From 88ae7c315980a035a6904fb6bb6140b2445875c2 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 26 Oct 2026 08:27:51 +0000
Subject: [PATCH 01/11] Plain wording for medicine record, AI summary label,
 Clinical Ask limits (D26-06, D26-09, D26-10, D26-12)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYsGZ5ecrWh4xL76inGoAq
---
 .../use-medication-catalog.ts                 | 19 ++++++--
 .../document-clinical-summary.tsx             | 10 ++++-
 src/lib/answer-limit-copy.ts                  | 44 +++++++++++++++++++
 src/lib/clinical-ask/client-stream.ts         | 30 ++++++++++---
 tests/clinical-ask-stream-contract.test.ts    | 34 +++++++++++++-
 tests/document-clinical-summary.dom.test.tsx  |  9 ++++
 tests/medication-catalog-errors.dom.test.tsx  | 20 ++++++++-
 7 files changed, 152 insertions(+), 14 deletions(-)
 create mode 100644 src/lib/answer-limit-copy.ts

diff --git a/src/components/clinical-dashboard/use-medication-catalog.ts b/src/components/clinical-dashboard/use-medication-catalog.ts
index d68a1a287f..f49c5083b5 100644
--- a/src/components/clinical-dashboard/use-medication-catalog.ts
+++ b/src/components/clinical-dashboard/use-medication-catalog.ts
@@ -205,6 +205,21 @@ function medicationCatalogErrorMessage(error: unknown, timedOut: boolean): strin
   return "Could not load medications. Try again in a moment.";
 }
 
+/**
+ * Plain words for a medicine record that would not load, with the status kept as a short code
+ * for reporting a fault. The record page shows this on its Details line, which used to read a
+ * bare "Request failed (503)" (design audit D26-12).
+ */
+function medicationRecordErrorMessage(error: unknown): string {
+  if (!(error instanceof MedicationRequestError)) return "Could not load this medicine.";
+  const code = `Code ${error.status}.`;
+  if (error.status === 401) return `Your sign-in has ended. Sign in again to view this medicine. ${code}`;
+  if (error.status === 429) return `Too many requests in a short time. Wait a moment, then try again. ${code}`;
+  if (error.status === 404) return `This medicine wasn’t found. ${code}`;
+  if (error.status >= 500) return `The medicines service is busy or unavailable. Try again in a minute. ${code}`;
+  return `This medicine couldn’t be loaded. ${code}`;
+}
+
 async function responseErrorCode(response: Response): Promise<string | null> {
   try {
     const body = jsonObject(await response.json());
@@ -427,9 +442,7 @@ export function useMedicationDetail(slug?: string): MedicationDetailState {
           loading: false,
           error: isOffline
             ? "You are offline. Connect to view this medication."
-            : error instanceof Error
-              ? error.message
-              : "Could not load medication.",
+            : medicationRecordErrorMessage(error),
           notFoundCode:
             error instanceof MedicationRequestError && error.status === 404 && error.code === "medication_not_found",
         });
diff --git a/src/components/document-viewer/document-clinical-summary.tsx b/src/components/document-viewer/document-clinical-summary.tsx
index 43b0a91bfd..44c40da0c5 100644
--- a/src/components/document-viewer/document-clinical-summary.tsx
+++ b/src/components/document-viewer/document-clinical-summary.tsx
@@ -435,6 +435,14 @@ export function DocumentClinicalSummary({
               </span>
             ) : null}
           </div>
+          {/* A model wrote this summary and the priorities below when the file was indexed, so it is
+              labelled as AI, as answers are; unlabelled it read as the document's own words (D26-06). */}
+          <p data-testid="document-ai-summary-label" className={cn("mt-2 text-xs leading-5", textMuted)}>
+            <span className="mr-1.5 inline-flex min-h-6 items-center rounded-md bg-[color:var(--surface-subtle)] px-2 text-3xs font-bold uppercase tracking-label text-[color:var(--text-heading)]">
+              AI summary
+            </span>
+            Written by AI from this document when it was added. Check each point against the page it links to.
+          </p>
           {model.summary ? (
             <p
               className={cn(
@@ -548,7 +556,7 @@ export function DocumentClinicalSummary({
         onClose={() => setMobilePrioritiesOpen(false)}
         returnFocusRef={mobilePrioritiesButtonRef}
         title="Clinical priorities"
-        description="Expanded, source-linked clinical detail"
+        description="AI summary of this document. Check each point against the page it links to."
         headerLeading={
           <span className="grid h-9 w-9 place-items-center rounded-lg bg-[color:var(--clinical-accent)] text-[color:var(--clinical-accent-contrast)] shadow-[var(--e1)]">
             <ListChecks aria-hidden="true" className="h-4 w-4" strokeWidth={2} />
diff --git a/src/lib/answer-limit-copy.ts b/src/lib/answer-limit-copy.ts
new file mode 100644
index 0000000000..117829764a
--- /dev/null
+++ b/src/lib/answer-limit-copy.ts
@@ -0,0 +1,44 @@
+/**
+ * Plain words for an answer that cannot run right now because of a limit, shared by the dashboard
+ * answer and Clinical Ask. Before this the screen offered Retry at the daily cap and counted the wait
+ * in seconds ("Try again in 86400 seconds"), design audit D26-09 and D26-10.
+ */
+
+/** The 429 code a signed-in account's daily generation cap answers with (`api-rate-limit.ts`). */
+export const ANSWER_DAILY_LIMIT_CODE = "generation_daily_cap";
+
+function sameLocalDay(a: Date, b: Date) {
+  return a.getFullYear() === b.getFullYear() && a.getMonth() === b.getMonth() && a.getDate() === b.getDate();
+}
+
+function clockTime(date: Date) {
+  return date.toLocaleTimeString("en-AU", { hour: "numeric", minute: "2-digit" });
+}
+
+/** "from 7:40 pm", "from 7:40 am tomorrow", or null when the wait is unknown. */
+export function answerLimitResumeTime(retryAfterMs: number | null | undefined, now = Date.now()): string | null {
+  if (typeof retryAfterMs !== "number" || !Number.isFinite(retryAfterMs) || retryAfterMs <= 0) return null;
+  const resume = new Date(now + retryAfterMs);
+  const today = new Date(now);
+  const tomorrow = new Date(today.getFullYear(), today.getMonth(), today.getDate() + 1);
+  if (sameLocalDay(resume, today)) return `from ${clockTime(resume)}`;
+  if (sameLocalDay(resume, tomorrow)) return `from ${clockTime(resume)} tomorrow`;
+  return null;
+}
+
+export function answerDailyLimitMessage(retryAfterMs: number | null | undefined, now = Date.now()): string {
+  const resume = answerLimitResumeTime(retryAfterMs, now);
+  return `You've used today's answers. ${
+    resume ? `You can ask again ${resume}.` : "You can ask again later."
+  } Search, the library and every tool still work.`;
+}
+
+/** A short burst limit, not the daily cap: the wait is seconds to minutes, never a raw count. */
+export function answerBurstLimitMessage(retryAfterMs: number | null | undefined): string {
+  const minutes =
+    typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) && retryAfterMs > 0
+      ? Math.ceil(retryAfterMs / 60_000)
+      : null;
+  const wait = minutes && minutes > 1 ? `about ${minutes} minutes` : "a minute";
+  return `Too many questions in a short time. Wait ${wait}, then try again.`;
+}
diff --git a/src/lib/clinical-ask/client-stream.ts b/src/lib/clinical-ask/client-stream.ts
index 9c46b99291..d2e28dbb93 100644
--- a/src/lib/clinical-ask/client-stream.ts
+++ b/src/lib/clinical-ask/client-stream.ts
@@ -1,5 +1,10 @@
 import type { ClinicalAskFinalPayload, ClinicalAskRequest, ClinicalAskStreamEvent } from "@/lib/clinical-ask/contracts";
 import { parseClinicalAskSseFrame } from "@/lib/clinical-ask-stream-contract";
+import {
+  ANSWER_DAILY_LIMIT_CODE,
+  answerBurstLimitMessage,
+  answerDailyLimitMessage,
+} from "@/lib/answer-limit-copy";
 
 type ClientFailureCode = "aborted" | "internal_error" | "unauthorized" | "rate_limited";
 
@@ -14,13 +19,14 @@ function failedPayload(
   request: ClinicalAskRequest,
   code: ClientFailureCode,
   message?: string,
+  retryable = code === "internal_error" || code === "rate_limited",
 ): ClinicalAskFinalPayload {
   return {
     response: {
       state: "failed",
       mode: request.mode,
       code,
-      retryable: code === "internal_error" || code === "rate_limited",
+      retryable,
       message: message ?? failureMessages[code],
     },
     feedback: null,
@@ -49,13 +55,23 @@ async function rejectedPayload(request: ClinicalAskRequest, response: Response):
   if (response.status === 401) return failedPayload(request, "unauthorized");
   if (response.status !== 429) return failedPayload(request, "internal_error");
   const body: unknown = await response.json().catch(() => null);
-  const serverMessage =
-    body && typeof body === "object" && "message" in body && typeof (body as { message: unknown }).message === "string"
-      ? (body as { message: string }).message.trim()
-      : "";
   const seconds = retryAfterSeconds(response, body);
-  const wait = seconds ? `Try again in ${seconds} seconds.` : "Try again shortly.";
-  return failedPayload(request, "rate_limited", `${serverMessage || failureMessages.rate_limited} ${wait}`);
+  const retryAfterMs = seconds ? seconds * 1000 : null;
+  // The daily cap cannot clear on Retry, so it is not offered, and the wait is a clock time
+  // rather than "Try again in 86400 seconds" (design audit D26-09, D26-10).
+  if (rateLimitCode(body) === ANSWER_DAILY_LIMIT_CODE) {
+    return failedPayload(request, "rate_limited", answerDailyLimitMessage(retryAfterMs), false);
+  }
+  return failedPayload(request, "rate_limited", answerBurstLimitMessage(retryAfterMs));
+}
+
+function rateLimitCode(body: unknown): string | null {
+  if (!body || typeof body !== "object") return null;
+  const code = (body as { code?: unknown }).code;
+  if (typeof code === "string") return code;
+  const details = (body as { details?: unknown }).details;
+  const detailsCode = details && typeof details === "object" ? (details as { code?: unknown }).code : undefined;
+  return typeof detailsCode === "string" ? detailsCode : null;
 }
 
 export async function streamClinicalAsk(
diff --git a/tests/clinical-ask-stream-contract.test.ts b/tests/clinical-ask-stream-contract.test.ts
index a21b2db7b9..15ede86f10 100644
--- a/tests/clinical-ask-stream-contract.test.ts
+++ b/tests/clinical-ask-stream-contract.test.ts
@@ -168,8 +168,38 @@ describe("Clinical Ask SSE contract", () => {
     expect(result.feedback).toBeNull();
     expect(result.response).toMatchObject({ state: "failed", mode: "services", code: "rate_limited", retryable: true });
     if (result.response.state === "failed") {
-      expect(result.response.message).toContain("Too many Clinical Ask requests.");
-      expect(result.response.message).toContain("42 seconds");
+      // The wait reads as plain time, never a raw count of seconds (design audit D26-10).
+      expect(result.response.message).toBe("Too many questions in a short time. Wait a minute, then try again.");
+      expect(result.response.message).not.toMatch(/seconds/);
+    }
+  });
+
+  it("does not offer Retry at the daily answer cap and says when it resets (D26-09, D26-10)", async () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date(2026, 9, 26, 9, 0, 0));
+    try {
+      vi.stubGlobal(
+        "fetch",
+        vi.fn().mockResolvedValue(
+          Response.json(
+            {
+              error: "Daily limit reached.",
+              message: "This account has reached its daily limit for generated answers.",
+              code: "generation_daily_cap",
+            },
+            { status: 429, headers: { "Retry-After": String(10 * 60 * 60 + 40 * 60) } },
+          ),
+        ),
+      );
+      const result = await streamClinicalAsk(streamRequest, new AbortController().signal, vi.fn());
+      expect(result.response).toMatchObject({ state: "failed", code: "rate_limited", retryable: false });
+      if (result.response.state === "failed") {
+        expect(result.response.message).toContain("You've used today's answers.");
+        expect(result.response.message).toMatch(/You can ask again from 7:40\s?pm\./);
+        expect(result.response.message).not.toMatch(/seconds|86400/);
+      }
+    } finally {
+      vi.useRealTimers();
     }
   });
 
diff --git a/tests/document-clinical-summary.dom.test.tsx b/tests/document-clinical-summary.dom.test.tsx
index f6418fe1f1..f3d735214c 100644
--- a/tests/document-clinical-summary.dom.test.tsx
+++ b/tests/document-clinical-summary.dom.test.tsx
@@ -43,6 +43,15 @@ const document = {
 } as ClinicalDocument;
 
 describe("DocumentClinicalSummary", () => {
+  // D26-06: a model wrote the summary at indexing, so it must never read as the document's own words.
+  it("labels the summary as written by AI", () => {
+    render(<DocumentClinicalSummary document={document} pageHref={(page) => `?page=${page}`} onPageChange={vi.fn()} />);
+
+    const label = screen.getByTestId("document-ai-summary-label");
+    expect(label).toHaveTextContent("AI summary");
+    expect(label).toHaveTextContent("Written by AI from this document when it was added.");
+  });
+
   it("expands the mobile summary without introducing a visible control row", () => {
     render(<DocumentClinicalSummary document={document} pageHref={(page) => `?page=${page}`} onPageChange={vi.fn()} />);
 
diff --git a/tests/medication-catalog-errors.dom.test.tsx b/tests/medication-catalog-errors.dom.test.tsx
index e9def578f9..82cfe03afd 100644
--- a/tests/medication-catalog-errors.dom.test.tsx
+++ b/tests/medication-catalog-errors.dom.test.tsx
@@ -5,7 +5,7 @@
 import { act, renderHook } from "@testing-library/react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-import { useMedicationCatalog } from "@/components/clinical-dashboard/use-medication-catalog";
+import { useMedicationCatalog, useMedicationDetail } from "@/components/clinical-dashboard/use-medication-catalog";
 
 vi.mock("@/lib/supabase/client", () => ({
   useAuthSession: () => ({ authorizationHeader: undefined, session: null, status: "authenticated" }),
@@ -62,3 +62,21 @@ describe("useMedicationCatalog failure wording", () => {
     expect(result.current.error).toMatch(/taking too long/);
   });
 });
+
+// D26-12: the record page's Details line read a bare "Request failed (503)".
+describe("useMedicationDetail failure wording", () => {
+  it.each([
+    [503, /medicines service is busy or unavailable/],
+    [429, /Too many requests/],
+    [401, /Sign in again/],
+  ])("turns a %i into plain words and keeps the code", async (status, expected) => {
+    fetchMock.mockResolvedValue(new Response("{}", { status }));
+    const { result } = renderHook(() => useMedicationDetail("clozapine"));
+    await settle();
+
+    expect(result.current.loading).toBe(false);
+    expect(result.current.error).toMatch(expected);
+    expect(result.current.error).toContain(`Code ${status}.`);
+    expect(result.current.error).not.toMatch(/Request failed/);
+  });
+});

From 28ba965db585f38a3a3662efc506d9ce67cb4375 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 26 Oct 2026 08:35:34 +0000
Subject: [PATCH 02/11] Plain answer errors, Sign in and send, offline wording,
 Clinical Ask stall prompt (D26-05, D26-08 to D26-11)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYsGZ5ecrWh4xL76inGoAq
---
 src/components/ClinicalDashboard.tsx          | 24 +++++++
 .../clinical-dashboard/answer-request.ts      |  3 +-
 .../clinical-ask-workspace.tsx                | 37 +++++++++++
 .../dashboard-search-error-state.tsx          | 66 ++++++++++++++++++-
 .../clinical-dashboard/search-utils.ts        | 38 ++++++++++-
 .../use-dashboard-search-execution.ts         | 21 ++++--
 .../front-door/ask-terms-not-now.ts           |  5 +-
 src/lib/patient-check-unavailable-copy.ts     | 14 ++++
 tests/clinical-ask-workspace.dom.test.tsx     | 37 ++++++++++-
 tests/clinical-dashboard-search-utils.test.ts | 40 +++++++++++
 .../dashboard-search-error-state.dom.test.tsx | 39 +++++++++--
 tests/patient-check-unavailable-copy.test.ts  | 20 ++++++
 12 files changed, 322 insertions(+), 22 deletions(-)
 create mode 100644 src/lib/patient-check-unavailable-copy.ts
 create mode 100644 tests/patient-check-unavailable-copy.test.ts

diff --git a/src/components/ClinicalDashboard.tsx b/src/components/ClinicalDashboard.tsx
index a0043c5a61..d299ad19a7 100644
--- a/src/components/ClinicalDashboard.tsx
+++ b/src/components/ClinicalDashboard.tsx
@@ -446,6 +446,7 @@ function ClinicalDashboardContent({
   // while `error` is truthy, and set alongside every `setError(<message>)` so a
   // stale value can never leak into a later, unrelated error.
   const [errorKind, setErrorKind] = useState<AnswerErrorKind | null>(null);
+  const [errorDetail, setErrorDetail] = useState<{ message: string; detail: string } | null>(null);
   const [lastFailedQuery, setLastFailedQuery] = useState<string | null>(null);
   const [setupWarning, setSetupWarning] = useState<string | null>(null);
   const [setupChecks, setSetupChecks] = useState<SetupCheck[]>(fallbackSetupChecks);
@@ -951,6 +952,7 @@ function ClinicalDashboardContent({
     setRestoredAnswerSavedAt,
     setError,
     setErrorKind,
+    setErrorDetail,
     setLastFailedQuery,
     setDemoMode,
     setActionNotice,
@@ -1100,6 +1102,21 @@ function ClinicalDashboardContent({
     askRef.current = ask;
   });
 
