Protect the original while governing every linked update.

CONTROL BOUNDARY

Append-only by design

Finalized notes remain immutable. Direct amendments require provider attestation. Correction and void entries require a structured request, an optimistic version check, and a second explicit authorization action.

Governance exposes counts and lifecycle states only. Patient identity, clinical text, instructions, and free-text reasons stay outside this surface.

SYNTHETIC REHEARSAL

Twelve safety scenarios, zero effects

Covers finalized-only eligibility, provider ownership, append-only history, structured reasons, attestation, authorization, concurrency, patient read boundary, acknowledgement scope, audit minimization, notification minimization, and aggregate governance.