))}
-          </tbody>
-        </table>
+            </thead>
+            <tbody>
+              {board.escalated.map((entry) => (
+                <tr key={entry.movement.id}>
+                  <td>{entry.movement.id}</td>
+                  <td>
+                    {entry.movement.escalation ? formatInstant(entry.movement.escalation.at) : "No time recorded"}
+                  </td>
+                  <td>{triedUnitsLabel(entry.triedUnits)}</td>
+                  <td>{entry.movement.escalation?.contact ?? "No contact recorded"}</td>
+                  <td>{elapsedLabel(entry.movement, now)}</td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
       )}
     </section>
   );
@@ -103,26 +107,28 @@ export function NowhereEligibleSection({ board, now }: { board: EscalationBoard;
           None — every open movement has at least one eligible ward right now.
         </p>
       ) : (
-        <table className={styles.table}>
-          <thead>
-            <tr>
-              <th scope="col">Movement</th>
-              <th scope="col">Wait</th>
-              <th scope="col">Stage</th>
-              <th scope="col">Department</th>
-            </tr>
-          </thead>
-          <tbody>
-            {board.nowhereEligible.map((movement) => (
-              <tr key={movement.id}>
-                <td>{movement.id}</td>
-                <td>{elapsedLabel(movement, now)}</td>
-                <td>{stageCopy[movement.stage].label}</td>
-                <td>{departmentLabel(movement)}</td>
+        <div className={styles.tableScroll}>
+          <table className={styles.table}>
+            <thead>
+              <tr>
+                <th scope="col">Movement</th>
+                <th scope="col">Wait</th>
+                <th scope="col">Stage</th>
+                <th scope="col">Department</th>
               </tr>
-            ))}
-          </tbody>
-        </table>
+            </thead>
+            <tbody>
+              {board.nowhereEligible.map((movement) => (
+                <tr key={movement.id}>
+                  <td>{movement.id}</td>
+                  <td>{elapsedLabel(movement, now)}</td>
+                  <td>{stageCopy[movement.stage].label}</td>
+                  <td>{departmentLabel(movement)}</td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
       )}
     </section>
   );
diff --git a/src/components/ward-management/escalation/escalation.module.css b/src/components/ward-management/escalation/escalation.module.css
index 8072fda6c5..dce1683b86 100644
--- a/src/components/ward-management/escalation/escalation.module.css
+++ b/src/components/ward-management/escalation/escalation.module.css
@@ -139,3 +139,20 @@
 .table tbody tr:last-child td {
   border-bottom: none;
 }
+
+/*
+ * Wide content scrolls; it never crushes. Without this the table is `width: 100%` on a 390px
+ * phone, so the browser squeezes every column until words break mid-syllable — measured on a
+ * production build: "Place/ment reque/sted", "Desti/natio/n revie/w" — and the right-hand column
+ * still runs off the screen. A `min-width` plus a scrolling wrapper keeps each column readable and
+ * lets the reader pan, which is the standard treatment for a wide table on a narrow screen.
+ *
+ * Found by looking at a screenshot. Every structural check passed on this table.
+ */
+.tableScroll {
+  overflow-x: auto;
+}
+
+.table {
+  min-width: 44rem;
+}
diff --git a/src/components/ward-management/search/patient-search.tsx b/src/components/ward-management/search/patient-search.tsx
index b508382b13..66986b02be 100644
--- a/src/components/ward-management/search/patient-search.tsx
+++ b/src/components/ward-management/search/patient-search.tsx
@@ -135,25 +135,27 @@ export function ResultsSection({ results, units, now }: { results: Movement[]; u
           No matches — no open movement fits the current search.
         </p>
       ) : (
-        <table className={styles.table}>
-          <thead>
-            <tr>
-              <th scope="col">Movement</th>
-              <th scope="col">Stage</th>
-              <th scope="col">Department</th>
-              <th scope="col">Destination</th>
-              <th scope="col">Since arrival</th>
-              <th scope="col">
-                <span className="sr-only">Open</span>
-              </th>
-            </tr>
-          </thead>
-          <tbody>
-            {results.map((movement) => (
-              <ResultRow key={movement.id} movement={movement} units={units} now={now} />
-            ))}
-          </tbody>
-        </table>
+        <div className={styles.tableScroll}>
+          <table className={styles.table}>
+            <thead>
+              <tr>
+                <th scope="col">Movement</th>
+                <th scope="col">Stage</th>
+                <th scope="col">Department</th>
+                <th scope="col">Destination</th>
+                <th scope="col">Since arrival</th>
+                <th scope="col">
+                  <span className="sr-only">Open</span>
+                </th>
+              </tr>
+            </thead>
+            <tbody>
+              {results.map((movement) => (
+                <ResultRow key={movement.id} movement={movement} units={units} now={now} />
+              ))}
+            </tbody>
+          </table>
+        </div>
       )}
     </section>
   );
diff --git a/src/components/ward-management/search/search.module.css b/src/components/ward-management/search/search.module.css
index 5365fccb34..b6788235a5 100644
--- a/src/components/ward-management/search/search.module.css
+++ b/src/components/ward-management/search/search.module.css
@@ -106,6 +106,11 @@
 
 .field {
   display: grid;
+  /* Grid items refuse to shrink below their content width by default, and a `<select>` is as wide
+     as its widest option. Without `min-width: 0` here and `width: 100%` below, the Department
+     select rendered wider than its own card on a 390px phone and spilled past the card's right
+     edge — visible in a screenshot, invisible to every structural check. */
+  min-width: 0;
   gap: var(--ps-space-4);
   color: var(--text-heading);
   font-size: var(--text-3xs);
@@ -114,6 +119,8 @@
 
 .field input,
 .field select {
+  width: 100%;
+  min-width: 0;
   min-height: var(--ps-space-48);
   border: 0.0625rem solid var(--border);
   border-radius: var(--radius-md);
@@ -187,3 +194,20 @@
 .resultLink:focus-visible {
   text-decoration: underline;
 }
+
+/*
+ * Wide content scrolls; it never crushes. Without this the table is `width: 100%` on a 390px
+ * phone, so the browser squeezes every column until words break mid-syllable — measured on a
+ * production build: "Place/ment reque/sted", "Desti/natio/n revie/w" — and the right-hand column
+ * still runs off the screen. A `min-width` plus a scrolling wrapper keeps each column readable and
+ * lets the reader pan, which is the standard treatment for a wide table on a narrow screen.
+ *
+ * Found by looking at a screenshot. Every structural check passed on this table.
+ */
+.tableScroll {
+  overflow-x: auto;
+}
+
+.table {
+  min-width: 44rem;
+}

From b42af6537bbc4968989a05e313b16a6a1586f156 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 03:42:15 +0800
Subject: [PATCH 46/54] Plan: give Ward Flow the repository's sidebar pattern

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ...6-08-26-ward-flow-sidebar-house-pattern.md | 107 ++++++++++++++++++
 1 file changed, 107 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-08-26-ward-flow-sidebar-house-pattern.md

diff --git a/docs/superpowers/plans/2026-08-26-ward-flow-sidebar-house-pattern.md b/docs/superpowers/plans/2026-08-26-ward-flow-sidebar-house-pattern.md
new file mode 100644
index 0000000000..c92aea968d
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-26-ward-flow-sidebar-house-pattern.md
@@ -0,0 +1,107 @@
+# Ward Flow sidebar — adopt the repository's house sidebar pattern
+
+**Goal:** Give Ward Flow the same sidebar *approach and structure* the clinical
+application already uses, tailored to Ward Flow's own tokens, style and
+destinations.
+
+**Why now:** Ward Flow's rail has exactly one state. `ward-management.module.css`
+contains four `@media` queries and not one of them is a width rule that touches
+the rail, so a 390px phone renders the full 4.5rem desktop icon column — 18% of
+the viewport — on every screen. Nine of the ten Ward Flow shells are a bare
+`rail | main` two-column grid with no header of any kind, so a phone user gets a
+squeezed column of unlabelled icons and nothing else.
+
+## The house pattern being adopted
+
+Read from `src/components/clinical-dashboard/ClinicalSidebar.tsx` and
+`use-sidebar-collapsed.ts`:
+
+1. **One content component, two hosts.** `ClinicalSidebarContent` renders the
+   labelled navigation once; the expanded desktop panel and the mobile drawer
+   both mount it. Nothing is written twice.
+2. **Three breakpoints, three shapes.** Phone: no rail at all — a `Sheet` drawer
+   opened from the app header. Tablet (`md`): icon rail only, with a static brand
+   mark and no expand control, because the expanded panel does not exist below
+   `lg`. Desktop (`lg`): icon rail *or* a 20rem labelled panel, chosen by the
+   user.
+3. **The choice persists.** `useSidebarCollapsed` is an external store over
+   `localStorage`, collapsed by default, with an in-memory fallback when storage
+   writes fail.
+4. **The brand mark is the toggle.** Hovering it swaps the logo for
+   `PanelLeftOpen`; it is a plain static mark on tablet where there is nothing to
+   expand into.
+5. **Navigating closes the drawer.** `onNavigate={() => onOpenChange(false)}`.
+
+## Tailoring for Ward Flow
+
+- Ward Flow's panel is **17rem**, not 20rem — its longest label is much shorter
+  than a recent-query line, and its shells are dense operational boards that want
+  the width back.
+- Ward Flow has no header on nine of its ten shells, so the phone drawer's
+  trigger has nowhere to live. The sidebar therefore **brings its own phone
+  header**: a fixed 3.5rem bar carrying the brand mark, the words "Ward Flow",
+  and the menu button. That is a genuine improvement, not just a port — those
+  nine screens currently have no phone chrome whatsoever.
+- The rail track becomes an `auto` grid track in all ten shells, so the sidebar's
+  own width is what decides the column. One rule, one place, three states.
+
+## Global constraints
+
+- Synthetic data only; sex is the only permitted patient attribute. No nav label
+  may name a real person, place-identifying address, or clinical narrative.
+- No figure or requirement from the Mental Health Act, quoted, paraphrased or
+  inferred.
+- Local and offline checks only. No provider-backed command.
+- Every Ward Flow route stays inside the sandbox: the developer hub is the only
+  outbound link, and the brand mark points at Ward Flow's own home.
+
+## Tasks
+
+### Task 1 — Make the nav data the single source for all three groups
+
+`ward-nav.ts` currently sources the six Ward-Flow-specific destinations. The
+eight mode views are still eight hand-written `<Link>` blocks inside
+`WardModeNavigation`, read back by `tests/ward-management.test.ts` through a
+regex over that function's own source text. A labelled panel and drawer cannot
+render from that without becoming a second hand-maintained list — which is the
+exact defect `ward-nav.ts` was created to end.
+
+- Move `WardMode` and the eight views into `ward-nav.ts` as `WARD_VIEWS`.
+- Re-export `WardMode` from `ward-management-navigation.tsx` so no call site changes.
+- Render `WardModeNavigation` from `WARD_VIEWS`.
+- Point `wardModeHrefs()` at `WARD_VIEWS` instead of a source-text regex.
+- The two-way route test keeps enforcing that every href is a real route and
+  every static route is listed or exempted with a reason.
+
+### Task 2 — Persisted collapse state
+
+`use-ward-sidebar-collapsed.ts`, mirroring the clinical hook's structure
+(external store, `localStorage`, in-memory fallback, collapsed by default) under
+Ward Flow's own key `ward-flow-sidebar-collapsed`. A separate key, not the
+clinical one: the sandbox does not share state with the application.
+
+### Task 3 — The shared labelled content
+
+`ward-sidebar-content.tsx` — brand row, three labelled groups (Views, Role
+screens, Boards), then the footer controls that already exist and are reused
+unchanged: `WardRoleSwitcher`, `WardDemoControls`, the developer-hub exit, and
+the guest mark. Mounted by both the desktop panel and the phone drawer.
+
+### Task 4 — Compose the three states
+
+`ClinicalRail` becomes the composer: phone bar + drawer, icon rail, expanded
+panel. Every one of the ten call sites keeps its current single
+`<ClinicalRail />` element.
+
+### Task 5 — Shell grids and phone reserve
+
+All ten shells: rail track `4.5rem` → `auto`; phone `padding-top: 3.5rem` for the
+fixed bar; the two shells with their own sticky headers get `top: 3.5rem`.
+
+### Task 6 — Tests
+
+Sidebar-state tests (phone hides the rail and shows the bar; the drawer opens,
+lists every destination and closes on navigate; the desktop toggle persists), and
+re-run the ward Chromium journeys plus phone screenshots. Screenshots are not
+optional here: every defect found in this area so far was invisible to structural
+checks.

From 7d286b9173239242161e1a1fe3ce36c4eea2326b Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 04:13:37 +0800
Subject: [PATCH 47/54] Give Ward Flow the repository's sidebar pattern,
 including a phone one

Ward Flow's rail had exactly one state. ward-management.module.css held four media
queries - prefers-reduced-motion, forced-colors, and two width rules naming
.workspaceGrid and .patientWorkspace - so not one of them touched the rail, and a
390px phone rendered the full 4.5rem desktop icon column, 18% of the viewport, on
every screen. 38 test files and 428 passing tests could not see it, because nothing
was structurally wrong.

It now has the three shapes ClinicalSidebar.tsx already uses: a drawer on a phone,
the icon rail on a tablet, and the rail or a 17rem labelled panel on a desktop with
the choice remembered per browser. Nine of the ten Ward Flow shells are a bare
rail-plus-main grid with no header of any kind, so unlike the clinical application
there was nowhere for a drawer trigger to live - the sidebar therefore brings its
own fixed phone bar, which is also the first phone chrome those nine screens have
ever had.

The eight views moved out of eight hand-written link blocks and into WARD_VIEWS.
A labelled panel cannot read a rail's icon-only JSX, so leaving them there would
have meant a second hand-maintained copy of the same eight destinations - the exact
two-lists-drifting defect ward-nav.ts exists to prevent. The mode-href test now
reads that data instead of regexing a function body, which is the stronger check.

Rail width also stops being a 4.5rem literal repeated across ten stylesheets: every
shell's first grid track is auto, so the sidebar's own width decides the column in
all three states.

Typecheck clean. Lint exit 0. Ward suites 40 files, 444 passed, 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 docs/design-system/adoption-manifest.json     |   3 +-
 .../coordinator/coordinator.module.css        |  13 +-
 .../ward-management/ed/ed.module.css          |  13 +-
 .../escalation/escalation.module.css          |  15 +-
 .../handover/handover.module.css              |  15 +-
 .../officer/officer.module.css                |  13 +-
 .../ward-management/search/search.module.css  |  15 +-
 .../tracker/live-tracker.module.css           |  15 +-
 .../use-ward-sidebar-collapsed.ts             |  70 +++
 .../ward-management-modes.module.css          |  14 +-
 .../ward-management-navigation.tsx            | 415 ++++++++----------
 .../ward-management.module.css                |  98 ++++-
 .../ward-management/ward-nav-icons.ts         |  47 ++
 src/components/ward-management/ward-nav.ts    | 117 ++---
 .../ward-management/ward-sidebar-content.tsx  | 145 ++++++
 .../ward-management/ward-sidebar.module.css   | 347 +++++++++++++++
 .../ward-management/ward/ward.module.css      |  13 +-
 tests/ward-management.test.ts                 |  17 +-
 tests/ward-nav.test.ts                        |  72 ++-
 tests/ward-sidebar-phone-contract.test.ts     |  92 ++++
 tests/ward-sidebar.dom.test.tsx               | 137 ++++++
 21 files changed, 1359 insertions(+), 327 deletions(-)
 create mode 100644 src/components/ward-management/use-ward-sidebar-collapsed.ts
 create mode 100644 src/components/ward-management/ward-nav-icons.ts
 create mode 100644 src/components/ward-management/ward-sidebar-content.tsx
 create mode 100644 src/components/ward-management/ward-sidebar.module.css
 create mode 100644 tests/ward-sidebar-phone-contract.test.ts
 create mode 100644 tests/ward-sidebar.dom.test.tsx

