Repository review: bug fixes, Leave/Help/Export screens, demo pass, code health, CI setup (D-145)

.github/actions/ward-setup/action.yml

@@ -0,0 +1,36 @@
+# The shared Node setup for the Ward Flow CI jobs that need installed packages
+# (.github/workflows/ward-flow.yml). The job checks out the repository first, so this local action exists.
+# Contracts: scripts/ward-ci-public/check-contracts.mjs. Every step is unconditional and pinned by commit.
+name: Ward Flow setup
+description: Select the pinned Node, provision the pinned npm, then restore and attest the locked install.
+outputs:
+  cache-hit:
+    description: Whether the exact installed-packages key was restored.
+    value: ${{ steps.node-modules.outputs.cache-hit }}
+  cache-primary-key:
+    description: The exact installed-packages key, for the main-only save in the build job.
+    value: ${{ steps.node-modules.outputs.cache-primary-key }}
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
+      with:
+        node-version-file: .nvmrc
+        cache: npm
+    - name: Install and record the pinned npm toolchain
+      shell: bash
+      run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p "require('./package.json').packageManager")" && node --version && npm --version
+    # Installed packages come from a cache saved on main only (build job), straight after an attested
+    # install; install-locked-dependencies.mjs reuses an exact hit only when its post-install stamp matches.
+    - name: Restore installed packages
+      id: node-modules
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      with:
+        path: node_modules
+        key: ward-node-modules-${{ runner.os }}-${{ hashFiles('.nvmrc', 'package.json', 'package-lock.json') }}
+    - name: Install locked dependencies
+      id: install
+      shell: bash
+      env:
+        WARD_INSTALL_RESTORED: ${{ steps.node-modules.outputs.cache-hit }}
+      run: node scripts/install-locked-dependencies.mjs

.github/dependabot.yml

@@ -35,8 +35,9 @@ updates:
         applies-to: security-updates
         patterns: ["*"]
 
+  # The local composite actions under .github/actions/ hold action pins too.
   - package-ecosystem: github-actions
-    directory: /
+    directories: ["/", "/.github/actions/*"]
     schedule:
       interval: weekly
       day: monday

