From e415ab268e0c1e282d268ae88b1b6300d2b22ec1 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Mon, 24 Aug 2026 18:28:13 +0800
Subject: [PATCH] fix(ward-flow): remove the fabricated Mental Health Act
 figure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`main` carried an invented statutory figure and rendered it to users as a
legal deadline. No product owner supplied it; an assistant wrote it from its
own recollection. It is the third invented statutory figure this prototype
has produced and the second attributed to the Act in a doc comment.

It was not dead code. It existed in four places and reached the screen:

  ward-model.ts        FORM_1A_REFERRAL_EXPIRY_MINUTES = 7 * 24 * 60,
                       doc-commented as "the Mental Health Act's seven-day
                       outer limit"
  ward-model.ts        the LegalForm doc comment asserting that a Form 1A
                       "always carries a real statutory examination window,
                       so it always carries a dueAt" — the same fabrication
                       in prose
  ward-flow-reducer.ts RAISE_REFERRAL stamped it onto every newly raised 1A
  ward-movements.ts    authored dueAt values on Form 1A movements

ward-management-console.tsx rendered "· due <time>"; ward-derivations.ts
turned it into a "Legal timing breached" inbox item with a countdown;
priority-queue.tsx and shortlist-panel.tsx rendered breach state from it. A
user raising a referral saw a legal deadline that does not exist.

A test also required it: ward-model-phase3.test.ts asserted that every Form
1A carries a dueAt. The fabrication was pinned in place by a guard.

The correction is the product owner's own, recorded verbatim in the code.
Asked directly on 2026-08-23 his instruction was narrower than a corrected
figure — "please can you leave the legal part and just start a clock once
the patient arrives to ED. Keep it simple for now." So neither a Form 1A nor
a Form 3B carries a dueAt. The forms record that they exist, never when they
lapse. This change supplies no figure and corrects none; removal is the only
direction it moves in.

Also corrected: "— no statutory deadline" now reads "no deadline recorded".
The first states what the Act requires, with the same unearned confidence as
the countdown being deleted; the second states what the record holds, which
is the only claim this prototype is entitled to make. The same unattributed
claim is brought into line at five further sites.

Adds tests/ward-legal-figure-guard.test.ts against a fourth recurrence. Two
independent halves, both fail-closed by construction rather than by guessing
what a bad name looks like:

  Part 1 walks the reducer through every event type, against a Form 1A and a
  Form 3B, asserting each event is genuinely accepted rather than refused,
  and that no legal form of ANY code carries a dueAt except an allowlist —
  4A "Transport order" and 4C "Transfer between authorised hospitals" — each
  with a recorded reason for legitimately carrying an operational deadline.

  Part 2 requires recorded provenance for every exported declaration in
  ward-model.ts whose initializer contains a numeric literal, naming who
  supplied the figure and when. ED_ACCESS_TARGET_MINUTES qualifies: the
  clinician's instruction of 2026-08-22 was "change the 4 hour limit to 24
  for patients in ED".

Both halves are declared rather than pattern-matched, so a name nobody has
invented yet fails for being undeclared. The file states plainly what it
still cannot see. Four bypasses that defeated earlier drafts now fail, each
verified by applying it, reading the edited line back from the file and
watching the guard go red: the constant under a different name; a
post-construction dueAt in TRANSPORT_ACCEPTED; the same targeted at Form 1A
specifically; and three declaration shapes (object, arrow function, enum).

Three tests that had quietly stopped proving anything were repaired rather
than left honest-but-dormant, each confirmed by re-running the regression it
exists to catch: the action inbox's one-item-per-category guard, the ED
pressure breach count, and the parallel-referral-cap case.

Out of scope and unchanged: forms 4A and 4C, which carry real operational
deadlines about moving a person rather than about the examination timeline;
and formedAt on RAISE_REFERRAL, which travels with the branch reconciliation.

Verification: tsc clean, exit 0, zero output lines. Ward unit suites, one
invocation, 20 files — 228 passed. Prettier clean on all 14 files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../coordinator/shortlist-panel.tsx           |   18 +-
 .../ward-management/ward-derivations.ts       |   34 +-
 .../ward-management/ward-flow-reducer.ts      |    3 +-
 .../ward-management-console.tsx               |   14 +-
 src/components/ward-management/ward-model.ts  |   36 +-
 .../ward-management/ward-movements.ts         |   21 +-
 tests/ui-ward-coordinator.spec.ts             |   42 +-
 tests/ward-derivations.test.ts                |  131 ++-
 tests/ward-flow-reducer.test.ts               |   14 +-
 tests/ward-legal-figure-guard.test.ts         | 1017 +++++++++++++++++
 tests/ward-model-phase3.test.ts               |   29 +-
 tests/ward-model.test.ts                      |   19 +-
 tests/ward-pressure.test.ts                   |   47 +-
 tests/ward-priority.test.ts                   |   57 +-
 14 files changed, 1376 insertions(+), 106 deletions(-)
 create mode 100644 tests/ward-legal-figure-guard.test.ts

diff --git a/src/components/ward-management/coordinator/shortlist-panel.tsx b/src/components/ward-management/coordinator/shortlist-panel.tsx
index 1f428ded50..67c3e5c126 100644
--- a/src/components/ward-management/coordinator/shortlist-panel.tsx
+++ b/src/components/ward-management/coordinator/shortlist-panel.tsx
@@ -67,17 +67,23 @@ function capacityLine(unit: Unit) {
 }
 
 /**
- * Task 6A: a Form 3B honestly carries no `dueAt` — the Mental Health Act imposes no
- * post-examination deadline (clinician-confirmed). For that case this states the form and the
- * real elapsed ED time via the existing `elapsedLabel` (never a new formatter), worded as time
- * IN the department rather than time left against anything, so it can never be misread as a
- * statutory countdown the way a bare number next to a form code could be.
+ * Neither a Form 1A nor a Form 3B carries a `dueAt` in this model (see `LegalForm`'s own doc
+ * comment in ward-model.ts). For that case this states the form and the real elapsed ED time via
+ * the existing `elapsedLabel` (never a new formatter), worded as time IN the department rather
+ * than time left against anything, so it can never be misread as a statutory countdown the way a
+ * bare number next to a form code could be.
+ *
+ * The wording is deliberately "no deadline recorded", not "no statutory deadline". It reports
+ * what THIS RECORD holds, which is all we can verify. "No statutory deadline" asserts what the
+ * Mental Health Act requires, and that is a legal claim this prototype is not entitled to make in
+ * either direction — asserting an absence is the same overreach as asserting the seven-day figure
+ * that was deleted on 2026-08-23.
  */
 function legalFormLine(movement: Movement, now: Instant) {
   if (!movement.legalForm) return "No legal form recorded for this movement";
   const named = `Form ${movement.legalForm.code} (${movement.legalForm.label})`;
   if (movement.legalForm.dueAt === undefined) {
-    return `${named} — no statutory deadline; ${elapsedLabel(movement, now)} in the emergency department`;
+    return `${named} — no deadline recorded; ${elapsedLabel(movement, now)} in the emergency department`;
   }
   const remaining = minutesUntil(movement.legalForm.dueAt, now);
   return remaining < 0
diff --git a/src/components/ward-management/ward-derivations.ts b/src/components/ward-management/ward-derivations.ts
index 8865a99757..4ca987d858 100644
--- a/src/components/ward-management/ward-derivations.ts
+++ b/src/components/ward-management/ward-derivations.ts
@@ -314,18 +314,36 @@ export type InboxItem = {
 /**
  * Every item here is computed from real movement fields — nothing is authored.
  *
- * RULING (Task 8): each category uses `.filter()`, never `.find()`. Measured against the real
- * fixture at `NOW_ANCHOR`, five movements carry a breached statutory deadline, one has reached
- * the parallel-referral cap, and two have transport accepted but not departed — a `.find()`-based
- * inbox reported exactly one of each regardless, understating a legal breach count by four. This
- * is the coordinator's work list, not a report: every qualifying movement gets its own row.
+ * RULING (Task 8): each category uses `.filter()`, never `.find()`. A `.find()`-based inbox
+ * reported exactly one item per category regardless of how many movements qualified, silently
+ * understating the coordinator's work list.
+ *
+ * Re-measured against the real fixture at `NOW_ANCHOR` on 2026-08-23: **zero** movements carry a
+ * breached legal deadline, one has reached the parallel-referral cap, and two have transport
+ * accepted but not departed. The legal category is empty because the 2026-08-23 product-owner
+ * correction removed every `dueAt` from Forms 1A and 3B (see `LegalForm`'s own doc comment in
+ * ward-model.ts), and the only deadlines left in this fixture — the transport/transfer forms 4A
+ * and 4C — are not currently in the past. An earlier version of this comment claimed five
+ * movements carried a breached statutory deadline; that number described the deleted fabrication
+ * and is not true of any figure in this model.
+ *
+ * The `.filter()` shape stays regardless, for two reasons: the transport category alone still
+ * qualifies two movements today, so `.find()` would still understate the list; and the legal
+ * category is dormant rather than removed, so it must count correctly the moment a form that
+ * legitimately carries a deadline falls due. This is the coordinator's work list, not a report:
+ * every qualifying movement gets its own row.
  */
 export function buildActionInbox(movements: Movement[], now: Instant): InboxItem[] {
   const items: InboxItem[] = [];
 