diff --git a/docs/design-system/adoption-manifest.json b/docs/design-system/adoption-manifest.json
index 1a84721fb6..ae82b2d9c4 100644
--- a/docs/design-system/adoption-manifest.json
+++ b/docs/design-system/adoption-manifest.json
@@ -1614,7 +1614,8 @@
         "src/components/mode-nav/mode-nav.tsx",
         "src/components/therapy-compass/record/key-facts.tsx",
         "src/components/tools/tools-search-results-page.tsx",
-        "src/components/ui/confirm-dialog.tsx"
+        "src/components/ui/confirm-dialog.tsx",
+        "src/components/ward-management/ward-management-navigation.tsx"
       ],
       "productImportFiles": [
         "src/components/AccessibleTable.tsx",
diff --git a/src/components/ward-management/coordinator/coordinator.module.css b/src/components/ward-management/coordinator/coordinator.module.css
index edac75781d..8b8012c3f6 100644
--- a/src/components/ward-management/coordinator/coordinator.module.css
+++ b/src/components/ward-management/coordinator/coordinator.module.css
@@ -35,7 +35,7 @@
   display: grid;
   height: 100dvh;
   min-height: 44rem;
-  grid-template-columns: 4.5rem minmax(0, 1fr);
+  grid-template-columns: auto minmax(0, 1fr);
   overflow: hidden;
   background: var(--surface);
   color: var(--text);
@@ -1929,3 +1929,14 @@
     outline-color: Highlight;
   }
 }
+
+/*
+ * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
+ * place. The bar is fixed rather than sticky because it has to sit above ten different shells
+ * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ */
+@media (max-width: 40rem) {
+  .screen {
+    padding-top: 3.5rem;
+  }
+}
diff --git a/src/components/ward-management/ed/ed.module.css b/src/components/ward-management/ed/ed.module.css
index d0e3e2ab8c..0c1004afd0 100644
--- a/src/components/ward-management/ed/ed.module.css
+++ b/src/components/ward-management/ed/ed.module.css
@@ -20,7 +20,7 @@
   min-height: 100dvh;
   /* The rail track stays reserved at every supported width, same as the ward, officer and
      coordinator screens — see ward-management.module.css's own note on this. */
-  grid-template-columns: 4.5rem minmax(0, 1fr);
+  grid-template-columns: auto minmax(0, 1fr);
   background: var(--surface);
   color: var(--text);
   font-variant-numeric: tabular-nums;
@@ -424,3 +424,14 @@
     text-align: left;
   }
 }
+
+/*
+ * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
+ * place. The bar is fixed rather than sticky because it has to sit above ten different shells
+ * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ */
+@media (max-width: 40rem) {
+  .screen {
+    padding-top: 3.5rem;
+  }
+}
diff --git a/src/components/ward-management/escalation/escalation.module.css b/src/components/ward-management/escalation/escalation.module.css
index dce1683b86..b4e735b795 100644
--- a/src/components/ward-management/escalation/escalation.module.css
+++ b/src/components/ward-management/escalation/escalation.module.css
@@ -16,9 +16,7 @@
   --es-leading-body: 1.4;
   display: grid;
   min-height: 100dvh;
-  /* The rail track stays reserved at every supported width, same as every other Ward Flow
-     screen — see ward-management.module.css's own note on this. */
-  grid-template-columns: 4.5rem minmax(0, 1fr);
+  grid-template-columns: auto minmax(0, 1fr);
   background: var(--surface);
   color: var(--text);
   font-variant-numeric: tabular-nums;
@@ -156,3 +154,14 @@
 .table {
   min-width: 44rem;
 }
+
+/*
+ * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
+ * place. The bar is fixed rather than sticky because it has to sit above ten different shells
+ * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ */
+@media (max-width: 40rem) {
+  .screen {
+    padding-top: 3.5rem;
+  }
+}
diff --git a/src/components/ward-management/handover/handover.module.css b/src/components/ward-management/handover/handover.module.css
index 87faf0e018..151c12a8cf 100644
--- a/src/components/ward-management/handover/handover.module.css
+++ b/src/components/ward-management/handover/handover.module.css
@@ -17,9 +17,7 @@
   --ho-leading-body: 1.4;
   display: grid;
   min-height: 100dvh;
-  /* The rail track stays reserved at every supported width, same as every other Ward Flow
-     screen — see ward-management.module.css's own note on this. */
-  grid-template-columns: 4.5rem minmax(0, 1fr);
+  grid-template-columns: auto minmax(0, 1fr);
   background: var(--surface);
   color: var(--text);
   font-variant-numeric: tabular-nums;
@@ -202,3 +200,14 @@
     border-bottom-color: #000;
   }
 }
+
+/*
+ * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
+ * place. The bar is fixed rather than sticky because it has to sit above ten different shells
+ * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ */
+@media (max-width: 40rem) {
+  .screen {
+    padding-top: 3.5rem;
+  }
+}
diff --git a/src/components/ward-management/officer/officer.module.css b/src/components/ward-management/officer/officer.module.css
index 5348332307..49e485a3cf 100644
--- a/src/components/ward-management/officer/officer.module.css
+++ b/src/components/ward-management/officer/officer.module.css
@@ -31,7 +31,7 @@
   min-height: 100dvh;
   /* The rail track stays reserved at every supported width, same as the ward and coordinator
      screens — see ward-management.module.css's own note on this. */
-  grid-template-columns: 4.5rem minmax(0, 1fr);
+  grid-template-columns: auto minmax(0, 1fr);
   background: var(--surface);
   color: var(--text);
   font-variant-numeric: tabular-nums;
@@ -247,3 +247,14 @@
     transition: none !important;
   }
 }
+
+/*
+ * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
+ * place. The bar is fixed rather than sticky because it has to sit above ten different shells
+ * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ */
+@media (max-width: 40rem) {
+  .screen {
+    padding-top: 3.5rem;
+  }
+}
diff --git a/src/components/ward-management/search/search.module.css b/src/components/ward-management/search/search.module.css
index b6788235a5..fefb233cb8 100644
--- a/src/components/ward-management/search/search.module.css
+++ b/src/components/ward-management/search/search.module.css
@@ -17,9 +17,7 @@
   --ps-leading-body: 1.4;
   display: grid;
   min-height: 100dvh;
-  /* The rail track stays reserved at every supported width, same as every other Ward Flow
-     screen — see ward-management.module.css's own note on this. */
-  grid-template-columns: 4.5rem minmax(0, 1fr);
+  grid-template-columns: auto minmax(0, 1fr);
   background: var(--surface);
   color: var(--text);
   font-variant-numeric: tabular-nums;
@@ -211,3 +209,14 @@
 .table {
   min-width: 44rem;
 }
+
+/*
+ * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
+ * place. The bar is fixed rather than sticky because it has to sit above ten different shells
+ * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ */
+@media (max-width: 40rem) {
+  .screen {
+    padding-top: 3.5rem;
+  }
+}
diff --git a/src/components/ward-management/tracker/live-tracker.module.css b/src/components/ward-management/tracker/live-tracker.module.css
index 937715ebf0..1eb67364c5 100644
--- a/src/components/ward-management/tracker/live-tracker.module.css
+++ b/src/components/ward-management/tracker/live-tracker.module.css
@@ -17,9 +17,7 @@
   --tr-leading-prose: 1.5;
   display: grid;
   min-height: 100dvh;
-  /* The rail track stays reserved at every supported width, same as every other Ward Flow
-     screen — see ward-management.module.css's own note on this. */
-  grid-template-columns: 4.5rem minmax(0, 1fr);
+  grid-template-columns: auto minmax(0, 1fr);
   background: var(--surface);
   color: var(--text);
   font-variant-numeric: tabular-nums;
@@ -206,3 +204,14 @@
     transition: none !important;
   }
 }
+
+/*
+ * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
+ * place. The bar is fixed rather than sticky because it has to sit above ten different shells
+ * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ */
+@media (max-width: 40rem) {
+  .screen {
+    padding-top: 3.5rem;
+  }
+}
diff --git a/src/components/ward-management/use-ward-sidebar-collapsed.ts b/src/components/ward-management/use-ward-sidebar-collapsed.ts
new file mode 100644
index 0000000000..36d8432e48
--- /dev/null
+++ b/src/components/ward-management/use-ward-sidebar-collapsed.ts
@@ -0,0 +1,70 @@
+"use client";
+
+import { useCallback } from "react";
+import { createBrowserStore } from "@/lib/client-store-factory";
+
+/**
+ * Ward Flow's desktop sidebar collapse preference. Deliberately mirrors the structure of
+ * `src/components/clinical-dashboard/use-sidebar-collapsed.ts` — external store over
+ * `localStorage`, collapsed by default, in-memory fallback when a storage write fails — because
+ * that is the repository's established pattern and Ward Flow should behave the way the rest of
+ * the application behaves.
+ *
+ * It does **not** reuse the clinical hook or its storage key. Ward Flow is a sandbox that
+ * interacts with the application only through the developer hub; sharing a persisted preference
+ * would be a second channel between them, and expanding the prototype's sidebar would silently
+ * expand the clinical application's.
+ */
+export const WARD_SIDEBAR_COLLAPSED_STORAGE_KEY = "ward-flow-sidebar-collapsed";
+
+const changeEvent = "ward-flow-sidebar-collapsed-change";
+
+/**
+ * Maps a raw stored value to the collapsed preference. An absent key resolves to collapsed, so a
+ * first visit gets the icon rail the prototype has always had rather than a panel it never
+ * asked for. Once a value is present, collapsed is true only for the explicit `"1"` pin.
+ */
+export function readWardSidebarCollapsedPreference(storedValue: string | null | undefined): boolean {
+  return storedValue === null || storedValue === undefined ? true : storedValue === "1";
+}
+
+// Null means no fallback is needed and storage is the source of truth.
+let inMemoryFallback: boolean | null = null;
+
+function getSnapshot() {
+  if (inMemoryFallback !== null) {
+    return inMemoryFallback;
+  }
+  try {
+    return readWardSidebarCollapsedPreference(window.localStorage.getItem(WARD_SIDEBAR_COLLAPSED_STORAGE_KEY));
+  } catch {
+    return true;
+  }
+}
+
+function subscribe(onChange: () => void) {
+  window.addEventListener("storage", onChange);
+  window.addEventListener(changeEvent, onChange);
+  return () => {
+    window.removeEventListener("storage", onChange);
+    window.removeEventListener(changeEvent, onChange);
+  };
+}
+
+const useWardSidebarCollapsedStore = createBrowserStore(subscribe, getSnapshot, true);
+
+export function useWardSidebarCollapsed() {
+  const collapsed = useWardSidebarCollapsedStore();
+  const setCollapsed = useCallback((next: boolean) => {
+    try {
+      window.localStorage.setItem(WARD_SIDEBAR_COLLAPSED_STORAGE_KEY, next ? "1" : "0");
+      inMemoryFallback = null;
+    } catch {
+      // Private browsing or quota exhaustion: remember the toggle in memory so the UI still
+      // reflects what the user just did, even though it will not survive a reload.
+      inMemoryFallback = next;
+    }
+    window.dispatchEvent(new Event(changeEvent));
+  }, []);
+  return [collapsed, setCollapsed] as const;
+}
diff --git a/src/components/ward-management/ward-management-modes.module.css b/src/components/ward-management/ward-management-modes.module.css
index 18b60b5c61..938a8a3797 100644
--- a/src/components/ward-management/ward-management-modes.module.css
+++ b/src/components/ward-management/ward-management-modes.module.css
@@ -38,7 +38,7 @@
   display: grid;
   height: 100dvh;
   min-height: 44rem;
-  grid-template-columns: 4.5rem minmax(0, 1fr);
+  grid-template-columns: auto minmax(0, 1fr);
   /* Task 9 Ruling 4: the nav row this used to reserve for the horizontal `WardModeNavigation`
      strip is gone — those eight links now live inside `ClinicalRail` (grid-column 1), so
      `.modeContent` is the second and last row. */
@@ -831,10 +831,6 @@
 }
 
 @media (max-width: 62rem) {
-  .modeShell {
-    grid-template-columns: 4rem minmax(0, 1fr);
-  }
-
   .modeHeader,
   .modeContent {
     display: block;
@@ -879,9 +875,15 @@
  * get the phone-specific sticky/compact treatment below.
  */
 @media (max-width: 40rem) {
+  /* Reserve the fixed phone bar (ward-sidebar.module.css) and push this shell's own sticky
+     header down below it, rather than letting the bar cover it. */
+  .modeShell {
+    padding-top: 3.5rem;
+  }
+
   .modeHeader {
     position: sticky;
-    top: 0;
+    top: 3.5rem;
     z-index: var(--ward-z-phone);
     display: grid;
     min-height: 4.25rem;
diff --git a/src/components/ward-management/ward-management-navigation.tsx b/src/components/ward-management/ward-management-navigation.tsx
index 1a14e78821..e73dcca58a 100644
--- a/src/components/ward-management/ward-management-navigation.tsx
+++ b/src/components/ward-management/ward-management-navigation.tsx
@@ -1,56 +1,22 @@
 "use client";
 
 import Link from "next/link";
-import {
-  Activity,
-  Ambulance,
-  BedSingle,
-  Building2,
-  CircleAlert,
-  ClipboardList,
-  LayoutDashboard,
-  LayoutGrid,
-  ListFilter,
-  Route,
-  Search,
-  ShieldCheck,
-  Siren,
-  TriangleAlert,
-  Truck,
-  Waypoints,
-  type LucideIcon,
-} from "lucide-react";
+import { useState } from "react";
+import { LayoutGrid, Menu, PanelLeftOpen } from "lucide-react";
 
 import { BrandMark } from "@/components/clinical-dashboard/brand";
+import { Sheet } from "@/components/ui/sheet";
 
 import shellStyles from "./ward-management.module.css";
-import modeStyles from "./ward-management-modes.module.css";
+import sidebarStyles from "./ward-sidebar.module.css";
 import { WardDemoControls } from "./ward-demo-controls";
 import { WardRoleSwitcher } from "./ward-role-switcher";
-import { WARD_NAV, type WardNavItem } from "./ward-nav";
+import { WardSidebarContent } from "./ward-sidebar-content";
+import { WARD_NAV_ICONS, WARD_VIEW_ICONS } from "./ward-nav-icons";
+import { WARD_DEVELOPER_HUB_HREF, WARD_NAV, WARD_VIEWS, type WardMode, type WardNavItem } from "./ward-nav";
+import { useWardSidebarCollapsed } from "./use-ward-sidebar-collapsed";
 
-/** Icon per `WARD_NAV` item id — kept out of `ward-nav.ts` so that single source of truth stays
- *  plain data, checkable by `tests/ward-nav.test.ts` without a JSX/React dependency. */
-const WARD_NAV_ICONS: Record<string, LucideIcon> = {
-  ward: Building2,
-  officer: Ambulance,
-  ed: Siren,
-  handover: ClipboardList,
-  escalation: TriangleAlert,
-  search: Search,
-};
-
-function WardNavLink({ item }: { item: WardNavItem }) {
-  const Icon = WARD_NAV_ICONS[item.id];
-  return (
-    <RailLink href={item.href} label={item.label}>
-      <Icon aria-hidden="true" />
-    </RailLink>
-  );
-}
-
-export type WardMode =
-  "command" | "network" | "queue" | "capacity" | "movements" | "exceptions" | "transport" | "governance";
+export type { WardMode } from "./ward-nav";
 