.github/workflows/ward-flow.yml

@@ -326,23 +326,11 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-      - name: Install and record the pinned npm toolchain
-        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p "require('./package.json').packageManager")" && node --version && npm --version
-      - name: Restore installed packages
-        id: node-modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: node_modules
-          key: ward-node-modules-${{ runner.os }}-${{ hashFiles('.nvmrc', 'package.json', 'package-lock.json') }}
-      - name: Install locked dependencies
+      # Node, the pinned npm, the exact installed-packages restore and the attested install
+      # (.github/actions/ward-setup); the checkout above provides the local action.
+      - name: Set up Node and install locked dependencies
         id: install
-        env:
-          WARD_INSTALL_RESTORED: ${{ steps.node-modules.outputs.cache-hit }}
-        run: node scripts/install-locked-dependencies.mjs
+        uses: ./.github/actions/ward-setup
       - name: Install locked Ward backend dependencies
         id: backend-install
         if: ${{ !cancelled() && steps.install.outcome == 'success' }}
@@ -436,23 +424,11 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-      - name: Install and record the pinned npm toolchain
-        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p "require('./package.json').packageManager")" && node --version && npm --version
-      - name: Restore installed packages
-        id: node-modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: node_modules
-          key: ward-node-modules-${{ runner.os }}-${{ hashFiles('.nvmrc', 'package.json', 'package-lock.json') }}
-      - name: Install locked dependencies
+      # Node, the pinned npm, the exact installed-packages restore and the attested install
+      # (.github/actions/ward-setup); the checkout above provides the local action.
+      - name: Set up Node and install locked dependencies
         id: install
-        env:
-          WARD_INSTALL_RESTORED: ${{ steps.node-modules.outputs.cache-hit }}
-        run: node scripts/install-locked-dependencies.mjs
+        uses: ./.github/actions/ward-setup
       - name: Select reproducible nightly fuzz window
         if: ${{ github.event_name == 'schedule' && steps.install.outcome == 'success' }}
         run: node scripts/ward-flow/engine-fuzz-window.mjs --output "$RUNNER_TEMP/ward-profile/fuzz-window.json" --github-env "$GITHUB_ENV"
@@ -534,23 +510,11 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-      - name: Install and record the pinned npm toolchain
-        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p "require('./package.json').packageManager")" && node --version && npm --version
-      - name: Restore installed packages
-        id: node-modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: node_modules
-          key: ward-node-modules-${{ runner.os }}-${{ hashFiles('.nvmrc', 'package.json', 'package-lock.json') }}
-      - name: Install locked dependencies
+      # Node, the pinned npm, the exact installed-packages restore and the attested install
+      # (.github/actions/ward-setup); the checkout above provides the local action.
+      - name: Set up Node and install locked dependencies
         id: install
-        env:
-          WARD_INSTALL_RESTORED: ${{ steps.node-modules.outputs.cache-hit }}
-        run: node scripts/install-locked-dependencies.mjs
+        uses: ./.github/actions/ward-setup
       - name: Restore Next build cache
         id: next-cache
         if: ${{ !cancelled() && steps.install.outcome == 'success' }}
@@ -597,23 +561,11 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-      - name: Install and record the pinned npm toolchain
-        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p "require('./package.json').packageManager")" && node --version && npm --version
-      - name: Restore installed packages
-        id: node-modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: node_modules
-          key: ward-node-modules-${{ runner.os }}-${{ hashFiles('.nvmrc', 'package.json', 'package-lock.json') }}
-      - name: Install locked dependencies
+      # Node, the pinned npm, the exact installed-packages restore and the attested install
+      # (.github/actions/ward-setup); the checkout above provides the local action.
+      - name: Set up Node and install locked dependencies
         id: install
-        env:
-          WARD_INSTALL_RESTORED: ${{ steps.node-modules.outputs.cache-hit }}
-        run: node scripts/install-locked-dependencies.mjs
+        uses: ./.github/actions/ward-setup
       - name: Download the verified browser build
         if: ${{ !cancelled() && needs.browser-build.result == 'success' && steps.install.outcome == 'success' }}
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
@@ -728,23 +680,11 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-      - name: Install and record the pinned npm toolchain
-        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p "require('./package.json').packageManager")" && node --version && npm --version
-      - name: Restore installed packages
-        id: node-modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: node_modules
-          key: ward-node-modules-${{ runner.os }}-${{ hashFiles('.nvmrc', 'package.json', 'package-lock.json') }}
-      - name: Install locked dependencies
+      # Node, the pinned npm, the exact installed-packages restore and the attested install
+      # (.github/actions/ward-setup); the checkout above provides the local action.
+      - name: Set up Node and install locked dependencies
         id: install
-        env:
-          WARD_INSTALL_RESTORED: ${{ steps.node-modules.outputs.cache-hit }}
-        run: node scripts/install-locked-dependencies.mjs
+        uses: ./.github/actions/ward-setup
       - name: Download the verified browser build
         if: ${{ !cancelled() && needs.browser-build.result == 'success' && steps.install.outcome == 'success' }}
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
@@ -914,32 +854,20 @@ jobs:
       - name: Record the measured main
         if: ${{ github.event_name == 'pull_request' }}
         run: echo "::notice title=Ward budget main::$(git rev-parse refs/remotes/origin/main)"
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-      - name: Install and record the pinned npm toolchain
-        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p "require('./package.json').packageManager")" && node --version && npm --version
-      - name: Restore installed packages
-        id: node-modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: node_modules
-          key: ward-node-modules-${{ runner.os }}-${{ hashFiles('.nvmrc', 'package.json', 'package-lock.json') }}
-      - name: Install locked dependencies
+      # Node, the pinned npm, the exact installed-packages restore and the attested install
+      # (.github/actions/ward-setup); the checkout above provides the local action.
+      - name: Set up Node and install locked dependencies
         id: install
-        env:
-          WARD_INSTALL_RESTORED: ${{ steps.node-modules.outputs.cache-hit }}
-        run: node scripts/install-locked-dependencies.mjs
+        uses: ./.github/actions/ward-setup
       # The clean tree is saved straight after its attested install, from main only, before any step
       # writes into node_modules; pull requests restore it and install-locked-dependencies.mjs reuses
       # it only when its post-install stamp still matches the lock and the files.
       - name: Save installed packages on main
-        if: ${{ !cancelled() && github.ref == 'refs/heads/main' && github.event_name != 'pull_request' && steps.install.outcome == 'success' && steps.node-modules.outputs.cache-hit != 'true' }}
+        if: ${{ !cancelled() && github.ref == 'refs/heads/main' && github.event_name != 'pull_request' && steps.install.outcome == 'success' && steps.install.outputs.cache-hit != 'true' }}
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
           path: node_modules
-          key: ${{ steps.node-modules.outputs.cache-primary-key }}
+          key: ${{ steps.install.outputs.cache-primary-key }}
       - name: Restore Next build cache
         id: production-cache
         if: ${{ !cancelled() && steps.install.outcome == 'success' }}
@@ -990,23 +918,11 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
-        with:
-          node-version-file: .nvmrc
-          cache: npm
-      - name: Install and record the pinned npm toolchain
-        run: npm install --global --ignore-scripts --no-audit --no-fund "$(node -p "require('./package.json').packageManager")" && node --version && npm --version
-      - name: Restore installed packages
-        id: node-modules
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          path: node_modules
-          key: ward-node-modules-${{ runner.os }}-${{ hashFiles('.nvmrc', 'package.json', 'package-lock.json') }}
-      - name: Install locked dependencies
+      # Node, the pinned npm, the exact installed-packages restore and the attested install
+      # (.github/actions/ward-setup); the checkout above provides the local action.
+      - name: Set up Node and install locked dependencies
         id: install
-        env:
-          WARD_INSTALL_RESTORED: ${{ steps.node-modules.outputs.cache-hit }}
-        run: node scripts/install-locked-dependencies.mjs
+        uses: ./.github/actions/ward-setup
       - name: Download shard coverage blobs
         if: ${{ !cancelled() && steps.install.outcome == 'success' }}
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333