-  // A form with no `dueAt` (Task 6A: a Form 3B honestly carries none — the Mental Health Act
-  // imposes no post-examination deadline) is never breached and contributes nothing here.
-  // `undefined` must never reach `clockState`'s arithmetic.
+  // A form with no `dueAt` is never breached and contributes nothing here; `undefined` must never
+  // reach `clockState`'s arithmetic. As of the 2026-08-23 product-owner correction that is every
+  // Form 1A and every Form 3B in this model — the record carries no deadline for them. Stated
+  // that way deliberately: what this model holds is a fact about the record, whereas what the
+  // Mental Health Act does or does not require is a legal claim this prototype is not entitled to
+  // make in either direction. The question was settled for the 3B by the clinician (Task 6A:
+  // "It is just counting how long they have been in ED determining priority. So counting up") and
+  // for the 1A by the product owner on 2026-08-23. See `LegalForm`'s doc comment in ward-model.ts.
   const breachedLegal = movements.filter(
     (movement) => movement.legalForm?.dueAt !== undefined && clockState(movement.legalForm.dueAt, now) === "breached",
   );
diff --git a/src/components/ward-management/ward-flow-reducer.ts b/src/components/ward-management/ward-flow-reducer.ts
index 5a980474fa..94478bfca9 100644
--- a/src/components/ward-management/ward-flow-reducer.ts
+++ b/src/components/ward-management/ward-flow-reducer.ts
@@ -1,5 +1,5 @@
 import { EVENT_ROLE, type WardFlowEvent, type WardFlowRole } from "@/components/ward-management/ward-flow-events";
-import { FORM_1A_REFERRAL_EXPIRY_MINUTES, PARALLEL_REFERRAL_CAP } from "@/components/ward-management/ward-model";
+import { PARALLEL_REFERRAL_CAP } from "@/components/ward-management/ward-model";
 import type { Movement, MovementStage, Rejection, Unit } from "@/components/ward-management/ward-model";
 import { wardMovements } from "@/components/ward-management/ward-movements";
 import { allEmergencyDepartments, allUnits } from "@/components/ward-management/ward-sites";
@@ -142,7 +142,6 @@ export function wardFlowReducer(state: WardFlowState, event: WardFlowEvent): War
               code: "1A",
               label: "Referral for examination",
               kind: "examination",
-              dueAt: event.now + FORM_1A_REFERRAL_EXPIRY_MINUTES,
             }
           : undefined,
         statusChanges: [],
diff --git a/src/components/ward-management/ward-management-console.tsx b/src/components/ward-management/ward-management-console.tsx
index 440c3bf924..238016532f 100644
--- a/src/components/ward-management/ward-management-console.tsx
+++ b/src/components/ward-management/ward-management-console.tsx
@@ -43,15 +43,21 @@ import styles from "./ward-management.module.css";
 
 /**
  * The "label (code) · …" line for a legal form, shared by the readiness card and the legal
- * panel below. Task 6A: a Form 3B honestly carries no `dueAt` (the Mental Health Act imposes no
- * post-examination deadline) — this states that absence explicitly rather than ever formatting
- * an undefined instant, which is how "due NaN:NaN" would ship.
+ * panel below. Neither a Form 1A nor a Form 3B carries a `dueAt` in this model (see `LegalForm`'s
+ * own doc comment in ward-model.ts) — this states that absence explicitly rather than ever
+ * formatting an undefined instant, which is how "due NaN:NaN" would ship.
+ *
+ * The wording is deliberately "no deadline recorded", not "no statutory deadline". It reports
+ * what THIS RECORD holds, which is all we can verify. "No statutory deadline" asserts what the
+ * Mental Health Act requires, and that is a legal claim this prototype is not entitled to make in
+ * either direction — asserting an absence is the same overreach as asserting the seven-day figure
+ * that was deleted on 2026-08-23.
  */
 function legalFormReadinessLine(legalForm: LegalForm): string {
   const named = `${legalForm.label} (${legalForm.code})`;
   return legalForm.dueAt !== undefined
     ? `${named} · due ${formatInstant(legalForm.dueAt)}`
-    : `${named} · no statutory deadline`;
+    : `${named} · no deadline recorded`;
 }
 
 const stageIcons = {
diff --git a/src/components/ward-management/ward-model.ts b/src/components/ward-management/ward-model.ts
index 0750cff0af..bfe49ca228 100644
--- a/src/components/ward-management/ward-model.ts
+++ b/src/components/ward-management/ward-model.ts
@@ -30,28 +30,30 @@ export type DeclineReason = (typeof DECLINE_REASONS)[number];
 /** Referring to more than three units at once spams wards and erodes trust between services. */
 export const PARALLEL_REFERRAL_CAP = 3;
 
-/**
- * A Form 1A referral must carry an explicit expiry. In this synthetic model a
- * newly raised referral uses the Mental Health Act's seven-day outer limit;
- * production form capture must always use the expiry recorded on the actual
- * approved form rather than treating this demo default as clinical advice.
- */
-export const FORM_1A_REFERRAL_EXPIRY_MINUTES = 7 * 24 * 60;
-
 export type LegalStatus =
   "Voluntary" | "Referred for psychiatric examination" | "Detained awaiting examination" | "Involuntary inpatient";
 
 /**
  * The legal clock and the ED clock are different clocks (spec "Model changes this phase
- * requires", `Movement.formedAt`). `dueAt` is the legal clock — the Mental Health Act deadline
- * this specific form carries, when it has one. A Form 1A ("referral for examination") always
- * carries a real statutory examination window, so it always carries a `dueAt`. A Form 3B
- * ("inpatient treatment order") has no equivalent post-examination deadline in the Act — put to
- * the clinician directly, his answer was that the post-examination clock "is just counting how
- * long they have been in ED determining priority. So counting up," i.e. it is not a legal
- * countdown at all (Task 6A). So `dueAt` is optional, and a 3B is authored — and produced by the
- * reducer — without one. Never substitute a fallback number for an absent `dueAt`, and never let
- * an absent `dueAt` read as "clear" or "not yet due"; render its absence explicitly.
+ * requires", `Movement.formedAt`). `dueAt`, when present, is the legal clock — a statutory
+ * deadline a specific form carries. Task 6A first established that a Form 3B ("inpatient
+ * treatment order") has no such deadline: put to the clinician directly, his answer was that
+ * the post-examination clock "is just counting how long they have been in ED determining
+ * priority. So counting up," i.e. not a legal countdown at all. This model briefly gave a Form
+ * 1A ("referral for examination") an authored `dueAt` on the strength of an unverified figure
+ * an earlier agent wrote into this file from its own recollection, not from the clinician.
+ * Asked directly on 2026-08-23, the product owner's instruction was narrower than a corrected
+ * figure — "please can you leave the legal part and just start a clock once the patient arrives
+ * to ED. Keep it simple for now" — so as of that date **neither a Form 1A nor a Form 3B carries
+ * a `dueAt` in this model.** (The transport/transfer forms — 4A, "Transport order"; 4C,
+ * "Transfer between authorised hospitals" — are a different question, out of scope for this
+ * correction, and still carry real `dueAt` figures unrelated to the examination timeline this
+ * comment is about.) The field stays optional (never required) precisely so a form can honestly
+ * carry none, the same shape Task 6A gave a 3B and this now gives a 1A too. Never substitute a
+ * fallback number for an absent `dueAt`, never let an absent `dueAt` read as "clear" or "not yet
+ * due" — render its absence explicitly — and never reintroduce a `dueAt` on a 1A or 3B without a
+ * figure that traces back to the clinician or product owner by name and date, not to an
+ * assistant's recollection of the Mental Health Act.
  */
 export type LegalForm = {
   code: string;
diff --git a/src/components/ward-management/ward-movements.ts b/src/components/ward-management/ward-movements.ts
index e5e61dcc67..69f51c69ca 100644
--- a/src/components/ward-management/ward-movements.ts
+++ b/src/components/ward-management/ward-movements.ts
@@ -5,8 +5,11 @@ import { NOW_ANCHOR, allEmergencyDepartments, allUnits } from "@/components/ward
 /**
  * Hand-authored movements covering the states volume alone cannot guarantee: three declines
  * with nowhere eligible left, a status change mid-referral, a movement that never completed,
- * two legal-form breaches, every stage in the pathway at least once, and the older-adult and
- * specialling pressure that is normal — not exceptional — on a busy metro night.
+ * every stage in the pathway at least once, and the older-adult and specialling pressure that
+ * is normal — not exceptional — on a busy metro night. (Earlier revisions of this fixture
+ * authored two Form 1A "legal-form breaches" here; the 2026-08-23 product-owner correction
+ * removed every `dueAt` from every Form 1A, so no legal-form breach exists in this fixture any
+ * longer — see `LegalForm`'s doc comment in `ward-model.ts`.)
  */
 const seededMovements: Movement[] = [
   {
@@ -19,7 +22,7 @@ const seededMovements: Movement[] = [
     sex: "Female",
     specialling: false,
     legalStatus: "Referred for psychiatric examination",
-    legalForm: { code: "1A", label: "Referral for examination", kind: "examination", dueAt: NOW_ANCHOR - 15 },
+    legalForm: { code: "1A", label: "Referral for examination", kind: "examination" },
     statusChanges: [],
     stage: "placement_requested",
     owner: "ED mental health team",
@@ -110,7 +113,7 @@ const seededMovements: Movement[] = [
     sex: "Female",
     specialling: false,
     legalStatus: "Detained awaiting examination",
-    legalForm: { code: "1A", label: "Referral for examination", kind: "examination", dueAt: NOW_ANCHOR - 40 },
+    legalForm: { code: "1A", label: "Referral for examination", kind: "examination" },
     statusChanges: [],
     stage: "handover_ready",
     owner: "ED mental health team",
@@ -295,7 +298,7 @@ const seededMovements: Movement[] = [
     sex: "Female",
     specialling: false,
     legalStatus: "Detained awaiting examination",
-    legalForm: { code: "1A", label: "Referral for examination", kind: "examination", dueAt: NOW_ANCHOR + 260 },
+    legalForm: { code: "1A", label: "Referral for examination", kind: "examination" },
     statusChanges: [
       { at: NOW_ANCHOR - 40, from: "Voluntary", to: "Detained awaiting examination", by: "Duty psychiatrist" },
     ],
@@ -342,7 +345,7 @@ const seededMovements: Movement[] = [
     sex: "Female",
     specialling: true,
     legalStatus: "Referred for psychiatric examination",
-    legalForm: { code: "1A", label: "Referral for examination", kind: "examination", dueAt: NOW_ANCHOR + 200 },
+    legalForm: { code: "1A", label: "Referral for examination", kind: "examination" },
     statusChanges: [],
     stage: "placement_requested",
     owner: "ED mental health team",
@@ -436,7 +439,7 @@ const seededMovements: Movement[] = [
     sex: "Female",
     specialling: false,
     legalStatus: "Referred for psychiatric examination",
-    legalForm: { code: "1A", label: "Referral for examination", kind: "examination", dueAt: NOW_ANCHOR + 220 },
+    legalForm: { code: "1A", label: "Referral for examination", kind: "examination" },
     statusChanges: [],
     stage: "bed_held",
     owner: "Flow coordinator",
@@ -617,13 +620,15 @@ function routineMovements(count: number, startIndex: number): Movement[] {
       sex,
       specialling: index % 11 === 0,
       legalStatus: index % 3 === 0 ? "Referred for psychiatric examination" : "Voluntary",
+      // 2026-08-23: no Form 1A in this model carries a dueAt (see LegalForm's own doc comment
+      // in ward-model.ts) — the product owner's instruction was to drop the legal countdown
+      // entirely, not to derive a corrected one, so this generator authors none.
       legalForm:
         index % 3 === 0
           ? {
               code: "1A",
               label: "Referral for examination",
               kind: "examination" as const,
-              dueAt: NOW_ANCHOR + (((index * 53) % 400) - 60),
             }
           : undefined,
       statusChanges: [],
diff --git a/tests/ui-ward-coordinator.spec.ts b/tests/ui-ward-coordinator.spec.ts
index 6da879c880..c4eb7d15b2 100644
--- a/tests/ui-ward-coordinator.spec.ts
+++ b/tests/ui-ward-coordinator.spec.ts
@@ -265,28 +265,28 @@ test.describe("Ward Flow coordinator screen", () => {
     const firstRowScore = await firstRow.getAttribute("data-score");
     await expect(firstRow).toContainText(`Operational ${firstRowScore}`);
 