+  // Sign in and send (D26-05): a question an expired sign-in held back goes once the person is
+  // signed in again. Any newer search or cleared error drops the pending send.
+  const pendingSignInResendRef = useRef<string | null>(null);
+  useEffect(() => {
+    if (!error) pendingSignInResendRef.current = null;
+  }, [error]);
+  useEffect(() => {
+    if (authStatus !== "authenticated") return;
+    const held = pendingSignInResendRef.current;
+    if (!held) return;
+    pendingSignInResendRef.current = null;
+    setError(null);
+    void askRef.current(held);
+  }, [authStatus]);
+
   useEffect(() => {
     const trimmedQuery = query.trim();
     const submittedSearchText = searchMode === "answer" && submittedUrlQuery ? submittedUrlQuery : trimmedQuery;
@@ -2156,6 +2173,7 @@ function ClinicalDashboardContent({
                     errorKind={errorKind}
                     activeModeResultKind={activeModeResultKind}
                     documentsResultsOwnError={documentsResultsOwnError}
+                    errorDetail={errorDetail?.message === error ? errorDetail.detail : null}
                     lastFailedQuery={lastFailedQuery}
                     query={query}
                     onRephrase={() => focusComposerInput()}
@@ -2165,6 +2183,12 @@ function ClinicalDashboardContent({
                       void ask(retryQuery);
                     }}
                     onSearchDocuments={() => crossModeSearch("documents", (lastFailedQuery ?? query).trim())}
+                    onSignInAndSend={() => {
+                      const held = lastFailedQuery ?? query;
+                      pendingSignInResendRef.current = held;
+                      setQuery(held);
+                      openSettings();
+                    }}
                   />
                 )}
 
diff --git a/src/components/clinical-dashboard/answer-request.ts b/src/components/clinical-dashboard/answer-request.ts
index 25b9739e55..12a87708ed 100644
--- a/src/components/clinical-dashboard/answer-request.ts
+++ b/src/components/clinical-dashboard/answer-request.ts
@@ -5,6 +5,7 @@ import {
   isAbortError,
 } from "@/components/clinical-dashboard/clinical-dashboard-helpers";
 import {
+  answerApiFailure,
   makeSearchError,
   readAnswerStream,
   SEARCH_SESSION_EXPIRED_MESSAGE,
@@ -73,7 +74,7 @@ export async function requestAnswerStream({
     throw makeSearchError(SEARCH_SESSION_EXPIRED_MESSAGE, 401, false);
   }
   if (!response.ok) {
-    throw await parseApiErrorResponse(response);
+    throw answerApiFailure(await parseApiErrorResponse(response));
   }
 
   try {
diff --git a/src/components/clinical-dashboard/clinical-ask-workspace.tsx b/src/components/clinical-dashboard/clinical-ask-workspace.tsx
index a57874df5e..e5b8c574e4 100644
--- a/src/components/clinical-dashboard/clinical-ask-workspace.tsx
+++ b/src/components/clinical-dashboard/clinical-ask-workspace.tsx
@@ -10,6 +10,27 @@ import { ClinicalAskAnswerSurface } from "./clinical-ask-answer-surface";
 import { useClinicalAskSession } from "./clinical-ask-session-context";
 import { clinicalAskWorkspaceVisible } from "./use-clinical-ask-shell-state";
 
+/** How long a Clinical Ask may run with no result before the reader is offered a choice (D26-10). */
+export const CLINICAL_ASK_STALL_PROMPT_MS = 45_000;
+
+/**
+ * True once a submitted Clinical Ask has waited `CLINICAL_ASK_STALL_PROMPT_MS` with no result.
+ * Keep waiting restarts the wait. Before this a stalled answer spun with no end (design audit D26-10).
+ */
+function useClinicalAskStall(waiting: boolean) {
+  const [stalled, setStalled] = useState(false);
+  const [round, setRound] = useState(0);
+  useEffect(() => {
+    if (!waiting) return;
+    const timer = window.setTimeout(() => setStalled(true), CLINICAL_ASK_STALL_PROMPT_MS);
+    return () => {
+      window.clearTimeout(timer);
+      setStalled(false);
+    };
+  }, [waiting, round]);
+  return { stalled: waiting && stalled, keepWaiting: () => setRound((value) => value + 1) };
+}
+
 /** What a screen reader hears when each kind of Clinical Ask result lands. */
 const responseAnnouncements: Record<ClinicalAskResponse["state"], string> = {
   answered: "Clinical Ask answer ready.",
@@ -32,6 +53,7 @@ export function ClinicalAskWorkspace({
   const [contextOpen, setContextOpen] = useState(false);
   const contextTriggerRef = useRef<HTMLButtonElement>(null);
   const visible = clinicalAskWorkspaceVisible(session);
+  const stall = useClinicalAskStall(visible && session.submitted && !session.response);
   // Stage changes go through the app's single announcer. A status node inserted
   // with its text already inside is often not read, and the result replaced it
   // with no live region at all, so a screen-reader user heard nothing either way.
@@ -68,6 +90,21 @@ export function ClinicalAskWorkspace({
         <p role="alert">Remove identifiable details before using Smart mode.</p>
       ) : null}
       {session.submitted ? <p>Clinical Ask is gathering governed evidence…</p> : null}
+      {stall.stalled ? (
+        <div role="status" data-testid="clinical-ask-stall">
+          <p>
+            <strong>This is taking longer than usual.</strong> The service may be busy.
+          </p>
+          <div className="flex gap-2">
+            <button type="button" onClick={stall.keepWaiting}>
+              Keep waiting
+            </button>
+            <button type="button" onClick={session.cancel}>
+              Stop
+            </button>
+          </div>
+        </div>
+      ) : null}
       {session.response ? (
         <ClinicalAskAnswerSurface
           response={session.response}
diff --git a/src/components/clinical-dashboard/dashboard-search-error-state.tsx b/src/components/clinical-dashboard/dashboard-search-error-state.tsx
index f48a3d401b..d64a17a40b 100644
--- a/src/components/clinical-dashboard/dashboard-search-error-state.tsx
+++ b/src/components/clinical-dashboard/dashboard-search-error-state.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { CircleAlert, FileText, RefreshCw, Search } from "lucide-react";
+import { CircleAlert, FileText, LogIn, RefreshCw, Search } from "lucide-react";
 
 import { generateQuerySuggestions, type AnswerErrorKind } from "@/components/clinical-dashboard/search-utils";
 import { cn, EmptyState, floatingControl, primaryControl } from "@/components/ui-primitives";
@@ -17,22 +17,80 @@ export function DashboardSearchErrorState({
   errorKind,
   activeModeResultKind,
   documentsResultsOwnError,
+  errorDetail,
   lastFailedQuery,
   query,
   onRephrase,
   onRetry,
   onSearchDocuments,
+  onSignInAndSend,
 }: {
   error: string | null;
   errorKind: AnswerErrorKind | null;
   activeModeResultKind: AppModeResultKind;
   documentsResultsOwnError: boolean;
+  /** The server's own words for this failure, shown only behind a tap (D26-08). */
+  errorDetail?: string | null;
   lastFailedQuery: string | null;
   query: string;
   onRephrase: () => void;
   onRetry: () => void;
   onSearchDocuments: () => void;
+  /** Opens sign-in and sends the held question once signed in (D26-05). */
+  onSignInAndSend?: () => void;
 }) {
+  const answerMode = activeModeResultKind === "answer";
+  if (error && answerMode && errorKind === "session-expired") {
+    // The question was never sent, so say so and keep it: one button signs in and sends it,
+    // instead of a dead end that left the reader to find Sign in and retype (D26-05).
+    return (
+      <EmptyState
+        icon={LogIn}
+        title="You were signed out, so this wasn’t sent"
+        body="Your question is kept. Sign in and it will send straight away."
+        live="assertive"
+        tone="info"
+        testId="answer-error"
+        actions={
+          onSignInAndSend && lastFailedQuery ? (
+            <button
+              type="button"
+              data-testid="answer-error-sign-in-and-send"
+              onClick={() => onSignInAndSend()}
+              className={cn(primaryControl, "text-xs")}
+            >
+              <LogIn aria-hidden="true" className="h-4 w-4" />
+              Sign in and send
+            </button>
+          ) : undefined
+        }
+      />
+    );
+  }
+  if (error && answerMode && errorKind === "daily-limit") {
+    // Retry cannot clear the daily cap, so it is not offered (D26-09).
+    return (
+      <EmptyState
+        icon={CircleAlert}
+        title="Today’s answers are used up"
+        body={error}
+        live="polite"
+        tone="info"
+        testId="answer-error"
+        actions={
+          <button
+            type="button"
+            data-testid="answer-error-search-documents"
+            onClick={() => onSearchDocuments()}
+            className={cn(floatingControl, "text-xs")}
+          >
+            <FileText aria-hidden="true" className="h-4 w-4" />
+            {answerRecovery.searchDocuments}
+          </button>
+        }
+      />
+    );
+  }
   return error && errorKind === "no-results" && activeModeResultKind === "answer" ? (
     <EmptyState
       icon={Search}
@@ -99,6 +157,12 @@ export function DashboardSearchErrorState({
               <FileText aria-hidden="true" className="h-4 w-4" />
               {answerRecovery.searchDocuments}
             </button>
+            {errorDetail ? (
+              <details className="w-full text-xs text-[color:var(--text-muted)]" data-testid="answer-error-detail">
+                <summary className="inline-flex min-h-tap cursor-pointer items-center">Show technical detail</summary>
+                <span className="break-words">{errorDetail}</span>
+              </details>
+            ) : null}
           </>
         ) : undefined
       }
diff --git a/src/components/clinical-dashboard/search-utils.ts b/src/components/clinical-dashboard/search-utils.ts
index 652d542674..4cefee52af 100644
--- a/src/components/clinical-dashboard/search-utils.ts
+++ b/src/components/clinical-dashboard/search-utils.ts
@@ -5,6 +5,8 @@ import {
 import { isAnswerStreamEventName, type VerifiedEvidencePreviewUnit } from "@/lib/answer-stream-contract";
 import { projectClientAnswerPayload, type ClientRagAnswerPayload } from "@/lib/answer-client-payload";
 import type { RagAnswer } from "@/lib/types";
+import { ANSWER_DAILY_LIMIT_CODE, answerBurstLimitMessage, answerDailyLimitMessage } from "@/lib/answer-limit-copy";
+import type { ApiClientError } from "@/lib/api-client-error";
 
 export { keywordQueryFromNaturalLanguage } from "@/lib/keyword-query";
 
@@ -49,6 +51,8 @@ export type SearchError = Error & {
   retryable?: boolean;
   code?: string;
   retryAfterMs?: number | null;
+  /** The server's own words, kept behind "Show technical detail" rather than shown as the message. */
+  detail?: string;
 };
 
 export const searchRetryDelaysMs = [500, 1000, 2000] as const;
@@ -354,7 +358,7 @@ export function createAnswerRequestWatchdog(
   };
 }
 
-export type AnswerErrorKind = "no-results" | "session-expired" | "failure";
+export type AnswerErrorKind = "no-results" | "session-expired" | "daily-limit" | "failure";
 
 /** Shown when the server answers 401: retrying with the expired session cannot help (audit F-15). */
 export const SEARCH_SESSION_EXPIRED_MESSAGE = "Your session expired. Sign in again, then try again.";
@@ -375,9 +379,41 @@ export function classifyAnswerError(error: unknown): AnswerErrorKind {
   if (error instanceof Error && (error as SearchError).status === 401) {
     return "session-expired";
   }
+  if (
+    error instanceof Error &&
+    (error as SearchError).status === 429 &&
+    (error as SearchError).code === ANSWER_DAILY_LIMIT_CODE
+  ) {
+    return "daily-limit";
+  }
   return "failure";
 }
 
+/** Shown when the answer service itself fails; the server's words move behind a tap (D26-08). */
+export const ANSWER_SERVICE_FAILED_MESSAGE =
+  "This answer didn’t finish. Your question is kept. Try again, or search your documents for the same topic.";
+
+/**
+ * Turn a failed answer response into plain words. The daily cap gets its reset time and no Retry,
+ * a burst limit gets its wait in minutes, and a server fault keeps its own text only as `detail`.
+ * Other 4xx messages are already written for the reader and pass through unchanged.
+ */
+export function answerApiFailure(apiError: ApiClientError, now = Date.now()): SearchError {
+  const daily = apiError.status === 429 && apiError.code === ANSWER_DAILY_LIMIT_CODE;
+  const message = daily
+    ? answerDailyLimitMessage(apiError.retryAfterMs, now)
+    : apiError.status === 429
+      ? answerBurstLimitMessage(apiError.retryAfterMs)
+      : apiError.status >= 500
+        ? ANSWER_SERVICE_FAILED_MESSAGE
+        : apiError.message;
+  const error = makeSearchError(message, apiError.status, daily ? false : apiError.retryable);
+  error.code = apiError.code;
+  error.retryAfterMs = apiError.retryAfterMs;
+  if (message !== apiError.message && apiError.message) error.detail = apiError.message;
+  return error;
+}
+
 /**
  * Generate intelligent query rephrasing suggestions for zero-result states.
  */
diff --git a/src/components/clinical-dashboard/use-dashboard-search-execution.ts b/src/components/clinical-dashboard/use-dashboard-search-execution.ts
index 837fb02541..7b8cb2437b 100644
--- a/src/components/clinical-dashboard/use-dashboard-search-execution.ts
+++ b/src/components/clinical-dashboard/use-dashboard-search-execution.ts
@@ -58,6 +58,9 @@ import { isDashboardModeHref } from "@/lib/search-route-ownership";
 import type { SearchScopeFilters } from "@/lib/search-scope";
 import type { SourceGovernanceWarning } from "@/lib/source-governance";
 import { errorCopy } from "@/lib/ui-copy";
+// A question is never sent unchecked: when the check cannot load (a dropped connection),
+// Ask stops with this and the next Ask tries the download again.
+import { patientCheckUnavailableMessage } from "@/lib/patient-check-unavailable-copy";
 import type {
   ClinicalQueryMode,
   DocumentMatch,
@@ -72,10 +75,6 @@ function loadClinicalQuestionPatientCheck() {
   return import("@/lib/clinical-question-patient-check");
 }
 
-// A question is never sent unchecked: when the check cannot load (a dropped connection),
-// Ask stops with this and the next Ask tries the download again.
-const PATIENT_CHECK_UNAVAILABLE =
-  "Could not check your question for patient details. Check your connection and try again.";
 /** Longest Retry-After the client waits out before reporting the service's busy message instead. */
 const maxClientRetryWaitMs = 10_000;
 
@@ -150,6 +149,8 @@ type DashboardSearchExecutionDeps = {
   setRestoredAnswerSavedAt: Dispatch<SetStateAction<number | null>>;
   setError: Dispatch<SetStateAction<string | null>>;
   setErrorKind: Dispatch<SetStateAction<AnswerErrorKind | null>>;
+  /** The server's own words behind a failure, keyed to the message they belong to (D26-08). */
+  setErrorDetail: Dispatch<SetStateAction<{ message: string; detail: string } | null>>;
   setLastFailedQuery: Dispatch<SetStateAction<string | null>>;
   setDemoMode: Dispatch<SetStateAction<boolean>>;
   setActionNotice: Dispatch<SetStateAction<DashboardActionNotice | null>>;
@@ -216,6 +217,7 @@ export function useDashboardSearchExecution(deps: DashboardSearchExecutionDeps)
     setRestoredAnswerSavedAt,
     setError,
     setErrorKind,
+    setErrorDetail,
     setLastFailedQuery,
     setDemoMode,
     setActionNotice,
@@ -473,7 +475,7 @@ export function useDashboardSearchExecution(deps: DashboardSearchExecutionDeps)
       const patientCheck = await loadClinicalQuestionPatientCheck().catch(() => null);
       if (submittedSeq !== searchRequestSeqRef.current) return;
       if (!patientCheck) {
-        setActionNotice({ tone: "warning", message: PATIENT_CHECK_UNAVAILABLE });
+        setActionNotice({ tone: "warning", message: patientCheckUnavailableMessage() });
         return;
       }
       const patientDetail = patientCheck.clinicalQuestionPatientDetail(trimmedQuery);
@@ -826,9 +828,14 @@ export function useDashboardSearchExecution(deps: DashboardSearchExecutionDeps)
             : makeSearchError(searchTimedOutMessage("Search"), 408, false)
           : requestError;
         if (isAnswerRequest) dispatchAnswerLifecycle({ type: "fail" });
-        setError(surfacedError instanceof Error ? surfacedError.message : "Search failed");
+        const surfacedMessage = surfacedError instanceof Error ? surfacedError.message : "Search failed";
+        const surfacedDetail = (surfacedError as SearchError | null)?.detail;
+        setError(surfacedMessage);
         setErrorKind(classifyAnswerError(surfacedError));
+        setErrorDetail(surfacedDetail ? { message: surfacedMessage, detail: surfacedDetail } : null);
         setLastFailedQuery(trimmedQuery);
+        // An expired sign-in never sent the question: keep it in the box for Sign in and send (D26-05).
+        if (sessionExpired) setQuery(trimmedQuery);
       }
     } finally {
       answerWatchdog.cancel();
@@ -896,7 +903,7 @@ export function useDashboardSearchExecution(deps: DashboardSearchExecutionDeps)
             : patientCheck.searchPatientDetailMessage(patientDetail);
         }
       } else if (sendsQueryToProvider) {
-        refusal = PATIENT_CHECK_UNAVAILABLE;
+        refusal = patientCheckUnavailableMessage();
       } else if (identifierShapeWarning(trimmedQuery)) {
         // Searches that stay on our servers still go ahead when the full check cannot load,
         // but never with a record number, date of birth, phone number or email in them.
diff --git a/src/components/front-door/ask-terms-not-now.ts b/src/components/front-door/ask-terms-not-now.ts
index b8b39507db..2961972c83 100644
--- a/src/components/front-door/ask-terms-not-now.ts
+++ b/src/components/front-door/ask-terms-not-now.ts
@@ -1,8 +1,7 @@
 import type * as PatientCheck from "@/lib/clinical-question-patient-check";
 
 // Matches the Answer path's wording when the check cannot load.
-const PATIENT_CHECK_UNAVAILABLE =
-  "Could not check your question for patient details. Check your connection and try again.";
+import { patientCheckUnavailableMessage } from "@/lib/patient-check-unavailable-copy";
 