 function RailLink({
   href,
@@ -76,126 +42,179 @@ function RailLink({
   );
 }
 
+function WardNavLink({ item }: { item: WardNavItem }) {
+  const Icon = WARD_NAV_ICONS[item.id];
+  return (
+    <RailLink href={item.href} label={item.label}>
+      <Icon aria-hidden="true" />
+    </RailLink>
+  );
+}
+
 /**
- * Task 9 (controller Ruling 4): the owner's own instruction — "you are your own application
- * inside of it... you are able to use the side bar to place all of your headings" — moved the
- * eight Ward Flow mode links out of the horizontal `WardModeNavigation` strip that used to sit
- * below the header on every route, and into this rail. `ClinicalRail` is defined in this file
- * (not the global app shell), so it is Ward Flow's own to extend rather than a shared surface
- * this task would be overreaching to touch.
+ * Ward Flow's sidebar, in the three shapes the rest of this repository already uses (see
+ * `src/components/clinical-dashboard/ClinicalSidebar.tsx`):
  *
- * Task 7 (D8) ruling: `WardModeNavigation` now always renders, whether or not the caller passes
- * `activeMode`. It used to render only when `activeMode` was set, which every one-off detail
- * screen and board that had no natural eight-mode equivalent — the role detail screens
- * (`ed/[edId]`, `ward/[unitId]`, the officer screen) and three boards (`handover`, `escalation`,
- * `search`) plus the patient workspace — simply never passed, so those routes silently lost the
- * in-page navigation other boards kept. Nine of fifteen routes behaving one way and six (later,
- * after this file's own Task 9 rewrite, seven) behaving another is a defect a user feels: the
- * rail alone never says which board they are on. `tests/ward-nav.test.ts`'s "Every Ward Flow
- * route carries the 'Ward Flow views' in-page nav (D8)" suite enforces this for every route,
- * rendered straight from the filesystem enumeration — never a hand-written list. `activeMode`
- * stays optional: routes with no natural eight-mode equivalent still render the nav with no link
- * marked current, rather than forcing an arbitrary "active" choice.
+ * - **Phone (below 40rem):** no rail at all. A fixed header bar carries the brand and a menu
+ *   button that opens a left drawer holding the full labelled navigation, which closes on
+ *   navigate. Before this, the 4.5rem desktop icon column rendered unchanged on a 390px phone —
+ *   18% of the viewport — because `ward-management.module.css` contained no width media query
+ *   that touched the rail at all. The bar is the sidebar's own, not a host's: nine of the ten
+ *   Ward Flow shells are a bare rail-plus-main grid with no header row for a trigger to live in.
+ * - **Tablet (40rem to 64rem):** the icon rail, with a plain brand link and no expand control,
+ *   because the expanded panel does not exist at this width — exactly how `ClinicalCollapsedRail`
+ *   behaves between md and lg.
+ * - **Desktop (64rem and up):** the icon rail or a 17rem labelled panel, chosen by the user and
+ *   remembered per browser by `useWardSidebarCollapsed`. Hovering the brand mark reveals the
+ *   expand control, as it does in the clinical sidebar.
+ *
+ * Every destination in all three shapes is read from `ward-nav.ts`. The eight views used to be
+ * eight hand-written link blocks in `WardModeNavigation` below; a labelled panel cannot read
+ * those, and copying them would have re-created the two-lists-drifting defect (D8/D9) that file
+ * exists to prevent.
+ *
+ * All ten host screens still mount exactly one `<ClinicalRail />` and are unchanged apart from
+ * their grid track, which is now `auto` so this component's own width decides the column.
  */
 export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
+  const [collapsed, setCollapsed] = useWardSidebarCollapsed();
+  const [menuOpen, setMenuOpen] = useState(false);
+
   return (
-    <aside className={shellStyles.clinicalRail} aria-label="Ward Flow">
-      {/* The NINTH link out of the sandbox, and the most prominent one: the logo pointed at `/`,
-          the clinical application's home. I removed eight others by reading the source and did not
-          see this one, because a logo linking home looks entirely normal in source. It showed up
-          the moment a screenshot was looked at. It now points at Ward Flow's own home, which is
-          what a standalone application's logo does. */}
+    <>
+      <div className={sidebarStyles.phoneBar}>
+        <Link href="/mockups/ward-flow" className={sidebarStyles.phoneBrand}>
+          <BrandMark className={sidebarStyles.brandGlyph} />
+          <span className={sidebarStyles.phoneBrandName}>Ward Flow</span>
+        </Link>
+        <button
+          type="button"
+          onClick={() => setMenuOpen(true)}
+          className={sidebarStyles.menuButton}
+          aria-label="Open Ward Flow menu"
+          aria-expanded={menuOpen}
+        >
+          <Menu aria-hidden="true" />
+        </button>
+      </div>
+
+      <WardIconRail activeMode={activeMode} hiddenOnDesktop={!collapsed} onExpand={() => setCollapsed(false)} />
+
+      {!collapsed ? (
+        <aside className={sidebarStyles.panel} aria-label="Ward Flow sidebar">
+          <div className={sidebarStyles.panelScroll}>
+            <WardSidebarContent activeMode={activeMode} onCollapse={() => setCollapsed(true)} />
+          </div>
+        </aside>
+      ) : null}
+
+      <Sheet
+        open={menuOpen}
+        onClose={() => setMenuOpen(false)}
+        title="Ward Flow"
+        description="Synthetic patient-flow prototype."
+        closeLabel="Close Ward Flow menu"
+        placement="left"
+        contentClassName={sidebarStyles.drawerHidden}
+        headerLeading={<BrandMark className={sidebarStyles.brandGlyph} />}
+      >
+        <div className={sidebarStyles.drawerBody}>
+          <WardSidebarContent activeMode={activeMode} showBrandRow={false} onNavigate={() => setMenuOpen(false)} />
+        </div>
+      </Sheet>
+    </>
+  );
+}
+
+/**
+ * The icon rail. Hidden below 40rem (the phone bar and drawer take over) and, when the user has
+ * expanded the panel, from 64rem up.
+ */
+function WardIconRail({
+  activeMode,
+  hiddenOnDesktop,
+  onExpand,
+}: {
+  activeMode?: WardMode;
+  hiddenOnDesktop: boolean;
+  onExpand: () => void;
+}) {
+  return (
+    <aside
+      className={`${shellStyles.clinicalRail}${hiddenOnDesktop ? ` ${shellStyles.railHiddenOnDesktop}` : ""}`}
+      aria-label="Ward Flow"
+    >
+      {/* The brand mark. Below 64rem it is a plain link to Ward Flow's own home; from 64rem the
+          expand control takes its place, revealing PanelLeftOpen on hover the way the clinical
+          sidebar's does. Either way it points at Ward Flow's home and never at the site root: the
+          logo was the ninth and most prominent exit out of the sandbox, and it took looking at a
+          screenshot rather than any amount of source reading to notice. */}
       <Link href="/mockups/ward-flow" className={shellStyles.railBrand} aria-label="Ward Flow home">
         <BrandMark className={shellStyles.brandGlyph} />
       </Link>
-      <div className={shellStyles.railRule} aria-hidden="true" />
-      {/* A sandbox has exactly one way out, and it is the developer page it was opened from.
-          This nav used to be Ward Flow's own copy of the clinical application's app switcher —
-          Clinical Answers, Documents, Services, Medication, Tools, All applications — six links
-          routing straight back into the application Ward Flow is meant to stand apart from. The
-          product owner's instruction is that each prototype is "its own sandbox only interacting
-          via the developer page, otherwise standalone app", so they are gone.
-
-          Removing them also fixes a real, browser-only defect. The rail is a fixed-height flex
-          column, and those six links pushed its content past a 1024px viewport, so `.railBottom`
-          overlapped the last nav links and swallowed their clicks. Every link stayed in the DOM
-          and stayed keyboard-reachable, so all ~10,000 unit tests passed while
-          `ui-ward-management.spec.ts`'s "opens every Ward Flow mode" timed out clicking one.
-          Established by elimination that it was neither the grouped rail (the pre-grouping rail
-          fails identically) nor the mockup shell (bypassing it changes nothing). */}
-      <nav className={shellStyles.railNav} aria-label="Ward Flow">
-        <RailLink href="/mockups/ward-flow" label="Ward Flow" active>
-          <Activity aria-hidden="true" />
-        </RailLink>
-        <RailLink href="/mockups/development" label="Back to the developer hub">
-          <LayoutGrid aria-hidden="true" />
-        </RailLink>
-      </nav>
+      <button
+        type="button"
+        onClick={onExpand}
+        className={shellStyles.railExpand}
+        aria-label="Expand sidebar"
+        title="Expand sidebar"
+      >
+        <BrandMark className={shellStyles.railExpandBrand} />
+        <PanelLeftOpen aria-hidden="true" className={shellStyles.railExpandIcon} />
+      </button>
       <div className={shellStyles.railRule} aria-hidden="true" />
       <WardModeNavigation active={activeMode} />
-      <div className={shellStyles.railBottom}>
-        {/* Task 12: the role switcher — the one control the proof journey (spec §14) uses to
-            move between all four roles without ever reloading the page. Placed first among the
-            Ward-Flow-specific shortcuts below since, unlike the three static ones after it, its
-            destination is dynamic (inferred from whichever patient the coordinator last
-            selected — see `ward-role-switcher.tsx`'s own doc comment). */}
-        <WardRoleSwitcher />
-        <div className={shellStyles.railRule} aria-hidden="true" />
-        {/*
-         * Task 4 (D9/D10): every link from here down through the "Patient search" equivalent used
-         * to be an individually hand-pasted block — 329 lines of them, accreted one per task, with
-         * nothing checking the rail and the real route tree against each other. That is *why* three
-         * boards (`/handover`, `/escalation`, `/search`) could ship with no rail entry and stay
-         * that way unnoticed (D8). They now render from `WARD_NAV`
-         * (`ward-nav.ts`), the single source `tests/ward-nav.test.ts` checks both ways: every href
-         * here resolves to a real route, and every static Ward Flow route appears either here or
-         * in `WARD_NAV_INTENTIONALLY_UNLISTED` with a stated reason.
-         *
-         * The old per-link comments about `RailLink` vs a raw `<Link>` (to stay visible to
-         * `tests/route-reachability.test.ts`'s literal-href AST scan) no longer apply: that test's
-         * `staticPageRoutes` excludes every `/mockups/**` route outright (Ward Flow's sandbox move
-         * — see that test's header comment), so nothing under `/mockups/ward-flow/**` needs a
-         * literal string href for that scanner to find it any more. Re-run `route-reachability` on
-         * any future change here to confirm that is still true rather than assuming it.
-         *
-         * "Ward Flow role screens" holds the one non-arbitrary role entry point (Officer); the
-         * nested group holds the two that name one arbitrary synthetic instance rather than a
-         * section of the app (D10) and says so in its own aria-label. Coordinator is deliberately
-         * absent from both — see `WARD_NAV_INTENTIONALLY_UNLISTED`'s entry for `/mockups/ward-flow`.
-         */}
-        <div className={shellStyles.railGroup} role="group" aria-label="Ward Flow role screens">
-          {WARD_NAV.filter((item) => item.group === "role" && !item.exampleOnly).map((item) => (
+      <div className={shellStyles.railRule} aria-hidden="true" />
+      {/*
+       * "Ward Flow role screens" holds the one non-arbitrary role entry point (Officer); the
+       * nested group holds the two that name one arbitrary synthetic instance rather than a
+       * section of the app (D10) and says so in its own aria-label. Coordinator is deliberately
+       * absent from both — it is the "Command" view one group up.
+       */}
+      <div className={shellStyles.railGroup} role="group" aria-label="Ward Flow role screens">
+        {WARD_NAV.filter((item) => item.group === "role" && !item.exampleOnly).map((item) => (
+          <WardNavLink key={item.id} item={item} />
+        ))}
+        <div
+          className={shellStyles.railGroup}
+          role="group"
+          aria-label="Example ward and emergency department — one arbitrary synthetic instance each, not a section of the app"
+        >
+          {WARD_NAV.filter((item) => item.group === "role" && item.exampleOnly).map((item) => (
             <WardNavLink key={item.id} item={item} />
           ))}
-          <div
-            className={shellStyles.railGroup}
-            role="group"
-            aria-label="Example ward and emergency department — one arbitrary synthetic instance each, not a section of the app"
-          >
-            {WARD_NAV.filter((item) => item.group === "role" && item.exampleOnly).map((item) => (
-              <WardNavLink key={item.id} item={item} />
-            ))}
-          </div>
         </div>
+      </div>
+      <div className={shellStyles.railRule} aria-hidden="true" />
+      <div className={shellStyles.railGroup} role="group" aria-label="Ward Flow specialist boards">
+        {WARD_NAV.filter((item) => item.group === "board").map((item) => (
+          <WardNavLink key={item.id} item={item} />
+        ))}
+      </div>
+      <div className={shellStyles.railBottom}>
+        {/* The role switcher is the one control the proof journey (spec section 14) uses to move
+            between all four roles without ever reloading the page, and unlike the static links
+            above its destination is dynamic. */}
+        <WardRoleSwitcher />
         <div className={shellStyles.railRule} aria-hidden="true" />
-        <div className={shellStyles.railGroup} role="group" aria-label="Ward Flow specialist boards">
-          {WARD_NAV.filter((item) => item.group === "board").map((item) => (
-            <WardNavLink key={item.id} item={item} />
-          ))}
-        </div>
-        {/* Favourites (`/?mode=answer`) and Settings (`/tools`) were removed with the app switcher
-            above, and for the same reason: both routed out of the sandbox and into the clinical
-            application. Neither had any Ward Flow meaning — Favourites pointed at the answer mode's
-            home and Settings at the tools catalogue, which no longer even lists Ward Flow. */}
+        {/* A sandbox has exactly one way out, and it is the developer page it was opened from.
+            This used to be Ward Flow's own copy of the clinical application's app switcher —
+            Clinical Answers, Documents, Services, Medication, Tools, All applications — six links
+            routing straight back into the application Ward Flow is meant to stand apart from.
+
+            Removing them also fixed a real, browser-only defect: the rail is a fixed-height flex
+            column, and those six links pushed its content past a 1024px viewport, so
+            `.railBottom` overlapped the last nav links and swallowed their clicks. Every link
+            stayed in the DOM and stayed keyboard-reachable, so the whole unit suite passed while
+            a Chromium journey timed out clicking one. */}
+        <RailLink href={WARD_DEVELOPER_HUB_HREF} label="Back to the developer hub">
+          <LayoutGrid aria-hidden="true" />
+        </RailLink>
         <div className={shellStyles.railRule} aria-hidden="true" />
-        {/* Whole-branch review I3: the demo jump-forward clock (spec §2 decision 5, §5) and
-            scenario reset, mounted once here so every `/mockups/ward-flow/*` route gets them
-            without per-screen wiring — the clock is shared provider state, not a per-screen
-            concern. Placed last, after a rule and visually separated from every real navigation
-            link above, and given its own warning-toned trigger (`ward-demo-controls.module.css`)
-            rather than the rail's usual link styling — this is deliberately NOT another
-            destination in the list, it never navigates anywhere, and it must never be mistaken
-            for one. See `ward-demo-controls.tsx`'s own doc comment for the full reasoning. */}
+        {/* The demo jump-forward clock and scenario reset, mounted once here so every Ward Flow
+            route gets them without per-screen wiring. Placed last, after a rule, with its own
+            warning-toned trigger: it is deliberately NOT another destination, it never navigates,
+            and it must never be mistaken for one. */}
         <WardDemoControls />
         <span className={shellStyles.avatar} aria-label="Guest workspace">
           G
@@ -206,94 +225,26 @@ export function ClinicalRail({ activeMode }: { activeMode?: WardMode } = {}) {
 }
 
 /**
- * The mode strip renders one literal `<Link href="...">` per view (never built from an array)
- * so `tests/route-reachability.test.ts` can find every href by static AST scan, and
- * `tests/ward-management.test.ts`'s `wardModeHrefs()` can read them back by scanning this
- * function's own source text — see that test's comment. Rendered icon-only inside `ClinicalRail`
- * now (Task 9 Ruling 4); each link still carries its own accessible name via `aria-label` since
- * its only visible content is an icon.
+ * The eight views as an icon-only strip inside the rail. Rendered from `WARD_VIEWS` rather than
+ * eight literal link blocks: the labelled panel and drawer need the same eight destinations, and
+ * a second hand-maintained copy of them is exactly the defect `ward-nav.ts` was created to end.
  *
- * `active` is optional (Task 7, D8): `ClinicalRail` now renders this nav unconditionally, and a
- * route with no natural eight-mode equivalent (a role detail screen, a board, the patient
- * workspace) passes no `activeMode` through — every `aria-current` comparison below is simply
- * false for all eight links in that case, which is correct: the nav still orients the user
- * without falsely claiming one of the eight views is the current page.
+ * `active` is optional: a route with no natural eight-view equivalent (a role detail screen, a
+ * board, the patient workspace) passes nothing, and every `aria-current` comparison is simply
+ * false. The nav still orients the user without falsely claiming one of the eight is current.
  */
 export function WardModeNavigation({ active }: { active?: WardMode }) {
   return (
-    <nav className={modeStyles.modeNavigation} aria-label="Ward Flow views">
-      <Link
-        href="/mockups/ward-flow"
-        aria-label="Command"
-        title="Command"
-        aria-current={active === "command" ? "page" : undefined}
-        className={active === "command" ? shellStyles.railLinkActive : shellStyles.railLink}
-      >
-        <LayoutDashboard aria-hidden="true" />
-      </Link>
-      <Link
-        href="/mockups/ward-flow/network"
-        aria-label="Network"
-        title="Network"
-        aria-current={active === "network" ? "page" : undefined}
-        className={active === "network" ? shellStyles.railLinkActive : shellStyles.railLink}
-      >
-        <Waypoints aria-hidden="true" />
-      </Link>
-      <Link
-        href="/mockups/ward-flow/queue"
-        aria-label="Priority queue"
-        title="Priority queue"
-        aria-current={active === "queue" ? "page" : undefined}
-        className={active === "queue" ? shellStyles.railLinkActive : shellStyles.railLink}
-      >
-        <ListFilter aria-hidden="true" />
-      </Link>
-      <Link
-        href="/mockups/ward-flow/capacity"
-        aria-label="Capacity"
-        title="Capacity"
-        aria-current={active === "capacity" ? "page" : undefined}
-        className={active === "capacity" ? shellStyles.railLinkActive : shellStyles.railLink}
-      >
-        <BedSingle aria-hidden="true" />
-      </Link>
-      <Link
-        href="/mockups/ward-flow/movements"
-        aria-label="Movements"
-        title="Movements"
-        aria-current={active === "movements" ? "page" : undefined}
-        className={active === "movements" ? shellStyles.railLinkActive : shellStyles.railLink}
-      >
-        <Route aria-hidden="true" />
-      </Link>
-      <Link
-        href="/mockups/ward-flow/exceptions"
-        aria-label="Exceptions"
-        title="Exceptions"
-        aria-current={active === "exceptions" ? "page" : undefined}
-        className={active === "exceptions" ? shellStyles.railLinkActive : shellStyles.railLink}
-      >
-        <CircleAlert aria-hidden="true" />
-      </Link>
-      <Link
-        href="/mockups/ward-flow/transport"
-        aria-label="Transport"
-        title="Transport"
-        aria-current={active === "transport" ? "page" : undefined}
-        className={active === "transport" ? shellStyles.railLinkActive : shellStyles.railLink}
-      >
-        <Truck aria-hidden="true" />
-      </Link>
-      <Link
-        href="/mockups/ward-flow/governance"
-        aria-label="Governance"
-        title="Governance"
-        aria-current={active === "governance" ? "page" : undefined}
-        className={active === "governance" ? shellStyles.railLinkActive : shellStyles.railLink}
-      >
-        <ShieldCheck aria-hidden="true" />
-      </Link>
+    <nav className={shellStyles.railNav} aria-label="Ward Flow views">
+      {WARD_VIEWS.map((view) => {
+        const Icon = WARD_VIEW_ICONS[view.id];
+        const isActive = active === view.id;
+        return (
+          <RailLink key={view.id} href={view.href} label={view.label} active={isActive}>
+            <Icon aria-hidden="true" />
+          </RailLink>
+        );
+      })}
     </nav>
   );
 }
diff --git a/src/components/ward-management/ward-management.module.css b/src/components/ward-management/ward-management.module.css
index 9385aa249d..180cc0de40 100644
--- a/src/components/ward-management/ward-management.module.css
+++ b/src/components/ward-management/ward-management.module.css
@@ -82,6 +82,11 @@
   z-index: var(--ward-z-sticky);
   display: flex;
   min-height: 0;
+  /* The rail's own width is now what decides the shell's first grid track: every Ward Flow shell
+     declares that track `auto`, so the sidebar has one width in one place across its three
+     shapes (icon rail here, 17rem panel in ward-sidebar.module.css, nothing at all on a phone)
+     instead of a `4.5rem` literal repeated in ten stylesheets. */
+  width: 4.5rem;
   flex-direction: column;
   align-items: center;
   border-right: 0.0625rem solid var(--ward-border);
@@ -89,6 +94,35 @@
   padding: var(--ward-space-10) var(--ward-space-8) var(--ward-space-12);
 }
 
+/*
+ * Below 40rem the rail does not exist: `ward-sidebar.module.css`'s fixed phone bar and its
+ * drawer take over, the same way the clinical application drops to `ClinicalMobileSidebar`
+ * below md. Until this rule the 4.5rem desktop icon column rendered unchanged on a 390px
+ * phone — 18% of the viewport — because this file's four media queries were
+ * `prefers-reduced-motion`, `forced-colors`, and two width rules that named `.workspaceGrid`
+ * and `.patientWorkspace`. Not one of them touched the rail.
+ */
+@media (max-width: 40rem) {
+  .clinicalRail {
+    display: none;
+  }
+}
+
+/*
+ * Applied alongside `.clinicalRail` when the user has expanded the labelled panel. The panel
+ * only exists from 64rem, so the rail must stay put below that width — mirroring
+ * `ClinicalCollapsedRail`'s `lg:hidden`, which is the same trade for the same reason.
+ */
+.railHiddenOnDesktop {
+  grid-column: 1;
+}
+
+@media (min-width: 64rem) {
+  .railHiddenOnDesktop {
+    display: none;
+  }
+}
+
 .railBrand {
   display: grid;
   flex-shrink: 0;
@@ -98,6 +132,64 @@
   border-radius: var(--radius-lg);
 }
 
+/*
+ * From 64rem the brand mark becomes the expand control and the plain home link steps aside,
+ * exactly as the clinical sidebar does: hovering or focusing the mark swaps it for
+ * `PanelLeftOpen`. Below 64rem there is nothing to expand into, so the link stays a link and
+ * this button is not rendered at all — a dead control is worse than no control.
+ */
+@media (min-width: 64rem) {
+  .railBrand {
+    display: none;
+  }
+}
+
+.railExpand {
+  display: none;
+  flex-shrink: 0;
+  width: 3rem;
+  height: 3rem;
+  place-items: center;
+  border: 0.0625rem solid transparent;
+  border-radius: var(--radius-lg);
+  background: none;
+  color: var(--ward-muted);
+  cursor: pointer;
+}
+
+@media (min-width: 64rem) {
+  .railExpand {
+    display: grid;
+  }
+}
+
+.railExpand:hover {
+  border-color: var(--ward-border);
+  background: var(--ward-canvas);
+  color: var(--ward-heading);
+}
+
+.railExpandBrand {
+  width: 2.5rem;
+  height: 2.5rem;
+}
+
+.railExpandIcon {
+  display: none;
+  width: 1.25rem;
+  height: 1.25rem;
+}
+
+.railExpand:hover .railExpandBrand,
+.railExpand:focus-visible .railExpandBrand {
+  display: none;
+}
+
+.railExpand:hover .railExpandIcon,
+.railExpand:focus-visible .railExpandIcon {
+  display: block;
+}
+
 .brandGlyph {
   width: 2.5rem;
   height: 2.5rem;
@@ -356,7 +448,7 @@
 .patientWorkspace {
   display: grid;
   min-height: 100dvh;
-  grid-template-columns: 4.5rem minmax(0, 1fr);
+  grid-template-columns: auto minmax(0, 1fr);
   grid-template-rows: 4.5rem minmax(0, 1fr);
   background: var(--background);
 }
@@ -686,6 +778,8 @@
     min-height: 100dvh;
     height: auto;
     overflow: visible;
+    /* Reserve the fixed phone bar (ward-sidebar.module.css). */
+    padding-top: 3.5rem;
   }
 
   /*
@@ -703,7 +797,7 @@
 
   .workspaceHeader {
     position: sticky;
-    top: 0;
+    top: 3.5rem;
     z-index: var(--ward-z-phone);
     min-height: 4rem;
     border-bottom: 0.0625rem solid var(--ward-border);
diff --git a/src/components/ward-management/ward-nav-icons.ts b/src/components/ward-management/ward-nav-icons.ts
new file mode 100644
index 0000000000..31b980ac75
--- /dev/null
+++ b/src/components/ward-management/ward-nav-icons.ts
@@ -0,0 +1,47 @@
+import {
+  Ambulance,
+  BedSingle,
+  Building2,
+  CircleAlert,
+  ClipboardList,
+  LayoutDashboard,
+  ListFilter,
+  Route,
+  Search,
+  ShieldCheck,
+  Siren,
+  TriangleAlert,
+  Truck,
+  Waypoints,
+  type LucideIcon,
+} from "lucide-react";
+
+import type { WardMode } from "./ward-nav";
+
+/**
+ * One icon per destination, keyed by the ids in `ward-nav.ts`. Kept out of `ward-nav.ts` so that
+ * single source of truth stays plain data with no React dependency, which is what lets
+ * `tests/ward-nav.test.ts` and `tests/ward-management.test.ts` read it in a plain Node context.
+ *
+ * Both the icon rail and the labelled panel/drawer read these, so an icon is chosen once rather
+ * than per surface — the rail's icon and the panel's icon can never drift apart.
+ */
+export const WARD_VIEW_ICONS: Record<WardMode, LucideIcon> = {
+  command: LayoutDashboard,
+  network: Waypoints,
+  queue: ListFilter,
+  capacity: BedSingle,
+  movements: Route,
+  exceptions: CircleAlert,
+  transport: Truck,
+  governance: ShieldCheck,
+};
+
+export const WARD_NAV_ICONS: Record<string, LucideIcon> = {
+  ward: Building2,
+  officer: Ambulance,
+  ed: Siren,
+  handover: ClipboardList,
+  escalation: TriangleAlert,
+  search: Search,
+};
diff --git a/src/components/ward-management/ward-nav.ts b/src/components/ward-management/ward-nav.ts
index 51f1899763..fd81aed093 100644
--- a/src/components/ward-management/ward-nav.ts
+++ b/src/components/ward-management/ward-nav.ts
@@ -1,7 +1,9 @@
 /**
- * The single source for Ward Flow's own rail navigation — see `ward-management-navigation.tsx`'s
- * `ClinicalRail`. Before this file, the rail's Ward-Flow-specific destinations (everything beyond
- * the eight views `WardModeNavigation` already sources statically) were 329 lines of individually
+ * The single source for every Ward Flow destination — rendered three ways by
+ * `ward-management-navigation.tsx` (icon rail, expanded panel, phone drawer) and checked both
+ * ways by `tests/ward-nav.test.ts`.
+ *
+ * Before this file, the rail's Ward-Flow-specific destinations were 329 lines of individually
  * hand-pasted link blocks, one appended per task over two phases. Nothing enumerated the two
  * sides — nav links and real routes — against each other, which is *why* three boards
  * (`/handover`, `/escalation`, `/search`) could ship with no rail entry and nothing noticed
@@ -14,6 +16,48 @@
  * D8 happen — it says nothing about a route with no link pointing at it at all.
  */
 