-    // The breach line is the row a coordinator must not miss, and it must be able to vanish
-    // silently for neither direction (Task 5 review Important 3).
+    // The breach line used to be the row a coordinator must not miss (Task 5 review Important
+    // 3, then Task 6A fix round 1, then the clinician's "Bed need confirmed" factor added
+    // 2026-08-22 — see this test's history for how WF-017/WF-009/WF-303 used to be pinned here).
     //
-    // Task 6A fix round 1 corrected two errors this comment used to carry (WF-017 as "first
-    // row", and "Form 2A" instead of "1A"). The clinician's "Bed need confirmed" factor, added
-    // 2026-08-22, moves the goalposts a second time: a movement whose examination outcome is
-    // recorded as `inpatient_order` now outranks one nobody has assessed at all, inside the
-    // same tier. WF-009 and WF-017 both carry that confirmed need and both carry a Form 3B with
-    // no `dueAt` (Task 6A deleted the fabricated one, so a 3B can never be breached) — they now
-    // rank rows 1 and 2 ahead of WF-303, which carries the breached Form 1A but no confirmed
-    // need. So `firstRow`/`secondRow` can no longer be used to prove the breach line renders —
-    // by design, neither of the top two rows has one to render — and the breach-line assertion
-    // is pinned by id instead, the same pattern the "shows a failing gate" test below already
-    // uses for WF-017/WF-009 for the identical reason (a fixture fact tied to a specific
-    // movement, not to whichever row currently ranks first).
-    await expect(firstRow).not.toContainText("passed its deadline");
-    const secondRow = rows.nth(1);
-    await expect(secondRow).not.toContainText("passed its deadline");
-    // Fixture assumption: WF-303 carries a breached Form 1A and no confirmed bed need, so it
-    // must still show the breach line — it just no longer does so from row 1 or 2.
-    const breachedRow = queue.locator('[data-testid="ward-queue-row-WF-303"]');
-    await expect(breachedRow).toContainText("passed its deadline");
+    // 2026-08-23 correction: put to the product owner directly, the instruction was to drop the
+    // legal countdown from this model entirely, not to get its deadline figure right — "please
+    // can you leave the legal part and just start a clock once the patient arrives to ED. Keep
+    // it simple for now." Neither a Form 1A nor a Form 3B carries a `dueAt` any longer (WF-303,
+    // the one movement this suite used to pin as "the genuine breach", now carries none — see
+    // `LegalForm`'s own doc comment in ward-model.ts). This supersedes ruling F17's requirement
+    // that the assertion be satisfied by a genuine breach: there is no longer such a thing as a
+    // legal breach for 1A/3B to prove, so the whole-page absence below replaces the old
+    // firstRow/secondRow/breachedRow pin rather than repointing it at a different movement.
+    // (Repointing at `ED_ACCESS_TARGET_MINUTES` instead was considered and rejected: measured
+    // against this fixture at `NOW_ANCHOR`, the longest current wait is under it, so no movement
+    // genuinely exceeds that target either — asserting one did would be a second fabrication of
+    // the exact kind this correction exists to remove.) This is a whole-page check, not a
+    // 1A/3B-scoped one, because the string itself is the thing that must not appear — on today's
+    // fixture the only other legal-form kinds, the transport/transfer forms 4A/4C (out of scope
+    // for this correction, still carrying a real `dueAt`), are not currently due in the past
+    // either, so the assertion is true for the whole page, not merely for 1A/3B rows.
+    await expect(queue).not.toContainText("passed its deadline");
 
     // Selecting a movement drives the rest of the screen.
     await firstRow.click();
diff --git a/tests/ward-derivations.test.ts b/tests/ward-derivations.test.ts
index ac0e148e9d..7c91342ef6 100644
--- a/tests/ward-derivations.test.ts
+++ b/tests/ward-derivations.test.ts
@@ -9,7 +9,13 @@ import {
   transportLeg,
 } from "../src/components/ward-management/ward-derivations";
 import { eligibility } from "../src/components/ward-management/ward-eligibility";
-import { PARALLEL_REFERRAL_CAP, type TransportJob } from "../src/components/ward-management/ward-model";
+import {
+  DECLINE_REASONS,
+  PARALLEL_REFERRAL_CAP,
+  type Decline,
+  type Movement,
+  type TransportJob,
+} from "../src/components/ward-management/ward-model";
 import { wardMovements } from "../src/components/ward-management/ward-movements";
 import { allUnits, NOW_ANCHOR } from "../src/components/ward-management/ward-sites";
 
@@ -22,14 +28,25 @@ function transportJob(overrides: Partial<TransportJob> = {}): TransportJob {
   };
 }
 
+// A real, valid, open fixture movement to spread from when a test needs to inject its own
+// movement list — same approach as tests/ward-pressure.test.ts's `movementFrom`. Object.assign
+// rather than spread, because `{ ...base, ...Partial<T> }` widens every overridden field back to
+// optional under TypeScript's spread-merge rules even though every field is present at runtime.
+const inboxBaseMovement = wardMovements.find((movement) => movement.id === "WF-002");
+if (!inboxBaseMovement) throw new Error("Fixture movement WF-002 is required as a template for ward-derivations tests");
+
+function movementFrom(overrides: Partial<Movement>): Movement {
+  return Object.assign({}, inboxBaseMovement, overrides);
+}
+
 describe("buildActionInbox", () => {
   // RULING 1 (Task 8): buildActionInbox used to build each of its three categories with
-  // `.find()`, so it could only ever report one movement per category. The real fixture at
-  // NOW_ANCHOR carries more than one qualifying movement in two of the three categories — a
-  // drawer built on `.find()` would tell a coordinator a single legal breach exists when several
-  // do. Expected numbers here are derived from `wardMovements` itself, never hard-coded, so this
-  // test keeps proving the real count rather than pinning today's fixture size.
-  it("emits one item per movement that carries a breached legal deadline, not just the first", () => {
+  // `.find()`, so it could only ever report one movement per category. Expected numbers here
+  // are derived from `wardMovements` itself, never hard-coded, so this test keeps proving the
+  // real count rather than pinning today's fixture size — a shape kept below even though the
+  // legal-timing category is dormant (see the next test): if a `dueAt` ever returns to this
+  // fixture, `.find()` regressing to one-item-per-category must still be caught here.
+  it("emits no legal-timing item for the real fixture, which carries no past-due deadline", () => {
     const expectedIds = wardMovements
       .filter(
         (movement) =>
@@ -43,10 +60,80 @@ describe("buildActionInbox", () => {
       .map((item) => item.id)
       .sort();
 