 /**
  * Whether a question set aside by Not now may run as a Documents search. The
@@ -16,7 +15,7 @@ export async function notNowDocumentsSearch(
   loadCheck: () => Promise<typeof PatientCheck> = () => import("@/lib/clinical-question-patient-check"),
 ): Promise<{ query: string } | { notice: string }> {
   const check = await loadCheck().catch(() => null);
-  if (!check) return { notice: PATIENT_CHECK_UNAVAILABLE };
+  if (!check) return { notice: patientCheckUnavailableMessage() };
   const detail = check.clinicalQuestionPatientDetail(query);
   if (detail) return { notice: check.clinicalQuestionPatientDetailMessage(detail) };
   return { query };
diff --git a/src/lib/patient-check-unavailable-copy.ts b/src/lib/patient-check-unavailable-copy.ts
new file mode 100644
index 0000000000..31d1c095ba
--- /dev/null
+++ b/src/lib/patient-check-unavailable-copy.ts
@@ -0,0 +1,14 @@
+/**
+ * What Ask says when the patient-detail check cannot load. With no connection the old wording
+ * ("Could not check your question for patient details") read as if the question had broken a
+ * rule, so offline gets its own plain message (design audit D26-11). Either way nothing is sent.
+ */
+export const PATIENT_CHECK_UNAVAILABLE_MESSAGE =
+  "Could not check your question for patient details. Check your connection and try again.";
+
+export const PATIENT_CHECK_OFFLINE_MESSAGE =
+  "You're offline, so nothing was sent. Your question is kept here. Try again when you have signal.";
+
+export function patientCheckUnavailableMessage(online = typeof navigator === "undefined" || navigator.onLine) {
+  return online ? PATIENT_CHECK_UNAVAILABLE_MESSAGE : PATIENT_CHECK_OFFLINE_MESSAGE;
+}
diff --git a/tests/clinical-ask-workspace.dom.test.tsx b/tests/clinical-ask-workspace.dom.test.tsx
index e43f35e1a0..97c9d546bb 100644
--- a/tests/clinical-ask-workspace.dom.test.tsx
+++ b/tests/clinical-ask-workspace.dom.test.tsx
@@ -1,5 +1,5 @@
 /** @vitest-environment jsdom */
-import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 const navigation = vi.hoisted(() => ({ push: vi.fn() }));
 vi.mock("next/navigation", () => ({ useRouter: () => navigation }));
@@ -10,7 +10,10 @@ import {
   ClinicalAskSessionProvider,
   useClinicalAskSession,
 } from "@/components/clinical-dashboard/clinical-ask-session-context";
-import { ClinicalAskWorkspace } from "@/components/clinical-dashboard/clinical-ask-workspace";
+import {
+  CLINICAL_ASK_STALL_PROMPT_MS,
+  ClinicalAskWorkspace,
+} from "@/components/clinical-dashboard/clinical-ask-workspace";
 
 function Harness({
   onDraftChange,
@@ -69,6 +72,7 @@ function Harness({
       >
         Clarify
       </button>
+      <button onClick={() => session.submit("services", {})}>Submit</button>
       <button
         onClick={() =>
           session.receiveEvent({
@@ -136,6 +140,35 @@ describe("ClinicalAskWorkspace", () => {
     HTMLElement.prototype.scrollIntoView = vi.fn();
   });
 
+  // D26-10: a stalled Clinical Ask spun with no end.
+  it("offers Keep waiting or Stop once an answer has stalled", () => {
+    vi.useFakeTimers();
+    try {
+      render(
+        <ClinicalAskSessionProvider>
+          <Harness />
+        </ClinicalAskSessionProvider>,
+      );
+      fireEvent.click(screen.getByRole("button", { name: "Seed" }));
+      fireEvent.click(screen.getByRole("button", { name: "Submit" }));
+      expect(screen.queryByTestId("clinical-ask-stall")).toBeNull();
+
+      act(() => vi.advanceTimersByTime(CLINICAL_ASK_STALL_PROMPT_MS));
+      expect(screen.getByTestId("clinical-ask-stall")).toHaveTextContent("This is taking longer than usual.");
+
+      fireEvent.click(screen.getByRole("button", { name: "Keep waiting" }));
+      expect(screen.queryByTestId("clinical-ask-stall")).toBeNull();
+      act(() => vi.advanceTimersByTime(CLINICAL_ASK_STALL_PROMPT_MS));
+      expect(screen.getByTestId("clinical-ask-stall")).toBeTruthy();
+
+      fireEvent.click(screen.getByRole("button", { name: "Stop" }));
+      expect(screen.queryByTestId("clinical-ask-stall")).toBeNull();
+      expect(screen.queryByText("Clinical Ask is gathering governed evidence…")).toBeNull();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it("announces each Clinical Ask result through the shared announcer", () => {
     render(
       <ClinicalAskSessionProvider>
diff --git a/tests/clinical-dashboard-search-utils.test.ts b/tests/clinical-dashboard-search-utils.test.ts
index ee3545b9e0..490bd48454 100644
--- a/tests/clinical-dashboard-search-utils.test.ts
+++ b/tests/clinical-dashboard-search-utils.test.ts
@@ -1,5 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import {
+  ANSWER_SERVICE_FAILED_MESSAGE,
+  answerApiFailure,
   answerPayloadIsUsable,
   answerRequestMaxDurationMs,
   answerStallTimeoutMs,
@@ -14,6 +16,7 @@ import {
   shouldRetryFailedAttempt,
   SEARCH_SESSION_EXPIRED_MESSAGE,
 } from "@/components/clinical-dashboard/search-utils";
+import { ApiClientError } from "@/lib/api-client-error";
 import type { RagAnswer } from "@/lib/types";
 
 function answer(overrides: Partial<RagAnswer> = {}): RagAnswer {
@@ -177,3 +180,40 @@ describe("answer request watchdog", () => {
     expect(watchdog.timedOut).toBe(true);
   });
 });
+
+// D26-08 to D26-10: a failed answer reads in plain words, the daily cap offers no Retry and
+// gives a clock time, and the server's own words are kept only as detail.
+describe("answerApiFailure", () => {
+  const now = new Date(2026, 9, 26, 9, 0, 0).getTime();
+
+  it("turns the daily cap into a non-retryable daily-limit with a reset time", () => {
+    const error = answerApiFailure(
+      new ApiClientError("This account has reached its daily limit.", 429, "generation_daily_cap", true, 38_400_000),
+      now,
+    );
+    expect(error.retryable).toBe(false);
+    expect(classifyAnswerError(error)).toBe("daily-limit");
+    expect(error.message).toMatch(/You can ask again from 7:40\s?pm\./);
+    expect(error.message).not.toMatch(/seconds/);
+  });
+
+  it("gives a burst limit its wait in minutes and keeps it retryable", () => {
+    const error = answerApiFailure(new ApiClientError("Too many requests.", 429, "rate_limited", true, 42_000), now);
+    expect(error.retryable).toBe(true);
+    expect(classifyAnswerError(error)).toBe("failure");
+    expect(error.message).toBe("Too many questions in a short time. Wait a minute, then try again.");
+  });
+
+  it("keeps a server fault's words as detail, not as the message", () => {
+    const error = answerApiFailure(new ApiClientError("upstream_timeout: stream closed", 502, "http_502", true), now);
+    expect(error.message).toBe(ANSWER_SERVICE_FAILED_MESSAGE);
+    expect(error.detail).toBe("upstream_timeout: stream closed");
+    expect(error.retryable).toBe(true);
+  });
+
+  it("passes a written 4xx message through unchanged", () => {
+    const error = answerApiFailure(new ApiClientError("Question is too long.", 400, "invalid_request", false), now);
+    expect(error.message).toBe("Question is too long.");
+    expect(error.detail).toBeUndefined();
+  });
+});
diff --git a/tests/dashboard-search-error-state.dom.test.tsx b/tests/dashboard-search-error-state.dom.test.tsx
index fb027b313e..3c9e5aa5b7 100644
--- a/tests/dashboard-search-error-state.dom.test.tsx
+++ b/tests/dashboard-search-error-state.dom.test.tsx
@@ -1,12 +1,16 @@
-import { render, screen } from "@testing-library/react";
-import { describe, expect, it } from "vitest";
+import { fireEvent, render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
 
 import { DashboardSearchErrorState } from "@/components/clinical-dashboard/dashboard-search-error-state";
 import { SEARCH_SESSION_EXPIRED_MESSAGE } from "@/components/clinical-dashboard/search-utils";
 
 const noop = () => undefined;
 
-function renderErrorState(errorKind: "failure" | "session-expired", error: string) {
+function renderErrorState(
+  errorKind: "failure" | "session-expired" | "daily-limit",
+  error: string,
+  extra: { errorDetail?: string; onSignInAndSend?: () => void } = {},
+) {
   render(
     <DashboardSearchErrorState
       error={error}
@@ -18,6 +22,7 @@ function renderErrorState(errorKind: "failure" | "session-expired", error: strin
       onRephrase={noop}
       onRetry={noop}
       onSearchDocuments={noop}
+      {...extra}
     />,
   );
 }
@@ -29,10 +34,30 @@ describe("answer error panel", () => {
     expect(screen.getByTestId("answer-error-retry")).toBeTruthy();
   });
 
-  it("asks the reader to sign in again, without Retry, when the session expired (audit F-15)", () => {
-    renderErrorState("session-expired", SEARCH_SESSION_EXPIRED_MESSAGE);
-    expect(screen.getByText("Sign in again")).toBeTruthy();
-    expect(screen.getByText(SEARCH_SESSION_EXPIRED_MESSAGE)).toBeTruthy();
+  it("keeps the question and offers Sign in and send, without Retry, when the session expired (F-15, D26-05)", () => {
+    const onSignInAndSend = vi.fn();
+    renderErrorState("session-expired", SEARCH_SESSION_EXPIRED_MESSAGE, { onSignInAndSend });
+    expect(screen.getByText("You were signed out, so this wasn\u2019t sent")).toBeTruthy();
+    expect(screen.getByText("Your question is kept. Sign in and it will send straight away.")).toBeTruthy();
     expect(screen.queryByTestId("answer-error-retry")).toBeNull();
+    fireEvent.click(screen.getByTestId("answer-error-sign-in-and-send"));
+    expect(onSignInAndSend).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not offer Retry at the daily answer limit (D26-09)", () => {
+    renderErrorState("daily-limit", "You've used today's answers. You can ask again from 7:40 pm.");
+    expect(screen.getByText("Today\u2019s answers are used up")).toBeTruthy();
+    expect(screen.queryByTestId("answer-error-retry")).toBeNull();
+    expect(screen.getByTestId("answer-error-search-documents")).toBeTruthy();
+  });
+
+  it("keeps the server's own words behind Show technical detail (D26-08)", () => {
+    renderErrorState("failure", "This answer didn\u2019t finish.", { errorDetail: "upstream_timeout: stream closed" });
+    expect(screen.getByTestId("answer-error")).toHaveTextContent("This answer didn\u2019t finish.");
+    const detail = screen.getByTestId("answer-error-detail");
+    expect(detail.tagName).toBe("DETAILS");
+    expect(detail).not.toHaveAttribute("open");
+    expect(detail).toHaveTextContent("Show technical detail");
+    expect(detail).toHaveTextContent("upstream_timeout: stream closed");
   });
 });
diff --git a/tests/patient-check-unavailable-copy.test.ts b/tests/patient-check-unavailable-copy.test.ts
new file mode 100644
index 0000000000..49180f11b8
--- /dev/null
+++ b/tests/patient-check-unavailable-copy.test.ts
@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  PATIENT_CHECK_OFFLINE_MESSAGE,
+  PATIENT_CHECK_UNAVAILABLE_MESSAGE,
+  patientCheckUnavailableMessage,
+} from "@/lib/patient-check-unavailable-copy";
+
+// D26-11: offline, the old wording read as if the question had broken the patient-detail rule.
+describe("patientCheckUnavailableMessage", () => {
+  it("says offline plainly when there is no connection", () => {
+    expect(patientCheckUnavailableMessage(false)).toBe(PATIENT_CHECK_OFFLINE_MESSAGE);
+    expect(PATIENT_CHECK_OFFLINE_MESSAGE).not.toMatch(/patient details/);
+    expect(PATIENT_CHECK_OFFLINE_MESSAGE).toMatch(/nothing was sent/);
+  });
+
+  it("keeps the check wording when online but the check could not load", () => {
+    expect(patientCheckUnavailableMessage(true)).toBe(PATIENT_CHECK_UNAVAILABLE_MESSAGE);
+  });
+});

From a40d2ce4ee8266ac6f2a67b911bf76a097d7487f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 26 Oct 2026 08:37:00 +0000
Subject: [PATCH 03/11] Safety plan: Clear the plan sits apart from Load
 example and offers Undo (D26-24)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYsGZ5ecrWh4xL76inGoAq
---
 src/components/patient-safety-plan.tsx        | 72 ++++++++++++++++---
 .../patient-safety-plan-privacy.dom.test.tsx  |  2 +-
 tests/patient-safety-plan.dom.test.tsx        | 52 +++++++++-----
 3 files changed, 100 insertions(+), 26 deletions(-)

diff --git a/src/components/patient-safety-plan.tsx b/src/components/patient-safety-plan.tsx
index 3789ac3c4d..04247df1c8 100644
--- a/src/components/patient-safety-plan.tsx
+++ b/src/components/patient-safety-plan.tsx
@@ -14,10 +14,11 @@ import {
   PhoneCall,
   Plus,
   Printer,
-  RotateCcw,
   ShieldCheck,
   Sparkles,
   Stethoscope,
+  Trash2,
+  Undo2,
   X,
   type LucideIcon,
 } from "lucide-react";
@@ -136,6 +137,9 @@ const WA_REGIONAL_CRISIS_CONTACTS = [MHERL_METRO_CONTACT, MHERL_PEEL_CONTACT, RU
 const focusRing =
   "focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)]";
 
+/** How long Undo stays after Clear the plan (design audit D26-24). */
+export const SAFETY_PLAN_UNDO_MS = 10_000;
+
 const softButton = cn(
   "inline-flex min-h-tap items-center justify-center gap-2 rounded-lg border border-[color:var(--border)] bg-[color:var(--surface-raised)] px-3 text-sm-minus font-bold text-[color:var(--text-muted)] shadow-[var(--shadow-inset)] transition hover:border-[color:var(--border-strong)] hover:text-[color:var(--text)]",
   focusRing,
@@ -624,6 +628,14 @@ export function PatientSafetyPlan() {
   const [mobileTab, setMobileTab] = useState<"build" | "preview">("build");
   const [copyStatus, setCopyStatus] = useState<"idle" | "copied" | "failed">("idle");
   const [finalised, setFinalised] = useState(false);
+  // The plan as it was before Clear the plan, held in memory for Undo only (D26-24). Like the plan
+  // itself it is never stored, and it goes when the Undo window closes or the page unmounts.
+  const [clearedPlan, setClearedPlan] = useState<{
+    entries: Record<StepKey, Entry[]>;
+    reasons: Entry[];
+    planDate: string;
+    finalised: boolean;
+  } | null>(null);
   const finaliseUnavailableId = useId();
   const [draftDirtyByRow, setDraftDirtyByRow] = useState<Record<string, boolean>>({});
   // Per-instance id counter — avoids a module-level mutable that would persist
@@ -907,19 +919,39 @@ export function PatientSafetyPlan() {
     setFinalised(false);
   };
 
+  useEffect(() => {
+    if (!clearedPlan) return;
+    const timer = window.setTimeout(() => setClearedPlan(null), SAFETY_PLAN_UNDO_MS);
+    return () => window.clearTimeout(timer);
+  }, [clearedPlan]);
+
   const clearAll = () => {
-    // Nothing to lose when the plan is empty or is the untouched example. Anything
-    // else is a clinician's work with a patient that is never stored, so ask first.
+    // Nothing to lose when the plan is empty or is the untouched example. Anything else is a
+    // clinician's work with a patient that is never stored, so it clears at once with Undo for
+    // ten seconds, rather than a browser "are you sure" box that is easy to tap through (D26-24).
     const untouchedExample = entries === SEED && reasons === SEED_REASONS && planDate.trim() === "";
     const hasContent =
       Object.values(entries).some((rows) => rows.length > 0) || reasons.length > 0 || planDate.trim() !== "";
-    if (hasContent && !untouchedExample && !window.confirm("Clear the whole plan? This can’t be undone.")) return;
+    if (hasContent && !untouchedExample) {
+      setClearedPlan({ entries, reasons, planDate, finalised });
+      announce("Plan cleared. Undo is available for 10 seconds.");
+    }
     setEntries(EMPTY_ENTRIES);
     setReasons([]);
     setPlanDate("");
     setFinalised(false);
   };
 
+  const undoClear = () => {
+    if (!clearedPlan) return;
+    setEntries(clearedPlan.entries);
+    setReasons(clearedPlan.reasons);
+    setPlanDate(clearedPlan.planDate);
+    setFinalised(clearedPlan.finalised);
+    setClearedPlan(null);
+    announce("Plan restored.");
+  };
+
   return (
     <main
       data-testid="safety-plan-tool"
@@ -1097,10 +1129,6 @@ export function PatientSafetyPlan() {
                 <Sparkles className="size-icon-sm" aria-hidden="true" />
                 Load example
               </button>
-              <button type="button" onClick={clearAll} className={softButton}>
-                <RotateCcw className="size-icon-sm" aria-hidden="true" />
-                Clear all
-              </button>
             </div>
           </div>
 
@@ -1208,6 +1236,34 @@ export function PatientSafetyPlan() {
               }}
             />
           </section>
+
+          {/* Clear sits at the foot of the builder, away from Load example (D26-24). */}
+          <div className="grid justify-items-end gap-2" data-testid="safety-plan-clear-row">
+            {clearedPlan ? (
+              <div
+                role="status"
+                data-testid="safety-plan-undo"
+                className="flex w-full flex-wrap items-center justify-between gap-2 rounded-lg border border-[color:var(--border-strong)] bg-[color:var(--surface-raised)] px-3 py-1 text-sm-minus font-semibold"
+              >
+                Plan cleared
+                <button type="button" onClick={undoClear} className={softButton}>
+                  <Undo2 className="size-icon-sm" aria-hidden="true" />
+                  Undo
+                </button>
+              </div>
+            ) : null}
+            <button
+              type="button"
+              onClick={clearAll}
+              className={cn(
+                softButton,
+                "border-[color:var(--danger-border)] text-[color:var(--danger-text)] hover:text-[color:var(--danger-text)]",
+              )}
+            >
+              <Trash2 className="size-icon-sm" aria-hidden="true" />
+              Clear the plan
+            </button>
+          </div>
         </div>
 