+/** The eight coordinator-level views. Ordered as the rail and the panel present them. */
+export type WardMode =
+  | "command"
+  | "network"
+  | "queue"
+  | "capacity"
+  | "movements"
+  | "exceptions"
+  | "transport"
+  | "governance";
+
+export type WardViewItem = {
+  id: WardMode;
+  href: string;
+  label: string;
+};
+
+/**
+ * The eight views, moved here from eight hand-written `<Link>` blocks inside
+ * `WardModeNavigation`. Those blocks were literal so that a source-text regex in
+ * `tests/ward-management.test.ts` could read the hrefs back, and so that
+ * `tests/route-reachability.test.ts`'s literal-href AST scan could see them. Neither reason
+ * survives: that reachability test's `staticPageRoutes` excludes every `/mockups/**` route
+ * outright (Ward Flow's sandbox move), and the mode-href test now reads this array directly,
+ * which is a stronger check than a regex over a function body.
+ *
+ * The move is what makes a labelled sidebar possible at all. A panel and a drawer that render
+ * labelled links cannot read a rail's icon-only JSX, so leaving the views in JSX would have
+ * meant a second hand-maintained list of the same eight destinations — the precise defect this
+ * file was created to end.
+ */
+export const WARD_VIEWS: readonly WardViewItem[] = [
+  { id: "command", href: "/mockups/ward-flow", label: "Command" },
+  { id: "network", href: "/mockups/ward-flow/network", label: "Network" },
+  { id: "queue", href: "/mockups/ward-flow/queue", label: "Priority queue" },
+  { id: "capacity", href: "/mockups/ward-flow/capacity", label: "Capacity" },
+  { id: "movements", href: "/mockups/ward-flow/movements", label: "Movements" },
+  { id: "exceptions", href: "/mockups/ward-flow/exceptions", label: "Exceptions" },
+  { id: "transport", href: "/mockups/ward-flow/transport", label: "Transport" },
+  { id: "governance", href: "/mockups/ward-flow/governance", label: "Governance" },
+];
+
 export type WardNavGroup = "role" | "board";
 
 export type WardNavItem = {
@@ -28,16 +72,16 @@ export type WardNavItem = {
 /**
  * `role` — entry points for the role screens `WardRoleSwitcher` offers (Coordinator, Ward,
  * Officer, Emergency department — see that component's own doc comment). Coordinator is
- * deliberately absent here: it is `/mockups/ward-flow` itself, already reachable via
- * `WardModeNavigation`'s "Command" view and the app-switcher's own "Ward Flow" link one section
- * up in the same rail — see `WARD_NAV_INTENTIONALLY_UNLISTED` below, which is where that
- * reasoning is recorded and checked. Ward and Emergency department are dynamic detail routes
+ * deliberately absent here: it is `/mockups/ward-flow` itself, already present in `WARD_VIEWS`
+ * as "Command" — see `WARD_NAV_INTENTIONALLY_UNLISTED` below, which is where that reasoning is
+ * recorded and checked. Ward and Emergency department are dynamic detail routes
  * (`ward/[unitId]`, `ed/[edId]`); the rail can only ever link to one concrete instance of each,
- * so both carry `exampleOnly: true` (D10) — the rail must present them as an example entry point
- * into that role screen, never as though they were a section of the app in their own right.
- * **Do not delete either** — they are currently the only way to reach those two role screens.
+ * so both carry `exampleOnly: true` (D10) — the navigation must present them as an example entry
+ * point into that role screen, never as though they were a section of the app in their own
+ * right. **Do not delete either** — they are currently the only way to reach those two role
+ * screens.
  *
- * `board` — the specialist boards that sit outside `WardModeNavigation`'s eight-view strip.
+ * `board` — the specialist boards that sit outside the eight views.
  */
 export const WARD_NAV: readonly WardNavItem[] = [
   {
@@ -61,47 +105,20 @@ export const WARD_NAV: readonly WardNavItem[] = [
 ];
 
 /**
- * Static Ward Flow routes intentionally absent from `WARD_NAV`, each with the reason it is
- * exempt — mirrors `REACHABILITY_ALLOWLIST` in `tests/route-reachability.test.ts`. Every key must
- * be a real static route under `src/app/mockups/ward-flow/` (checked by `tests/ward-nav.test.ts`,
- * which fails on a stale entry) and must never also appear in `WARD_NAV` — a route belongs in
- * exactly one of the two.
+ * The one link out of the sandbox. A sandbox has exactly one exit and it is the developer page
+ * it was opened from — see `ward-management-navigation.tsx` for the eight that were removed and
+ * why.
+ */
+export const WARD_DEVELOPER_HUB_HREF = "/mockups/development";
+
+/**
+ * Static Ward Flow routes intentionally absent from `WARD_VIEWS` and `WARD_NAV`, each with the
+ * reason it is exempt — mirrors `REACHABILITY_ALLOWLIST` in `tests/route-reachability.test.ts`.
+ * Every key must be a real static route under `src/app/mockups/ward-flow/` (checked by
+ * `tests/ward-nav.test.ts`, which fails on a stale entry) and must never also appear in a nav
+ * array — a route belongs in exactly one of the two.
  */
 export const WARD_NAV_INTENTIONALLY_UNLISTED: ReadonlyMap<string, string> = new Map([
-  [
-    "/mockups/ward-flow",
-    "Coordinator's own entry point — already reachable via WardModeNavigation's \"Command\" view " +
-      'and the app-switcher\'s "Ward Flow" link; not duplicated in the role/board rail groups.',
-  ],
-  [
-    "/mockups/ward-flow/network",
-    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
-  ],
-  [
-    "/mockups/ward-flow/queue",
-    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
-  ],
-  [
-    "/mockups/ward-flow/capacity",
-    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
-  ],
-  [
-    "/mockups/ward-flow/movements",
-    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
-  ],
-  [
-    "/mockups/ward-flow/exceptions",
-    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
-  ],
-  [
-    "/mockups/ward-flow/transport",
-    "One of WardModeNavigation's eight views (the live tracker) — sourced, rendered and tested " +
-      "separately from this file. Distinct from /transport/officer, which is in WARD_NAV.",
-  ],
-  [
-    "/mockups/ward-flow/governance",
-    "One of WardModeNavigation's eight views — sourced, rendered and tested separately from this file.",
-  ],
   [
     "/mockups/ward-flow/constellation",
     "A deliberate 307 redirect to /network, documented in its own route file (constellation/page.tsx) — not a destination.",
diff --git a/src/components/ward-management/ward-sidebar-content.tsx b/src/components/ward-management/ward-sidebar-content.tsx
new file mode 100644
index 0000000000..44bb1ce0c3
--- /dev/null
+++ b/src/components/ward-management/ward-sidebar-content.tsx
@@ -0,0 +1,145 @@
+"use client";
+
+import Link from "next/link";
+import { LayoutGrid, PanelLeftClose } from "lucide-react";
+
+import { BrandMark } from "@/components/clinical-dashboard/brand";
+
+import { WardDemoControls } from "./ward-demo-controls";
+import { WardRoleSwitcher } from "./ward-role-switcher";
+import { WARD_NAV_ICONS, WARD_VIEW_ICONS } from "./ward-nav-icons";
+import {
+  WARD_DEVELOPER_HUB_HREF,
+  WARD_NAV,
+  WARD_VIEWS,
+  type WardMode,
+  type WardNavItem,
+} from "./ward-nav";
+
+import styles from "./ward-sidebar.module.css";
+
+/**
+ * Ward Flow's labelled sidebar body, mounted by both the expanded desktop panel and the phone
+ * drawer — the same one-content-two-hosts arrangement `ClinicalSidebarContent` uses for the
+ * clinical application's sidebar and mobile sheet. Writing the destinations once is the whole
+ * point: the icon rail, this panel and this drawer all read `ward-nav.ts`, so a destination
+ * added in one place appears in all three or in none.
+ */
+export function WardSidebarContent({
+  activeMode,
+  showBrandRow = true,
+  onCollapse,
+  onNavigate,
+}: {
+  activeMode?: WardMode;
+  /** The drawer's Sheet supplies its own header, so it turns this off. */
+  showBrandRow?: boolean;
+  /** Present only on the desktop panel; the drawer closes instead of collapsing. */
+  onCollapse?: () => void;
+  onNavigate?: () => void;
+}) {
+  return (
+    <>
+      {showBrandRow ? (
+        <div className={styles.brandRow}>
+          <Link href="/mockups/ward-flow" className={styles.brandLink} onClick={onNavigate}>
+            <BrandMark className={styles.brandGlyph} />
+            <span className={styles.brandText}>
+              <span className={styles.brandName}>Ward Flow</span>
+              <span className={styles.brandTagline}>Synthetic patient-flow prototype</span>
+            </span>
+          </Link>
+          {onCollapse ? (
+            <button
+              type="button"
+              onClick={onCollapse}
+              className={styles.collapseButton}
+              aria-label="Collapse sidebar"
+              title="Collapse sidebar"
+            >
+              <PanelLeftClose aria-hidden="true" />
+            </button>
+          ) : null}
+        </div>
+      ) : null}
+
+      <nav className={styles.group} aria-label="Ward Flow views">
+        <span className={styles.groupLabel}>Views</span>
+        {WARD_VIEWS.map((view) => {
+          const Icon = WARD_VIEW_ICONS[view.id];
+          const active = activeMode === view.id;
+          return (
+            <Link
+              key={view.id}
+              href={view.href}
+              onClick={onNavigate}
+              aria-current={active ? "page" : undefined}
+              className={active ? styles.linkActive : styles.link}
+            >
+              <Icon aria-hidden="true" />
+              <span className={styles.linkLabel}>{view.label}</span>
+            </Link>
+          );
+        })}
+      </nav>
+
+      <WardSidebarGroup
+        label="Role screens"
+        items={WARD_NAV.filter((item) => item.group === "role")}
+        onNavigate={onNavigate}
+      />
+
+      <WardSidebarGroup
+        label="Boards"
+        items={WARD_NAV.filter((item) => item.group === "board")}
+        onNavigate={onNavigate}
+      />
+
+      <div className={styles.footer}>
+        {/* The role switcher and the demo clock are mounted here exactly as the rail mounts them
+            — same components, same behaviour. The clock is not a destination and never navigates;
+            it sits below the rule with every real link above it, as it does in the rail. */}
+        <div className={styles.footerControls}>
+          <WardRoleSwitcher />
+          <WardDemoControls />
+          <span className={styles.guest} aria-label="Guest workspace">
+            G
+          </span>
+        </div>
+        {/* The single way out of the sandbox. */}
+        <Link href={WARD_DEVELOPER_HUB_HREF} className={styles.link} onClick={onNavigate}>
+          <LayoutGrid aria-hidden="true" />
+          <span className={styles.linkLabel}>Back to the developer hub</span>
+        </Link>
+      </div>
+    </>
+  );
+}
+
+function WardSidebarGroup({
+  label,
+  items,
+  onNavigate,
+}: {
+  label: string;
+  items: readonly WardNavItem[];
+  onNavigate?: () => void;
+}) {
+  return (
+    <nav className={styles.group} aria-label={`Ward Flow ${label.toLowerCase()}`}>
+      <span className={styles.groupLabel}>{label}</span>
+      {items.map((item) => {
+        const Icon = WARD_NAV_ICONS[item.id];
+        return (
+          <Link key={item.id} href={item.href} onClick={onNavigate} className={styles.link}>
+            <Icon aria-hidden="true" />
+            <span className={styles.linkLabel}>{item.label}</span>
+            {/* D10: this href names one arbitrary synthetic instance, not a section of the app.
+                The icon rail can only say so in an aria-label; a labelled row can show it. */}
+            {item.exampleOnly ? <span className={styles.exampleTag}>example</span> : null}
+          </Link>
+        );
+      })}
+    </nav>
+  );
+}
diff --git a/src/components/ward-management/ward-sidebar.module.css b/src/components/ward-management/ward-sidebar.module.css
new file mode 100644
index 0000000000..66580a33a4
--- /dev/null
+++ b/src/components/ward-management/ward-sidebar.module.css
@@ -0,0 +1,347 @@
+/*
+ * Ward Flow's expanded sidebar panel, phone header bar and phone drawer body.
+ *
+ * Same self-contained-tokens convention every other Ward Flow module documents: each local
+ * custom property this file needs is declared on the elements that use it, never borrowed from
+ * another module's scope. `.clinicalRail` in `ward-management.module.css` had to learn this the
+ * hard way — it read `var(--ward-*)` that the coordinator shell (`--co-*`) never declared, so
+ * every one of them silently computed to nothing on that route.
+ */
+
+.panel,
+.drawerBody,
+.phoneBar {
+  --ward-blue: var(--clinical-accent);
+  --ward-blue-soft: var(--clinical-accent-soft);
+  --ward-blue-border: var(--clinical-accent-border);
+  --ward-canvas: var(--surface);
+  --ward-chrome: var(--surface-chrome);
+  --ward-border: var(--border);
+  --ward-heading: var(--text-heading);
+  --ward-text: var(--text);
+  --ward-muted: var(--text-muted);
+  --ward-space-2: 0.125rem;
+  --ward-space-4: 0.25rem;
+  --ward-space-6: 0.375rem;
+  --ward-space-8: 0.5rem;
+  --ward-space-10: 0.625rem;
+  --ward-space-12: 0.75rem;
+  --ward-space-16: 1rem;
+}
+
+/*
+ * The expanded panel. 17rem rather than the clinical sidebar's 20rem: Ward Flow's longest label
+ * is "Ward — RPH Adult Secure", far shorter than a recent-query line, and every screen behind it
+ * is a dense operational board that wants the width back.
+ *
+ * Hidden below 64rem because there is nothing to expand into on a tablet — the icon rail is the
+ * whole sidebar there, exactly as `ClinicalCollapsedRail` behaves between md and lg.
+ */
+.panel {
+  display: none;
+  grid-column: 1;
+  grid-row: 1 / -1;
+  z-index: 3;
+  width: 17rem;
+  min-height: 0;
+  flex-direction: column;
+  border-right: 0.0625rem solid var(--ward-border);
+  background: var(--ward-chrome);
+}
+
+@media (min-width: 64rem) {
+  .panel {
+    display: flex;
+  }
+}
+
+.panelScroll {
+  display: flex;
+  min-height: 0;
+  flex: 1;
+  flex-direction: column;
+  gap: var(--ward-space-16);
+  overflow-y: auto;
+  overscroll-behavior: contain;
+  padding: var(--ward-space-12) var(--ward-space-12) var(--ward-space-16);
+}
+
+/* The brand row: mark, name, and — on the panel only — the control that collapses it back to
+   the icon rail. The mark itself is the expand control on the rail, mirroring the clinical
+   sidebar, so the two directions sit in the same place. */
+.brandRow {
+  display: flex;
+  align-items: center;
+  gap: var(--ward-space-10);
+  padding: var(--ward-space-4) var(--ward-space-4) var(--ward-space-8);
+}
+
+.brandLink {
+  display: flex;
+  min-width: 0;
+  min-height: var(--spacing-tap);
+  flex: 1;
+  align-items: center;
+  gap: var(--ward-space-10);
+  border-radius: var(--radius-lg);
+  padding: 0 var(--ward-space-4);
+  color: var(--ward-heading);
+  text-decoration: none;
+}
+
+.brandGlyph {
+  width: 2rem;
+  height: 2rem;
+  flex-shrink: 0;
+}
+
+.brandText {
+  display: grid;
+  min-width: 0;
+  gap: var(--ward-space-2);
+}
+
+.brandName {
+  color: var(--ward-heading);
+  font-size: var(--text-sm);
+  font-weight: 650;
+  line-height: 1.2;
+}
+
+.brandTagline {
+  color: var(--ward-muted);
+  font-size: var(--text-xs);
+  line-height: 1.2;
+}
+
+.collapseButton {
+  display: grid;
+  width: var(--spacing-tap);
+  height: var(--spacing-tap);
+  flex-shrink: 0;
+  place-items: center;
+  border: 0.0625rem solid transparent;
+  border-radius: var(--radius-lg);
+  background: none;
+  color: var(--ward-muted);
+  cursor: pointer;
+}
+
+.collapseButton:hover {
+  border-color: var(--ward-border);
+  background: var(--ward-canvas);
+  color: var(--ward-heading);
+}
+
+.collapseButton svg {
+  width: 1.125rem;
+  height: 1.125rem;
+}
+
+.group {
+  display: grid;
+  gap: var(--ward-space-2);
+}
+
+.groupLabel {
+  padding: 0 var(--ward-space-8) var(--ward-space-6);
+  color: var(--ward-muted);
+  font-size: var(--text-xs);
+  font-weight: 650;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+}
+
+.link,
+.linkActive {
+  display: flex;
+  min-height: var(--spacing-tap);
+  align-items: center;
+  gap: var(--ward-space-10);
+  border: 0.0625rem solid transparent;
+  border-radius: var(--radius-lg);
+  padding: 0 var(--ward-space-8);
+  color: var(--ward-muted);
+  font-size: var(--text-sm);
+  text-decoration: none;
+  transition:
+    color var(--duration-fast),
+    border-color var(--duration-fast),
+    background-color var(--duration-fast);
+}
+
+.link:hover {
+  border-color: var(--ward-border);
+  background: var(--ward-canvas);
+  color: var(--ward-heading);
+}
+
+.linkActive {
+  border-color: var(--ward-blue-border);
+  background: var(--ward-blue-soft);
+  color: var(--ward-blue);
+  box-shadow: var(--shadow-inset);
+}
+
+.link svg,
+.linkActive svg {
+  width: 1.125rem;
+  height: 1.125rem;
+  flex-shrink: 0;
+}
+
+.linkLabel {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+/*
+ * D10: the two links that name one arbitrary synthetic instance rather than a section of the
+ * app. The icon rail can only say so in an aria-label; a labelled list can show it, which is
+ * part of what labels are for.
+ */
+.exampleTag {
+  flex-shrink: 0;
+  border: 0.0625rem solid var(--ward-border);
+  border-radius: var(--radius-pill, 9999px);
+  padding: 0 var(--ward-space-6);
+  color: var(--ward-muted);
+  font-size: var(--text-xs);
+  line-height: 1.5;
+}
+
+.rule {
+  height: 0.0625rem;
+  margin: var(--ward-space-2) var(--ward-space-8);
+  background: var(--ward-border);
+}
+
+.footer {
+  display: grid;
+  flex-shrink: 0;
+  gap: var(--ward-space-8);
+  border-top: 0.0625rem solid var(--ward-border);
+  padding: var(--ward-space-12);
+}
+
+/* The role switcher and the demo clock are self-contained controls with their own popovers and
+   their own tokens; the panel gives them a full-width row rather than restyling them. */
+.footerControls {
+  display: flex;
+  align-items: center;
+  gap: var(--ward-space-8);
+}
+
+.guest {
+  display: grid;
+  width: var(--spacing-tap);
+  height: var(--spacing-tap);
+  flex-shrink: 0;
+  place-items: center;
+  border: 0.0625rem solid var(--ward-blue-border);
+  border-radius: var(--radius-pill, 9999px);
+  background: var(--ward-blue-soft);
+  color: var(--ward-blue);
+  font-size: var(--text-xs);
+  font-weight: 700;
+}
+
+/*
+ * The phone header bar.
+ *
+ * Nine of Ward Flow's ten shells are a bare rail-plus-main two-column grid with no header row of
+ * any kind, so there is no existing chrome for a drawer trigger to live in — unlike the clinical
+ * application, where MasterSearchHeader already owns the phone menu button. The sidebar
+ * therefore brings its own bar. It is fixed rather than sticky because it must sit above ten
+ * different shells whose scroll containers are all in a different place; each shell reserves the
+ * 3.5rem in its own phone media query.
+ */
+.phoneBar {
+  position: fixed;
+  top: 0;
+  right: 0;
+  left: 0;
+  z-index: 30;
+  display: none;
+  height: 3.5rem;
+  align-items: center;
+  gap: var(--ward-space-10);
+  border-bottom: 0.0625rem solid var(--ward-border);
+  background: var(--ward-chrome);
+  padding: 0 max(var(--ward-space-8), env(safe-area-inset-right)) 0 max(var(--ward-space-8), env(safe-area-inset-left));
+}
+
+@media (max-width: 40rem) {
+  .phoneBar {
+    display: flex;
+  }
+}
+
+.phoneBrand {
+  display: flex;
+  min-width: 0;
+  flex: 1;
+  align-items: center;
+  gap: var(--ward-space-8);
+  color: var(--ward-heading);
+  text-decoration: none;
+}
+
+.phoneBrandName {
+  min-width: 0;
+  overflow: hidden;
+  color: var(--ward-heading);
+  font-size: var(--text-sm);
+  font-weight: 650;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.menuButton {
+  display: grid;
+  width: var(--spacing-tap);
+  height: var(--spacing-tap);
+  flex-shrink: 0;
+  place-items: center;
+  border: 0.0625rem solid var(--ward-border);
+  border-radius: var(--radius-lg);
+  background: var(--ward-canvas);
+  color: var(--ward-heading);
+  cursor: pointer;
+}
+
+.menuButton svg {
+  width: 1.25rem;
+  height: 1.25rem;
+}
+
+/* The drawer body reuses the panel's own content component, so it inherits every rule above and
+   only needs its own padding — the Sheet supplies the surface, the header and the close control. */
+.drawerBody {
+  display: grid;
+  gap: var(--ward-space-16);
+  padding-bottom: var(--ward-space-16);
+}
+
+/* The drawer can only be opened from .phoneBar, which does not exist above 40rem — but a
+   viewport resized while it is open would otherwise leave it stranded over a tablet layout. */
+@media (min-width: 40.0625rem) {
+  .drawerHidden {
+    display: none;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .link,
+  .linkActive {
+    transition: none;
+  }
+}
+
+@media (forced-colors: active) {
+  .linkActive {
+    border: 0.125rem solid Highlight;
+  }
+}
diff --git a/src/components/ward-management/ward/ward.module.css b/src/components/ward-management/ward/ward.module.css
index bf7716776e..b9568775ac 100644
--- a/src/components/ward-management/ward/ward.module.css
+++ b/src/components/ward-management/ward/ward.module.css
@@ -22,7 +22,7 @@
   min-height: 100dvh;
   /* The rail track stays reserved at every supported width, same as the coordinator and patient
      workspace screens — see ward-management.module.css's own note on this. */
-  grid-template-columns: 4.5rem minmax(0, 1fr);
+  grid-template-columns: auto minmax(0, 1fr);
   background: var(--surface);
   color: var(--text);
   font-variant-numeric: tabular-nums;
@@ -418,3 +418,14 @@
     width: 100%;
   }
 }
+
+/*
+ * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
+ * place. The bar is fixed rather than sticky because it has to sit above ten different shells
+ * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ */
+@media (max-width: 40rem) {
+  .screen {
+    padding-top: 3.5rem;
+  }
+}
diff --git a/tests/ward-management.test.ts b/tests/ward-management.test.ts
index 95794eda26..6654e8fa96 100644
--- a/tests/ward-management.test.ts
+++ b/tests/ward-management.test.ts
@@ -1,6 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
 