-    expect(expectedIds.length).toBeGreaterThan(1);
+    // 2026-08-23: neither a Form 1A nor a Form 3B carries a `dueAt` any longer (see
+    // `LegalForm`'s own doc comment in ward-model.ts) — the only other legal-form kinds in this
+    // fixture, the transport/transfer forms 4A/4C, still carry one but are not currently due in
+    // the past — so this category is empty on today's fixture. `expectedIds`/`items` still
+    // agreeing on that, computed independently, is the proof that `buildActionInbox` itself has
+    // not silently started fabricating a breach.
+    //
+    // This is an ABSENCE check and cannot catch a `.find()` regression. The positive proof that
+    // the legal category emits one item PER movement lives in the next test, which injects its
+    // own movements rather than relying on a fixture that no longer contains a breach.
+    expect(expectedIds).toHaveLength(0);
     expect(items).toEqual(expectedIds);
   });
 
+  /**
+   * Fix wave 1, finding 3 — the restored `.find()`-regression guard for the legal category.
+   *
+   * The original test asserted `expectedIds.length > 1` against the real fixture. After the
+   * 2026-08-23 correction the fixture carries no past-due 1A/3B at all, so that assertion was
+   * changed to `toHaveLength(0)` and the guard silently stopped guarding: appending `.slice(0, 1)`
+   * to `breachedLegal` in ward-derivations.ts — the exact historical `.find()` regression this
+   * test exists to catch — left the whole suite green (measured: 45 passed).
+   *
+   * `buildActionInbox(movements, now)` takes an explicit array, so the fix is to inject two
+   * qualifying movements instead of hoping the fixture contains some. Both carry a Form **4A**
+   * ("Transport order"), which is about moving a person and is unrelated to the examination
+   * timeline this project's fabrications were about. The `- 20` and `- 90` offsets are arbitrary
+   * test scaffolding chosen to sit in the past; they are NOT Mental Health Act figures and
+   * nothing derives them from one.
+   */
+  it("emits a legal-timing item for EVERY past-due movement, not just the first", () => {
+    const first = movementFrom({
+      id: "TEST-legal-one",
+      legalForm: { code: "4A", label: "Transport order", kind: "transport", dueAt: NOW_ANCHOR - 20 },
+    });
+    const second = movementFrom({
+      id: "TEST-legal-two",
+      legalForm: { code: "4A", label: "Transport order", kind: "transport", dueAt: NOW_ANCHOR - 90 },
+    });
+    const notDue = movementFrom({
+      id: "TEST-legal-not-due",
+      legalForm: { code: "4A", label: "Transport order", kind: "transport", dueAt: NOW_ANCHOR + 500 },
+    });
+
+    const items = buildActionInbox([first, second, notDue], NOW_ANCHOR)
+      .filter((item) => item.id.startsWith("legal-"))
+      .map((item) => item.id)
+      .sort();
+
+    // Both past-due movements, and only those two. `.slice(0, 1)` or a `.find()` yields one id
+    // and fails; a filter that ignored `clockState` would also emit the not-due one and fail.
+    expect(items).toEqual(["legal-TEST-legal-one", "legal-TEST-legal-two"]);
+  });
+
+  // Regression proof for the 2026-08-23 correction: WF-303 is the real fixture Form 1A that an
+  // earlier, now-deleted authored `dueAt` made "breached" at `NOW_ANCHOR` (an arbitrary window
+  // unrelated to how long the patient had actually waited — see the fixture's own file header).
+  // It must never surface a "legal-WF-303" inbox item, because the form now carries no deadline
+  // at all.
+  it("never lists a legal-timing item for WF-303, a long-waiting Form 1A with no dueAt", () => {
+    const movement = wardMovements.find((candidate) => candidate.id === "WF-303");
+    expect(movement?.legalForm?.code).toBe("1A");
+    expect(movement?.legalForm?.dueAt).toBeUndefined();
+
+    const items = buildActionInbox(wardMovements, NOW_ANCHOR);
+    expect(items.find((item) => item.id === "legal-WF-303")).toBeUndefined();
+  });
+
+  // Fix wave 2, finding 3. Exactly one fixture movement (WF-009) reaches the cap, so this
+  // fixture-derived test could not catch a one-item regression: `.slice(0, 1)` on
+  // `heavilyDeclined` left it green (measured: 19 passed). It is kept — agreement between two
+  // independently computed lists is still worth pinning — but the positive proof now lives in the
+  // injected test below, and the floor here stops it degrading into a pure absence check if the
+  // fixture ever loses WF-009.
   it("emits one item per movement that reached the parallel-referral cap, not just the first", () => {
     const expectedIds = wardMovements
       .filter((movement) => movement.declines.length >= PARALLEL_REFERRAL_CAP)
@@ -58,9 +145,35 @@ describe("buildActionInbox", () => {
       .map((item) => item.id)
       .sort();
 
+    expect(expectedIds.length, "the fixture no longer contains a capped movement").toBeGreaterThan(0);
     expect(items).toEqual(expectedIds);
   });
 
+  // The `.find()`-regression guard for the declines category, on injected movements so it does not
+  // depend on how many fixture movements happen to qualify. No legal form and no deadline is
+  // involved here at all — this category counts declines.
+  it("emits a declines item for EVERY capped movement, not just the first", () => {
+    const decline = (unitId: string): Decline => ({ unitId, at: NOW_ANCHOR - 60, reason: DECLINE_REASONS[0] });
+    const capped = (id: string): Movement =>
+      movementFrom({ id, declines: [decline("unit-a"), decline("unit-b"), decline("unit-c")] });
+    const underCap = movementFrom({ id: "TEST-declines-under", declines: [decline("unit-a")] });
+
+    expect(capped("TEST-declines-one").declines.length, "fixture assumption: three declines meets the cap").toBe(
+      PARALLEL_REFERRAL_CAP,
+    );
+
+    const items = buildActionInbox([capped("TEST-declines-one"), capped("TEST-declines-two"), underCap], NOW_ANCHOR)
+      .filter((item) => item.id.startsWith("declines-"))
+      .map((item) => item.id)
+      .sort();
+
+    expect(items).toEqual(["declines-TEST-declines-one", "declines-TEST-declines-two"]);
+  });
+
+  // Fix wave 2, finding 3 — checked for the same shape as the declines category above. Two
+  // fixture movements currently qualify, so a one-item regression IS caught here today; the floor
+  // below is what keeps that true if the fixture changes, and the injected test after it does not
+  // depend on the fixture at all.
   it("emits one item per movement with transport accepted but not yet en route, not just the first", () => {
     const expectedIds = wardMovements
       .filter(
@@ -72,6 +185,8 @@ describe("buildActionInbox", () => {
       .map((movement) => `transport-${movement.id}`)
       .sort();
 
+    expect(expectedIds.length, "the fixture no longer contains a stalled transport").toBeGreaterThan(1);
+
     const items = buildActionInbox(wardMovements, NOW_ANCHOR)
       .filter((item) => item.id.startsWith("transport-"))
       .map((item) => item.id)
diff --git a/tests/ward-flow-reducer.test.ts b/tests/ward-flow-reducer.test.ts
index 384feeeeb0..903e9577cc 100644
--- a/tests/ward-flow-reducer.test.ts
+++ b/tests/ward-flow-reducer.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, it } from "vitest";
 
 import { seedWardFlowState, wardFlowReducer } from "../src/components/ward-management/ward-flow-reducer";
-import { FORM_1A_REFERRAL_EXPIRY_MINUTES } from "../src/components/ward-management/ward-model";
 import { NOW_ANCHOR } from "../src/components/ward-management/ward-sites";
 
 const NOW = NOW_ANCHOR;
@@ -282,12 +281,16 @@ describe("new referrals", () => {
         },
       });
       const created = referred.movements.at(-1)!;
+      // 2026-08-23 product-owner correction: a raised Form 1A carries no legal deadline. The
+      // `toEqual` below is exact, so an extra `dueAt` key would already fail it — but the
+      // explicit assertion that follows names the intent, so a later reader cannot read the
+      // absence as an oversight in the object literal.
       expect(created.legalForm).toEqual({
         code: "1A",
         label: "Referral for examination",
         kind: "examination",
-        dueAt: NOW + FORM_1A_REFERRAL_EXPIRY_MINUTES,
       });
+      expect(created.legalForm?.dueAt).toBeUndefined();
       expect(created.formedAt).toBe(NOW);
 
       const examined = wardFlowReducer(referred, {
@@ -331,9 +334,10 @@ describe("examination", () => {
     const target = movement(next, "WF-001");
     expect(target.examination).toEqual({ at: NOW, outcome: "inpatient_order" });
     expect(target.legalForm?.code).toBe("3B");
-    // Task 6A: the Mental Health Act imposes no post-examination deadline, so the reducer-
-    // produced 3B must carry no dueAt at all — pinned as an explicit absence, not merely no
-    // longer contradicted by a stale expected value.
+    // Task 6A: the clinician settled that the post-examination clock is elapsed ED wait,
+    // counting up, never a countdown — so no post-examination deadline is recorded for a 3B, and
+    // the reducer-produced 3B must carry no dueAt at all. Pinned as an explicit absence, not
+    // merely no longer contradicted by a stale expected value.
     expect(target.legalForm?.dueAt).toBeUndefined();
   });
 