         {/* ---------- Preview ---------- */}
diff --git a/tests/patient-safety-plan-privacy.dom.test.tsx b/tests/patient-safety-plan-privacy.dom.test.tsx
index c87cfe449a..5f06130310 100644
--- a/tests/patient-safety-plan-privacy.dom.test.tsx
+++ b/tests/patient-safety-plan-privacy.dom.test.tsx
@@ -124,7 +124,7 @@ describe("PatientSafetyPlan privacy contract", () => {
       target: { value: "Not sleeping" },
     });
     fireEvent.click(screen.getByRole("button", { name: "Load example" }));
-    fireEvent.click(screen.getByRole("button", { name: "Clear all" }));
+    fireEvent.click(screen.getByRole("button", { name: "Clear the plan" }));
     fireEvent.click(screen.getByRole("button", { name: "Go back" }));
 
     expect(confirmSpy).toHaveBeenCalledOnce();
diff --git a/tests/patient-safety-plan.dom.test.tsx b/tests/patient-safety-plan.dom.test.tsx
index b2a457611a..6034431fa0 100644
--- a/tests/patient-safety-plan.dom.test.tsx
+++ b/tests/patient-safety-plan.dom.test.tsx
@@ -4,7 +4,7 @@ import { act, fireEvent, render, screen, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { describe, expect, it, vi } from "vitest";
 
-import { PatientSafetyPlan } from "@/components/patient-safety-plan";
+import { PatientSafetyPlan, SAFETY_PLAN_UNDO_MS } from "@/components/patient-safety-plan";
 import { WA_CRISIS_CONTACTS } from "@/lib/crisis-contacts";
 import { confirmShellNavigation } from "@/lib/navigation-guards";
 
@@ -128,7 +128,7 @@ describe("PatientSafetyPlan — incomplete-plan draft guard", () => {
     render(<PatientSafetyPlan />);
 
     await user.click(screen.getByRole("button", { name: /Load example/ }));
-    await user.click(screen.getByRole("button", { name: /Clear all/ }));
+    await user.click(screen.getByRole("button", { name: /Clear the plan/ }));
 
     const supportStep = screen.getByRole("region", { name: "Step 4: People I can ask for help" });
     await user.type(within(supportStep).getByPlaceholderText("Name & relationship"), "Sam — a friend");
@@ -333,8 +333,9 @@ describe("PatientSafetyPlan — incomplete-plan draft guard", () => {
 
 describe("PatientSafetyPlan — Clear all and Copy feedback", () => {
   // fireEvent rather than userEvent: an earlier case in this file uses fake timers.
-  it("asks before Clear all wipes a plan with real entries, and keeps it when the doctor says no", () => {
-    const confirm = vi.spyOn(window, "confirm").mockReturnValue(false);
+  // D26-24: no browser "are you sure" box; the plan clears at once and Undo brings it back.
+  it("clears a plan with real entries at once and offers Undo for ten seconds", () => {
+    const confirm = vi.spyOn(window, "confirm");
     render(<PatientSafetyPlan />);
 
     const supportStep = screen.getByRole("region", { name: "Step 4: People I can ask for help" });
@@ -342,29 +343,46 @@ describe("PatientSafetyPlan — Clear all and Copy feedback", () => {
       target: { value: "Sam — a friend" },
     });
     fireEvent.click(within(supportStep).getByRole("button", { name: /^Add to / }));
-    fireEvent.click(screen.getByRole("button", { name: /Clear all/ }));
-
-    expect(confirm).toHaveBeenCalledOnce();
-    expect(confirm).toHaveBeenCalledWith(expect.stringMatching(/Clear the whole plan\?.*can’t be undone/));
-    expect(within(supportStep).getAllByText("Sam — a friend").length).toBeGreaterThan(0);
+    fireEvent.click(screen.getByRole("button", { name: /Clear the plan/ }));
 
-    confirm.mockReturnValue(true);
-    fireEvent.click(screen.getByRole("button", { name: /Clear all/ }));
+    expect(confirm).not.toHaveBeenCalled();
     expect(within(supportStep).queryByText("Sam — a friend")).toBeNull();
+    expect(screen.getByTestId("safety-plan-undo")).toHaveTextContent("Plan cleared");
+
+    fireEvent.click(screen.getByRole("button", { name: "Undo" }));
+    expect(within(supportStep).getAllByText("Sam — a friend").length).toBeGreaterThan(0);
+    expect(screen.queryByTestId("safety-plan-undo")).toBeNull();
     confirm.mockRestore();
   });
 
-  it("clears an untouched example or an empty plan without asking", () => {
-    const confirm = vi.spyOn(window, "confirm").mockReturnValue(false);
+  it("lets the Undo offer lapse after ten seconds", () => {
+    vi.useFakeTimers();
+    try {
+      render(<PatientSafetyPlan />);
+      const supportStep = screen.getByRole("region", { name: "Step 4: People I can ask for help" });
+      fireEvent.change(within(supportStep).getByPlaceholderText("Name & relationship"), {
+        target: { value: "Sam — a friend" },
+      });
+      fireEvent.click(within(supportStep).getByRole("button", { name: /^Add to / }));
+      fireEvent.click(screen.getByRole("button", { name: /Clear the plan/ }));
+      expect(screen.getByTestId("safety-plan-undo")).toBeTruthy();
+
+      act(() => vi.advanceTimersByTime(SAFETY_PLAN_UNDO_MS));
+      expect(screen.queryByTestId("safety-plan-undo")).toBeNull();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("clears an untouched example or an empty plan without an Undo offer", () => {
     render(<PatientSafetyPlan />);
 
-    fireEvent.click(screen.getByRole("button", { name: /Clear all/ }));
+    fireEvent.click(screen.getByRole("button", { name: /Clear the plan/ }));
     fireEvent.click(screen.getByRole("button", { name: /Load example/ }));
-    fireEvent.click(screen.getByRole("button", { name: /Clear all/ }));
+    fireEvent.click(screen.getByRole("button", { name: /Clear the plan/ }));
 
-    expect(confirm).not.toHaveBeenCalled();
+    expect(screen.queryByTestId("safety-plan-undo")).toBeNull();
     expect(screen.queryByText(examplePattern)).toBeNull();
-    confirm.mockRestore();
   });
 
   it("moves between Build and Plan preview with the arrow keys", () => {

From 52a56a3ff37e155c7e39b3a4db9ff40e826b3e8d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 26 Oct 2026 08:41:32 +0000
Subject: [PATCH 04/11] On Call: Undo for a deleted call note, and say when the
 shift wipe ran (D26-25)

Deleting a call note now shows a 10 second Undo toast. The end-of-shift wipe
leaves only the time it ran, so the call log can say the notes were cleared
instead of them vanishing silently. The marker is forgotten at the next shift
and at sign-out.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYsGZ5ecrWh4xL76inGoAq
---
 src/components/on-call/handover/call-log.tsx | 74 +++++++++++++++++++-
 src/lib/on-call/call-log.ts                  | 22 ++++++
 src/lib/patient-label-storage.ts             | 40 +++++++++++
 tests/on-call-call-log-card.dom.test.tsx     | 38 +++++++++-
 tests/on-call-call-log.test.ts               | 19 +++++
 tests/patient-label-storage.dom.test.tsx     | 24 +++++++
 6 files changed, 215 insertions(+), 2 deletions(-)

diff --git a/src/components/on-call/handover/call-log.tsx b/src/components/on-call/handover/call-log.tsx
index 541bdb5bd2..efda8ad649 100644
--- a/src/components/on-call/handover/call-log.tsx
+++ b/src/components/on-call/handover/call-log.tsx
@@ -12,6 +12,7 @@ import { modeInsetHairline } from "@/components/mode-kit/recipes";
 import { modeNameText, modeNumberText, modeSecondaryText } from "@/components/mode-kit/type";
 import { FormField } from "@/components/ui/form-field";
 import { announce } from "@/components/ui/live-announcer";
+import { useOptionalToast } from "@/components/ui/toast";
 import { TextField } from "@/components/ui/text-field";
 import { cn, fieldControlPlain } from "@/components/ui-primitives";
 import {
@@ -21,6 +22,7 @@ import {
   onCallCallLogStorageKey,
   visibleOnCallCallLog,
   removeOnCallCallLogEntry,
+  restoreOnCallCallLogEntry,
   setOnCallCallLogDone,
   type OnCallCallLogDraft,
   type OnCallCallLogEntry,
@@ -36,6 +38,9 @@ import {
 import {
   PATIENT_LABEL_EXPIRY_STORAGE_KEY,
   PATIENT_LABELS_CLEARED_EVENT,
+  SHIFT_LABELS_CLEARED_AT_STORAGE_KEY,
+  dismissShiftLabelsClearedNotice,
+  readShiftLabelsClearedAt,
   startPatientLabelRetention,
 } from "@/lib/patient-label-storage";
 import { useWorkTimeZone } from "@/components/work-time/use-work-time-zone";
@@ -168,8 +173,40 @@ export const ON_CALL_CALLER_CHIPS = ["Ward nurse", "Emergency dept", "Registrar"
  * before, with "Who called" as chips so most calls need one tap and one line,
  * then tonight's calls and "Add the 1 to-do to the handover".
  */
+/** How long a deleted note can be put back (D26-25). */
+export const ON_CALL_CALL_LOG_UNDO_MS = 10_000;
+
+/**
+ * When the end of the last shift wiped the labels and notes on this phone, so the card can say so
+ * once instead of the notes silently vanishing (D26-25). Null when there is nothing to say.
+ */
+function useShiftLabelsClearedAt(): readonly [number | null, () => void] {
+  const [clearedAt, setClearedAt] = useState<number | null>(null);
+  useEffect(() => {
+    const refresh = () => setClearedAt(readShiftLabelsClearedAt());
+    refresh();
+    const onStorage = (event: StorageEvent) => {
+      if (event.key === null || event.key === SHIFT_LABELS_CLEARED_AT_STORAGE_KEY) refresh();
+    };
+    window.addEventListener(PATIENT_LABELS_CLEARED_EVENT, refresh);
+    window.addEventListener(onCallDeviceStoreChangedEvent, refresh);
+    window.addEventListener("storage", onStorage);
+    return () => {
+      window.removeEventListener(PATIENT_LABELS_CLEARED_EVENT, refresh);
+      window.removeEventListener(onCallDeviceStoreChangedEvent, refresh);
+      window.removeEventListener("storage", onStorage);
+    };
+  }, []);
+  const dismiss = () => {
+    dismissShiftLabelsClearedNotice();
+    setClearedAt(null);
+  };
+  return [clearedAt, dismiss] as const;
+}
+
 export function OnCallCallLogCard() {
   const { zone } = useWorkTimeZone();
+  const [shiftClearedAt, dismissShiftCleared] = useShiftLabelsClearedAt();
   const view = useOnCallCallLog();
   const entries = view?.entries ?? null;
   const [draft, setDraft] = useState<OnCallCallLogDraft>(emptyDraft);
@@ -270,6 +307,20 @@ export function OnCallCallLogCard() {
 
   return (
     <section className="grid min-w-0 gap-4" aria-label="Log a call" data-testid="on-call-call-log">
+      {shiftClearedAt !== null ? (
+        <ModeNotice testId="on-call-shift-cleared">
+          Last shift&apos;s labels and notes were cleared at {clockLabel(shiftClearedAt, zone)}, when the shift ended,
+          to protect patient privacy.{" "}
+          <button
+            type="button"
+            onClick={dismissShiftCleared}
+            data-testid="on-call-shift-cleared-dismiss"
+            className={cn(focusRing, "font-medium underline underline-offset-2")}
+          >
+            OK
+          </button>
+        </ModeNotice>
+      ) : null}
       <form onSubmit={onSubmit} noValidate className="grid min-w-0 gap-3" data-testid="on-call-call-log-form">
         <fieldset className="grid min-w-0 gap-1">
           <legend className="text-sm font-medium text-[color:var(--text-heading)]">Who called</legend>
@@ -368,8 +419,29 @@ export function OnCallCallLogCard() {
 }
 
 function CallLogRow({ entry }: { readonly entry: OnCallCallLogEntry }) {
+  const toast = useOptionalToast();
   const who = [entry.caller, entry.label].filter(Boolean).join(" · ");
   const title = [onCallCallLogTime(entry.at), who].filter(Boolean).join(" · ");
+  // Delete at once, with a short Undo, instead of a confirm box (D26-25).
+  const onDelete = () => {
+    removeOnCallCallLogEntry(entry.id);
+    const deleted = `${title} note deleted`;
+    if (!toast) {
+      announce(deleted);
+      return;
+    }
+    toast.push({
+      tone: "info",
+      title: deleted,
+      duration: ON_CALL_CALL_LOG_UNDO_MS,
+      action: {
+        label: "Undo",
+        onAction: () => {
+          announce(restoreOnCallCallLogEntry(entry) ? "Note put back." : "The note could not be put back.");
+        },
+      },
+    });
+  };
   return (
     <li
       className={cn(modeInsetHairline, "flex min-w-0 items-start gap-3 py-2 pl-3 pr-1")}
@@ -409,7 +481,7 @@ function CallLogRow({ entry }: { readonly entry: OnCallCallLogEntry }) {
       <ModeActionButton
         icon={Trash2}
         label={`Delete the ${title} note`}
-        onClick={() => removeOnCallCallLogEntry(entry.id)}
+        onClick={onDelete}
         testId="on-call-call-log-delete"
       />
     </li>
diff --git a/src/lib/on-call/call-log.ts b/src/lib/on-call/call-log.ts
index aefae0a613..ba7dfd4669 100644
--- a/src/lib/on-call/call-log.ts
+++ b/src/lib/on-call/call-log.ts
@@ -3,6 +3,7 @@ import { z } from "zod";
 import { recordOnCallCallCount } from "@/lib/on-call/call-counts";
 import { onCallDeviceStoreChangedEvent } from "@/lib/on-call/device-state-keys";
 import {
+  PATIENT_LABEL_EXPIRY_STORAGE_KEY,
   parsePatientLabelExpiryStamp,
   patientLabelStorageKey,
   readPatientLabels,
@@ -221,6 +222,27 @@ export function removeOnCallCallLogEntry(id: string, now: Date = new Date()): vo
   );
 }
 
+/**
+ * Put back a note deleted moments ago (the Undo on the delete toast, D26-25). Refused once the
+ * shift's labels have been wiped, so an Undo never carries a note into the next shift, and when
+ * the log is already full again.
+ */
+export function restoreOnCallCallLogEntry(entry: OnCallCallLogEntry, now: Date = new Date()): boolean {
+  if (typeof window === "undefined") return false;
+  let stamp: string | null = null;
+  try {
+    stamp = window.localStorage.getItem(PATIENT_LABEL_EXPIRY_STORAGE_KEY);
+  } catch {
+    return false;
+  }
+  const expiresAt = parsePatientLabelExpiry(stamp);
+  if (expiresAt === null || now.getTime() >= expiresAt) return false;
+  const current = live(readStored(now), now);
+  if (current.some((existing) => existing.id === entry.id)) return true;
+  if (current.length >= ON_CALL_CALL_LOG_LIMIT || live([entry], now).length === 0) return false;
+  return write([entry, ...current], now);
+}
+
 /** Clear every note on this device. */
 export function clearOnCallCallLog(): void {
   if (typeof window === "undefined") return;
diff --git a/src/lib/patient-label-storage.ts b/src/lib/patient-label-storage.ts
index a69c113bdd..fd242d876c 100644
--- a/src/lib/patient-label-storage.ts
+++ b/src/lib/patient-label-storage.ts
@@ -177,9 +177,46 @@ export function clearPatientLabels(reason: PatientLabelClearReason = "manual"):
       // Storage that refuses access has nothing stored to clear.
     }
   }
+  if (reason === "account-transition") setShiftLabelsClearedAt(null);
   notifyPatientLabelsCleared(reason);
 }
 
+/**
+ * When the end of a shift last wiped this phone's labels: a time only, never a label, kept outside
+ * the label prefix so the wipe itself leaves it. On Call says "were cleared at" from it, because the
+ * wipe often happens while the page is closed and the list was simply empty next morning (D26-25).
+ * A new shift's first label, a sign-out or an account change removes it.
+ */
+export const SHIFT_LABELS_CLEARED_AT_STORAGE_KEY = "psychsift-shift-labels-cleared-at";
+
+function setShiftLabelsClearedAt(at: number | null): void {
+  const local = storageFor("local");
+  if (!local) return;
+  try {
+    if (at === null) local.removeItem(SHIFT_LABELS_CLEARED_AT_STORAGE_KEY);
+    else local.setItem(SHIFT_LABELS_CLEARED_AT_STORAGE_KEY, String(at));
+  } catch {
+    // A notice that cannot be kept is simply not shown.
+  }
+}
+
+/** When the end of the last shift wiped this phone's labels, or null. */
+export function readShiftLabelsClearedAt(): number | null {
+  const local = storageFor("local");
+  if (!local) return null;
+  try {
+    const value = Number(local.getItem(SHIFT_LABELS_CLEARED_AT_STORAGE_KEY));
+    return Number.isFinite(value) && value > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The reader has seen the "were cleared" notice. */
+export function dismissShiftLabelsClearedNotice(): void {
+  setShiftLabelsClearedAt(null);
+}
+
 function notifyPatientLabelsCleared(reason: PatientLabelClearReason): void {
   window.dispatchEvent(new CustomEvent(PATIENT_LABELS_CLEARED_EVENT, { detail: { reason } }));
 }
@@ -242,6 +279,7 @@ export function clearExpiredPatientLabels(now: number = Date.now()): boolean {
     return true;
   }
   if (now >= stamp.expiresAt) {
+    setShiftLabelsClearedAt(stamp.expiresAt);
     clearPatientLabels("shift-ended");
     return true;
   }
@@ -312,6 +350,8 @@ function ensurePatientLabelStamp(options: WritePatientLabelsOptions = {}): Expir
   } catch {
     return null;
   }
+  // A new shift has started, so last shift's "were cleared" notice no longer applies.
+  if (typeof existing !== "object") setShiftLabelsClearedAt(null);
   clearStaleSessionLabels(stamp, now);
   return stamp;
 }
diff --git a/tests/on-call-call-log-card.dom.test.tsx b/tests/on-call-call-log-card.dom.test.tsx
index 49b5694b17..06724a8744 100644
--- a/tests/on-call-call-log-card.dom.test.tsx
+++ b/tests/on-call-call-log-card.dom.test.tsx
@@ -3,7 +3,14 @@ import { act, cleanup, fireEvent, render, screen } from "@testing-library/react"
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { OnCallCallLogCard } from "@/components/on-call/handover/call-log";
-import { PATIENT_LABEL_EXPIRY_STORAGE_KEY, writePatientLabels } from "@/lib/patient-label-storage";
+import { ToastProvider } from "@/components/ui/toast";
+import { addOnCallCallLogEntry, readOnCallCallLog } from "@/lib/on-call/call-log";
+import {
+  PATIENT_LABEL_EXPIRY_STORAGE_KEY,
+  SHIFT_LABELS_CLEARED_AT_STORAGE_KEY,
+  clearExpiredPatientLabels,
+  writePatientLabels,
+} from "@/lib/patient-label-storage";
 
 afterEach(() => {
   cleanup();
@@ -109,3 +116,32 @@ describe("OnCallCallLogCard cross-tab clearing", () => {
     expect(screen.getByTestId("on-call-call-log-note")).toHaveValue("keep me");
   });
 });
+
+// D26-25: delete has a short Undo, and the end-of-shift wipe is said, not silent.
+describe("OnCallCallLogCard delete and shift clearing", () => {
+  it("deletes a note at once and puts it back from the toast's Undo", () => {
+    const added = addOnCallCallLogEntry({ label: "4B-12", caller: "Ward nurse", note: "SYNTHETIC", followUp: "" });
+    if (!added.ok) throw new Error("setup failed");
+    render(
+      <ToastProvider>
+        <OnCallCallLogCard />
+      </ToastProvider>,
+    );
+    fireEvent.click(screen.getByTestId("on-call-call-log-delete"));
+    expect(readOnCallCallLog()).toEqual([]);
+    expect(screen.getByText(/note deleted/)).toBeTruthy();
+    fireEvent.click(screen.getByRole("button", { name: "Undo" }));
+    expect(readOnCallCallLog().map((entry) => entry.id)).toEqual([added.entry.id]);
+  });
+
+  it("says when the last shift's notes were cleared, until dismissed", () => {
+    const start = Date.now() - 13 * 60 * 60 * 1000;
+    writePatientLabels("fixture", "SYNTHETIC", { now: start });
+    clearExpiredPatientLabels();
+    render(<OnCallCallLogCard />);
+    expect(screen.getByTestId("on-call-shift-cleared").textContent).toMatch(/were cleared at .*when the shift ended/);
+    fireEvent.click(screen.getByTestId("on-call-shift-cleared-dismiss"));
+    expect(screen.queryByTestId("on-call-shift-cleared")).toBeNull();
+    expect(window.localStorage.getItem(SHIFT_LABELS_CLEARED_AT_STORAGE_KEY)).toBeNull();
+  });
+});
diff --git a/tests/on-call-call-log.test.ts b/tests/on-call-call-log.test.ts
index b999141ebd..0dbebaf0dd 100644
--- a/tests/on-call-call-log.test.ts
+++ b/tests/on-call-call-log.test.ts
@@ -12,6 +12,7 @@ import {
   onCallHandoverText,
   readOnCallCallLog,
   removeOnCallCallLogEntry,
+  restoreOnCallCallLogEntry,
   onCallCallLogStorageKey,
   setOnCallCallLogDone,
   visibleOnCallCallLog,
@@ -140,6 +141,24 @@ describe("the call log store", () => {
     expect(window.localStorage.getItem(onCallCallLogStorageKey)).toBeNull();
   });
 