+import { WARD_VIEWS } from "@/components/ward-management/ward-nav";
+
 import { elapsedLabel } from "../src/components/ward-management/ward-derivations";
 import { legalFormName } from "../src/components/ward-management/ward-legal-forms";
 import { MOVEMENT_STAGES, PARALLEL_REFERRAL_CAP } from "../src/components/ward-management/ward-model";
@@ -10,14 +12,17 @@ import { NOW_ANCHOR, allUnits } from "../src/components/ward-management/ward-sit
 const modesSource = readFileSync("src/components/ward-management/ward-management-modes.tsx", "utf8");
 
 /**
- * The mode strip renders one literal `<Link href="...">` per view so
- * `tests/route-reachability.test.ts` can find the hrefs by static AST scan. Reading the
- * source back is therefore the only way to assert the strip and the routes agree.
+ * The eight views, read from the data the rail, the panel and the drawer all render from.
+ *
+ * This used to be a regex over `WardModeNavigation`'s own source text, because the eight
+ * destinations only existed as eight literal `<Link href="...">` blocks inside that function.
+ * They now live in `WARD_VIEWS` (`ward-nav.ts`), which is both a stronger check — it reads what
+ * ships rather than what the source happens to spell — and the reason a labelled sidebar was
+ * possible at all: a panel cannot read a rail's icon-only JSX, and a second hand-maintained copy
+ * of the same eight destinations is the exact defect `ward-nav.ts` exists to prevent.
  */
 function wardModeHrefs() {
-  const source = readFileSync("src/components/ward-management/ward-management-navigation.tsx", "utf8");
-  const modeStrip = source.slice(source.indexOf("export function WardModeNavigation"));
-  return [...modeStrip.matchAll(/href="(\/mockups\/ward-flow[^"]*)"/g)].map((match) => match[1]);
+  return WARD_VIEWS.map((view) => view.href);
 }
 
 function routeFileFor(href: string) {
diff --git a/tests/ward-nav.test.ts b/tests/ward-nav.test.ts
index 39141c02f9..981c99481d 100644
--- a/tests/ward-nav.test.ts
+++ b/tests/ward-nav.test.ts
@@ -40,7 +40,12 @@ import { WardScreen } from "@/components/ward-management/ward/ward-screen";
 import { WardPatientWorkspace } from "@/components/ward-management/ward-management-console";
 import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
 
-import { WARD_NAV, WARD_NAV_INTENTIONALLY_UNLISTED } from "../src/components/ward-management/ward-nav";
+import {
+  WARD_DEVELOPER_HUB_HREF,
+  WARD_NAV,
+  WARD_NAV_INTENTIONALLY_UNLISTED,
+  WARD_VIEWS,
+} from "../src/components/ward-management/ward-nav";
 
 const REPO_ROOT = path.resolve(__dirname, "..");
 const WARD_FLOW_ROOT = path.join(REPO_ROOT, "src", "app", "mockups", "ward-flow");
@@ -105,6 +110,9 @@ describe("Ward Flow route enumeration (sanity check on the scan itself)", () =>
 });
 
 describe("Ward Flow navigation — single source (ward-nav.ts)", () => {
+  // Every destination the rail, the panel and the drawer render, from the one file all three read.
+  const navHrefs = new Set([...WARD_VIEWS, ...WARD_NAV].map((item) => item.href));
+
   // Direction 1: every WARD_NAV href must be a real route (static or one instance of a dynamic
   // route). This is the direction a purely "does every link work" check would already cover.
   it("every WARD_NAV href resolves to a real route under src/app/mockups/ward-flow/", () => {
@@ -117,17 +125,38 @@ describe("Ward Flow navigation — single source (ward-nav.ts)", () => {
   // Direction 2: every real STATIC route must appear in WARD_NAV or be recorded as intentionally
   // unlisted with a reason. This is the direction a one-way "is every link real" check cannot
   // see — and its absence is exactly how D8 shipped three boards with no rail entry.
-  it("every static Ward Flow route appears in WARD_NAV or is recorded as intentionally unlisted", () => {
-    const navHrefs = new Set(WARD_NAV.map((item) => item.href));
+  it("every static Ward Flow route appears in the navigation or is recorded as intentionally unlisted", () => {
     const missing = staticRoutes.filter((route) => !navHrefs.has(route) && !WARD_NAV_INTENTIONALLY_UNLISTED.has(route));
     expect(
       missing,
-      `Static Ward Flow route(s) in neither WARD_NAV nor WARD_NAV_INTENTIONALLY_UNLISTED: ${missing.join(", ")}`,
+      `Static Ward Flow route(s) in neither the nav arrays nor WARD_NAV_INTENTIONALLY_UNLISTED: ${missing.join(", ")}`,
     ).toEqual([]);
   });
 
-  it("WARD_NAV_INTENTIONALLY_UNLISTED has no stale entries, no empty reasons, and never overlaps WARD_NAV", () => {
-    const navHrefs = new Set(WARD_NAV.map((item) => item.href));
+  // The eight views moved out of eight literal `<Link>` blocks and into `WARD_VIEWS` so the
+  // labelled panel and drawer could render the same destinations the icon rail renders. Direction
+  // 1 has to cover them too, or half the navigation would be unchecked.
+  it("every WARD_VIEWS href resolves to a real static route, and ids and hrefs are unique", () => {
+    const unresolved = WARD_VIEWS.filter((view) => !staticRoutes.includes(view.href)).map((view) => view.href);
+    expect(unresolved, `WARD_VIEWS href(s) with no matching route: ${unresolved.join(", ")}`).toEqual([]);
+    expect(new Set(WARD_VIEWS.map((view) => view.id)).size).toBe(WARD_VIEWS.length);
+    expect(new Set(WARD_VIEWS.map((view) => view.href)).size).toBe(WARD_VIEWS.length);
+    expect(WARD_VIEWS).toHaveLength(8);
+  });
+
+  it("no route is listed in both WARD_VIEWS and WARD_NAV", () => {
+    const viewHrefs = new Set(WARD_VIEWS.map((view) => view.href));
+    const overlap = WARD_NAV.filter((item) => viewHrefs.has(item.href)).map((item) => item.href);
+    expect(overlap, `href(s) in both WARD_VIEWS and WARD_NAV — pick one: ${overlap.join(", ")}`).toEqual([]);
+  });
+
+  it("every destination carries a non-empty label, so the panel and drawer can name it", () => {
+    for (const item of [...WARD_VIEWS, ...WARD_NAV]) {
+      expect(item.label.trim().length, `${item.href} has an empty label`).toBeGreaterThan(0);
+    }
+  });
+
+  it("WARD_NAV_INTENTIONALLY_UNLISTED has no stale entries, no empty reasons, and never overlaps the nav", () => {
     for (const [route, reason] of WARD_NAV_INTENTIONALLY_UNLISTED) {
       expect(
         staticRoutes,
@@ -162,10 +191,20 @@ describe("Ward Flow navigation — single source (ward-nav.ts)", () => {
 });
 
 describe("ClinicalRail's aria-label is honest for a sandboxed prototype (D11)", () => {
-  const source = readFileSync(
-    path.join(REPO_ROOT, "src/components/ward-management/ward-management-navigation.tsx"),
-    "utf8",
-  );
+  /**
+   * Every file that can put a link on a Ward Flow screen, concatenated. The sidebar is now three
+   * surfaces (icon rail, labelled panel, phone drawer) across three files plus the data they all
+   * read, so scanning only `ward-management-navigation.tsx` would leave two of the three
+   * unguarded — and a link out of the sandbox added to the drawer is exactly as wrong as one
+   * added to the rail.
+   */
+  const source = [
+    "src/components/ward-management/ward-management-navigation.tsx",
+    "src/components/ward-management/ward-sidebar-content.tsx",
+    "src/components/ward-management/ward-nav.ts",
+  ]
+    .map((file) => readFileSync(path.join(REPO_ROOT, file), "utf8"))
+    .join("\n");
 
   it("no longer claims Ward Flow is a clinical application", () => {
     expect(source).not.toContain("Clinical applications");
@@ -195,11 +234,16 @@ describe("ClinicalRail's aria-label is honest for a sandboxed prototype (D11)",
     // brand mark linking to `/` looks completely unremarkable in source and only reads as wrong
     // once you see it sitting above a sandboxed prototype's own rail.
     const clinicalExits = ["/", "/documents", "/services", "/medications", "/tools", "/?mode=answer"];
-    const found = clinicalExits.filter((href) => source.includes(`href="${href}"`));
-    expect(found, `the rail must not link into the clinical app, but found: ${found.join(", ")}`).toEqual([]);
+    const found = clinicalExits.filter(
+      (href) => source.includes(`href="${href}"`) || source.includes(`"${href}",`),
+    );
+    expect(found, `the sidebar must not link into the clinical app, but found: ${found.join(", ")}`).toEqual([]);
     // Non-vacuity: the one legitimate exit must still be there, or this test would also pass on a
-    // rail with no links at all.
-    expect(source).toContain('href="/mockups/development"');
+    // sidebar with no links at all. The href is now a named constant shared by the rail and the
+    // drawer, so both its value and its use are asserted.
+    expect(WARD_DEVELOPER_HUB_HREF).toBe("/mockups/development");
+    expect(source).toContain("WARD_DEVELOPER_HUB_HREF");
+    expect(source).toContain('"/mockups/development"');
   });
 });
 
