Consequences¶

Positive¶

• No global cache means subject switching needs only a remount, not a cache-invalidation layer.
• A single request function means the subject-explicit contract is enforced in one place.
• The existing doctor patient screen is a working template, so the delegated view is largely assembly rather than new design.
• The existing session-change cleanup already handles the awkward cases and extends naturally to subject change.
• Three standing privacy weaknesses — health data in the system browser, no screenshot protection, and no central handling for lost access — are closed as part of this work.

Negative¶

• Duplicate route surface for medications, records and appointments, reduced but not eliminated by reusing the existing screens as components.
• Caregiver reminders will not work offline, unlike the patient's own alarms. This is a direct consequence of decision 6 and should be confirmed with product.
• Screenshot protection will prompt support questions from users who screenshot their own records.
• An in-app record viewer is more work than handing a link to the browser, including zoom and document handling.
• Alarm behaviour must be regression-tested on physical devices, because the automated suite cannot observe the operating system scheduler.

Operational¶

• The in-app record viewer and screenshot protection are independent of this feature and can ship immediately.
• Everything else is sequenced behind the server work: the subject-aware request layer and route group first (no visible change), then the banner, switcher, cleanup, guard and central access-lost handling, then delegation and family screens, then dependent creation, then caregiver reminder subscriptions together with decision 6.
• Both languages ship with each screen rather than as a later pass.

Open with product¶

Switcher placement; whether the first delegated write in a session needs confirmation; whether a shared device should require re-authentication before a subject-scoped screen; the visual treatment for subject-scoped mode; whether screenshot protection covers all health screens or only subject-scoped ones; and whether offline caregiver reminders are required.

Related¶

• ADR-005 — the server model. Its subject-explicit endpoints are the contract boundary between the two records.