diff --git a/tests/ward-legal-figure-guard.test.ts b/tests/ward-legal-figure-guard.test.ts
new file mode 100644
index 0000000000..6a7dc23d60
--- /dev/null
+++ b/tests/ward-legal-figure-guard.test.ts
@@ -0,0 +1,1017 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import ts from "typescript";
+import { describe, expect, it } from "vitest";
+
+import { EVENT_ROLE, type WardFlowEvent } from "../src/components/ward-management/ward-flow-events";
+import {
+  seedWardFlowState,
+  wardFlowReducer,
+  type WardFlowState,
+} from "../src/components/ward-management/ward-flow-reducer";
+import { DECLINE_REASONS, type LegalForm, type LegalStatus } from "../src/components/ward-management/ward-model";
+import { wardMovements } from "../src/components/ward-management/ward-movements";
+import { allEmergencyDepartments, NOW_ANCHOR } from "../src/components/ward-management/ward-sites";
+
+/**
+ * Guard against a fourth fabrication of a Mental Health Act duration in this prototype.
+ *
+ * Three separate agents have now written three different invented statutory figures into
+ * `src/components/ward-management/` and attributed them to the Act: a Form 3B post-examination
+ * deadline (deleted in Task 6A), a four-hour figure bolted onto `legalForm.dueAt` (ruling F23),
+ * and a Form 1A examination window (deleted 2026-08-23, the correction this file was added
+ * alongside). Each was removed only after it had already reached the screen. The product owner's
+ * standing instruction is narrower than "get the number right": "please can you leave the legal
+ * part and just start a clock once the patient arrives to ED. Keep it simple for now."
+ *
+ * The guard has three parts, built on different evidence so a reintroduction has to defeat more
+ * than one. Every claim below is demonstrated by an assertion in this file; where a part has a
+ * limit, the limit is stated rather than glossed.
+ *
+ *   Part 1 reads REAL RUNTIME VALUES — every `LegalForm` the fixture authors, every one the
+ *   reducer authors, and every one reachable by driving the reducer through EVERY event type in
+ *   its union — and requires that NO form of ANY code carries a `dueAt` unless its code is on
+ *   `DEADLINE_BEARING_FORM_PROVENANCE` below. It is fail-closed on the code, not a check of two
+ *   named codes: every consumer is code-agnostic (`ward-priority.ts` scores any code carrying a
+ *   `dueAt` and renders `Form ${code} passed its deadline …`), so a fabrication on an invented
+ *   code would otherwise render as a legal countdown with nothing in its way.
+ *
+ *   Because it inspects values rather than text, it is unaffected by how the value got there: a
+ *   helper in another file, an intermediate local, a spread, a computed property name, a
+ *   post-construction mutation of an existing form, or a constant imported from anywhere at all.
+ *   Its limit is REACHABILITY. The traversal drives every event type against a movement carrying
+ *   EACH examination-timeline code and asserts acceptance per code, so a branch keyed on one code
+ *   cannot go unentered — that exact hole let `code === "1A" ? { …, dueAt } : legalForm` pass the
+ *   whole suite. What acceptance-per-code still does not give is every guard condition inside
+ *   each case; a branch the sweep cannot reach at all is not inspected.
+ *
+ *   Part 2 is a fail-closed ALLOWLIST over `ward-model.ts`. Every exported declaration there that
+ *   WRITES A NUMBER DOWN ANYWHERE in its initializer — a constant, an object property, a function
+ *   body, an enum member — must appear in `MODEL_CONSTANT_PROVENANCE` below with a one-line record
+ *   of who supplied the figure and when. The trigger is the shape of the declaration, never its
+ *   name, so a constant nobody thought to predict is caught because it was never declared. Its
+ *   limits are SCOPE (it governs `ward-model.ts` and nothing else) and EXPORT (a module-private
+ *   declaration is not inspected).
+ *
+ *   Part 3 is a token denylist over the whole ward directory, kept as a WIDER BUT INCOMPLETE
+ *   second net for the files Part 2 does not govern. It scans identifiers via the TypeScript AST
+ *   (never a regular expression, never a hand-rolled string scanner) across every `.ts`/`.tsx`
+ *   file under the ward directory, recursively, so a file added in `coordinator/`, `ed/`,
+ *   `officer/`, `tracker/` or `ward/` is covered exactly as a top-level one is. It is NOT
+ *   complete and a green Part 3 proves nothing on its own.
+ *
+ * WHY PART 2 IS SHAPE-BASED AND NOT NAME-BASED. Two earlier versions of this guard tried to
+ * recognise a fabricated figure by its NAME, and both were defeated by a reviewer:
+ *
+ *     FORM_1A_REFERRAL_EXPIRY_MINUTES   caught by the token denylist
+ *     ASSESSMENT_WINDOW_MINUTES         defeated the denylist  (caught by v2's unit-token rule)
+ *     INVOLUNTARY_ORDER_HOURS           defeated the denylist  (caught by v2's unit-token rule)
+ *     SECTION_REVIEW_DAYS               defeated the denylist  (caught by v2's unit-token rule)
+ *     FORM_1A_REFERRAL_CLOCK            defeated BOTH — no unit token, and it carried the
+ *                                       deleted fabrication's exact value, 7 * 24 * 60
+ *
+ * Each round added vocabulary and each round missed the next name nobody had thought of. Keying
+ * on the shape of the declaration instead ends that: an exported number in `ward-model.ts` is
+ * caught whatever it is called. All of the names above are pinned as test cases below.
+ *
+ * WHAT THIS GUARD CANNOT SEE — stated plainly, because a guard that overstates its reach is the
+ * failure mode this repository has hit most often:
+ *
+ *   - Part 2 governs `ward-model.ts` only. A duration constant declared in another ward file
+ *     falls through to Part 3's incomplete denylist, and one declared outside the ward directory
+ *     entirely is seen by neither.
+ *   - Part 3 is incomplete BY CONSTRUCTION, as the table above demonstrates. It is a safety net,
+ *     not a proof of absence, and a green Part 3 means nothing on its own.
+ *   - Part 2 sees only EXPORTED declarations — `export const`, `export enum`, `export function`.
+ *     A module-private `const` in `ward-model.ts`, or a number written inline at its use site, is
+ *     not a declaration it inspects. Within an exported declaration it looks for a numeric literal
+ *     anywhere, so the object / arrow-function / enum shapes that defeated the narrower rule are
+ *     covered; a number arriving by import or computed at runtime is not.
+ *   - Part 3 sees only SCREAMING_SNAKE_CASE identifiers. That filter is deliberate: every
+ *     fabrication so far was a named constant, whereas the camelCase names in this directory are
+ *     locals that merely READ a value (`legalDueAt`, `minutesLegalClock` — both honest readers of
+ *     the 4A/4C deadlines that legitimately exist). Flagging those would make the guard cry wolf
+ *     and get it disabled.
+ *   - Anything that is not an identifier at all. A duration written only inside a string literal,
+ *     a template literal, a comment, JSX text, or a CSS module is invisible to Part 3.
+ *   - Part 1's limit is reachability. It inspects the states its traversal reaches; a branch the
+ *     traversal cannot get an event accepted into is not inspected. The traversal asserts every
+ *     event type was accepted against a movement carrying EACH examination-timeline code, so a
+ *     code-keyed branch is entered rather than assumed — but "accepted per code" is still not
+ *     "every guard condition inside that case exercised".
+ *   - The `STRUCTURALLY_IMPOSSIBLE_FOR_CODE` exclusion list gets only a partial check; its exact
+ *     limit, and the measurement that established it, are recorded at its declaration.
+ *   - A fabricated number parked in a variable nothing reads reaches no user and is caught by
+ *     nothing here until something uses it.
+ *   - Non-`.ts`/`.tsx` files, including the `.module.css` files in this directory.
+ *   - Forms 4A ("Transport order") and 4C ("Transfer between authorised hospitals"), which carry
+ *     real `dueAt` figures about moving a person rather than about the examination timeline and
+ *     are deliberately out of scope for every part.
+ *
+ * This file must never be relaxed to make a change green. If a real statutory figure is ever
+ * supplied, it arrives with a named source and date from the clinician or the product owner, and
+ * this guard is amended in the same change that records that provenance — never before it.
+ */
+
+const WARD_DIR = "src/components/ward-management";
+
+/**
+ * THE DEADLINE ALLOWLIST (Part 1's rule). A legal form of ANY code may carry a `dueAt` only if its
+ * code appears here with a line recording why that form legitimately bears an operational
+ * deadline. Every other code — including one nobody has invented yet — fails.
+ *
+ * This is the same fail-closed inversion Part 2 uses, and for the same reason. The previous rule
+ * named the two codes to CHECK (`1A`, `3B`), which meant a fabrication on any third code was
+ * checked by nothing — while every consumer is code-agnostic: `ward-priority.ts` scores points
+ * for any code carrying a `dueAt` and renders `Form ${code} passed its deadline …`, and
+ * `shortlist-panel.tsx` and `ward-derivations.ts` do the same. A new code would have rendered as
+ * a legal countdown with no guard in its way.
+ *