diff --git a/tests/ward-sidebar-phone-contract.test.ts b/tests/ward-sidebar-phone-contract.test.ts
new file mode 100644
index 0000000000..532559adb5
--- /dev/null
+++ b/tests/ward-sidebar-phone-contract.test.ts
@@ -0,0 +1,92 @@
+import { readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+/**
+ * The phone contract, asserted as stylesheet rules rather than as rendered output.
+ *
+ * jsdom has no layout and applies no media query, so a DOM test cannot tell a sidebar that
+ * disappears on a phone from one that does not. That gap is not hypothetical here: Ward Flow
+ * shipped with the full 4.5rem desktop icon rail rendering unchanged on a 390px phone — 18% of
+ * the viewport — through 38 test files and 428 passing tests, because nothing was structurally
+ * wrong and no check ever looked at a width. The rules below are what make the phone treatment
+ * exist at all, so they are what gets pinned.
+ */
+const REPO_ROOT = path.resolve(__dirname, "..");
+const WARD_ROOT = path.join(REPO_ROOT, "src", "components", "ward-management");
+
+function readModule(relativePath: string) {
+  // Normalised to LF: the repository enforces LF via .gitattributes, but a working tree that
+  // has picked up CRLF must fail this suite on its content, never on its line endings.
+  return readFileSync(path.join(WARD_ROOT, relativePath), "utf8").split("\r\n").join("\n");
+}
+
+/** Every Ward Flow stylesheet that lays out a whole screen around the sidebar. */
+function shellStylesheets(): string[] {
+  const found: string[] = [];
+  for (const entry of readdirSync(WARD_ROOT, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      for (const nested of readdirSync(path.join(WARD_ROOT, entry.name))) {
+        if (nested.endsWith(".module.css")) found.push(`${entry.name}/${nested}`);
+      }
+    }
+  }
+  found.push("ward-management.module.css", "ward-management-modes.module.css");
+  return found;
+}
+
+const shellFiles = shellStylesheets().filter((file) => readModule(file).includes("minmax(0, 1fr);"));
+
+describe("Ward Flow sidebar — phone contract", () => {
+  it("finds the shell stylesheets it is about to check (sanity check on the scan)", () => {
+    // A broken scan would leave every assertion below vacuously true.
+    expect(shellFiles.length).toBeGreaterThanOrEqual(9);
+    expect(shellFiles).toContain("search/search.module.css");
+    expect(shellFiles).toContain("ward-management-modes.module.css");
+  });
+
+  it("gives the sidebar its own grid track instead of a 4.5rem literal repeated per shell", () => {
+    const literals = shellFiles.filter((file) => readModule(file).includes("grid-template-columns: 4.5rem"));
+    expect(
+      literals,
+      `shell(s) still hard-coding the rail width instead of letting the sidebar own it: ${literals.join(", ")}`,
+    ).toEqual([]);
+  });
+
+  it("hides the icon rail below 40rem, where the phone bar and drawer take over", () => {
+    const shared = readModule("ward-management.module.css");
+    const phoneBlock = shared.slice(shared.indexOf("@media (max-width: 40rem)"));
+    expect(phoneBlock).toContain(".clinicalRail {\n    display: none;\n  }");
+  });
+
+  it("shows the phone bar only below 40rem, and the labelled panel only from 64rem", () => {
+    const sidebar = readModule("ward-sidebar.module.css");
+    expect(sidebar).toContain("@media (max-width: 40rem) {\n  .phoneBar {\n    display: flex;\n  }\n}");
+    expect(sidebar).toContain("@media (min-width: 64rem) {\n  .panel {\n    display: flex;\n  }\n}");
+    // Default state for each, so a browser with no media-query support shows the rail alone
+    // rather than three sidebars stacked.
+    expect(sidebar).toContain(".phoneBar {\n  position: fixed;");
+    expect(sidebar).toMatch(/\.panel \{\n {2}display: none;/);
+  });
+
+  it("reserves the fixed phone bar's height in every shell it floats above", () => {
+    const missing = shellFiles.filter((file) => !readModule(file).includes("padding-top: 3.5rem;"));
+    expect(
+      missing,
+      `shell(s) whose content would sit under the fixed phone bar: ${missing.join(", ")}`,
+    ).toEqual([]);
+  });
+
+  it("pushes each shell's own sticky header below the phone bar rather than under it", () => {
+    // The two shells that have a sticky header of their own. Anything else has no header at all,
+    // which is why the sidebar brings its own bar.
+    for (const file of ["ward-management.module.css", "ward-management-modes.module.css"]) {
+      const source = readModule(file);
+      const phoneBlock = source.slice(source.indexOf("@media (max-width: 40rem)"));
+      expect(phoneBlock, `${file} has a sticky header still pinned to the viewport top`).not.toContain(
+        "position: sticky;\n    top: 0;",
+      );
+      expect(phoneBlock).toContain("top: 3.5rem;");
+    }
+  });
+});
diff --git a/tests/ward-sidebar.dom.test.tsx b/tests/ward-sidebar.dom.test.tsx
new file mode 100644
index 0000000000..3fb7ffc393
--- /dev/null
+++ b/tests/ward-sidebar.dom.test.tsx
@@ -0,0 +1,137 @@
+import { fireEvent, render, screen, within } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// Same reason as every sibling dom suite: `ClinicalRail` renders next/link anchors and this suite
+// reads hrefs rather than actually navigating, so a plain <a> avoids an App Router context jsdom
+// cannot provide.
+vi.mock("next/link", () => ({
+  default: ({ children, href, ...rest }: { children: ReactNode; href: string }) => (
+    <a href={href} {...rest}>
+      {children}
+    </a>
+  ),
+}));
+
+import { ClinicalRail } from "@/components/ward-management/ward-management-navigation";
+import { WardFlowProvider } from "@/components/ward-management/ward-flow-provider";
+import { WARD_NAV, WARD_VIEWS } from "@/components/ward-management/ward-nav";
+import { WARD_SIDEBAR_COLLAPSED_STORAGE_KEY } from "@/components/ward-management/use-ward-sidebar-collapsed";
+import { NOW_ANCHOR } from "@/components/ward-management/ward-sites";
+
+function renderRail() {
+  return render(
+    <WardFlowProvider initialNow={NOW_ANCHOR}>
+      <ClinicalRail activeMode="queue" />
+    </WardFlowProvider>,
+  );
+}
+
+beforeEach(() => {
+  window.localStorage.removeItem(WARD_SIDEBAR_COLLAPSED_STORAGE_KEY);
+});
+
+afterEach(() => {
+  window.localStorage.removeItem(WARD_SIDEBAR_COLLAPSED_STORAGE_KEY);
+});
+
+/**
+ * The phone drawer.
+ *
+ * Ward Flow had no phone treatment of any kind before this: `ward-management.module.css` held
+ * four media queries, of which two were `prefers-reduced-motion` and `forced-colors` and two
+ * named `.workspaceGrid` and `.patientWorkspace`. Not one touched the rail, so a 390px phone
+ * rendered the full 4.5rem desktop icon column. Nothing in the test suite could notice, because
+ * nothing was structurally wrong — which is why the checks below assert the drawer exists and
+ * works, and why `tests/ward-sidebar-phone-contract.test.ts` separately asserts the stylesheet
+ * rules that make it reachable.
+ */
+describe("Ward Flow phone drawer", () => {
+  it("opens from the phone bar's menu button and closes again", () => {
+    renderRail();
+    const trigger = screen.getByRole("button", { name: "Open Ward Flow menu" });
+    expect(trigger).toHaveAttribute("aria-expanded", "false");
+    expect(screen.queryByRole("dialog")).toBeNull();
+
+    fireEvent.click(trigger);
+
+    const drawer = screen.getByRole("dialog");
+    expect(within(drawer).getByText("Ward Flow")).toBeTruthy();
+    fireEvent.click(within(drawer).getByRole("button", { name: "Close Ward Flow menu" }));
+    expect(screen.queryByRole("dialog")).toBeNull();
+  });
+
+  it("lists every destination by name, which the icon rail can only do in an aria-label", () => {
+    renderRail();
+    fireEvent.click(screen.getByRole("button", { name: "Open Ward Flow menu" }));
+    const drawer = screen.getByRole("dialog");
+
+    for (const view of WARD_VIEWS) {
+      const link = within(drawer).getByRole("link", { name: new RegExp(`^${view.label}$`) });
+      expect(link, `${view.label} is missing from the drawer`).toHaveAttribute("href", view.href);
+    }
+    // Matched on href rather than on accessible name: two of these labels carry an "example" tag
+    // inside the link (D10), so the name is the label plus that word.
+    const drawerHrefs = within(drawer)
+      .getAllByRole("link")
+      .map((link) => link.getAttribute("href"));
+    for (const item of WARD_NAV) {
+      expect(drawerHrefs, `${item.label} is missing from the drawer`).toContain(item.href);
+    }
+    // The two entries that name one arbitrary synthetic instance rather than a section of the app
+    // say so in words here. The icon rail can only say it in an aria-label nobody reads.
+    expect(within(drawer).getAllByText("example")).toHaveLength(2);
+    // The one legitimate way out of the sandbox.
+    expect(within(drawer).getByRole("link", { name: "Back to the developer hub" })).toHaveAttribute(
+      "href",
+      "/mockups/development",
+    );
+  });
+
+  it("closes when a destination is chosen, so the drawer never covers the page it opened", () => {
+    renderRail();
+    fireEvent.click(screen.getByRole("button", { name: "Open Ward Flow menu" }));
+    const drawer = screen.getByRole("dialog");
+    fireEvent.click(within(drawer).getByRole("link", { name: "Capacity" }));
+    expect(screen.queryByRole("dialog")).toBeNull();
+  });
+
+  it("marks the active view current in the drawer as well as in the rail", () => {
+    renderRail();
+    fireEvent.click(screen.getByRole("button", { name: "Open Ward Flow menu" }));
+    const drawer = screen.getByRole("dialog");
+    expect(within(drawer).getByRole("link", { name: "Priority queue" })).toHaveAttribute("aria-current", "page");
+    expect(within(drawer).getByRole("link", { name: "Capacity" })).not.toHaveAttribute("aria-current");
+  });
+});
+
+/**
+ * The desktop expand/collapse pair, mirroring `useSidebarCollapsed` in the clinical application:
+ * collapsed on a first visit, remembered per browser afterwards.
+ */
+describe("Ward Flow desktop sidebar collapse", () => {
+  it("starts collapsed, with the icon rail and no labelled panel", () => {
+    renderRail();
+    expect(screen.getByRole("complementary", { name: "Ward Flow" })).toBeTruthy();
+    expect(screen.queryByRole("complementary", { name: "Ward Flow sidebar" })).toBeNull();
+  });
+
+  it("expands into the labelled panel and remembers the choice", () => {
+    renderRail();
+    fireEvent.click(screen.getByRole("button", { name: "Expand sidebar" }));
+
+    const panel = screen.getByRole("complementary", { name: "Ward Flow sidebar" });
+    expect(within(panel).getByRole("link", { name: "Priority queue" })).toHaveAttribute("aria-current", "page");
+    expect(window.localStorage.getItem(WARD_SIDEBAR_COLLAPSED_STORAGE_KEY)).toBe("0");
+
+    fireEvent.click(within(panel).getByRole("button", { name: "Collapse sidebar" }));
+    expect(screen.queryByRole("complementary", { name: "Ward Flow sidebar" })).toBeNull();
+    expect(window.localStorage.getItem(WARD_SIDEBAR_COLLAPSED_STORAGE_KEY)).toBe("1");
+  });
+
+  it("restores a remembered expanded preference on the next visit", () => {
+    window.localStorage.setItem(WARD_SIDEBAR_COLLAPSED_STORAGE_KEY, "0");
+    renderRail();
+    expect(screen.getByRole("complementary", { name: "Ward Flow sidebar" })).toBeTruthy();
+  });
+});

From e93b1382d15e1b3df3e914cd463c7da2df96a0e0 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 04:16:58 +0800
Subject: [PATCH 48/54] Fix a phone-contract check that passed with the rule it
 guards deleted

The rail-hidden assertion sliced the file at the first "@media (max-width: 40rem)"
and looked for ".clinicalRail { display: none; }" inside it. That substring also
occurs inside the long-standing ".patientWorkspace .clinicalRail" rule further down,
so deleting the whole phone-hide block left the test green. Found by deleting the
block and watching the test pass, not by reading it.

It now matches the complete block including its leading newline and indent, which
the qualified selector cannot satisfy. Re-mutated: 1 failed, 5 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 tests/ward-sidebar-phone-contract.test.ts | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/tests/ward-sidebar-phone-contract.test.ts b/tests/ward-sidebar-phone-contract.test.ts
index 532559adb5..b2d2079ad9 100644
--- a/tests/ward-sidebar-phone-contract.test.ts
+++ b/tests/ward-sidebar-phone-contract.test.ts
@@ -54,9 +54,13 @@ describe("Ward Flow sidebar — phone contract", () => {
   });
 
   it("hides the icon rail below 40rem, where the phone bar and drawer take over", () => {
-    const shared = readModule("ward-management.module.css");
-    const phoneBlock = shared.slice(shared.indexOf("@media (max-width: 40rem)"));
-    expect(phoneBlock).toContain(".clinicalRail {\n    display: none;\n  }");
+    // The leading newline-and-indent matters: without it this also matches the long-standing
+    // `.patientWorkspace .clinicalRail { display: none; }` rule further down the same file, and
+    // the check passes with the rule it exists to protect deleted. Caught by mutation, not by
+    // reading it.
+    expect(readModule("ward-management.module.css")).toContain(
+      "@media (max-width: 40rem) {\n  .clinicalRail {\n    display: none;\n  }\n}",
+    );
   });
 
   it("shows the phone bar only below 40rem, and the labelled panel only from 64rem", () => {

From 4d945ef7395a1e457d5d92ce10ec7f1dda328862 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 04:41:15 +0800
Subject: [PATCH 49/54] fix(ward-flow): align sidebar with design contracts

---
 ...26-08-26-ward-flow-sidebar-house-pattern.md |  4 ++--
 src/app/globals.css                            |  2 ++
 .../coordinator/coordinator.module.css         |  4 ++--
 .../ward-management/ed/ed.module.css           |  4 ++--
 .../escalation/escalation.module.css           |  4 ++--
 .../handover/handover.module.css               |  4 ++--
 .../ward-management/officer/officer.module.css |  4 ++--
 .../ward-management/search/search.module.css   |  4 ++--
 .../tracker/live-tracker.module.css            |  4 ++--
 .../ward-management-modes.module.css           |  4 ++--
 .../ward-management/ward-management.module.css |  4 ++--
 src/components/ward-management/ward-nav.ts     |  9 +--------
 .../ward-management/ward-sidebar-content.tsx   |  8 +-------
 .../ward-management/ward-sidebar.module.css    | 18 +++++++++++-------
 .../ward-management/ward/ward.module.css       |  4 ++--
 tests/ward-nav.test.ts                         |  4 +---
 tests/ward-sidebar-phone-contract.test.ts      | 11 +++++------
 17 files changed, 43 insertions(+), 53 deletions(-)

diff --git a/docs/superpowers/plans/2026-08-26-ward-flow-sidebar-house-pattern.md b/docs/superpowers/plans/2026-08-26-ward-flow-sidebar-house-pattern.md
index c92aea968d..277b5c8764 100644
--- a/docs/superpowers/plans/2026-08-26-ward-flow-sidebar-house-pattern.md
+++ b/docs/superpowers/plans/2026-08-26-ward-flow-sidebar-house-pattern.md
@@ -1,6 +1,6 @@
 # Ward Flow sidebar — adopt the repository's house sidebar pattern
 
-**Goal:** Give Ward Flow the same sidebar *approach and structure* the clinical
+**Goal:** Give Ward Flow the same sidebar _approach and structure_ the clinical
 application already uses, tailored to Ward Flow's own tokens, style and
 destinations.
 
@@ -22,7 +22,7 @@ Read from `src/components/clinical-dashboard/ClinicalSidebar.tsx` and
 2. **Three breakpoints, three shapes.** Phone: no rail at all — a `Sheet` drawer
    opened from the app header. Tablet (`md`): icon rail only, with a static brand
    mark and no expand control, because the expanded panel does not exist below
-   `lg`. Desktop (`lg`): icon rail *or* a 20rem labelled panel, chosen by the
+   `lg`. Desktop (`lg`): icon rail _or_ a 20rem labelled panel, chosen by the
    user.
 3. **The choice persists.** `useSidebarCollapsed` is an external store over
    `localStorage`, collapsed by default, with an in-memory fallback when storage
diff --git a/src/app/globals.css b/src/app/globals.css
index a31673581d..8c8415d7c4 100644
--- a/src/app/globals.css
+++ b/src/app/globals.css
@@ -118,6 +118,8 @@
      which covers the composer input as well as the icon/send buttons). */
   --spacing-tap: 3rem;
   --spacing-phone-frame: 52.75rem;
+  /* Ward Flow's fixed phone navigation bar and the matching content reserve. */
+  --spacing-ward-phone-bar: 3.5rem;
 
   /* Shared reading measure, wide mockup study canvas, and Factsheets phone geometry. */
   --container-reading: 64rem;
diff --git a/src/components/ward-management/coordinator/coordinator.module.css b/src/components/ward-management/coordinator/coordinator.module.css
index 8b8012c3f6..83dac98de4 100644
--- a/src/components/ward-management/coordinator/coordinator.module.css
+++ b/src/components/ward-management/coordinator/coordinator.module.css
@@ -1933,10 +1933,10 @@
 /*
  * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
  * place. The bar is fixed rather than sticky because it has to sit above ten different shells
- * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ * whose scroll containers are all in a different place, so each shell reserves the shared phone-bar height here.
  */
 @media (max-width: 40rem) {
   .screen {
-    padding-top: 3.5rem;
+    padding-top: var(--spacing-ward-phone-bar);
   }
 }
diff --git a/src/components/ward-management/ed/ed.module.css b/src/components/ward-management/ed/ed.module.css
index 0c1004afd0..2a428c9e61 100644
--- a/src/components/ward-management/ed/ed.module.css
+++ b/src/components/ward-management/ed/ed.module.css
@@ -428,10 +428,10 @@
 /*
  * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
  * place. The bar is fixed rather than sticky because it has to sit above ten different shells
- * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ * whose scroll containers are all in a different place, so each shell reserves the shared phone-bar height here.
  */
 @media (max-width: 40rem) {
   .screen {
-    padding-top: 3.5rem;
+    padding-top: var(--spacing-ward-phone-bar);
   }
 }
diff --git a/src/components/ward-management/escalation/escalation.module.css b/src/components/ward-management/escalation/escalation.module.css
index 34f8afd1c4..e08027a44b 100644
--- a/src/components/ward-management/escalation/escalation.module.css
+++ b/src/components/ward-management/escalation/escalation.module.css
@@ -159,10 +159,10 @@
 /*
  * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
  * place. The bar is fixed rather than sticky because it has to sit above ten different shells
- * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ * whose scroll containers are all in a different place, so each shell reserves the shared phone-bar height here.
  */
 @media (max-width: 40rem) {
   .screen {
-    padding-top: 3.5rem;
+    padding-top: var(--spacing-ward-phone-bar);
   }
 }
diff --git a/src/components/ward-management/handover/handover.module.css b/src/components/ward-management/handover/handover.module.css
index c7551d768c..f9c25e1b1e 100644
--- a/src/components/ward-management/handover/handover.module.css
+++ b/src/components/ward-management/handover/handover.module.css
@@ -201,10 +201,10 @@
 /*
  * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
  * place. The bar is fixed rather than sticky because it has to sit above ten different shells
- * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ * whose scroll containers are all in a different place, so each shell reserves the shared phone-bar height here.
  */
 @media (max-width: 40rem) {
   .screen {
-    padding-top: 3.5rem;
+    padding-top: var(--spacing-ward-phone-bar);
   }
 }
diff --git a/src/components/ward-management/officer/officer.module.css b/src/components/ward-management/officer/officer.module.css
index 49e485a3cf..85ba1a60b0 100644
--- a/src/components/ward-management/officer/officer.module.css
+++ b/src/components/ward-management/officer/officer.module.css
@@ -251,10 +251,10 @@
 /*
  * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
  * place. The bar is fixed rather than sticky because it has to sit above ten different shells
- * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ * whose scroll containers are all in a different place, so each shell reserves the shared phone-bar height here.
  */
 @media (max-width: 40rem) {
   .screen {
-    padding-top: 3.5rem;
+    padding-top: var(--spacing-ward-phone-bar);
   }
 }
diff --git a/src/components/ward-management/search/search.module.css b/src/components/ward-management/search/search.module.css
index 23c028610e..b3b513aa36 100644
--- a/src/components/ward-management/search/search.module.css
+++ b/src/components/ward-management/search/search.module.css
@@ -214,10 +214,10 @@
 /*
  * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
  * place. The bar is fixed rather than sticky because it has to sit above ten different shells
- * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ * whose scroll containers are all in a different place, so each shell reserves the shared phone-bar height here.
  */
 @media (max-width: 40rem) {
   .screen {
-    padding-top: 3.5rem;
+    padding-top: var(--spacing-ward-phone-bar);
   }
 }
diff --git a/src/components/ward-management/tracker/live-tracker.module.css b/src/components/ward-management/tracker/live-tracker.module.css
index 1eb67364c5..a4b4d1078b 100644
--- a/src/components/ward-management/tracker/live-tracker.module.css
+++ b/src/components/ward-management/tracker/live-tracker.module.css
@@ -208,10 +208,10 @@
 /*
  * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
  * place. The bar is fixed rather than sticky because it has to sit above ten different shells
- * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ * whose scroll containers are all in a different place, so each shell reserves the shared phone-bar height here.
  */
 @media (max-width: 40rem) {
   .screen {
-    padding-top: 3.5rem;
+    padding-top: var(--spacing-ward-phone-bar);
   }
 }
diff --git a/src/components/ward-management/ward-management-modes.module.css b/src/components/ward-management/ward-management-modes.module.css
index 7e76055eb3..066b5b7069 100644
--- a/src/components/ward-management/ward-management-modes.module.css
+++ b/src/components/ward-management/ward-management-modes.module.css
@@ -880,12 +880,12 @@
   /* Reserve the fixed phone bar (ward-sidebar.module.css) and push this shell's own sticky
      header down below it, rather than letting the bar cover it. */
   .modeShell {
-    padding-top: 3.5rem;
+    padding-top: var(--spacing-ward-phone-bar);
   }
 
   .modeHeader {
     position: sticky;
-    top: 3.5rem;
+    top: var(--spacing-ward-phone-bar);
     z-index: var(--ward-z-phone);
     display: grid;
     min-height: 4.25rem;
diff --git a/src/components/ward-management/ward-management.module.css b/src/components/ward-management/ward-management.module.css
index 180cc0de40..680cf43b96 100644
--- a/src/components/ward-management/ward-management.module.css
+++ b/src/components/ward-management/ward-management.module.css
@@ -779,7 +779,7 @@
     height: auto;
     overflow: visible;
     /* Reserve the fixed phone bar (ward-sidebar.module.css). */
-    padding-top: 3.5rem;
+    padding-top: var(--spacing-ward-phone-bar);
   }
 
   /*
@@ -797,7 +797,7 @@
 
   .workspaceHeader {
     position: sticky;
-    top: 3.5rem;
+    top: var(--spacing-ward-phone-bar);
     z-index: var(--ward-z-phone);
     min-height: 4rem;
     border-bottom: 0.0625rem solid var(--ward-border);
diff --git a/src/components/ward-management/ward-nav.ts b/src/components/ward-management/ward-nav.ts
index fd81aed093..c0f4b05000 100644
--- a/src/components/ward-management/ward-nav.ts
+++ b/src/components/ward-management/ward-nav.ts
@@ -18,14 +18,7 @@
 