backend/ward-flow/command-schemas.ts

@@ -129,6 +129,8 @@ const SCHEMAS: Partial<Record<WardFlowEvent["type"], z.ZodType>> = {
   FLAG_RETURN_EARLY: z.looseObject({ admissionId: id, homeHospital: id }),
   RECORD_MEDICAL_CLEARANCE: z.looseObject({ referralId: id, cleared: z.boolean() }),
   REQUEST_CAPACITY_REFRESH: z.looseObject({ unitId: id }),
+  // Staff needed: the shift start the desk chose, when sent. The reducer checks it against now.
+  REQUEST_WARD_STAFF: z.looseObject({ shiftStartAt: instant.optional() }),
   // H-0978: one exact bed closed or reopened. The reducer checks the bed and the reason list.
   SET_BED_CLOSED: z.looseObject({ unitId: id, actingUnitId: id, bedNumber: count, closed: z.boolean() }),
   CONFIRM_CAPACITY: z.looseObject({

backend/ward-flow/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "engines": {
-    "node": ">=22"
+    "node": ">=24.22.1 <25"
   },
   "scripts": {
     "start": "node --env-file-if-exists=.env server.mjs",
@@ -13,8 +13,6 @@
     "typecheck": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json",
     "migrate:postgres": "node --env-file-if-exists=.env migrate-postgres.mjs",
     "migrate:supabase": "node --env-file-if-exists=.env migrate-supabase.mjs",
-    "prune:postgres": "node --env-file-if-exists=.env prune-receipts.mjs postgres",
-    "prune:supabase": "node --env-file-if-exists=.env prune-receipts.mjs supabase",
     "prune:receipts:postgres": "node --env-file-if-exists=.env prune-receipts.mjs postgres",
     "prune:receipts:supabase": "node --env-file-if-exists=.env prune-receipts.mjs supabase",
     "prune:receipts:supabase-pruner": "node --env-file-if-exists=.env prune-receipts.mjs supabase-pruner",