+ * Never add an entry for a form on the examination timeline (1A, 3B), and never add one whose
+ * justification traces to an assistant's recollection of the Mental Health Act.
+ */
+const DEADLINE_BEARING_FORM_PROVENANCE: Record<string, string> = {
+  // "Transport order" — a deadline about MOVING A PERSON (when transport must occur by), not
+  // about the examination timeline. Pre-dates the 2026-08-23 correction, which the product owner
+  // scoped to the examination clock and explicitly left these alone.
+  "4A": "Transport order — operational deadline for moving a person, out of scope for the 2026-08-23 correction",
+
+  // "Transfer between authorised hospitals" — same category as 4A: an operational deadline about
+  // a move between sites, unrelated to the examination timeline.
+  "4C": "Transfer between authorised hospitals — operational deadline for a move between sites, same category as 4A",
+};
+
+/**
+ * The two codes on the examination timeline. Used ONLY for non-vacuity — proving the fixture and
+ * the traversal actually held these forms — never as the set of codes the rule checks. The rule
+ * is the allowlist above.
+ */
+const EXAMINATION_TIMELINE_CODES = new Set(["1A", "3B"]);
+
+/**
+ * Word-level token sets. Matching is on exact tokens, never substrings: substring matching would
+ * flag `formattedMinutes` (FORM inside FORMATTED) and other innocent names, and a guard that
+ * cries wolf gets disabled. Tokenisation splits on `_` and on camelCase boundaries, so both
+ * `FORM_1A_EXPIRY_MINUTES` and `form1AExpiryMinutes` decompose the same way.
+ */
+const LEGAL_TOKENS = new Set([
+  "FORM",
+  "FORMS",
+  "1A",
+  "3B",
+  "STATUTORY",
+  "LEGAL",
+  "MHA",
+  "ACT",
+  "DETENTION",
+  "DETAINED",
+  "EXAMINATION",
+  "REFERRAL",
+]);
+
+const DURATION_TOKENS = new Set([
+  "MINUTES",
+  "MINS",
+  "HOURS",
+  "DAYS",
+  "EXPIRY",
+  "EXPIRES",
+  "DEADLINE",
+  "WINDOW",
+  "LIMIT",
+  "TIMEOUT",
+  "DUE",
+]);
+
+/**
+ * THE ALLOWLIST (Part 2). Every exported SCREAMING_SNAKE_CASE constant in `ward-model.ts` whose
+ * name carries a duration token must appear here, with a one-line record of who supplied the
+ * figure and when. Adding an entry is the deliberate act of recording provenance; a figure whose
+ * provenance cannot be written down does not belong in this model at all.
+ *
+ * Never add an entry whose provenance is an assistant's recollection of the Mental Health Act.
+ * That is precisely what produced the three deleted fabrications. Provenance means a named human
+ * — the clinician or the product owner — and a date.
+ */
+const MODEL_CONSTANT_PROVENANCE: Record<string, string> = {
+  // Product owner (the spec's own author), 2026-08-22: superseded the spec's original four-hour
+  // figure and set the emergency department access target to 24 hours for this prototype, in
+  // response to a direct clinical question. Counted UP from `openedAt`; never a deadline, never
+  // attached to a `LegalForm`. See the constant's own doc comment in ward-model.ts.
+  ED_ACCESS_TARGET_MINUTES: "product owner, 2026-08-22 — ED access target, counted up from openedAt",
+
+  // Product owner's own spec, `docs/ward-flow-context.md` (line 205 states the constant; line 287
+  // states the rule: "Parallel referrals are supported, capped at three"). An operational
+  // courtesy limit between services — explicitly NOT a clinical or statutory quantity, and it
+  // measures a count of units, not a duration.
+  PARALLEL_REFERRAL_CAP: "product owner's spec, docs/ward-flow-context.md — count of units, not a duration",
+};
+
+/**
+ * True when a subtree contains a numeric literal ANYWHERE. Read structurally from the AST, so the
+ * trigger does not depend on the declaration's NAME at all, and not on its shape either.
+ *
+ * Both narrower rules this replaced were defeated by a reviewer. Keying on the name was defeated
+ * by `FORM_1A_REFERRAL_CLOCK = 7 * 24 * 60` — the deleted fabrication's exact value, carrying no
+ * duration-unit token. Keying on "the initializer IS a number" was then defeated by three shapes
+ * that merely CONTAIN one: an object (`{ minutes: 7 * 24 * 60 }`), an arrow function
+ * (`(): number => 7 * 24 * 60`), and an enum member (`Window = 10080`). Containment is the widest
+ * honest rule available here, and it is the one in force.
+ */
+function containsNumericLiteral(node: ts.Node): boolean {
+  if (ts.isNumericLiteral(node)) return true;
+  let found = false;
+  ts.forEachChild(node, (child) => {
+    if (!found && containsNumericLiteral(child)) found = true;
+  });
+  return found;
+}
+
+/**
+ * Exported constant names declared in one file, read from the AST — never from a regular
+ * expression, and never from a substring search that a quote or a comment could fool. Only
+ * `export const NAME = …` declarations are collected, which is exactly the shape a written-down
+ * figure takes. `numericOnly` narrows to declarations whose initializer is a number written into
+ * the source, which is the allowlist's trigger.
+ */
+function exportedDeclarationNames(source: ts.SourceFile, numericOnly = false): string[] {
+  const names: string[] = [];
+  const isExported = (node: ts.Node): boolean =>
+    ts.canHaveModifiers(node) &&
+    (ts.getModifiers(node)?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) ?? false);
+
+  const visit = (node: ts.Node): void => {
+    if (ts.isVariableStatement(node) && isExported(node)) {
+      for (const declaration of node.declarationList.declarations) {
+        if (!ts.isIdentifier(declaration.name)) continue;
+        if (numericOnly && !(declaration.initializer && containsNumericLiteral(declaration.initializer))) continue;
+        names.push(declaration.name.text);
+      }
+    }
+    // An exported enum is a declaration of numbers by another name, and was one of the three
+    // shapes that defeated the previous rule.
+    if (ts.isEnumDeclaration(node) && isExported(node)) {
+      if (!numericOnly || containsNumericLiteral(node)) names.push(node.name.text);
+    }
+    // An exported function whose body writes a number down is the same thing wearing a hat.
+    if (ts.isFunctionDeclaration(node) && isExported(node) && node.name) {
+      if (!numericOnly || containsNumericLiteral(node)) names.push(node.name.text);
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  return names;
+}
+
+function exportedNamesInFile(path: string, numericOnly = false): string[] {
+  return exportedDeclarationNames(
+    ts.createSourceFile(path, readFileSync(path, "utf8"), ts.ScriptTarget.Latest, true, ts.ScriptKind.TS),
+    numericOnly,
+  );
+}
+
+/**
+ * SCREAMING_SNAKE_CASE — the shape a written-down figure takes in this codebase. See the header
+ * for why camelCase readers are deliberately excluded and what that costs.
+ */
+function isConstantName(identifier: string): boolean {
+  return /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)*$/.test(identifier);
+}
+
+function tokenise(identifier: string): string[] {
+  return identifier
+    .split("_")
+    .flatMap((part) => part.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(" "))
+    .filter((token) => token.length > 0)
+    .map((token) => token.toUpperCase());
+}
+
+/**
+ * True when an identifier names a legal concept AND a duration — the shape every one of the
+ * three fabrications took (`FORM_1A_REFERRAL_EXPIRY_MINUTES` and its predecessors).
+ */
+function namesALegalDuration(identifier: string): boolean {
+  const tokens = tokenise(identifier);
+  return tokens.some((token) => LEGAL_TOKENS.has(token)) && tokens.some((token) => DURATION_TOKENS.has(token));
+}
+
+/**
+ * The unconditional shapes the brief names for `ward-model.ts`: any `*_EXPIRY_MINUTES` or
+ * `*_DEADLINE_*` identifier is banned there whether or not it also names a legal concept,
+ * because that file is the model's own vocabulary and a bare `EXPIRY_MINUTES` there would be
+ * read as statutory by the next author regardless of what it is called.
+ */
+function namesABannedModelShape(identifier: string): boolean {
+  const upper = identifier.toUpperCase();
+  return upper.endsWith("_EXPIRY_MINUTES") || upper.includes("_DEADLINE_") || upper.endsWith("_DEADLINE");
+}
+
+function walk(dir: string): string[] {
+  return readdirSync(dir, { withFileTypes: true }).flatMap((entry) =>
+    entry.isDirectory() ? walk(join(dir, entry.name)) : [join(dir, entry.name)],
+  );
+}
+
+type ScannedFile = { path: string; identifiers: string[] };
+
+/**
+ * Every identifier the TypeScript parser sees in a file — declarations, references and imports
+ * alike, so importing a banned name from elsewhere is caught as well as declaring one here.
+ * Identifiers are collected into an array of the matched names themselves; nothing in this file
+ * counts loop iterations and calls that a result.
+ */
+function scanWardFiles(): ScannedFile[] {
+  return walk(WARD_DIR)
+    .filter((path) => path.endsWith(".ts") || path.endsWith(".tsx"))
+    .map((path) => {
+      const source = ts.createSourceFile(
+        path,
+        readFileSync(path, "utf8"),
+        ts.ScriptTarget.Latest,
+        true,
+        path.endsWith(".tsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS,
+      );
+      const identifiers: string[] = [];
+      const visit = (node: ts.Node): void => {
+        if (ts.isIdentifier(node)) identifiers.push(node.text);
+        ts.forEachChild(node, visit);
+      };
+      visit(source);
+      return { path, identifiers };