 /** The eight coordinator-level views. Ordered as the rail and the panel present them. */
 export type WardMode =
-  | "command"
-  | "network"
-  | "queue"
-  | "capacity"
-  | "movements"
-  | "exceptions"
-  | "transport"
-  | "governance";
+  "command" | "network" | "queue" | "capacity" | "movements" | "exceptions" | "transport" | "governance";
 
 export type WardViewItem = {
   id: WardMode;
diff --git a/src/components/ward-management/ward-sidebar-content.tsx b/src/components/ward-management/ward-sidebar-content.tsx
index 44bb1ce0c3..5d6baa87c6 100644
--- a/src/components/ward-management/ward-sidebar-content.tsx
+++ b/src/components/ward-management/ward-sidebar-content.tsx
@@ -8,13 +8,7 @@ import { BrandMark } from "@/components/clinical-dashboard/brand";
 import { WardDemoControls } from "./ward-demo-controls";
 import { WardRoleSwitcher } from "./ward-role-switcher";
 import { WARD_NAV_ICONS, WARD_VIEW_ICONS } from "./ward-nav-icons";
-import {
-  WARD_DEVELOPER_HUB_HREF,
-  WARD_NAV,
-  WARD_VIEWS,
-  type WardMode,
-  type WardNavItem,
-} from "./ward-nav";
+import { WARD_DEVELOPER_HUB_HREF, WARD_NAV, WARD_VIEWS, type WardMode, type WardNavItem } from "./ward-nav";
 
 import styles from "./ward-sidebar.module.css";
 
diff --git a/src/components/ward-management/ward-sidebar.module.css b/src/components/ward-management/ward-sidebar.module.css
index 66580a33a4..85e97bf981 100644
--- a/src/components/ward-management/ward-sidebar.module.css
+++ b/src/components/ward-management/ward-sidebar.module.css
@@ -27,6 +27,10 @@
   --ward-space-10: 0.625rem;
   --ward-space-12: 0.75rem;
   --ward-space-16: 1rem;
+  --ward-leading-tight: 1.2;
+  --ward-leading-body: 1.5;
+  --ward-z-panel: 3;
+  --ward-z-phone: 30;
 }
 
 /*
@@ -41,7 +45,7 @@
   display: none;
   grid-column: 1;
   grid-row: 1 / -1;
-  z-index: 3;
+  z-index: var(--ward-z-panel);
   width: 17rem;
   min-height: 0;
   flex-direction: column;
@@ -105,13 +109,13 @@
   color: var(--ward-heading);
   font-size: var(--text-sm);
   font-weight: 650;
-  line-height: 1.2;
+  line-height: var(--ward-leading-tight);
 }
 
 .brandTagline {
   color: var(--ward-muted);
   font-size: var(--text-xs);
-  line-height: 1.2;
+  line-height: var(--ward-leading-tight);
 }
 
 .collapseButton {
@@ -209,7 +213,7 @@
   padding: 0 var(--ward-space-6);
   color: var(--ward-muted);
   font-size: var(--text-xs);
-  line-height: 1.5;
+  line-height: var(--ward-leading-body);
 }
 
 .rule {
@@ -256,16 +260,16 @@
  * application, where MasterSearchHeader already owns the phone menu button. The sidebar
  * therefore brings its own bar. It is fixed rather than sticky because it must sit above ten
  * different shells whose scroll containers are all in a different place; each shell reserves the
- * 3.5rem in its own phone media query.
+ * `--spacing-ward-phone-bar` in its own phone media query.
  */
 .phoneBar {
   position: fixed;
   top: 0;
   right: 0;
   left: 0;
-  z-index: 30;
+  z-index: var(--ward-z-phone);
   display: none;
-  height: 3.5rem;
+  height: var(--spacing-ward-phone-bar);
   align-items: center;
   gap: var(--ward-space-10);
   border-bottom: 0.0625rem solid var(--ward-border);
diff --git a/src/components/ward-management/ward/ward.module.css b/src/components/ward-management/ward/ward.module.css
index b9568775ac..8470ad07e3 100644
--- a/src/components/ward-management/ward/ward.module.css
+++ b/src/components/ward-management/ward/ward.module.css
@@ -422,10 +422,10 @@
 /*
  * Below 40rem the icon rail is gone and `ward-sidebar.module.css`'s fixed phone bar takes its
  * place. The bar is fixed rather than sticky because it has to sit above ten different shells
- * whose scroll containers are all in a different place, so each shell reserves its 3.5rem here.
+ * whose scroll containers are all in a different place, so each shell reserves the shared phone-bar height here.
  */
 @media (max-width: 40rem) {
   .screen {
-    padding-top: 3.5rem;
+    padding-top: var(--spacing-ward-phone-bar);
   }
 }
diff --git a/tests/ward-nav.test.ts b/tests/ward-nav.test.ts
index 981c99481d..9d23284c95 100644
--- a/tests/ward-nav.test.ts
+++ b/tests/ward-nav.test.ts
@@ -234,9 +234,7 @@ describe("ClinicalRail's aria-label is honest for a sandboxed prototype (D11)",
     // brand mark linking to `/` looks completely unremarkable in source and only reads as wrong
     // once you see it sitting above a sandboxed prototype's own rail.
     const clinicalExits = ["/", "/documents", "/services", "/medications", "/tools", "/?mode=answer"];
-    const found = clinicalExits.filter(
-      (href) => source.includes(`href="${href}"`) || source.includes(`"${href}",`),
-    );
+    const found = clinicalExits.filter((href) => source.includes(`href="${href}"`) || source.includes(`"${href}",`));
     expect(found, `the sidebar must not link into the clinical app, but found: ${found.join(", ")}`).toEqual([]);
     // Non-vacuity: the one legitimate exit must still be there, or this test would also pass on a
     // sidebar with no links at all. The href is now a named constant shared by the rail and the
diff --git a/tests/ward-sidebar-phone-contract.test.ts b/tests/ward-sidebar-phone-contract.test.ts
index b2d2079ad9..5acfeedfdc 100644
--- a/tests/ward-sidebar-phone-contract.test.ts
+++ b/tests/ward-sidebar-phone-contract.test.ts
@@ -74,11 +74,10 @@ describe("Ward Flow sidebar — phone contract", () => {
   });
 
   it("reserves the fixed phone bar's height in every shell it floats above", () => {
-    const missing = shellFiles.filter((file) => !readModule(file).includes("padding-top: 3.5rem;"));
-    expect(
-      missing,
-      `shell(s) whose content would sit under the fixed phone bar: ${missing.join(", ")}`,
-    ).toEqual([]);
+    const missing = shellFiles.filter(
+      (file) => !readModule(file).includes("padding-top: var(--spacing-ward-phone-bar);"),
+    );
+    expect(missing, `shell(s) whose content would sit under the fixed phone bar: ${missing.join(", ")}`).toEqual([]);
   });
 
   it("pushes each shell's own sticky header below the phone bar rather than under it", () => {
@@ -90,7 +89,7 @@ describe("Ward Flow sidebar — phone contract", () => {
       expect(phoneBlock, `${file} has a sticky header still pinned to the viewport top`).not.toContain(
         "position: sticky;\n    top: 0;",
       );
-      expect(phoneBlock).toContain("top: 3.5rem;");
+      expect(phoneBlock).toContain("top: var(--spacing-ward-phone-bar);");
     }
   });
 });

From bfd3aa327477902621b6049400526d951510c648 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 04:42:39 +0800
Subject: [PATCH 50/54] docs(review): record PR 2373 repair audit

---
 ...68ea01cd69d3456de137cd89f6f366b1c34cf6f6ec88e70a99f.record.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 docs/branch-review-records/caf00bc10f3cb68ea01cd69d3456de137cd89f6f366b1c34cf6f6ec88e70a99f.record.md

diff --git a/docs/branch-review-records/caf00bc10f3cb68ea01cd69d3456de137cd89f6f366b1c34cf6f6ec88e70a99f.record.md b/docs/branch-review-records/caf00bc10f3cb68ea01cd69d3456de137cd89f6f366b1c34cf6f6ec88e70a99f.record.md
new file mode 100644
index 0000000000..50c7097ec0
--- /dev/null
+++ b/docs/branch-review-records/caf00bc10f3cb68ea01cd69d3456de137cd89f6f366b1c34cf6f6ec88e70a99f.record.md
@@ -0,0 +1 @@
+| 2026-08-25 | claude/ward-flow-phase-4-spec | 4d945ef7395a1e457d5d92ce10ec7f1dda328862 | PR #2373 CI failures, merge conflicts, and review-thread fixes | fixed seven review findings and merge conflicts | focused 120 tests passed before sidebar merge; design contract passed after sidebar merge; final focused rerun admission-deferred |

From 436fb8a306299f29c6f972d31ff51ccb6674d007 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 05:01:03 +0800
Subject: [PATCH 51/54] docs(ward-flow): update sandbox route references

---
 docs/ward-flow-phase-3-workspace/task-10-brief.md   | 2 +-
 docs/ward-flow-phase-3-workspace/task-10-report.md  | 2 +-
 docs/ward-flow-phase-3-workspace/task-11-brief.md   | 2 +-
 docs/ward-flow-phase-3-workspace/task-11-report.md  | 2 +-
 docs/ward-flow-phase-3-workspace/task-4-brief.md    | 6 +++---
 docs/ward-flow-phase-3-workspace/task-4-report.md   | 4 ++--
 docs/ward-flow-phase-3-workspace/task-4-review.md   | 6 +++---
 docs/ward-flow-phase-3-workspace/task-6-report.md   | 2 +-
 docs/ward-flow-phase-3-workspace/task-7-addendum.md | 2 +-
 docs/ward-flow-phase-3-workspace/task-7-report.md   | 2 +-
 docs/ward-flow-phase-3-workspace/task-8-addendum.md | 4 ++--
 docs/ward-flow-phase-3-workspace/task-8-brief.md    | 2 +-
 docs/ward-flow-phase-3-workspace/task-8-report.md   | 2 +-
 docs/ward-flow-phase-3-workspace/task-9-brief.md    | 2 +-
 docs/ward-flow-phase-3-workspace/task-9-report.md   | 2 +-
 15 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/docs/ward-flow-phase-3-workspace/task-10-brief.md b/docs/ward-flow-phase-3-workspace/task-10-brief.md
index 9a565e07da..ce65850598 100644
--- a/docs/ward-flow-phase-3-workspace/task-10-brief.md
+++ b/docs/ward-flow-phase-3-workspace/task-10-brief.md
@@ -3,7 +3,7 @@
 **Files:**
 
 - Create: `src/components/ward-management/tracker/live-tracker.tsx`
-- Modify: `src/app/ward-management/transport/page.tsx`, `tests/ui-ward-roles.spec.ts`
+- Modify: `src/app/mockups/ward-flow/transport/page.tsx`, `tests/ui-ward-roles.spec.ts`
 
 - [ ] **Step 1: Write the failing test**
 
diff --git a/docs/ward-flow-phase-3-workspace/task-10-report.md b/docs/ward-flow-phase-3-workspace/task-10-report.md
index 123426f712..d1abd55565 100644
--- a/docs/ward-flow-phase-3-workspace/task-10-report.md
+++ b/docs/ward-flow-phase-3-workspace/task-10-report.md
@@ -11,7 +11,7 @@ Commit: `b2e0a92aa` on `codex/ward-management-design`. Worktree:
   pure rendering helpers (`trackerRowState`, `stampAgeText`).
 - Created `tests/tracker-derivations.test.ts` — node-environment unit coverage over those
   helpers.
-- Modified `src/app/ward-management/transport/page.tsx` — mounts `LiveTracker` instead of
+- Modified `src/app/mockups/ward-flow/transport/page.tsx` — mounts `LiveTracker` instead of
   `WardModeWorkspace mode="transport"`.
 - Modified `tests/ui-ward-roles.spec.ts` — appended the brief's Step 1 test verbatim plus one
   strengthening test.
diff --git a/docs/ward-flow-phase-3-workspace/task-11-brief.md b/docs/ward-flow-phase-3-workspace/task-11-brief.md
index 33d2d6a05b..b10485ac7c 100644
--- a/docs/ward-flow-phase-3-workspace/task-11-brief.md
+++ b/docs/ward-flow-phase-3-workspace/task-11-brief.md
@@ -5,7 +5,7 @@ The last screen, and the one carrying both clocks. Spec §7.
 **Files:**
 
 - Create: `src/components/ward-management/ed/ed-screen.tsx`
-- Create: `src/app/ward-management/ed/[edId]/page.tsx`
+- Create: `src/app/mockups/ward-flow/ed/[edId]/page.tsx`
 - Modify: `tests/ui-ward-roles.spec.ts`, `adoption-contract.json`, `ward-management-navigation.tsx`
 
 - [ ] **Step 1: Write the failing test**
diff --git a/docs/ward-flow-phase-3-workspace/task-11-report.md b/docs/ward-flow-phase-3-workspace/task-11-report.md
index b4f43af321..1431cc07d6 100644
--- a/docs/ward-flow-phase-3-workspace/task-11-report.md
+++ b/docs/ward-flow-phase-3-workspace/task-11-report.md
@@ -7,7 +7,7 @@ of `b2e0a92aa`). Nothing else on the branch was touched.
 
 - Created: `src/components/ward-management/ed/ed-screen.tsx`
 - Created: `src/components/ward-management/ed/ed.module.css`
-- Created: `src/app/ward-management/ed/[edId]/page.tsx`
+- Created: `src/app/mockups/ward-flow/ed/[edId]/page.tsx`
 - Modified: `tests/ui-ward-roles.spec.ts` (appended the brief's test plus five more)
 - Modified: `src/components/ward-management/ward-management-navigation.tsx` (rail link)
 - Modified: `docs/design-system/adoption-contract.json`, `docs/design-system/adoption-manifest.json`,
diff --git a/docs/ward-flow-phase-3-workspace/task-4-brief.md b/docs/ward-flow-phase-3-workspace/task-4-brief.md
index 15761485aa..92e9967335 100644
--- a/docs/ward-flow-phase-3-workspace/task-4-brief.md
+++ b/docs/ward-flow-phase-3-workspace/task-4-brief.md
@@ -3,7 +3,7 @@
 **Files:**
 
 - Create: `src/components/ward-management/ward-flow-provider.tsx`
-- Create: `src/app/ward-management/layout.tsx`
+- Create: `src/app/mockups/ward-flow/layout.tsx`
 - Create: `tests/ward-flow-provider.dom.test.tsx`
 
 **Interfaces:**
@@ -81,7 +81,7 @@ const now = NOW_ANCHOR + elapsed + state.clockOffsetMinutes;
 
 `useWardFlow()` throws a named error when the context is absent — never a default empty state.
 
-`src/app/ward-management/layout.tsx` is a server component that renders `<WardFlowProvider>{children}</WardFlowProvider>`.
+`src/app/mockups/ward-flow/layout.tsx` is a server component that renders `<WardFlowProvider>{children}</WardFlowProvider>`.
 
 - [ ] **Step 4: Run to verify it passes**
 
@@ -102,7 +102,7 @@ Expected: 21 passed, 0 skipped. Adding a layout above the routes must change not
 
 ```bash
 npm run format
-git add src/components/ward-management/ward-flow-provider.tsx src/app/ward-management/layout.tsx tests/ward-flow-provider.dom.test.tsx
+git add src/components/ward-management/ward-flow-provider.tsx src/app/mockups/ward-flow/layout.tsx tests/ward-flow-provider.dom.test.tsx
 git commit -m "feat(ward-flow): add the state provider and the ticking clock"
 ```
 
diff --git a/docs/ward-flow-phase-3-workspace/task-4-report.md b/docs/ward-flow-phase-3-workspace/task-4-report.md
index 2fdb64dd8e..b04325a54a 100644
--- a/docs/ward-flow-phase-3-workspace/task-4-report.md
+++ b/docs/ward-flow-phase-3-workspace/task-4-report.md
@@ -28,7 +28,7 @@ undefined` guard in the effect, the `elapsed` and `now` formulas — is unchange
   `null`, following the exact pattern already used by `useAccountData` in
   `src/components/account-data-provider.tsx` (`if (!context) throw new Error(...)`).
 
-### `src/app/ward-management/layout.tsx` (new)
+### `src/app/mockups/ward-flow/layout.tsx` (new)
 
 - A server component (no `"use client"`, no hooks) that renders `<WardFlowProvider>{children}</WardFlowProvider>`.
   This is exactly the "Context providers" pattern documented in
@@ -199,6 +199,6 @@ used`) — confirmed untouched by this diff (`git diff --stat HEAD` on both retu
 ## Commit
 
 ```
-git add src/components/ward-management/ward-flow-provider.tsx src/app/ward-management/layout.tsx tests/ward-flow-provider.dom.test.tsx
+git add src/components/ward-management/ward-flow-provider.tsx src/app/mockups/ward-flow/layout.tsx tests/ward-flow-provider.dom.test.tsx
 git commit -m "feat(ward-flow): add the state provider and the ticking clock"
 ```
diff --git a/docs/ward-flow-phase-3-workspace/task-4-review.md b/docs/ward-flow-phase-3-workspace/task-4-review.md
index fc7fa19cfd..dfbb8edeb0 100644
--- a/docs/ward-flow-phase-3-workspace/task-4-review.md
+++ b/docs/ward-flow-phase-3-workspace/task-4-review.md
@@ -42,7 +42,7 @@
 
 4. **Clock mechanics otherwise sound.** Confirmed by grep: `wallClockNow`/`Date.now`/`new
 Date`/`performance.now`/`setInterval` appear nowhere else under `src/components/ward-management/**`
-   or `src/app/ward-management/**` except inside `ward-clock.ts` and this provider — no other
+   or `src/app/mockups/ward-flow/**` except inside `ward-clock.ts` and this provider — no other
    screen or module reads the wall clock. The pinned path returns from the effect before
    `setInterval` is ever called (not "start-then-ignore"), proven by the `setInterval` spy test.
    The interval is cleaned up (`return () => clearInterval(id)`). The reducer is seeded exactly
@@ -50,11 +50,11 @@ Date`/`performance.now`/`setInterval` appear nowhere else under `src/components/
    throws `"useWardFlow must be used within WardFlowProvider."`, matching the existing
    `useAccountData` convention in `src/components/account-data-provider.tsx` exactly.
 
-5. **`src/app/ward-management/layout.tsx` server/client boundary is correct per Next 16 docs.**
+5. **`src/app/mockups/ward-flow/layout.tsx` server/client boundary is correct per Next 16 docs.**
    Matches `node_modules/next/dist/docs/01-app/01-getting-started/05-server-and-client-components.md`
    § "Context providers" verbatim: an ordinary (non-`"use client"`) layout importing and rendering
    a `"use client"` provider around `children`, no hooks in the layout itself. No existing page
-   under `src/app/ward-management/**` calls `useWardFlow` yet, confirming "nothing should render
+   under `src/app/mockups/ward-flow/**` calls `useWardFlow` yet, confirming "nothing should render
    differently yet."
 