+  it("puts a deleted note back for Undo, but never into the next shift", () => {
+    const first = addOnCallCallLogEntry(draft(), twoAm);
+    if (!first.ok) throw new Error("setup failed");
+    removeOnCallCallLogEntry(first.entry.id, halfThree);
+    expect(readOnCallCallLog(halfThree)).toEqual([]);
+    expect(restoreOnCallCallLogEntry(first.entry, halfThree)).toBe(true);
+    expect(readOnCallCallLog(halfThree).map((entry) => entry.id)).toEqual([first.entry.id]);
+    // A second Undo does not duplicate it.
+    expect(restoreOnCallCallLogEntry(first.entry, halfThree)).toBe(true);
+    expect(readOnCallCallLog(halfThree)).toHaveLength(1);
+
+    removeOnCallCallLogEntry(first.entry.id, halfThree);
+    const afterShift = new Date(twoAm.getTime() + 12 * 3_600_000);
+    clearExpiredPatientLabels(afterShift.getTime());
+    expect(restoreOnCallCallLogEntry(first.entry, afterShift)).toBe(false);
+    expect(window.localStorage.getItem(onCallCallLogStorageKey)).toBeNull();
+  });
+
   it("is kept only through the patient-label store, behind its expiry stamp", () => {
     expect(onCallCallLogStorageKey.startsWith(PATIENT_LABEL_KEY_PREFIX)).toBe(true);
     addOnCallCallLogEntry(draft(), twoAm);
diff --git a/tests/patient-label-storage.dom.test.tsx b/tests/patient-label-storage.dom.test.tsx
index 2a97f0a478..a44ca63a1b 100644
--- a/tests/patient-label-storage.dom.test.tsx
+++ b/tests/patient-label-storage.dom.test.tsx
@@ -64,11 +64,14 @@ import {
   PATIENT_LABEL_KEY_PREFIX,
   PATIENT_LABEL_MAX_LIFETIME_MS,
   PATIENT_LABEL_WATCH_INTERVAL_MS,
+  SHIFT_LABELS_CLEARED_AT_STORAGE_KEY,
   clearExpiredPatientLabels,
   clearPatientLabels,
+  dismissShiftLabelsClearedNotice,
   patientLabelStorageKey,
   patientLabelsExpireAt,
   readPatientLabels,
+  readShiftLabelsClearedAt,
   removePatientLabels,
   subscribePatientLabelsCleared,
   watchPatientLabelExpiry,
@@ -305,6 +308,27 @@ describe("the wipe removes patient labels and nothing else", () => {
     expectUnrelatedIntact();
   });
 
+  // D26-25: the end-of-shift wipe often runs while the page is closed, so it leaves the time it
+  // ran (never a label) for On Call to say "were cleared at".
+  it("records when the end of a shift wiped the labels, and forgets it at the next shift or sign-out", () => {
+    writePatientLabels("timers", "Bed 4", { now: T0, shiftEndsAt: T0 + 8 * HOUR });
+    expect(readShiftLabelsClearedAt()).toBeNull();
+    expect(clearExpiredPatientLabels(T0 + 9 * HOUR)).toBe(true);
+    expect(readShiftLabelsClearedAt()).toBe(T0 + 8 * HOUR);
+    expect(SHIFT_LABELS_CLEARED_AT_STORAGE_KEY.startsWith(PATIENT_LABEL_KEY_PREFIX)).toBe(false);
+
+    writePatientLabels("timers", "Bed 7", { now: T0 + 20 * HOUR });
+    expect(readShiftLabelsClearedAt()).toBeNull();
+
+    window.localStorage.setItem(SHIFT_LABELS_CLEARED_AT_STORAGE_KEY, String(T0));
+    clearPatientLabels("account-transition");
+    expect(readShiftLabelsClearedAt()).toBeNull();
+
+    window.localStorage.setItem(SHIFT_LABELS_CLEARED_AT_STORAGE_KEY, String(T0));
+    dismissShiftLabelsClearedNotice();
+    expect(readShiftLabelsClearedAt()).toBeNull();
+  });
+
   it("has nothing to do when no labels are stored", () => {
     seedUnrelated();
     const onCleared = vi.fn();

From 491210fc5ad7681eeb5cf1fff9975e93b051ebc9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 26 Oct 2026 08:43:22 +0000
Subject: [PATCH 05/11] Sign out: say what goes before clearing this shift's
 labels (D26-26)

Sign out in Settings and in the work profile now asks "Sign out and clear this
phone?" when the phone still holds this shift's bed numbers and initials. With
nothing to lose it signs out at once, as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYsGZ5ecrWh4xL76inGoAq
---
 docs/design-system/COMPONENTS.md              |  2 +-
 docs/design-system/adoption-manifest.json     |  2 +
 .../clinical-dashboard/settings-dialog.tsx    | 12 ++--
 .../clinical-dashboard/sign-out-confirm.tsx   | 34 +++++++++++
 .../work-profile/work-profile-panels.tsx      |  5 +-
 src/lib/patient-label-storage.ts              | 20 +++++++
 tests/sign-out-confirm.dom.test.tsx           | 60 +++++++++++++++++++
 7 files changed, 129 insertions(+), 6 deletions(-)
 create mode 100644 src/components/clinical-dashboard/sign-out-confirm.tsx
 create mode 100644 tests/sign-out-confirm.dom.test.tsx

diff --git a/docs/design-system/COMPONENTS.md b/docs/design-system/COMPONENTS.md
index cb6cce9b24..2655329dc0 100644
--- a/docs/design-system/COMPONENTS.md
+++ b/docs/design-system/COMPONENTS.md
@@ -1069,7 +1069,7 @@ This generated snapshot is a local source-derived inventory. It does not assert
 | `ChoiceChip`             | controls | yes   | yes                | inherited-global-root | yes            | no                 |               7 |
 | `Citation`               | source   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
 | `CitationList`           | source   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
-| `ConfirmDialog`          | layout   | yes   | yes                | inherited-global-root | yes            | no                 |              18 |
+| `ConfirmDialog`          | layout   | yes   | yes                | inherited-global-root | yes            | no                 |              19 |
 | `DateDisplay`            | source   | yes   | yes                | inherited-global-root | yes            | no                 |               4 |
 | `Disclosure`             | layout   | yes   | yes                | inherited-global-root | yes            | no                 |               3 |
 | `DisclosureGroup`        | layout   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
diff --git a/docs/design-system/adoption-manifest.json b/docs/design-system/adoption-manifest.json
index 7856f0e078..048ed46e94 100644
--- a/docs/design-system/adoption-manifest.json
+++ b/docs/design-system/adoption-manifest.json
@@ -840,6 +840,7 @@
         "src/components/calendar/calendar-subscribe.tsx",
         "src/components/clinical-dashboard/favourites-command-library-page.tsx",
         "src/components/clinical-dashboard/settings-dialog.tsx",
+        "src/components/clinical-dashboard/sign-out-confirm.tsx",
         "src/components/cme/cme-drafts-section.tsx",
         "src/components/cme/cme-entry-form.tsx",
         "src/components/cme/cme-entry-route-client.tsx",
@@ -860,6 +861,7 @@
         "src/components/calendar/calendar-subscribe.tsx",
         "src/components/clinical-dashboard/favourites-command-library-page.tsx",
         "src/components/clinical-dashboard/settings-dialog.tsx",
+        "src/components/clinical-dashboard/sign-out-confirm.tsx",
         "src/components/cme/cme-drafts-section.tsx",
         "src/components/cme/cme-entry-form.tsx",
         "src/components/cme/cme-entry-route-client.tsx",
diff --git a/src/components/clinical-dashboard/settings-dialog.tsx b/src/components/clinical-dashboard/settings-dialog.tsx
index 9a5e5c0663..46e4ada647 100644
--- a/src/components/clinical-dashboard/settings-dialog.tsx
+++ b/src/components/clinical-dashboard/settings-dialog.tsx
@@ -93,6 +93,7 @@ import {
 import { ProviderBrandMark, type SsoProvider } from "@/components/clinical-dashboard/provider-brand-icons";
 import { ReminderSettingsBlock } from "@/components/clinical-dashboard/settings-reminders";
 import { ConfirmDialog } from "@/components/ui/confirm-dialog";
+import { useSignOutConfirm } from "@/components/clinical-dashboard/sign-out-confirm";
 import { Select } from "@/components/ui/select";
 import { Sheet } from "@/components/ui/sheet";
 import { SegmentedControl } from "@/components/ui/segmented-control";
@@ -341,6 +342,10 @@ export function SettingsDialog({
   const [privacyNotice, setPrivacyNotice] = useState<string | null>(null);
   const [query, setQuery] = useState("");
   const [pendingConfirm, setPendingConfirm] = useState<"clear-saved" | "reset" | null>(null);
+  const { requestSignOut, dialog: signOutConfirm } = useSignOutConfirm(() => {
+    onSignOut();
+    onClose();
+  });
   const [prevOpen, setPrevOpen] = useState(false);
 
   const settingsAuthBusy = auth.status === "loading";
@@ -1151,10 +1156,8 @@ export function SettingsDialog({
                     ) : (
                       <button
                         type="button"
-                        onClick={() => {
-                          onSignOut();
-                          onClose();
-                        }}
+                        onClick={requestSignOut}
+                        data-testid="settings-sign-out"
                         className={cn(
                           floatingControl,
                           "mt-3 w-full justify-center gap-2 rounded-lg text-sm md:w-auto md:px-4",
@@ -1588,6 +1591,7 @@ export function SettingsDialog({
         }
         confirmLabel="Reset everything"
       />
+      {signOutConfirm}
     </Sheet>
   );
 }
diff --git a/src/components/clinical-dashboard/sign-out-confirm.tsx b/src/components/clinical-dashboard/sign-out-confirm.tsx
new file mode 100644
index 0000000000..e3af4b51db
--- /dev/null
+++ b/src/components/clinical-dashboard/sign-out-confirm.tsx
@@ -0,0 +1,34 @@
+"use client";
+
+import { useCallback, useState } from "react";
+
+import { ConfirmDialog } from "@/components/ui/confirm-dialog";
+import { patientLabelsOnDevice } from "@/lib/patient-label-storage";
+
+export const SIGN_OUT_CONFIRM_TITLE = "Sign out and clear this phone?";
+
+/**
+ * Sign out, but first say what goes when this phone still holds the shift's bed numbers and
+ * initials (D26-26). With nothing to lose it signs out at once, so the common case stays one tap.
+ */
+export function useSignOutConfirm(signOut: () => void) {
+  const [open, setOpen] = useState(false);
+  const requestSignOut = useCallback(() => {
+    if (patientLabelsOnDevice()) setOpen(true);
+    else signOut();
+  }, [signOut]);
+  const dialog = (
+    <ConfirmDialog
+      open={open}
+      onCancel={() => setOpen(false)}
+      onConfirm={() => {
+        setOpen(false);
+        signOut();
+      }}
+      title={SIGN_OUT_CONFIRM_TITLE}
+      description="Signing out clears the bed numbers and initials kept on this phone for this shift, including call notes, handover drafts and timers. They cannot be brought back. Display settings stay."
+      confirmLabel="Sign out and clear"
+    />
+  );
+  return { requestSignOut, dialog } as const;
+}
diff --git a/src/components/work-profile/work-profile-panels.tsx b/src/components/work-profile/work-profile-panels.tsx
index 560e09b57a..af99d5e936 100644
--- a/src/components/work-profile/work-profile-panels.tsx
+++ b/src/components/work-profile/work-profile-panels.tsx
@@ -39,6 +39,7 @@ import { countAllRecents, forgetAllRecents } from "@/lib/work-search/memory";
 import { FATIGUE_RULE_SET } from "@/lib/roster/fatigue-rules-source";
 import { ROSTER_GRADES } from "@/lib/roster/team/model";
 import { useAuthSession } from "@/lib/supabase/client";
+import { useSignOutConfirm } from "@/components/clinical-dashboard/sign-out-confirm";
 import {
   adminArea,
   cpdArea,
@@ -396,6 +397,7 @@ export function PrivacyPanel({
   readonly prefs: WorkProfilePreferences;
 }) {
   const { signOut } = useAuthSession();
+  const { requestSignOut, dialog: signOutConfirm } = useSignOutConfirm(() => void signOut());
   const [cleared, setCleared] = useState<string | null>(null);
   const teams = teamMemberships(
     data.teams.status === "ready" ? data.teams.value : [],
@@ -476,7 +478,8 @@ export function PrivacyPanel({
           href="/roster/settings"
         />
       </WorkProfileSection>
-      <SignOutBlock onSignOut={() => void signOut()} />
+      <SignOutBlock onSignOut={requestSignOut} />
+      {signOutConfirm}
     </div>
   );
 }
diff --git a/src/lib/patient-label-storage.ts b/src/lib/patient-label-storage.ts
index fd242d876c..9080c3059b 100644
--- a/src/lib/patient-label-storage.ts
+++ b/src/lib/patient-label-storage.ts
@@ -181,6 +181,26 @@ export function clearPatientLabels(reason: PatientLabelClearReason = "manual"):
   notifyPatientLabelsCleared(reason);
 }
 
+/**
+ * Whether this phone still holds any of this shift's patient labels (timers, call notes, handover
+ * drafts), so Sign out can say what it will clear before it clears it (D26-26). Expired labels are
+ * wiped first, so a finished shift never counts.
+ */
+export function patientLabelsOnDevice(now: number = Date.now()): boolean {
+  if (typeof window === "undefined") return false;
+  clearExpiredPatientLabels(now);
+  for (const area of ["local", "session"] as const) {
+    const storage = storageFor(area);
+    if (!storage) continue;
+    try {
+      if (labelKeysIn(storage).some((key) => key !== PATIENT_LABEL_EXPIRY_STORAGE_KEY)) return true;
+    } catch {
+      // Storage that refuses access holds nothing to lose.
+    }
+  }
+  return false;
+}
+
 /**
  * When the end of a shift last wiped this phone's labels: a time only, never a label, kept outside
  * the label prefix so the wipe itself leaves it. On Call says "were cleared at" from it, because the
diff --git a/tests/sign-out-confirm.dom.test.tsx b/tests/sign-out-confirm.dom.test.tsx
new file mode 100644
index 0000000000..4691b580b8
--- /dev/null
+++ b/tests/sign-out-confirm.dom.test.tsx
@@ -0,0 +1,60 @@
+// @vitest-environment jsdom
+import { cleanup, fireEvent, render, screen } from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { SIGN_OUT_CONFIRM_TITLE, useSignOutConfirm } from "@/components/clinical-dashboard/sign-out-confirm";
+import { clearPatientLabels, patientLabelsOnDevice, writePatientLabels } from "@/lib/patient-label-storage";
+
+afterEach(() => {
+  cleanup();
+  window.localStorage.clear();
+  window.sessionStorage.clear();
+});
+
+function Harness({ signOut }: { readonly signOut: () => void }) {
+  const { requestSignOut, dialog } = useSignOutConfirm(signOut);
+  return (
+    <>
+      <button type="button" onClick={requestSignOut}>
+        Sign out
+      </button>
+      {dialog}
+    </>
+  );
+}
+
+// D26-26: Sign out says what goes only when there is something to lose.
+describe("useSignOutConfirm", () => {
+  it("signs out at once when the phone holds no patient labels", () => {
+    const signOut = vi.fn();
+    render(<Harness signOut={signOut} />);
+    fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+    expect(signOut).toHaveBeenCalledTimes(1);
+    expect(screen.queryByText(SIGN_OUT_CONFIRM_TITLE)).toBeNull();
+  });
+
+  it("asks first when this shift's labels are on the phone, and Cancel keeps them", () => {
+    writePatientLabels("fixture", "SYNTHETIC Bed 4");
+    const signOut = vi.fn();
+    render(<Harness signOut={signOut} />);
+    fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+    expect(signOut).not.toHaveBeenCalled();
+    expect(screen.getByText(SIGN_OUT_CONFIRM_TITLE)).toBeTruthy();
+    fireEvent.click(screen.getAllByRole("button", { name: "Cancel" })[0]!);
+    expect(signOut).not.toHaveBeenCalled();
+    expect(patientLabelsOnDevice()).toBe(true);
+
+    fireEvent.click(screen.getByRole("button", { name: "Sign out" }));
+    fireEvent.click(screen.getByTestId("confirm-dialog-confirm"));
+    expect(signOut).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not count the shift stamp alone, or labels from a finished shift", () => {
+    const start = Date.now() - 13 * 60 * 60 * 1000;
+    writePatientLabels("fixture", "SYNTHETIC", { now: start });
+    expect(patientLabelsOnDevice()).toBe(false);
+    writePatientLabels("fixture", "SYNTHETIC");
+    clearPatientLabels("manual");
+    expect(patientLabelsOnDevice()).toBe(false);
+  });
+});