docs/script-budget-history/2026-11-11-pr1623-repository-review.md

@@ -0,0 +1,31 @@
+# 11 Nov 2026, Repository review fixes and features (PR #1623)
+
+Changed on top of `main` at `35c7ccd`: movements `/ward-flow/movements/WF-001` raised 609.8 to 610.3; statistics `/ward-flow/statistics` raised 632.6 to 632.9. Each raise is under 1 KB, within the 5 KB per-screen allowance in HOW-WE-WORK section 6.
+
+Measured on hosted CI (production build of the PR head `883a3c1`, merged with main): movements 610.0 KB, statistics 632.6 KB, both over their limit after rounding. Main alone could not be measured because this PR updates patch-level dependencies. Each new limit is the measurement plus about 0.3.
+
+Why it changed: Movements gained Print and spreadsheet Export (D-145 item 3). The CSV download helper moved to the ward root (`ward-csv.ts`) so Legal forms and Movements can share it without importing from the Statistics screen; Statistics now loads it through a thin wrapper.
+
+Trim tried: the export code only runs on a tap but is small and shares the existing download helper; splitting it into a lazy chunk would add more than it saves. No other safe trim was found.
+
+Later the same day (merged with main `c21e99a`, which had raised every route): the same two raises applied on top of main's values, so movements is 610.9 + 0.5 = 611.4 and statistics 633.6 + 0.3 = 633.9. Every other route takes main's value.
+
+Then (PR head `9c7302e`, merged with main `c21e99a`): ED `/ward-flow/ed` raised 536.3 to 536.6. Hosted CI measured 536.3 KB, level with the limit after rounding; main alone could not be measured because of the dependency updates. The growth is most likely the shared helpers from D-145 item 2 (typed-time reader, pull-hold lapse check) that the ED screen loads; this was not measured route by route. Same trim reasoning as above.
+
+Merged again with main `cc755fa`, which raised every route: the same three raises sit on main's values, so ED is 537.8 + 0.3 = 538.1, movements 612.6 + 0.5 = 613.1 and statistics 635.1 + 0.3 = 635.4.
+
+Merged again after #1607 and #1628 (main `daacf218e`): main's values taken, plus this PR's deltas, giving ED 538.8, Movements 613.6 and Statistics 636.0.
+
+Then Home `/ward-flow` raised 580.5 to 581.1: hosted CI measured 580.8 KB on this merge (head `1190d68`), 0.3 KB over main's value. Main alone could not be measured because this PR changes dependencies. The likely source is the same shared helpers plus the new "leave" search entry; this was not measured route by route. Well within the 5 KB allowance.
+
+Merged again after #1603 (main `30abc7aee`): main's values taken, plus this PR's deltas, giving Home 584.1, ED 540.9, Movements 615.8 and Statistics 638.3.
+
+Merged again after #1624 and #1629 (main `51a474537`, which raised the ward route to 622.0): main's values taken, plus this PR's deltas, giving Home 584.1, ED 540.9, Movements 615.8 and Statistics 638.3. Main left those four routes unchanged since the last merge, so the totals are the same.
+
+Merged again after #1608 (main `0e2478133`): main's values taken, plus this PR's deltas, giving Home 586.6, ED 543.1, Movements 618.4 and Statistics 640.6. Then Referrals `/ward-flow/referrals` raised 593.4 to 593.8: hosted CI measured 593.5 KB on this merge (head `54dd212f6`), 0.1 KB over main's value. Main alone could not be measured because this PR changes dependencies. The likely source is the same shared helpers (typed-time reader, pull-hold lapse check) now also loaded by Referrals; this was not measured route by route. Same trim reasoning as above, and well within the 5 KB allowance.
+
+Merged again after #1606 (main `0b657ad3f`): main's values taken, plus this PR's deltas, giving Home 588.3, Referrals 594.7, ED 543.7, Movements 619.2 and Statistics 640.8.
+
+Merged again after #1632 (main `02817bbd6`, which raised six routes): main's values taken, plus this PR's deltas, giving Home 588.9, Referrals 594.7, ED 544.2, Movements 619.5 and Statistics 641.3.
+
+Hosted CI on that merge (head `986e9dfa9`) measured, in KB: Home 589.2, Movements 619.8 and Capacity 666.4, and `main` alone could not be built, so it could not be compared. Builds vary by a few tenths, so these three limits are now the measurement plus 0.5: Home 589.7 (+1.4 over `main`), Movements 620.3 (+1.3) and Capacity 666.9 (+1.0), each within the 5 KB allowance.