 6. **Fixture commit (`ward-movements.ts`) is sound.** The new pin test iterates a non-empty,
diff --git a/docs/ward-flow-phase-3-workspace/task-6-report.md b/docs/ward-flow-phase-3-workspace/task-6-report.md
index 5d5f4f4fc7..61b1dabde6 100644
--- a/docs/ward-flow-phase-3-workspace/task-6-report.md
+++ b/docs/ward-flow-phase-3-workspace/task-6-report.md
@@ -201,7 +201,7 @@ This is the decisive evidence for the task: the same movement, referred once on
 screen, was reflected by two different route components (`ward-management-modes.tsx`'s
 `QueueView`/`DecisionPanel` and its `MovementsView`) purely because both now read `movements` from
 the same `WardFlowProvider` instance that persists across client-side navigation in
-`src/app/ward-management/layout.tsx`. Before this task, `MovementsView` and `QueueView` read the
+`src/app/mockups/ward-flow/layout.tsx`. Before this task, `MovementsView` and `QueueView` read the
 frozen `wardMovements` array and would have kept showing WF-001 under "Placement requested"
 forever, disagreeing with the coordinator screen the whole session.
 
diff --git a/docs/ward-flow-phase-3-workspace/task-7-addendum.md b/docs/ward-flow-phase-3-workspace/task-7-addendum.md
index 62879f04ca..590b511c12 100644
--- a/docs/ward-flow-phase-3-workspace/task-7-addendum.md
+++ b/docs/ward-flow-phase-3-workspace/task-7-addendum.md
@@ -59,7 +59,7 @@ Before writing any fixed-position phone element, read `docs/search-chrome-behavi
 bind here.
 
 What I have already established for you, so you do not have to rediscover it: `/ward-management`
-is **not** inside the `(search-app)` route group, and `src/app/ward-management/layout.tsx` is only
+is **not** inside the `(search-app)` route group, and `src/app/mockups/ward-flow/layout.tsx` is only
 the `WardFlowProvider` — no global search shell, no phone composer dock. So a bottom-pinned bar on
 this route does **not** collide with the "one search composer per page" rule and there is no
 existing dock reserve to fight. Confirm that yourself before relying on it.
diff --git a/docs/ward-flow-phase-3-workspace/task-7-report.md b/docs/ward-flow-phase-3-workspace/task-7-report.md
index 8a3cdf650c..b0afd520d4 100644
--- a/docs/ward-flow-phase-3-workspace/task-7-report.md
+++ b/docs/ward-flow-phase-3-workspace/task-7-report.md
@@ -69,7 +69,7 @@ still be mid-resize. The constraint dissolves; nothing was deleted silently.
 
 ## R26: phone chrome contract
 
-Confirmed independently, not just taken on the controller's word: `src/app/ward-management/layout.tsx`
+Confirmed independently, not just taken on the controller's word: `src/app/mockups/ward-flow/layout.tsx`
 is only `<WardFlowProvider>{children}</WardFlowProvider>`, and `/ward-management` is not inside the
 `(search-app)` route group (`src/app/` has a separate `(search-app)` directory; `ward-management` is
 a sibling top-level route). So there is no `GlobalSearchShell`/`ClinicalDashboard` composer dock on
diff --git a/docs/ward-flow-phase-3-workspace/task-8-addendum.md b/docs/ward-flow-phase-3-workspace/task-8-addendum.md
index 9f0f17a8fe..0c98d91ddf 100644
--- a/docs/ward-flow-phase-3-workspace/task-8-addendum.md
+++ b/docs/ward-flow-phase-3-workspace/task-8-addendum.md
@@ -170,9 +170,9 @@ red — which is the guard working. Run it and quote its output.
 ## R39b — the adoption contract entry
 
 `docs/design-system/adoption-contract.json` has a `ward-management` surface starting around line 490
-listing route files under `"src/app/ward-management/..."` and component files under
+listing route files under `"src/app/mockups/ward-flow/..."` and component files under
 `"src/components/ward-management/..."`. Add your new route
-(`src/app/ward-management/ward/[unitId]/page.tsx`) and your new component
+(`src/app/mockups/ward-flow/ward/[unitId]/page.tsx`) and your new component
 (`src/components/ward-management/ward/ward-screen.tsx`) to the matching arrays, keeping the existing
 ordering convention, then run `npm run design-system:adoption:update` and commit whatever it
 regenerates.
diff --git a/docs/ward-flow-phase-3-workspace/task-8-brief.md b/docs/ward-flow-phase-3-workspace/task-8-brief.md
index e2a97fe6ff..25ab518590 100644
--- a/docs/ward-flow-phase-3-workspace/task-8-brief.md
+++ b/docs/ward-flow-phase-3-workspace/task-8-brief.md
@@ -3,7 +3,7 @@
 **Files:**
 
 - Create: `src/components/ward-management/ward/ward-screen.tsx`
-- Create: `src/app/ward-management/ward/[unitId]/page.tsx`
+- Create: `src/app/mockups/ward-flow/ward/[unitId]/page.tsx`
 - Create: `tests/ui-ward-roles.spec.ts`
 - Modify: `playwright.config.ts`, `docs/design-system/adoption-contract.json`, `ward-management-navigation.tsx`
 
diff --git a/docs/ward-flow-phase-3-workspace/task-8-report.md b/docs/ward-flow-phase-3-workspace/task-8-report.md
index 20aadc43f5..2dd437110a 100644
--- a/docs/ward-flow-phase-3-workspace/task-8-report.md
+++ b/docs/ward-flow-phase-3-workspace/task-8-report.md
@@ -8,7 +8,7 @@
   local token set on `.screen`, following the same convention as `coordinator.module.css` and
   `ward-management.module.css` — CSS Modules scope per file, so their local tokens are not
   reachable from this one).
-- `src/app/ward-management/ward/[unitId]/page.tsx` — the route. Next 16 async `params`
+- `src/app/mockups/ward-flow/ward/[unitId]/page.tsx` — the route. Next 16 async `params`
   (`Promise<{ unitId: string }>`), matching `patients/[patientId]/page.tsx`'s exact pattern.
 - `tests/ui-ward-roles.spec.ts` — Playwright, two tests (brief's test + R40's).
 - `tests/ward-screen.dom.test.tsx` — jsdom, three tests (R38's restriction-notice coverage plus a
diff --git a/docs/ward-flow-phase-3-workspace/task-9-brief.md b/docs/ward-flow-phase-3-workspace/task-9-brief.md
index e613de95a2..5c4dcc7fde 100644
--- a/docs/ward-flow-phase-3-workspace/task-9-brief.md
+++ b/docs/ward-flow-phase-3-workspace/task-9-brief.md
@@ -3,7 +3,7 @@
 **Files:**
 
 - Create: `src/components/ward-management/officer/officer-screen.tsx`
-- Create: `src/app/ward-management/transport/officer/page.tsx`
+- Create: `src/app/mockups/ward-flow/transport/officer/page.tsx`
 - Modify: `tests/ui-ward-roles.spec.ts`, `adoption-contract.json`, `ward-management-navigation.tsx`
 
 - [ ] **Step 1: Write the failing test**
diff --git a/docs/ward-flow-phase-3-workspace/task-9-report.md b/docs/ward-flow-phase-3-workspace/task-9-report.md
index 57b34add39..2a88b5c5f6 100644
--- a/docs/ward-flow-phase-3-workspace/task-9-report.md
+++ b/docs/ward-flow-phase-3-workspace/task-9-report.md
@@ -8,7 +8,7 @@ Worktree: `C:\Users\joshs\.codex\worktrees\ward-management-design\Database`, bra
 - `src/components/ward-management/officer/officer-screen.tsx` — `OfficerScreen`.
 - `src/components/ward-management/officer/officer.module.css` — its styles, local tokens on
   `.screen` per the file convention `ward.module.css` documents.
-- `src/app/ward-management/transport/officer/page.tsx` — the route.
+- `src/app/mockups/ward-flow/transport/officer/page.tsx` — the route.
 - `src/components/ward-management/ward-sites.ts` — added `edById`, matching `unitById`'s shape
   (the Task 9-12 preflight's "no `edById`" note said this was preferable to an inline `.find()`).
 - `src/components/ward-management/ward-management-navigation.tsx` — one raw `<Link>` in

From 16a65c8432a95ae857c8766ad961cdf32d76567b Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 05:02:16 +0800
Subject: [PATCH 52/54] docs(review): supersede PR 2373 audit record

---
 ...6cb820c7c585ed285ceb863a5aa2f9902ebe83d831fab2df066.record.md | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 docs/branch-review-records/3695bb07ddb686cb820c7c585ed285ceb863a5aa2f9902ebe83d831fab2df066.record.md

diff --git a/docs/branch-review-records/3695bb07ddb686cb820c7c585ed285ceb863a5aa2f9902ebe83d831fab2df066.record.md b/docs/branch-review-records/3695bb07ddb686cb820c7c585ed285ceb863a5aa2f9902ebe83d831fab2df066.record.md
new file mode 100644
index 0000000000..2ef538d4f2
--- /dev/null
+++ b/docs/branch-review-records/3695bb07ddb686cb820c7c585ed285ceb863a5aa2f9902ebe83d831fab2df066.record.md
@@ -0,0 +1 @@
+| 2026-08-25 | claude/ward-flow-phase-4-spec | 436fb8a306299f29c6f972d31ff51ccb6674d007 | PR #2373 CI failures, merge conflicts, and review-thread fixes | fixed seven review findings, merge conflicts, and stale sandbox document links | focused 120 tests passed; design contract and docs link check passed; exact-head hosted static rerun pending |

From 839ceb052d7ff23fc24ff5a943451d60ad8150ed Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 05:08:54 +0800
Subject: [PATCH 53/54] style(ward-flow): separate mode shell tokens

---
 src/components/ward-management/ward-management-modes.module.css | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/components/ward-management/ward-management-modes.module.css b/src/components/ward-management/ward-management-modes.module.css
index 066b5b7069..e9bcfebb8b 100644
--- a/src/components/ward-management/ward-management-modes.module.css
+++ b/src/components/ward-management/ward-management-modes.module.css
@@ -37,6 +37,7 @@
   --ward-radius-round: 50%;
   --ward-z-base: 1;
   --ward-z-phone: 20;
+
   display: grid;
   height: 100dvh;
   min-height: 44rem;

From a4c696d7f089cf5d17998412f578dc3a473cef20 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Wed, 26 Aug 2026 05:14:54 +0800
Subject: [PATCH 54/54] fix(ward-flow): synchronize route and spacing contracts

---
 data/repo-awareness-snapshot.json | 204 +++++++++++++++++++-----------
 src/lib/tailwind-merge.ts         |   1 +
 2 files changed, 131 insertions(+), 74 deletions(-)

diff --git a/data/repo-awareness-snapshot.json b/data/repo-awareness-snapshot.json
index 4c783dca91..692d7ca66a 100644
--- a/data/repo-awareness-snapshot.json
+++ b/data/repo-awareness-snapshot.json
@@ -1,8 +1,8 @@
 {
   "version": "repo-awareness-snapshot-v1",
   "captured_revision": {
-    "sha": "a5d918057c1fb8103f8aa3b57b8c4056aea533c6",
-    "committed_at": "2026-08-26T00:44:09+08:00"
+    "sha": "16a65c8432a95ae857c8766ad961cdf32d76567b",
+    "committed_at": "2026-08-26T05:02:16+08:00"
   },
   "routes": {
     "modes": [
@@ -878,6 +878,81 @@
         "file": "src/app/mockups/verification-notice-subtle/page.tsx",
         "area": "mockup"
       },
+      {
+        "path": "/mockups/ward-flow",
+        "file": "src/app/mockups/ward-flow/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/capacity",
+        "file": "src/app/mockups/ward-flow/capacity/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/ed/[edId]",
+        "file": "src/app/mockups/ward-flow/ed/[edId]/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/escalation",
+        "file": "src/app/mockups/ward-flow/escalation/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/exceptions",
+        "file": "src/app/mockups/ward-flow/exceptions/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/governance",
+        "file": "src/app/mockups/ward-flow/governance/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/handover",
+        "file": "src/app/mockups/ward-flow/handover/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/movements",
+        "file": "src/app/mockups/ward-flow/movements/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/network",
+        "file": "src/app/mockups/ward-flow/network/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/patients/[patientId]",
+        "file": "src/app/mockups/ward-flow/patients/[patientId]/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/queue",
+        "file": "src/app/mockups/ward-flow/queue/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/search",
+        "file": "src/app/mockups/ward-flow/search/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/transport",
+        "file": "src/app/mockups/ward-flow/transport/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/transport/officer",
+        "file": "src/app/mockups/ward-flow/transport/officer/page.tsx",
+        "area": "mockup"
+      },
+      {
+        "path": "/mockups/ward-flow/ward/[unitId]",
+        "file": "src/app/mockups/ward-flow/ward/[unitId]/page.tsx",
+        "area": "mockup"
+      },
       {
         "path": "/mockups/warning-consolidation",
         "file": "src/app/mockups/warning-consolidation/page.tsx",
@@ -982,66 +1057,6 @@
         "path": "/tools",
         "file": "src/app/(search-app)/tools/page.tsx",
         "area": "product"
-      },
-      {
-        "path": "/ward-management",
-        "file": "src/app/ward-management/page.tsx",
-        "area": "product"
-      },
-      {
-        "path": "/ward-management/capacity",
-        "file": "src/app/ward-management/capacity/page.tsx",
-        "area": "product"
-      },
-      {
-        "path": "/ward-management/ed/[edId]",
-        "file": "src/app/ward-management/ed/[edId]/page.tsx",
-        "area": "product"
-      },
-      {
-        "path": "/ward-management/exceptions",
-        "file": "src/app/ward-management/exceptions/page.tsx",
-        "area": "product"
-      },
-      {
-        "path": "/ward-management/governance",
-        "file": "src/app/ward-management/governance/page.tsx",
-        "area": "product"
-      },
-      {
-        "path": "/ward-management/movements",
-        "file": "src/app/ward-management/movements/page.tsx",
-        "area": "product"
-      },
-      {
-        "path": "/ward-management/network",
-        "file": "src/app/ward-management/network/page.tsx",
-        "area": "product"
-      },
-      {
-        "path": "/ward-management/patients/[patientId]",
-        "file": "src/app/ward-management/patients/[patientId]/page.tsx",
-        "area": "product"
-      },
-      {
-        "path": "/ward-management/queue",
-        "file": "src/app/ward-management/queue/page.tsx",
-        "area": "product"
-      },
-      {
-        "path": "/ward-management/transport",
-        "file": "src/app/ward-management/transport/page.tsx",
-        "area": "product"
-      },
-      {
-        "path": "/ward-management/transport/officer",
-        "file": "src/app/ward-management/transport/officer/page.tsx",
-        "area": "product"
-      },
-      {
-        "path": "/ward-management/ward/[unitId]",
-        "file": "src/app/ward-management/ward/[unitId]/page.tsx",
-        "area": "product"
       }
     ],
     "redirects": [
@@ -1110,6 +1125,11 @@
         "file": "src/app/mockups/medication-prescribing/page.tsx",
         "target": "/medications/acamprosate"
       },
+      {
+        "path": "/mockups/ward-flow/constellation",
+        "file": "src/app/mockups/ward-flow/constellation/page.tsx",
+        "target": "/mockups/ward-flow/network"
+      },
       {
         "path": "/services",
         "file": "src/app/(search-app)/services/page.tsx",
@@ -1124,11 +1144,6 @@
         "path": "/therapy-compass",
         "file": "src/app/(search-app)/therapy-compass/page.tsx",
         "target": "/?mode=therapy-compass"
-      },
-      {
-        "path": "/ward-management/constellation",
-        "file": "src/app/ward-management/constellation/page.tsx",
-        "target": "/ward-management/network"
       }
     ],
     "api": [
@@ -1359,9 +1374,9 @@
     ],
     "counts": {
       "modes": 15,
-      "pages": 189,
-      "product_pages": 67,
-      "mockup_pages": 122,
+      "pages": 192,
+      "product_pages": 55,
+      "mockup_pages": 137,
       "redirects": 17,
       "api": 56
     }
@@ -2918,6 +2933,26 @@
         "section": "superpowers",
         "catalogued": false
       },
+      {
+        "path": "docs/superpowers/plans/2026-08-25-ward-flow-phase-4-specialist-boards.md",
+        "section": "superpowers",
+        "catalogued": false
+      },
+      {
+        "path": "docs/superpowers/plans/2026-08-25-ward-flow-sandbox-and-design-repair.md",
+        "section": "superpowers",
+        "catalogued": false
+      },
+      {
+        "path": "docs/superpowers/plans/2026-08-25-ward-flow-standalone-and-nav-repair.md",
+        "section": "superpowers",
+        "catalogued": false
+      },
+      {
+        "path": "docs/superpowers/plans/2026-08-26-ward-flow-sidebar-house-pattern.md",
+        "section": "superpowers",
+        "catalogued": false
+      },
       {
         "path": "docs/superpowers/rag-upgrade/canonical/approval-matrix.md",
         "section": "superpowers",
@@ -3193,6 +3228,11 @@
         "section": "superpowers",
         "catalogued": false
       },
+      {
+        "path": "docs/superpowers/specs/2026-08-25-ward-flow-phase-4-specialist-boards-design.md",
+        "section": "superpowers",
+        "catalogued": false
+      },
       {
         "path": "docs/testing.md",
         "section": "root",
@@ -3581,9 +3621,9 @@
       }
     ],
     "counts": {
-      "documents": 431,
+      "documents": 436,
       "catalogued": 102,
-      "uncatalogued": 329,
+      "uncatalogued": 334,
       "sections": 18
     }
   },
@@ -3628,6 +3668,22 @@
         "outcome": "Reviewed and reworked: settings search index, phone/tablet section rail, 768px two-column seam, ConfirmDialog on both destructive privacy actions plus a scoped app-only reset, real preference sync state replacing two swallowed catches, new saveRecentSearches privacy gate, corrected platform-aware shortcuts, persistent live regions. Answer style deliberately left inert (protected RAG surface). PR #2364.",
         "checks": "verify:pr-local exit 0 (18 gates, none failed; 815 test files, 9853 passed); verify:cheap exit 0; focused Chromium pass at 320/390/768/1280 caught and fixed a duplicate native search-clear glyph; check:production-readiness fails only on pre-existing privacy-register items byte-identical to origin/main"
       },
+      {
+        "date": "2026-08-25",
+        "ref": "claude/ward-flow-phase-4-spec",
+        "head": "436fb8a306299f29c6f972d31ff51ccb6674d007",
+        "scope": "PR #2373 CI failures, merge conflicts, and review-thread fixes",
+        "outcome": "fixed seven review findings, merge conflicts, and stale sandbox document links",
+        "checks": "focused 120 tests passed; design contract and docs link check passed; exact-head hosted static rerun pending"
+      },
+      {
+        "date": "2026-08-25",
+        "ref": "claude/ward-flow-phase-4-spec",
+        "head": "4d945ef7395a1e457d5d92ce10ec7f1dda328862",
+        "scope": "PR #2373 CI failures, merge conflicts, and review-thread fixes",
+        "outcome": "fixed seven review findings and merge conflicts",
+        "checks": "focused 120 tests passed before sidebar merge; design contract passed after sidebar merge; final focused rerun admission-deferred"
+      },
       {
         "date": "2026-08-24",
         "ref": "2354",
@@ -24502,8 +24558,8 @@
       }
     ],
     "counts": {
-      "records": 2613,
-      "refs": 1593
+      "records": 2615,
+      "refs": 1594
     }
   }
 }
diff --git a/src/lib/tailwind-merge.ts b/src/lib/tailwind-merge.ts
index 30eff84e41..6d3bfb06e7 100644
--- a/src/lib/tailwind-merge.ts
+++ b/src/lib/tailwind-merge.ts
@@ -109,6 +109,7 @@ export const CLINICAL_TWMERGE_THEME = {
     "specifier-map-jump",
     "specifier-map-step-number",
     "tap",
+    "ward-phone-bar",
   ],
 
   // globals.css @theme --ease-*.