Harden encounter estimate conversion and medication charge handoff

[evangauer]

What changed

• Adds an explicit, confirmed estimate-to-visit-invoice flow in Billing and the encounter workspace.
• Serializes conversion behind invoice and appointment locks, revalidates the client-visible invoice version, blocks competing actual invoices, validates catalog and medication sources, updates inventory atomically, normalizes the result to a reviewable draft, and records a PHI-free audit event.
• Makes visit-linked refill dispenses visible in both Charge capture and the signed clinical medication handoff, while blocking send, payment, portal checkout, and visit completion until every dispense is invoiced or explicitly waived.
• Rejects legacy prescription-only charge links for new writes and preserves the exact dispense identity through billing reconciliation.
• Canonicalizes prescription, product, template, edit, and void lock ordering to avoid inventory/invoice deadlocks and prevents template mutations from reusing a stale estimate version.
• Adds a disposable real-PostgreSQL concurrency and rollback drill to CI.

Why

The prior estimate conversion path could bypass the safer visit-invoice invariants, including medication dispense reconciliation and some inventory lock ordering. Older prescriptions refilled during a visit could also remain outside the signed clinical handoff even though their charge existed. Those gaps could create duplicate or stranded medication charges, stale confirmation conversions, incomplete checkout evidence, and deadlock victims during concurrent clinic work.

Clinic impact

Staff now review an estimate before promoting it into the active visit invoice. Performed medication work must be reconciled once, remains traceable to its exact dispense, and is included in the clinical handoff. Concurrent edits fail with clear refresh/review instructions instead of silently mutating stale work.

Validation

• pnpm --filter @openpims/web test — 3,887 passed; 15 expected integration skips
• Disposable PostgreSQL billing drill — 9/9 passed, including deadlock checks, stock rollback, competing invoice serialization, stale-template rejection, refill/clinical handoff, and edit/void races
• pnpm --filter @openpims/web type-check
• pnpm --filter @openpims/db type-check
• pnpm --filter @openpims/db db:generate — no schema changes
• pnpm --filter @openpims/web build
• Prettier and git diff --check

No provider calls, SMS sends, payment charges, production mutations, or schema migrations are part of this change.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openvpm-app	Ready	Preview	Aug 11, 2026 11:48am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
openvpm	Ignored		Aug 11, 2026 11:48am