From d26b01df9b42f285ce09a9d3ac4b6742bd2ab1f7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 26 Oct 2026 08:48:25 +0000
Subject: [PATCH 06/11] Sign-in: ask before clearing this shift's signed-out
 work (D26-02)

Signing in from signed out used to wipe the call notes, handover drafts and
timers made on this phone without a word. When any are present the sign-in now
holds just those labels and asks: Keep with my account, or Clear them. Every
other store still clears at once, and an account switch, sign-out or expiry
still clears the labels as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYsGZ5ecrWh4xL76inGoAq
---
 docs/design-system/COMPONENTS.md              |  2 +-
 docs/design-system/adoption-manifest.json     |  2 +
 src/components/app-helpers-deferred.tsx       |  6 ++
 .../front-door/signed-out-work-prompt.tsx     | 40 +++++++++++
 src/lib/account-device-sweep.ts               | 14 ++--
 src/lib/account-scoped-browser-state.ts       |  6 +-
 src/lib/supabase/client.tsx                   | 41 +++++++++--
 tests/account-device-sweep.dom.test.tsx       | 10 +++
 tests/auth-provider-login.dom.test.tsx        | 69 +++++++++++++++++++
 tests/signed-out-work-prompt.dom.test.tsx     | 29 ++++++++
 10 files changed, 205 insertions(+), 14 deletions(-)
 create mode 100644 src/components/front-door/signed-out-work-prompt.tsx
 create mode 100644 tests/signed-out-work-prompt.dom.test.tsx

diff --git a/docs/design-system/COMPONENTS.md b/docs/design-system/COMPONENTS.md
index 2655329dc0..b1711152a6 100644
--- a/docs/design-system/COMPONENTS.md
+++ b/docs/design-system/COMPONENTS.md
@@ -1069,7 +1069,7 @@ This generated snapshot is a local source-derived inventory. It does not assert
 | `ChoiceChip`             | controls | yes   | yes                | inherited-global-root | yes            | no                 |               7 |
 | `Citation`               | source   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
 | `CitationList`           | source   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
-| `ConfirmDialog`          | layout   | yes   | yes                | inherited-global-root | yes            | no                 |              19 |
+| `ConfirmDialog`          | layout   | yes   | yes                | inherited-global-root | yes            | no                 |              20 |
 | `DateDisplay`            | source   | yes   | yes                | inherited-global-root | yes            | no                 |               4 |
 | `Disclosure`             | layout   | yes   | yes                | inherited-global-root | yes            | no                 |               3 |
 | `DisclosureGroup`        | layout   | yes   | yes                | inherited-global-root | yes            | no                 |               1 |
diff --git a/docs/design-system/adoption-manifest.json b/docs/design-system/adoption-manifest.json
index 048ed46e94..3d1cf92270 100644
--- a/docs/design-system/adoption-manifest.json
+++ b/docs/design-system/adoption-manifest.json
@@ -848,6 +848,7 @@
         "src/components/cme/cme-training-page.tsx",
         "src/components/cme/cme-year-close-panel.tsx",
         "src/components/front-door/ask-terms-step.tsx",
+        "src/components/front-door/signed-out-work-prompt.tsx",
         "src/components/on-call/on-call-entry-editor.tsx",
         "src/components/on-call/service-admin-panel.tsx",
         "src/components/on-call/service-governance-panel.tsx",
@@ -869,6 +870,7 @@
         "src/components/cme/cme-training-page.tsx",
         "src/components/cme/cme-year-close-panel.tsx",
         "src/components/front-door/ask-terms-step.tsx",
+        "src/components/front-door/signed-out-work-prompt.tsx",
         "src/components/on-call/on-call-entry-editor.tsx",
         "src/components/on-call/service-admin-panel.tsx",
         "src/components/on-call/service-governance-panel.tsx",
diff --git a/src/components/app-helpers-deferred.tsx b/src/components/app-helpers-deferred.tsx
index c892a2a81c..ea96fb06c0 100644
--- a/src/components/app-helpers-deferred.tsx
+++ b/src/components/app-helpers-deferred.tsx
@@ -22,6 +22,10 @@ const SignInEndedNotice = dynamic(
   () => import("@/components/front-door/sign-in-ended-notice").then((m) => m.SignInEndedNotice),
   { ssr: false },
 );
+const SignedOutWorkPrompt = dynamic(
+  () => import("@/components/front-door/signed-out-work-prompt").then((m) => m.SignedOutWorkPrompt),
+  { ssr: false },
+);
 const MotionEnter = dynamic(() => import("@/components/motion/motion-enter").then((m) => m.MotionEnter), {
   ssr: false,
 });
@@ -36,6 +40,8 @@ export function AppHelpersDeferred() {
       <TermsAcceptancePrompt />
       {/* Says when an ended sign-in cleared this device's private notes. */}
       <SignInEndedNotice />
+      {/* Asks whether a first sign-in keeps the shift's signed-out work on this phone. */}
+      <SignedOutWorkPrompt />
     </>
   );
 }
diff --git a/src/components/front-door/signed-out-work-prompt.tsx b/src/components/front-door/signed-out-work-prompt.tsx
new file mode 100644
index 0000000000..b904119095
--- /dev/null
+++ b/src/components/front-door/signed-out-work-prompt.tsx
@@ -0,0 +1,40 @@
+"use client";
+
+import { ConfirmDialog } from "@/components/ui/confirm-dialog";
+import { useOptionalToast } from "@/components/ui/toast";
+import { useAuthSession } from "@/lib/supabase/client";
+
+export const SIGNED_OUT_WORK_TITLE = "Keep what's on this phone?";
+export const SIGNED_OUT_WORK_BODY =
+  "Before you signed in, bed numbers or initials were saved on this phone in call notes, handover drafts or timers. Keep them with your account for this shift, or clear them now. Kept ones still clear when the shift ends.";
+
+/**
+ * Asks, once per sign-in, whether the signed-out work on this phone stays (design audit D26-02).
+ * Closing the sheet keeps it, because clearing cannot be undone; Clear them is the deliberate step.
+ */
+export function SignedOutWorkPrompt() {
+  const { signedOutWorkHeld, resolveSignedOutWork } = useAuthSession();
+  const toast = useOptionalToast();
+  if (!resolveSignedOutWork) return null;
+
+  const answer = (keep: boolean) => {
+    resolveSignedOutWork(keep);
+    toast?.push({
+      tone: "info",
+      title: keep ? "Kept with your account" : "Cleared from this phone",
+      body: keep ? "They clear when your shift ends or you sign out." : undefined,
+    });
+  };
+
+  return (
+    <ConfirmDialog
+      open={Boolean(signedOutWorkHeld)}
+      onCancel={() => answer(true)}
+      onConfirm={() => answer(false)}
+      title={SIGNED_OUT_WORK_TITLE}
+      description={SIGNED_OUT_WORK_BODY}
+      cancelLabel="Keep with my account"
+      confirmLabel="Clear them"
+    />
+  );
+}
diff --git a/src/lib/account-device-sweep.ts b/src/lib/account-device-sweep.ts
index 90202aeea5..64483e57c0 100644
--- a/src/lib/account-device-sweep.ts
+++ b/src/lib/account-device-sweep.ts
@@ -40,11 +40,15 @@ const CLINICAL_DRAFT_PREFIXES: readonly string[] = ["psychsift_dsm_draft_", "cli
 
 const SERVICE_WORKER_CACHE_PREFIX = "clinical-kb-pwa-";
 
-function sweepStorage(storage: Storage): void {
+/** Options for one sweep. `keepPrefix` spares one key family, used only while a sign-in asks first (D26-02). */
+export type AccountDeviceSweepOptions = { readonly keepPrefix?: string };
+
+function sweepStorage(storage: Storage, { keepPrefix }: AccountDeviceSweepOptions): void {
   const doomed: string[] = [];
   for (let index = 0; index < storage.length; index += 1) {
     const key = storage.key(index);
     if (!key) continue;
+    if (keepPrefix && key.startsWith(keepPrefix)) continue;
     const workKey = key.startsWith(PSYCHSIFT_PREFIX) && !DEVICE_PREFERENCE_KEYS.has(key);
     const draftKey = CLINICAL_DRAFT_KEYS.includes(key) || CLINICAL_DRAFT_PREFIXES.some((p) => key.startsWith(p));
     if (workKey || draftKey) doomed.push(key);
@@ -52,10 +56,10 @@ function sweepStorage(storage: Storage): void {
   for (const key of doomed) storage.removeItem(key);
 }
 
-function sweepWebStorage(): void {
+function sweepWebStorage(options: AccountDeviceSweepOptions): void {
   for (const getStorage of [() => window.localStorage, () => window.sessionStorage]) {
     try {
-      sweepStorage(getStorage());
+      sweepStorage(getStorage(), options);
     } catch {
       // Storage blocked: nothing was stored to clear.
     }
@@ -94,9 +98,9 @@ async function closePsychSiftNotifications(): Promise<void> {
  * sees honest absence), then the asynchronous parts in the background. Safe on
  * the server (no-op) and never throws.
  */
-export function sweepAccountDeviceData(): void {
+export function sweepAccountDeviceData(options: AccountDeviceSweepOptions = {}): void {
   if (typeof window === "undefined") return;
-  sweepWebStorage();
+  sweepWebStorage(options);
   for (const task of [deleteIndexedDbDatabases, deletePageCaches, closePsychSiftNotifications]) {
     void task().catch(() => undefined);
   }
diff --git a/src/lib/account-scoped-browser-state.ts b/src/lib/account-scoped-browser-state.ts
index b683ba1792..1620c653a0 100644
--- a/src/lib/account-scoped-browser-state.ts
+++ b/src/lib/account-scoped-browser-state.ts
@@ -32,7 +32,7 @@
  * goes; name it here anyway, because the name is where its contents are written down.
  */
 
-import { sweepAccountDeviceData } from "@/lib/account-device-sweep";
+import { type AccountDeviceSweepOptions, sweepAccountDeviceData } from "@/lib/account-device-sweep";
 import { WORK_MODE_PREFERENCE_COOKIE } from "@/lib/work-mode-launch/launch";
 
 export const ACCOUNT_TRANSITION_EVENT = "clinical-kb-account-transition";
@@ -249,7 +249,7 @@ function removeQuietly(storage: () => Storage, key: string): void {
  * Remove every account-scoped key this module names, then dispatch one
  * `ACCOUNT_TRANSITION_EVENT` on `window`. Safe to call on the server (no-op).
  */
-export function clearAccountScopedBrowserStorage(): void {
+export function clearAccountScopedBrowserStorage(options: AccountDeviceSweepOptions = {}): void {
   if (typeof window === "undefined") return;
   // Cookie — the classic or new work view choice: the person's, so the next person starts on the default.
   try {
@@ -316,7 +316,7 @@ export function clearAccountScopedBrowserStorage(): void {
   stripAccountScopedPreferences();
   // The catch-all: every other `psychsift:` key, the clinical drafts, IndexedDB,
   // page caches and PsychSift's notifications (see account-device-sweep.ts).
-  sweepAccountDeviceData();
+  sweepAccountDeviceData(options);
   window.dispatchEvent(new Event(ACCOUNT_TRANSITION_EVENT));
 }
 
diff --git a/src/lib/supabase/client.tsx b/src/lib/supabase/client.tsx
index 5d44ddd07b..27455a6983 100644
--- a/src/lib/supabase/client.tsx
+++ b/src/lib/supabase/client.tsx
@@ -11,7 +11,12 @@ import { clearOnCallEntryCache } from "@/lib/on-call/entry-cache-keys";
 import { clearOnCallChecklists } from "@/lib/on-call/checklist-storage-keys";
 import { clearOnCallDeviceState } from "@/lib/on-call/device-state-keys";
 import { clearOnCallRecent } from "@/lib/on-call/recent-storage-keys";
-import { clearPatientLabels, watchPatientLabelExpiry } from "@/lib/patient-label-storage";
+import {
+  PATIENT_LABEL_KEY_PREFIX,
+  clearPatientLabels,
+  patientLabelsOnDevice,
+  watchPatientLabelExpiry,
+} from "@/lib/patient-label-storage";
 import { clearMhaClocks } from "@/lib/psychiatry-hub/mha-clocks";
 import { clearPatientProfile } from "@/lib/patient-profile-storage";
 import { clearRecentQueries } from "@/lib/recent-query-storage";
@@ -48,6 +53,14 @@ type AuthContextValue = {
    * because the clearing itself is silent (design audit D-04, owner yes 19 Oct 2026).
    */
   deviceDataClearedAt?: number | null;
+  /**
+   * True while a sign-in on this tab is holding the bed numbers and initials made on this phone
+   * before it (call notes, handover drafts, timers), until the person says to keep or clear them.
+   * Before this the sign-in cleared them without a word (design audit D26-02).
+   */
+  signedOutWorkHeld?: boolean;
+  /** Answer the question above: keep the work with this account for the shift, or clear it now. */
+  resolveSignedOutWork?: (keep: boolean) => void;
 };
 
 export const AUTH_EMAIL_STORAGE_KEY = "clinical.dashboard.lastAuthEmail";
@@ -78,7 +91,7 @@ const AuthContext = createContext<AuthContextValue | null>(null);
  * answer-thread snapshot (see `initializeSession`). The one boot case that IS a
  * transition, a stored session the auth server rejects, calls this too.
  */
-function clearAccountScopedBrowserState() {
+function clearAccountScopedBrowserState({ keepPatientLabels = false }: { readonly keepPatientLabels?: boolean } = {}) {
   // First, so a store that restarts on any clear below (On Call's epoch) never
   // joins the previous account's read still in flight (src/lib/shared-get.ts).
   resetSharedGets();
@@ -89,7 +102,8 @@ function clearAccountScopedBrowserState() {
   clearPatientProfile();
   // Bed numbers and initials (timers, call notes, handover drafts). They also
   // expire at the end of the shift; see the watcher in AuthProvider.
-  clearPatientLabels("account-transition");
+  // Kept only while a first sign-in asks whether this shift's signed-out work stays (D26-02).
+  if (!keepPatientLabels) clearPatientLabels("account-transition");
   // On Call entries are the owner's own ward numbers, escalation contacts and
   // personal lines (added on main while this branch was open). A shared ward
   // computer switches accounts without ever signing out, so without this the
@@ -113,7 +127,7 @@ function clearAccountScopedBrowserState() {
   // plan draft left by the retired Caring Contacts prototype (audit L6).
   // The raw keys are removed here, synchronously, whether or not those modules
   // are loaded in this page; the stores drop their caches on the event it fires.
-  clearAccountScopedBrowserStorage();
+  clearAccountScopedBrowserStorage(keepPatientLabels ? { keepPrefix: PATIENT_LABEL_KEY_PREFIX } : {});
   // Phone alerts belong to the person too. Sign-out has already awaited this so
   // it can say if it failed; expiry and an account switch drop it here in the
   // background, so the next person at a shared computer gets nothing of theirs.
@@ -287,6 +301,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
   const [error, setError] = useState<string | null>(null);
   const [notice, setNotice] = useState<string | null>(null);
   const [deviceDataClearedAt, setDeviceDataClearedAt] = useState<number | null>(null);
+  const [signedOutWorkHeld, setSignedOutWorkHeld] = useState(false);
   const callbackErrorRef = useRef<string | null | undefined>(undefined);
   const authRequestsRef = useRef(createAuthRequestLifecycle());
   const authFingerprintRef = useRef<string | null>(null);
@@ -457,7 +472,12 @@ export function AuthProvider({ children }: { children: ReactNode }) {
       // switch; sign-out and expiry null the ref themselves, so a later sign-in
       // as a different user still clears.
       if (initialSessionPublishedRef.current && publishedUserIdRef.current !== nextUserId) {
-        clearAccountScopedBrowserState();
+        // Signing in from signed out, with this shift's labels on the phone: they were made here,
+        // signed out, so ask before clearing them (D26-02). Every other store still clears now, and
+        // any other change (sign-out, expiry, an account switch) clears the labels as before.
+        const holdSignedOutWork = publishedUserIdRef.current === null && nextUserId !== null && patientLabelsOnDevice();
+        clearAccountScopedBrowserState({ keepPatientLabels: holdSignedOutWork });
+        setSignedOutWorkHeld(holdSignedOutWork);
         // A session that ended without this tab's Sign out (a refresh the auth
         // server refused) cleared this device too, so the notice says so.
         if (!nextUserId && !userSignOutRef.current) setDeviceDataClearedAt(Date.now());
@@ -623,6 +643,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
       });
     userSignOutRef.current = false;
     clearAccountScopedBrowserState();
+    setSignedOutWorkHeld(false);
     publishedUserIdRef.current = null;
     setSession(null);
     setStatus("signed_out");
@@ -648,6 +669,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     // failure is reported as expiry — accepted: a stale profile surviving to the
     // next sign-in is the worse failure on a shared workstation.
     clearAccountScopedBrowserState();
+    setSignedOutWorkHeld(false);
     setDeviceDataClearedAt(Date.now());
     publishedUserIdRef.current = null;
     setSession(null);
@@ -656,6 +678,11 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     setError("Your session expired. Sign in again to use account features.");
   }, [invalidateAuthRequests]);
 
+  const resolveSignedOutWork = useCallback((keep: boolean) => {
+    if (!keep) clearPatientLabels("account-transition");
+    setSignedOutWorkHeld(false);
+  }, []);
+
   const accessToken = session?.access_token ?? null;
   const authorizationHeader = useMemo(() => authorizationHeadersForAccessToken(accessToken), [accessToken]);
 