+    });
+}
+
+/** Every event type in the union, taken from the role table so a new variant cannot be forgotten. */
+const ALL_EVENT_TYPES = Object.keys(EVENT_ROLE) as WardFlowEvent["type"][];
+
+/**
+ * Candidate events of one type, generated against the CURRENT state rather than hard-coded, so a
+ * fixture change cannot silently make the traversal untestable. Every candidate carries the role
+ * the role table requires — a wrong role is refused before the reducer body runs, and a refused
+ * event proves nothing about what the reducer body does.
+ */
+function candidateEvents(type: WardFlowEvent["type"], state: WardFlowState, now: number): WardFlowEvent[] {
+  const role = EVENT_ROLE[type];
+  const movementIds = state.movements.map((movement) => movement.id);
+  const unitIds = state.units.map((unit) => unit.id);
+  const pairs = movementIds.flatMap((movementId) => unitIds.map((unitId) => ({ movementId, unitId })));
+
+  switch (type) {
+    case "RAISE_REFERRAL":
+      return allEmergencyDepartments().flatMap((ed) =>
+        (["Referred for psychiatric examination", "Detained awaiting examination"] as LegalStatus[]).map(
+          (legalStatus) => ({
+            type,
+            role,
+            now,
+            edId: ed.id,
+            draft: {
+              cohort: "Adult" as const,
+              security: "Open" as const,
+              sex: "Female" as const,
+              specialling: false,
+              legalStatus,
+              urgency: 2 as const,
+            },
+          }),
+        ),
+      );
+    case "RECORD_EXAMINATION":
+      return movementIds.flatMap((movementId) =>
+        (["inpatient_order", "community_order", "revoked"] as const).map((outcome) => ({
+          type,
+          role,
+          now,
+          movementId,
+          outcome,
+        })),
+      );
+    case "REFER_TO_UNITS":
+      return pairs.map(({ movementId, unitId }) => ({ type, role, now, movementId, unitIds: [unitId] }));
+    case "ACCEPT_IN_PRINCIPLE":
+    case "HOLD_BED":
+      return pairs.map(({ movementId, unitId }) => ({ type, role, now, movementId, unitId }));
+    case "DECLINE":
+      return pairs.map(({ movementId, unitId }) => ({
+        type,
+        role,
+        now,
+        movementId,
+        unitId,
+        reason: DECLINE_REASONS[0],
+      }));
+    case "HANDOVER_READY":
+    case "TRANSPORT_ACCEPTED":
+    case "TRANSPORT_EN_ROUTE":
+    case "PATIENT_COLLECTED":
+    case "PATIENT_ARRIVED":
+      return movementIds.map((movementId) => ({ type, role, now, movementId }));
+    case "CONFIRM_CAPACITY":
+      return unitIds.flatMap((unitId) => [0, 1, 2].map((value) => ({ type, role, now, unitId, value })));
+    case "RECORD_ESCALATION":
+      return movementIds.map((movementId) => ({
+        type,
+        role,
+        now,
+        movementId,
+        triedUnitIds: unitIds.slice(0, 1),
+        contact: "State-wide bed coordination line",
+      }));
+    case "ADVANCE_CLOCK":
+      return [{ type, role, now, minutes: 30 }];
+    case "RESET_SCENARIO":
+      return [{ type, role, now }];
+  }
+}
+
+/** Event types that act on one named movement. The rest act on a unit, or on the whole scenario. */
+const MOVEMENT_TARGETED_EVENTS: ReadonlySet<WardFlowEvent["type"]> = new Set([
+  "RECORD_EXAMINATION",
+  "REFER_TO_UNITS",
+  "ACCEPT_IN_PRINCIPLE",
+  "HOLD_BED",
+  "DECLINE",
+  "HANDOVER_READY",
+  "TRANSPORT_ACCEPTED",
+  "TRANSPORT_EN_ROUTE",
+  "PATIENT_COLLECTED",
+  "PATIENT_ARRIVED",
+  "RECORD_ESCALATION",
+]);
+
+/**
+ * Event types that CANNOT apply to a movement already carrying a given code, because the reducer
+ * structurally refuses them — not because the traversal failed to reach them.
+ *
+ * This is an exclusion from the coverage assertion, so it is exactly the shape that could be
+ * abused to hide a real gap. Only structural impossibility belongs here — never "the sweep did
+ * not happen to get there".
+ *
+ * THE CHECK ON THIS LIST IS WEAKER THAN IT LOOKS, and the limit is stated here rather than
+ * discovered later. The test below confirms the reducer refuses each entry against ONE fixture
+ * movement carrying that code, in the seeded state. That catches an entry the reducer plainly
+ * accepts, but it does NOT establish structural impossibility: an event refused for that
+ * movement's STAGE rather than its form code passes the check too. Measured directly — adding a
+ * bogus `1A: HOLD_BED` entry left the guard green at 7 passed, because WF-001 sits at
+ * `placement_requested` and HOLD_BED requires `accepted_awaiting_bed`.
+ *
+ * So the single entry below is justified by READING the reducer, not by this check:
+ * `RECORD_EXAMINATION` opens with `if (movement.legalForm?.code !== "1A") return reject(...)`,
+ * which is a guard on the code itself. Any future entry needs the same treatment — quote the
+ * code-keyed guard that makes it impossible — and must not lean on the check alone.
+ */
+const STRUCTURALLY_IMPOSSIBLE_FOR_CODE: Record<string, { type: WardFlowEvent["type"]; reason: string }[]> = {
+  "3B": [
+    {
+      type: "RECORD_EXAMINATION",
+      // ward-flow-reducer.ts: `if (movement.legalForm?.code !== "1A") return reject(...)`. A 3B is
+      // what RECORD_EXAMINATION PRODUCES, so by construction it acts on a 1A and never on a 3B.
+      reason: "the reducer refuses RECORD_EXAMINATION unless the form is 1A; a 3B is its output",
+    },
+  ],
+};
+
+/** The movement an event acts on, or `undefined` for the unit- and scenario-scoped events. */
+function targetMovementId(event: WardFlowEvent): string | undefined {
+  return "movementId" in event ? event.movementId : undefined;
+}
+
+/**
+ * Applies the first candidate of this type that the reducer ACCEPTS, optionally restricted to
+ * candidates acting on a movement whose legal form carries `code`.
+ *
+ * Acceptance is measured by `state.rejections` not growing — the reducer records every refusal
+ * there, so this cannot mistake a silently-refused event for an applied one.
+ *
+ * The `code` restriction is the whole point of fix wave 3. Without it this took whichever
+ * movement the reducer happened to accept first — a fixture Form 3B — so a branch keyed on
+ * `movement.legalForm?.code === "1A"` was never entered, and a seven-day fabrication written
+ * there passed the entire suite.
+ */
+function applyFirstAccepted(
+  type: WardFlowEvent["type"],
+  state: WardFlowState,
+  now: number,
+  code?: string,
+): { applied: WardFlowState; event: WardFlowEvent } | undefined {
+  for (const event of candidateEvents(type, state, now)) {
+    if (code !== undefined && MOVEMENT_TARGETED_EVENTS.has(type)) {
+      const target = state.movements.find((movement) => movement.id === targetMovementId(event));
+      if (target?.legalForm?.code !== code) continue;
+    }
+    const next = wardFlowReducer(state, event);
+    if (next.rejections.length === state.rejections.length) return { applied: next, event };
+  }
+  return undefined;
+}
+
+/**
+ * Drives the reducer repeatedly against movements carrying `code`. Sweeping rather than following
+ * a hand-written script means the clinical pathway's ordering (HOLD_BED must precede
+ * HANDOVER_READY, which must precede TRANSPORT_ACCEPTED) is discovered rather than assumed, so a
+ * reordering of the pathway cannot silently drop a branch from coverage.
+ *
+ * Each round ROTATES the order the event types are tried in. A fixed order is itself an
+ * assumption, and a wrong one: with the role table's natural order, ACCEPT_IN_PRINCIPLE always
+ * ran before DECLINE and consumed the only live referral, so DECLINE was never once accepted
+ * against a Form 1A — the coverage assertion below caught that while this fix was being written.
+ * Rotating over at least as many rounds as there are event types tries every relative ordering.
+ */
+function driveEveryEventAgainst(
+  code: string,
+  rounds = ALL_EVENT_TYPES.length + 2,
+): {
+  accepted: Set<WardFlowEvent["type"]>;
+  offenders: string[];
+  finalState: WardFlowState;
+} {
+  let state = seedWardFlowState();
+  const accepted = new Set<WardFlowEvent["type"]>();
+  const offenders: string[] = [];
+
+  for (let round = 0; round < rounds; round += 1) {
+    const now = NOW_ANCHOR + round;
+    const pivot = round % ALL_EVENT_TYPES.length;
+    const order = [...ALL_EVENT_TYPES.slice(pivot), ...ALL_EVENT_TYPES.slice(0, pivot)];
+    for (const type of order) {
+      // RESET_SCENARIO would discard the movement the sweep is building; it is exercised on its
+      // own below, where the invariant is checked against the reset state directly.
+      if (type === "RESET_SCENARIO") continue;
+      const result = applyFirstAccepted(type, state, now, code);
+      if (!result) continue;
+      accepted.add(type);
+      state = result.applied;
+      offenders.push(...offendingFormsIn(state, `${code} / ${type}`));
+    }
+  }
+
+  return { accepted, offenders, finalState: state };
+}
+
+/**
+ * Every form in a state carrying a `dueAt` whose code is NOT on the deadline allowlist — of any
+ * code, invented or otherwise. This is the rule; the code list is not.
+ */
+function offendingFormsIn(state: WardFlowState, label: string): string[] {
+  return state.movements
+    .filter(
+      (movement) =>
+        movement.legalForm !== undefined &&
+        movement.legalForm.dueAt !== undefined &&
+        !(movement.legalForm.code in DEADLINE_BEARING_FORM_PROVENANCE),