@@ -694,6 +721,8 @@ export function AuthProvider({ children }: { children: ReactNode }) {
       signOut,
       markSessionExpired,
       deviceDataClearedAt,
+      signedOutWorkHeld,
+      resolveSignedOutWork,
     }),
     [
       client,
@@ -713,6 +742,8 @@ export function AuthProvider({ children }: { children: ReactNode }) {
       signOut,
       markSessionExpired,
       deviceDataClearedAt,
+      signedOutWorkHeld,
+      resolveSignedOutWork,
     ],
   );
 
diff --git a/tests/account-device-sweep.dom.test.tsx b/tests/account-device-sweep.dom.test.tsx
index f14bbc4ba9..3f20333976 100644
--- a/tests/account-device-sweep.dom.test.tsx
+++ b/tests/account-device-sweep.dom.test.tsx
@@ -37,6 +37,16 @@ describe("account device sweep", () => {
     expect(window.localStorage.getItem("clinical-kb-theme")).toBe("dark");
   });
 
+  it("spares only the named key family while a sign-in asks first (D26-02)", () => {
+    window.localStorage.setItem("psychsift:patient-labels:fixture", "SYNTHETIC");
+    window.localStorage.setItem("psychsift:other:fixture", "SYNTHETIC");
+    sweepAccountDeviceData({ keepPrefix: "psychsift:patient-labels:" });
+    expect(window.localStorage.getItem("psychsift:patient-labels:fixture")).toBe("SYNTHETIC");
+    expect(window.localStorage.getItem("psychsift:other:fixture")).toBeNull();
+    sweepAccountDeviceData();
+    expect(window.localStorage.getItem("psychsift:patient-labels:fixture")).toBeNull();
+  });
+
   it("deletes IndexedDB databases and page caches, keeps the service worker's caches, and closes PsychSift notifications", async () => {
     const deleteDatabase = vi.fn();
     vi.stubGlobal("indexedDB", {
diff --git a/tests/auth-provider-login.dom.test.tsx b/tests/auth-provider-login.dom.test.tsx
index 97df4ba92e..16ccc45c59 100644
--- a/tests/auth-provider-login.dom.test.tsx
+++ b/tests/auth-provider-login.dom.test.tsx
@@ -25,6 +25,7 @@ vi.mock("@supabase/ssr", () => ({
 }));
 
 import { AuthProvider, useAuthSession } from "@/lib/supabase/client";
+import { patientLabelsOnDevice, writePatientLabels } from "@/lib/patient-label-storage";
 
 function Probe() {
   const auth = useAuthSession();
@@ -48,6 +49,13 @@ function Probe() {
         Sign out
       </button>
       <p data-testid="cleared">{auth.deviceDataClearedAt ? "cleared" : "kept"}</p>
+      <p data-testid="held">{auth.signedOutWorkHeld ? "held" : "not held"}</p>
+      <button type="button" onClick={() => auth.resolveSignedOutWork?.(false)}>
+        Clear held
+      </button>
+      <button type="button" onClick={() => auth.resolveSignedOutWork?.(true)}>
+        Keep held
+      </button>
     </>
   );
 }
@@ -183,6 +191,67 @@ describe("provider login requests", () => {
     expect(screen.getByTestId("cleared")).toHaveTextContent("cleared");
   });
 
+  // D26-02: signing in from signed out asks about this shift's signed-out work instead of wiping it.
+  it("holds signed-out patient labels at sign-in until told to keep or clear them", async () => {
+    const user = userEvent.setup();
+    render(
+      <AuthProvider>
+        <Probe />
+      </AuthProvider>,
+    );
+    await screen.findByText("signed_out");
+    writePatientLabels("fixture", "SYNTHETIC Bed 4");
+    act(() => {
+      for (const listener of authState.listeners)
+        listener("SIGNED_IN", { user: { id: "synthetic-user" }, access_token: "synthetic-token" });
+    });
+    await screen.findByText("authenticated");
+    expect(screen.getByTestId("held")).toHaveTextContent("held");
+    expect(patientLabelsOnDevice()).toBe(true);
+    await user.click(screen.getByRole("button", { name: "Clear held" }));
+    expect(screen.getByTestId("held")).toHaveTextContent("not held");
+    expect(patientLabelsOnDevice()).toBe(false);
+  });
+
+  it("keeps held work when told to, and never holds anything across an account switch", async () => {
+    const user = userEvent.setup();
+    render(
+      <AuthProvider>
+        <Probe />
+      </AuthProvider>,
+    );
+    await screen.findByText("signed_out");
+    act(() => {
+      for (const listener of authState.listeners)
+        listener("SIGNED_IN", { user: { id: "synthetic-user" }, access_token: "synthetic-token" });
+    });
+    await screen.findByText("authenticated");
+    // Nothing on the phone at sign-in: nothing to ask about.
+    expect(screen.getByTestId("held")).toHaveTextContent("not held");
+
+    writePatientLabels("fixture", "SYNTHETIC Bed 4");
+    act(() => {
+      for (const listener of authState.listeners)
+        listener("SIGNED_IN", { user: { id: "another-synthetic-user" }, access_token: "synthetic-token-2" });
+    });
+    expect(screen.getByTestId("held")).toHaveTextContent("not held");
+    expect(patientLabelsOnDevice()).toBe(false);
+
+    act(() => {
+      for (const listener of authState.listeners) listener("SIGNED_OUT", null);
+    });
+    writePatientLabels("fixture", "SYNTHETIC Bed 7");
+    act(() => {
+      for (const listener of authState.listeners)
+        listener("SIGNED_IN", { user: { id: "synthetic-user" }, access_token: "synthetic-token" });
+    });
+    expect(screen.getByTestId("held")).toHaveTextContent("held");
+    await user.click(screen.getByRole("button", { name: "Keep held" }));
+    expect(screen.getByTestId("held")).toHaveTextContent("not held");
+    expect(patientLabelsOnDevice()).toBe(true);
+    window.localStorage.clear();
+  });
+
   it("settles a rejected password request so the user can retry", async () => {
     api.signInWithPassword.mockRejectedValue(new Error("offline"));
     const user = userEvent.setup();
diff --git a/tests/signed-out-work-prompt.dom.test.tsx b/tests/signed-out-work-prompt.dom.test.tsx
new file mode 100644
index 0000000000..2f24157593
--- /dev/null
+++ b/tests/signed-out-work-prompt.dom.test.tsx
@@ -0,0 +1,29 @@
+// @vitest-environment jsdom
+import { cleanup, fireEvent, render, screen } from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const auth = vi.hoisted(() => ({ signedOutWorkHeld: true, resolveSignedOutWork: vi.fn() }));
+vi.mock("@/lib/supabase/client", () => ({ useAuthSession: () => auth }));
+
+import { SIGNED_OUT_WORK_TITLE, SignedOutWorkPrompt } from "@/components/front-door/signed-out-work-prompt";
+
+afterEach(() => {
+  cleanup();
+  auth.resolveSignedOutWork.mockReset();
+});
+
+// D26-02: the sign-in question about work made on this phone while signed out.
+describe("SignedOutWorkPrompt", () => {
+  it("clears only on the deliberate Clear them", () => {
+    render(<SignedOutWorkPrompt />);
+    expect(screen.getByText(SIGNED_OUT_WORK_TITLE)).toBeTruthy();
+    fireEvent.click(screen.getByTestId("confirm-dialog-confirm"));
+    expect(auth.resolveSignedOutWork).toHaveBeenCalledWith(false);
+  });
+
+  it("keeps the work when the sheet is answered with Keep", () => {
+    render(<SignedOutWorkPrompt />);
+    fireEvent.click(screen.getAllByRole("button", { name: "Keep with my account" })[0]!);
+    expect(auth.resolveSignedOutWork).toHaveBeenCalledWith(true);
+  });
+});

From e14fa9f7a1a62444bf19a6ae59fbedb632e51966 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 26 Oct 2026 09:11:22 +0000
Subject: [PATCH 07/11] Format two files touched by the answer error changes

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYsGZ5ecrWh4xL76inGoAq
---
 src/components/clinical-dashboard/use-medication-catalog.ts | 4 +---
 src/lib/clinical-ask/client-stream.ts                       | 6 +-----
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/src/components/clinical-dashboard/use-medication-catalog.ts b/src/components/clinical-dashboard/use-medication-catalog.ts
index f49c5083b5..ff05d17405 100644
--- a/src/components/clinical-dashboard/use-medication-catalog.ts
+++ b/src/components/clinical-dashboard/use-medication-catalog.ts
@@ -440,9 +440,7 @@ export function useMedicationDetail(slug?: string): MedicationDetailState {
         setState({
           data: null,
           loading: false,
-          error: isOffline
-            ? "You are offline. Connect to view this medication."
-            : medicationRecordErrorMessage(error),
+          error: isOffline ? "You are offline. Connect to view this medication." : medicationRecordErrorMessage(error),
           notFoundCode:
             error instanceof MedicationRequestError && error.status === 404 && error.code === "medication_not_found",
         });
diff --git a/src/lib/clinical-ask/client-stream.ts b/src/lib/clinical-ask/client-stream.ts
index d2e28dbb93..386aaf32eb 100644
--- a/src/lib/clinical-ask/client-stream.ts
+++ b/src/lib/clinical-ask/client-stream.ts
@@ -1,10 +1,6 @@
 import type { ClinicalAskFinalPayload, ClinicalAskRequest, ClinicalAskStreamEvent } from "@/lib/clinical-ask/contracts";
 import { parseClinicalAskSseFrame } from "@/lib/clinical-ask-stream-contract";
-import {
-  ANSWER_DAILY_LIMIT_CODE,
-  answerBurstLimitMessage,
-  answerDailyLimitMessage,
-} from "@/lib/answer-limit-copy";
+import { ANSWER_DAILY_LIMIT_CODE, answerBurstLimitMessage, answerDailyLimitMessage } from "@/lib/answer-limit-copy";
 
 type ClientFailureCode = "aborted" | "internal_error" | "unauthorized" | "rate_limited";
 

From dbac69be2e094541a12682366192018ef643d248 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 26 Oct 2026 10:12:16 +0000
Subject: [PATCH 08/11] Record the owner's 26 Oct choice: sign-in asks, and
 closing keeps signed-out shift work

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYsGZ5ecrWh4xL76inGoAq
---
 ...026-10-26-sign-in-keeps-signed-out-shift-work.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 docs/decisions/2026-10-26-sign-in-keeps-signed-out-shift-work.md

diff --git a/docs/decisions/2026-10-26-sign-in-keeps-signed-out-shift-work.md b/docs/decisions/2026-10-26-sign-in-keeps-signed-out-shift-work.md
new file mode 100644
index 0000000000..96af387755
--- /dev/null
+++ b/docs/decisions/2026-10-26-sign-in-keeps-signed-out-shift-work.md
@@ -0,0 +1,13 @@
+# Decision: Signing in asks before clearing this shift's signed-out work, and closing the question keeps it
+
+- **Status:** decided 2026-10-26
+- **Source:** `src/components/front-door/signed-out-work-prompt.tsx`, find "Closing the sheet keeps it, because clearing cannot be undone"
+
+On 26 Oct 2026 the owner approved the design wording in pull request 3836 and chose, by decision card,
+that closing the sign-in question keeps the work ("Approve, closing keeps"). When someone signs in on a
+phone holding this shift's call notes, handover drafts or timers made while signed out, the app asks
+whether to keep them with the account or clear them. Closing without choosing keeps them. Kept labels
+still clear at the end of the shift, at sign-out, at expiry and when a different account signs in.
+Before this they were cleared at sign-in without a word.
+
+If this summary and the source ever differ, the source wins.

From 0c8bc5343da8fc1a4a81dfcbe2f10f54c6abf6d6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 26 Oct 2026 10:17:46 +0000
Subject: [PATCH 09/11] On Call: a call-note Undo only works within the shift
 it was deleted in

Codex review on #3836: after a sign-out wipe and a new shift starting, the
delete toast's Undo could put the old note back into the new shift's labels.
Delete now records the shift's generation, and Undo is refused unless the
current shift has the same generation and has not expired.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYsGZ5ecrWh4xL76inGoAq
---
 src/components/on-call/handover/call-log.tsx |  8 +--
 src/lib/on-call/call-log.ts                  | 52 ++++++++++++++------
 tests/on-call-call-log.test.ts               | 26 ++++++++--
 3 files changed, 62 insertions(+), 24 deletions(-)

diff --git a/src/components/on-call/handover/call-log.tsx b/src/components/on-call/handover/call-log.tsx
index efda8ad649..d317d104fa 100644
--- a/src/components/on-call/handover/call-log.tsx
+++ b/src/components/on-call/handover/call-log.tsx
@@ -21,7 +21,7 @@ import {
   onCallCallLogTime,
   onCallCallLogStorageKey,
   visibleOnCallCallLog,
-  removeOnCallCallLogEntry,
+  deleteOnCallCallLogEntryForUndo,
   restoreOnCallCallLogEntry,
   setOnCallCallLogDone,
   type OnCallCallLogDraft,
@@ -424,9 +424,9 @@ function CallLogRow({ entry }: { readonly entry: OnCallCallLogEntry }) {
   const title = [onCallCallLogTime(entry.at), who].filter(Boolean).join(" · ");
   // Delete at once, with a short Undo, instead of a confirm box (D26-25).
   const onDelete = () => {
-    removeOnCallCallLogEntry(entry.id);
+    const undo = deleteOnCallCallLogEntryForUndo(entry);
     const deleted = `${title} note deleted`;
-    if (!toast) {
+    if (!toast || !undo) {
       announce(deleted);
       return;
     }
@@ -437,7 +437,7 @@ function CallLogRow({ entry }: { readonly entry: OnCallCallLogEntry }) {
       action: {
         label: "Undo",
         onAction: () => {
-          announce(restoreOnCallCallLogEntry(entry) ? "Note put back." : "The note could not be put back.");
+          announce(restoreOnCallCallLogEntry(undo) ? "Note put back." : "The note could not be put back.");
         },
       },
     });
diff --git a/src/lib/on-call/call-log.ts b/src/lib/on-call/call-log.ts
index ba7dfd4669..66bb38e2b0 100644
--- a/src/lib/on-call/call-log.ts
+++ b/src/lib/on-call/call-log.ts
@@ -222,25 +222,47 @@ export function removeOnCallCallLogEntry(id: string, now: Date = new Date()): vo
   );
 }
 
-/**
- * Put back a note deleted moments ago (the Undo on the delete toast, D26-25). Refused once the
- * shift's labels have been wiped, so an Undo never carries a note into the next shift, and when
- * the log is already full again.
- */
-export function restoreOnCallCallLogEntry(entry: OnCallCallLogEntry, now: Date = new Date()): boolean {
-  if (typeof window === "undefined") return false;
-  let stamp: string | null = null;
+/** The current shift's stamp, with the random generation each new shift gets. */
+function readShiftStamp() {
   try {
-    stamp = window.localStorage.getItem(PATIENT_LABEL_EXPIRY_STORAGE_KEY);
+    return parsePatientLabelExpiryStamp(window.localStorage.getItem(PATIENT_LABEL_EXPIRY_STORAGE_KEY));
   } catch {
-    return false;
+    return null;
   }
-  const expiresAt = parsePatientLabelExpiry(stamp);
-  if (expiresAt === null || now.getTime() >= expiresAt) return false;
+}
+
+/**
+ * Delete a note and return what an Undo needs to put it back: the note and the shift it belonged
+ * to, read from the shift's stamp at the moment of deletion (D26-25).
+ */
+export function deleteOnCallCallLogEntryForUndo(
+  entry: OnCallCallLogEntry,
+  now: Date = new Date(),
+): OnCallCallLogUndo | null {
+  if (typeof window === "undefined") return null;
+  const stamp = readShiftStamp();
+  removeOnCallCallLogEntry(entry.id, now);
+  // A stamp from before generations existed cannot tell one shift from the next, so it gets no Undo.
+  return stamp?.generation ? { entry, shiftGeneration: stamp.generation } : null;
+}
+
+export type OnCallCallLogUndo = { readonly entry: OnCallCallLogEntry; readonly shiftGeneration: string };
+
+/**
+ * Put back a note deleted moments ago (the Undo on the delete toast). Refused unless the shift it
+ * was deleted in is still the current one: the same generation, unexpired. A sign-out, an account change
+ * or the end of the shift wipes the stamp, and any later shift writes a new one, so an Undo can
+ * never carry a note across a wipe into another person's or another shift's labels. Also refused
+ * when the log is already full again.
+ */
+export function restoreOnCallCallLogEntry(undo: OnCallCallLogUndo, now: Date = new Date()): boolean {
+  if (typeof window === "undefined") return false;
+  const stamp = readShiftStamp();
+  if (!stamp || stamp.generation !== undo.shiftGeneration || now.getTime() >= stamp.expiresAt) return false;
   const current = live(readStored(now), now);
-  if (current.some((existing) => existing.id === entry.id)) return true;
-  if (current.length >= ON_CALL_CALL_LOG_LIMIT || live([entry], now).length === 0) return false;
-  return write([entry, ...current], now);
+  if (current.some((existing) => existing.id === undo.entry.id)) return true;
+  if (current.length >= ON_CALL_CALL_LOG_LIMIT || live([undo.entry], now).length === 0) return false;
+  return write([undo.entry, ...current], now);
 }
 
 /** Clear every note on this device. */
diff --git a/tests/on-call-call-log.test.ts b/tests/on-call-call-log.test.ts
index 0dbebaf0dd..3595655004 100644
--- a/tests/on-call-call-log.test.ts
+++ b/tests/on-call-call-log.test.ts
@@ -11,6 +11,7 @@ import {
   onCallHandoverItems,
   onCallHandoverText,
   readOnCallCallLog,
+  deleteOnCallCallLogEntryForUndo,
   removeOnCallCallLogEntry,
   restoreOnCallCallLogEntry,
   onCallCallLogStorageKey,
@@ -144,21 +145,36 @@ describe("the call log store", () => {
   it("puts a deleted note back for Undo, but never into the next shift", () => {
     const first = addOnCallCallLogEntry(draft(), twoAm);
     if (!first.ok) throw new Error("setup failed");
-    removeOnCallCallLogEntry(first.entry.id, halfThree);
+    const undo = deleteOnCallCallLogEntryForUndo(first.entry, halfThree);
+    if (!undo) throw new Error("no undo");
     expect(readOnCallCallLog(halfThree)).toEqual([]);
-    expect(restoreOnCallCallLogEntry(first.entry, halfThree)).toBe(true);
+    expect(restoreOnCallCallLogEntry(undo, halfThree)).toBe(true);
     expect(readOnCallCallLog(halfThree).map((entry) => entry.id)).toEqual([first.entry.id]);
     // A second Undo does not duplicate it.
-    expect(restoreOnCallCallLogEntry(first.entry, halfThree)).toBe(true);
+    expect(restoreOnCallCallLogEntry(undo, halfThree)).toBe(true);
     expect(readOnCallCallLog(halfThree)).toHaveLength(1);
 
-    removeOnCallCallLogEntry(first.entry.id, halfThree);
+    const again = deleteOnCallCallLogEntryForUndo(first.entry, halfThree);
+    if (!again) throw new Error("no undo");
     const afterShift = new Date(twoAm.getTime() + 12 * 3_600_000);
     clearExpiredPatientLabels(afterShift.getTime());
-    expect(restoreOnCallCallLogEntry(first.entry, afterShift)).toBe(false);
+    expect(restoreOnCallCallLogEntry(again, afterShift)).toBe(false);
     expect(window.localStorage.getItem(onCallCallLogStorageKey)).toBeNull();
   });
 
+  it("never puts a note back across a sign-out wipe into a new shift's labels", () => {
+    const first = addOnCallCallLogEntry(draft(), twoAm);
+    if (!first.ok) throw new Error("setup failed");
+    const undo = deleteOnCallCallLogEntryForUndo(first.entry, halfThree);
+    if (!undo) throw new Error("no undo");
+    clearPatientLabels("account-transition");
+    // The next person starts a shift before the toast closes.
+    const next = addOnCallCallLogEntry(draft({ label: "5A-3" }), halfThree);
+    if (!next.ok) throw new Error("setup failed");
+    expect(restoreOnCallCallLogEntry(undo, halfThree)).toBe(false);
+    expect(readOnCallCallLog(halfThree).map((entry) => entry.id)).toEqual([next.entry.id]);
+  });
+
   it("is kept only through the patient-label store, behind its expiry stamp", () => {
     expect(onCallCallLogStorageKey.startsWith(PATIENT_LABEL_KEY_PREFIX)).toBe(true);
     addOnCallCallLogEntry(draft(), twoAm);

From aaead9782ca1cf09fd8cc8291eb864a346eaed70 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 26 Oct 2026 10:31:49 +0000
Subject: [PATCH 10/11] Regenerate the repo-awareness snapshot for the new
 decision record

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYsGZ5ecrWh4xL76inGoAq
---
 data/repo-awareness-snapshot.json | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/data/repo-awareness-snapshot.json b/data/repo-awareness-snapshot.json
index 38daec3658..3b1e6edcd5 100644
--- a/data/repo-awareness-snapshot.json
+++ b/data/repo-awareness-snapshot.json
@@ -4886,6 +4886,11 @@
         "section": "archive",
         "catalogued": true
       },
+      {
+        "path": "docs/decisions/2026-10-26-sign-in-keeps-signed-out-shift-work.md",
+        "section": "decisions",
+        "catalogued": true
+      },
       {
         "path": "docs/development-speed-playbook.md",
         "section": "root",

From 7e35caa53fb27c65dee681cf960f021e83fae239 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 26 Oct 2026 11:05:51 +0000
Subject: [PATCH 11/11] Address CodeRabbit review on the design-audit fixes

- Cleared-shift notice formats the time in the chosen work zone.
- No cleared-at notice when the ended shift held only its expiry stamp.
- A deliberate call-log clear invalidates any pending Undo.
- Safety plan Undo goes once new work starts on the cleared plan.
- Stalled Answer prompt is announced through the shared announcer.
- "Medicine wasn't found" only for a confirmed medication_not_found.
- AI summary note no longer promises a page link that may be absent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QYsGZ5ecrWh4xL76inGoAq
---
 .../clinical-ask-workspace.tsx                |  6 +++-
 .../use-medication-catalog.ts                 |  2 +-
 .../document-clinical-summary.tsx             |  5 ++--
 src/components/on-call/handover/call-log.tsx  |  4 +--
 src/components/patient-safety-plan.tsx        | 10 +++++++
 src/lib/on-call/call-log.ts                   | 13 +++++++--
 src/lib/patient-label-storage.ts              | 28 +++++++++++--------
 tests/on-call-call-log.test.ts                | 10 +++++++
 tests/patient-label-storage.dom.test.tsx      |  7 +++++
 tests/patient-safety-plan.dom.test.tsx        | 15 ++++++++++
 10 files changed, 81 insertions(+), 19 deletions(-)

diff --git a/src/components/clinical-dashboard/clinical-ask-workspace.tsx b/src/components/clinical-dashboard/clinical-ask-workspace.tsx
index e5b8c574e4..aa43ee05ef 100644
--- a/src/components/clinical-dashboard/clinical-ask-workspace.tsx
+++ b/src/components/clinical-dashboard/clinical-ask-workspace.tsx
@@ -22,7 +22,11 @@ function useClinicalAskStall(waiting: boolean) {
   const [round, setRound] = useState(0);
   useEffect(() => {
     if (!waiting) return;
-    const timer = window.setTimeout(() => setStalled(true), CLINICAL_ASK_STALL_PROMPT_MS);
+    const timer = window.setTimeout(() => {
+      setStalled(true);
+      // A status node inserted already filled is not read out reliably, so say it through the announcer.
+      announce("This is taking longer than usual. You can keep waiting or stop.");
+    }, CLINICAL_ASK_STALL_PROMPT_MS);
     return () => {
       window.clearTimeout(timer);
       setStalled(false);
diff --git a/src/components/clinical-dashboard/use-medication-catalog.ts b/src/components/clinical-dashboard/use-medication-catalog.ts
index ff05d17405..02a94ad73c 100644
--- a/src/components/clinical-dashboard/use-medication-catalog.ts
+++ b/src/components/clinical-dashboard/use-medication-catalog.ts
@@ -215,7 +215,7 @@ function medicationRecordErrorMessage(error: unknown): string {
   const code = `Code ${error.status}.`;
   if (error.status === 401) return `Your sign-in has ended. Sign in again to view this medicine. ${code}`;
   if (error.status === 429) return `Too many requests in a short time. Wait a moment, then try again. ${code}`;
-  if (error.status === 404) return `This medicine wasn’t found. ${code}`;
+  if (error.status === 404 && error.code === "medication_not_found") return `This medicine wasn’t found. ${code}`;
   if (error.status >= 500) return `The medicines service is busy or unavailable. Try again in a minute. ${code}`;
   return `This medicine couldn’t be loaded. ${code}`;
 }
diff --git a/src/components/document-viewer/document-clinical-summary.tsx b/src/components/document-viewer/document-clinical-summary.tsx
index 44c40da0c5..9647ec1c5c 100644
--- a/src/components/document-viewer/document-clinical-summary.tsx
+++ b/src/components/document-viewer/document-clinical-summary.tsx
@@ -441,7 +441,8 @@ export function DocumentClinicalSummary({
             <span className="mr-1.5 inline-flex min-h-6 items-center rounded-md bg-[color:var(--surface-subtle)] px-2 text-3xs font-bold uppercase tracking-label text-[color:var(--text-heading)]">
               AI summary
             </span>
-            Written by AI from this document when it was added. Check each point against the page it links to.
+            Written by AI from this document when it was added. Check each point against the source document, using the
+            page link where one is shown.
           </p>
           {model.summary ? (
             <p
@@ -556,7 +557,7 @@ export function DocumentClinicalSummary({
         onClose={() => setMobilePrioritiesOpen(false)}
         returnFocusRef={mobilePrioritiesButtonRef}
         title="Clinical priorities"
-        description="AI summary of this document. Check each point against the page it links to."
+        description="AI summary of this document. Check each point against the source document, using the page link where one is shown."
         headerLeading={
           <span className="grid h-9 w-9 place-items-center rounded-lg bg-[color:var(--clinical-accent)] text-[color:var(--clinical-accent-contrast)] shadow-[var(--e1)]">
             <ListChecks aria-hidden="true" className="h-4 w-4" strokeWidth={2} />
diff --git a/src/components/on-call/handover/call-log.tsx b/src/components/on-call/handover/call-log.tsx
index d317d104fa..05152a1894 100644
--- a/src/components/on-call/handover/call-log.tsx
+++ b/src/components/on-call/handover/call-log.tsx
@@ -44,7 +44,7 @@ import {
   startPatientLabelRetention,
 } from "@/lib/patient-label-storage";
 import { useWorkTimeZone } from "@/components/work-time/use-work-time-zone";
-import { formatZonedDay, zonedDateOf } from "@/lib/work-time/format";
+import { formatZonedDay, formatZonedTime, zonedDateOf } from "@/lib/work-time/format";
 
 /*
  * The quick call log (`OnCallCallLogCard`), shown in Now's "Log a call" sheet.
@@ -162,7 +162,7 @@ function NoteArea({
 function clockLabel(epochMs: number, zone: string): string {
   const at = new Date(epochMs);
   const day = formatZonedDay(zonedDateOf(at, zone)).slice(0, 3);
-  return `${day} ${onCallCallLogTime(at.toISOString())}`;
+  return `${day} ${formatZonedTime(at, zone)}`;
 }
 
 /** The roles most calls come from, as one-tap chips; "Other" opens a short field. */
diff --git a/src/components/patient-safety-plan.tsx b/src/components/patient-safety-plan.tsx
index 04247df1c8..919255370c 100644
--- a/src/components/patient-safety-plan.tsx
+++ b/src/components/patient-safety-plan.tsx
@@ -925,6 +925,16 @@ export function PatientSafetyPlan() {
     return () => window.clearTimeout(timer);
   }, [clearedPlan]);
 
+  // Undo puts back the plan that was cleared, so once new work starts on the empty plan the
+  // snapshot goes. Otherwise Undo would quietly replace that new work with the old plan.
+  // Adjusted during render rather than in an effect, so Undo is gone before the new work paints.
+  if (
+    clearedPlan &&
+    (Object.values(entries).some((rows) => rows.length > 0) || reasons.length > 0 || planDate.trim() !== "")
+  ) {
+    setClearedPlan(null);
+  }
+
   const clearAll = () => {
     // Nothing to lose when the plan is empty or is the untouched example. Anything else is a
     // clinician's work with a patient that is never stored, so it clears at once with Undo for
diff --git a/src/lib/on-call/call-log.ts b/src/lib/on-call/call-log.ts
index 66bb38e2b0..53757f57b7 100644
--- a/src/lib/on-call/call-log.ts
+++ b/src/lib/on-call/call-log.ts
@@ -243,10 +243,17 @@ export function deleteOnCallCallLogEntryForUndo(
   const stamp = readShiftStamp();
   removeOnCallCallLogEntry(entry.id, now);
   // A stamp from before generations existed cannot tell one shift from the next, so it gets no Undo.
-  return stamp?.generation ? { entry, shiftGeneration: stamp.generation } : null;
+  return stamp?.generation ? { entry, shiftGeneration: stamp.generation, clearCount } : null;
 }
 
-export type OnCallCallLogUndo = { readonly entry: OnCallCallLogEntry; readonly shiftGeneration: string };
+export type OnCallCallLogUndo = {
+  readonly entry: OnCallCallLogEntry;
+  readonly shiftGeneration: string;
+  readonly clearCount: number;
+};
+
+// Bumped by clearOnCallCallLog so an Undo taken before a deliberate clear cannot bring a note back.
+let clearCount = 0;
 
 /**
  * Put back a note deleted moments ago (the Undo on the delete toast). Refused unless the shift it
@@ -259,6 +266,7 @@ export function restoreOnCallCallLogEntry(undo: OnCallCallLogUndo, now: Date = n
   if (typeof window === "undefined") return false;
   const stamp = readShiftStamp();
   if (!stamp || stamp.generation !== undo.shiftGeneration || now.getTime() >= stamp.expiresAt) return false;
+  if (undo.clearCount !== clearCount) return false;
   const current = live(readStored(now), now);
   if (current.some((existing) => existing.id === undo.entry.id)) return true;
   if (current.length >= ON_CALL_CALL_LOG_LIMIT || live([undo.entry], now).length === 0) return false;
@@ -268,6 +276,7 @@ export function restoreOnCallCallLogEntry(undo: OnCallCallLogUndo, now: Date = n
 /** Clear every note on this device. */
 export function clearOnCallCallLog(): void {
   if (typeof window === "undefined") return;
+  clearCount += 1;
   write([], new Date());
 }
 
diff --git a/src/lib/patient-label-storage.ts b/src/lib/patient-label-storage.ts
index 9080c3059b..b643a16fd0 100644
--- a/src/lib/patient-label-storage.ts
+++ b/src/lib/patient-label-storage.ts
@@ -98,6 +98,20 @@ function labelKeysIn(storage: Storage): string[] {
   return keys;
 }
 
+/** True when a real label is stored, not just the shift's expiry stamp. */
+function hasLabelDataKeys(): boolean {
+  for (const area of ["local", "session"] as const) {
+    const storage = storageFor(area);
+    if (!storage) continue;
+    try {
+      if (labelKeysIn(storage).some((key) => key !== PATIENT_LABEL_EXPIRY_STORAGE_KEY)) return true;
+    } catch {
+      // Storage that refuses access holds nothing to lose.
+    }
+  }
+  return false;
+}
+
 function hasAnyLabelKeys(): boolean {
   for (const area of ["local", "session"] as const) {
     const storage = storageFor(area);
@@ -189,16 +203,7 @@ export function clearPatientLabels(reason: PatientLabelClearReason = "manual"):
 export function patientLabelsOnDevice(now: number = Date.now()): boolean {
   if (typeof window === "undefined") return false;
   clearExpiredPatientLabels(now);
-  for (const area of ["local", "session"] as const) {
-    const storage = storageFor(area);
-    if (!storage) continue;
-    try {
-      if (labelKeysIn(storage).some((key) => key !== PATIENT_LABEL_EXPIRY_STORAGE_KEY)) return true;
-    } catch {
-      // Storage that refuses access holds nothing to lose.
-    }
-  }
-  return false;
+  return hasLabelDataKeys();
 }
 
 /**
@@ -299,7 +304,8 @@ export function clearExpiredPatientLabels(now: number = Date.now()): boolean {
     return true;
   }
   if (now >= stamp.expiresAt) {
-    setShiftLabelsClearedAt(stamp.expiresAt);
+    // An expiry stamp with nothing under it cleared nothing, so there is nothing to tell anyone.
+    if (hasLabelDataKeys()) setShiftLabelsClearedAt(stamp.expiresAt);
     clearPatientLabels("shift-ended");
     return true;
   }
diff --git a/tests/on-call-call-log.test.ts b/tests/on-call-call-log.test.ts
index 3595655004..23a61fa278 100644
--- a/tests/on-call-call-log.test.ts
+++ b/tests/on-call-call-log.test.ts
@@ -175,6 +175,16 @@ describe("the call log store", () => {
     expect(readOnCallCallLog(halfThree).map((entry) => entry.id)).toEqual([next.entry.id]);
   });
 
+  it("does not bring a note back after the log was deliberately cleared", () => {
+    const first = addOnCallCallLogEntry(draft(), twoAm);
+    if (!first.ok) throw new Error("setup failed");
+    const undo = deleteOnCallCallLogEntryForUndo(first.entry, halfThree);
+    if (!undo) throw new Error("no undo");
+    clearOnCallCallLog();
+    expect(restoreOnCallCallLogEntry(undo, halfThree)).toBe(false);
+    expect(readOnCallCallLog(halfThree)).toEqual([]);
+  });
+
   it("is kept only through the patient-label store, behind its expiry stamp", () => {
     expect(onCallCallLogStorageKey.startsWith(PATIENT_LABEL_KEY_PREFIX)).toBe(true);
     addOnCallCallLogEntry(draft(), twoAm);
diff --git a/tests/patient-label-storage.dom.test.tsx b/tests/patient-label-storage.dom.test.tsx
index a44ca63a1b..311d148847 100644
--- a/tests/patient-label-storage.dom.test.tsx
+++ b/tests/patient-label-storage.dom.test.tsx
@@ -73,6 +73,7 @@ import {
   readPatientLabels,
   readShiftLabelsClearedAt,
   removePatientLabels,
+  startPatientLabelRetention,
   subscribePatientLabelsCleared,
   watchPatientLabelExpiry,
   writePatientLabels,
@@ -329,6 +330,12 @@ describe("the wipe removes patient labels and nothing else", () => {
     expect(readShiftLabelsClearedAt()).toBeNull();
   });
 
+  it("records no cleared time when the ended shift held only its expiry stamp", () => {
+    startPatientLabelRetention({ now: T0, shiftEndsAt: T0 + 8 * HOUR });
+    clearExpiredPatientLabels(T0 + 9 * HOUR);
+    expect(readShiftLabelsClearedAt()).toBeNull();
+  });
+
   it("has nothing to do when no labels are stored", () => {
     seedUnrelated();
     const onCleared = vi.fn();
diff --git a/tests/patient-safety-plan.dom.test.tsx b/tests/patient-safety-plan.dom.test.tsx
index 6034431fa0..b78aa7887b 100644
--- a/tests/patient-safety-plan.dom.test.tsx
+++ b/tests/patient-safety-plan.dom.test.tsx
@@ -355,6 +355,21 @@ describe("PatientSafetyPlan — Clear all and Copy feedback", () => {
     confirm.mockRestore();
   });
 
+  it("drops Undo once new work starts on the cleared plan", () => {
+    render(<PatientSafetyPlan />);
+    const supportStep = screen.getByRole("region", { name: "Step 4: People I can ask for help" });
+    const field = () => within(supportStep).getByPlaceholderText("Name & relationship") as HTMLInputElement;
+    fireEvent.change(field(), { target: { value: "Sam — a friend" } });
+    fireEvent.click(within(supportStep).getByRole("button", { name: /^Add to / }));
+    fireEvent.click(screen.getByRole("button", { name: /Clear the plan/ }));
+    expect(screen.getByTestId("safety-plan-undo")).toBeTruthy();
+
+    fireEvent.change(field(), { target: { value: "Alex — a brother" } });
+    fireEvent.click(within(supportStep).getByRole("button", { name: /^Add to / }));
+    expect(screen.queryByTestId("safety-plan-undo")).toBeNull();
+    expect(within(supportStep).getAllByText("Alex — a brother").length).toBeGreaterThan(0);
+  });
+
   it("lets the Undo offer lapse after ten seconds", () => {
     vi.useFakeTimers();
     try {