+    )
+    .map(
+      (movement) => `${label}: ${movement.id} (Form ${movement.legalForm!.code}, dueAt ${movement.legalForm!.dueAt})`,
+    );
+}
+
+/** Every `LegalForm` reachable at runtime, tagged with where it came from. */
+function collectLegalForms(): { source: string; movementId: string; form: LegalForm }[] {
+  const collected: { source: string; movementId: string; form: LegalForm }[] = [];
+
+  for (const movement of wardMovements) {
+    if (movement.legalForm) collected.push({ source: "fixture", movementId: movement.id, form: movement.legalForm });
+  }
+
+  const seeded = seedWardFlowState();
+  for (const movement of seeded.movements) {
+    if (movement.legalForm)
+      collected.push({ source: "seeded state", movementId: movement.id, form: movement.legalForm });
+  }
+
+  // Every reducer path that authors a legal form: RAISE_REFERRAL builds the 1A, RECORD_EXAMINATION
+  // replaces it with the 3B. A fabricated constant would have to be applied in one of these.
+  const nonVoluntary: LegalStatus[] = ["Referred for psychiatric examination", "Detained awaiting examination"];
+  for (const legalStatus of nonVoluntary) {
+    const referred = wardFlowReducer(seeded, {
+      type: "RAISE_REFERRAL",
+      role: "ed",
+      now: NOW_ANCHOR,
+      edId: "jhc-ed",
+      draft: { cohort: "Adult", security: "Open", sex: "Female", specialling: false, legalStatus, urgency: 2 },
+    });
+    const raised = referred.movements.at(-1)!;
+    if (raised.legalForm) collected.push({ source: "RAISE_REFERRAL", movementId: raised.id, form: raised.legalForm });
+
+    const examined = wardFlowReducer(referred, {
+      type: "RECORD_EXAMINATION",
+      role: "ed",
+      now: NOW_ANCHOR + 1,
+      movementId: raised.id,
+      outcome: "inpatient_order",
+    });
+    const afterExamination = examined.movements.find((movement) => movement.id === raised.id);
+    if (afterExamination?.legalForm)
+      collected.push({ source: "RECORD_EXAMINATION", movementId: raised.id, form: afterExamination.legalForm });
+  }
+
+  return collected;
+}
+
+describe("Mental Health Act figures cannot return to the ward model", () => {
+  it("gives no Form 1A and no Form 3B a dueAt, in the fixture or from any reducer path", () => {
+    const collected = collectLegalForms();
+
+    // Non-vacuity, per source and per code: this test must fail if it ever inspects nothing,
+    // or if one of the four sources silently stopped producing a form. Asserting only a total
+    // would let a reducer path that returned `undefined` forever pass unnoticed.
+    expect(collected.length).toBeGreaterThan(0);
+    for (const source of ["fixture", "seeded state", "RAISE_REFERRAL", "RECORD_EXAMINATION"]) {
+      expect(
+        collected.filter((entry) => entry.source === source).length,
+        `no legal form was collected from ${source}`,
+      ).toBeGreaterThan(0);
+    }
+    for (const code of EXAMINATION_TIMELINE_CODES) {
+      expect(
+        collected.filter((entry) => entry.form.code === code).length,
+        `no Form ${code} was inspected — this guard would pass vacuously`,
+      ).toBeGreaterThan(0);
+    }
+
+    const offenders = collected
+      .filter((entry) => EXAMINATION_TIMELINE_CODES.has(entry.form.code) && entry.form.dueAt !== undefined)
+      .map((entry) => `${entry.source}:${entry.movementId} (Form ${entry.form.code}, dueAt ${entry.form.dueAt})`);
+    expect(offenders).toEqual([]);
+  });
+
+  /**
+   * Fix wave 3, finding 1 — the traversal, now driven PER FORM CODE.
+   *
+   * Wave 2's version applied whichever candidate the reducer accepted first. That was a fixture
+   * Form 3B, so a branch keyed on the other code was never entered, and this variant of the
+   * TRANSPORT_ACCEPTED bypass passed the whole suite at 227:
+   *
+   *     legalForm: movement.legalForm?.code === "1A"
+   *       ? { ...movement.legalForm, dueAt: event.now + 10080 }
+   *       : movement.legalForm,
+   *
+   * It is genuinely reachable — raise referral, refer, accept in principle, hold bed, handover
+   * ready, transport accepted puts a seven-day `dueAt` on a real Form 1A. So every event type is
+   * now driven against a movement carrying EACH code, and acceptance is asserted per code so the
+   * traversal cannot pass by quietly failing to reach one of them.
+   */
+  it("puts no dueAt on a form of any code, through any event, against a movement carrying each code", () => {
+    // Non-vacuity 1: the union is non-trivial and drawn from the role table, not hand-listed.
+    expect(ALL_EVENT_TYPES.length, "the event union looks empty").toBeGreaterThan(10);
+
+    const offenders: string[] = [];
+    const coverage = new Map<string, Set<WardFlowEvent["type"]>>();
+
+    for (const code of EXAMINATION_TIMELINE_CODES) {
+      const { accepted, offenders: found, finalState } = driveEveryEventAgainst(code);
+      coverage.set(code, accepted);
+      offenders.push(...found);
+
+      // Non-vacuity 2: the sweep really held a movement of this code to act on. Without this, a
+      // code that vanished from the model would make its whole pass silently vacuous.
+      const carrying = finalState.movements.filter((movement) => movement.legalForm?.code === code);
+      expect(carrying.length, `the sweep never held a Form ${code}`).toBeGreaterThan(0);
+    }
+
+    // Non-vacuity 3: every movement-targeted event type was ACCEPTED against a movement carrying
+    // each code. This is the assertion wave 2 lacked. Reported by name, never counted — and it is
+    // what proves the `code === "1A"` branch above is actually entered rather than merely
+    // believed to be reachable.
+    for (const [code, accepted] of coverage) {
+      const excluded = new Set((STRUCTURALLY_IMPOSSIBLE_FOR_CODE[code] ?? []).map((entry) => entry.type));
+      const missing = [...MOVEMENT_TARGETED_EVENTS].filter((type) => !accepted.has(type) && !excluded.has(type));
+      expect(missing, `never accepted against a Form ${code}`).toEqual([]);
+    }
+
+    // The exclusions above get a PARTIAL check, whose limit is documented at the declaration: for
+    // each entry, confirm the reducer refuses the event against a fixture movement carrying that
+    // code. This catches an entry the reducer plainly accepts. It does NOT prove structural
+    // impossibility — an event refused for that movement's stage passes too — so the entry itself
+    // must be justified by a code-keyed guard read out of the reducer.
+    const seededForExclusions = seedWardFlowState();
+    for (const [code, entries] of Object.entries(STRUCTURALLY_IMPOSSIBLE_FOR_CODE)) {
+      for (const entry of entries) {
+        const carrier = seededForExclusions.movements.find((movement) => movement.legalForm?.code === code);
+        expect(carrier, `no fixture movement carries a Form ${code} to test the exclusion against`).toBeDefined();
+        const refusedEvents = candidateEvents(entry.type, seededForExclusions, NOW_ANCHOR).filter(
+          (event) => targetMovementId(event) === carrier!.id,
+        );
+        expect(refusedEvents.length, `no ${entry.type} candidate targets ${carrier!.id}`).toBeGreaterThan(0);
+        for (const event of refusedEvents) {
+          const next = wardFlowReducer(seededForExclusions, event);
+          expect(
+            next.rejections.length,
+            `${entry.type} was NOT refused against Form ${code} — the exclusion is wrong: ${entry.reason}`,
+          ).toBeGreaterThan(seededForExclusions.rejections.length);
+        }
+      }
+    }
+
+    // The non-movement-scoped events (RAISE_REFERRAL, CONFIRM_CAPACITY, ADVANCE_CLOCK) are not
+    // code-targetable, but must still be exercised and must still leave the invariant intact.
+    for (const [code, accepted] of coverage) {
+      const unscoped = ALL_EVENT_TYPES.filter(
+        (type) => !MOVEMENT_TARGETED_EVENTS.has(type) && type !== "RESET_SCENARIO",
+      );
+      expect(
+        unscoped.filter((type) => !accepted.has(type)),
+        `unscoped events never accepted during the Form ${code} sweep`,
+      ).toEqual([]);
+    }
+
+    // RESET_SCENARIO on its own: it discards the sweep's movements, so it is exercised here and
+    // the invariant checked against the state it restores.
+    const reset = applyFirstAccepted("RESET_SCENARIO", seedWardFlowState(), NOW_ANCHOR);
+    expect(reset, "RESET_SCENARIO was never accepted").toBeDefined();
+    offenders.push(...offendingFormsIn(reset!.applied, "RESET_SCENARIO"));
+
+    expect(offenders).toEqual([]);
+  });
+
+  // Fix wave 3, finding 2 — the deadline allowlist is a real gate in both directions, and it is
+  // what makes the traversal above code-agnostic. Without these, `offendingFormsIn` could be
+  // silently inert (allowlisting everything) or absurd (allowlisting nothing).
+  it("permits a dueAt only on a form code with recorded provenance", () => {
+    // The two allowlisted codes are permitted; the examination-timeline codes are not; and a code
+    // nobody has invented yet is not — which is the case the old two-code rule could not make.
+    for (const code of ["4A", "4C"]) {
+      expect(code in DEADLINE_BEARING_FORM_PROVENANCE, `Form ${code} should be permitted`).toBe(true);
+    }
+    for (const code of ["1A", "3B", "2B", "6A", "MHA-99", ""]) {
+      expect(code in DEADLINE_BEARING_FORM_PROVENANCE, `Form ${code} must not be permitted`).toBe(false);
+    }
+
+    // Every entry records WHY, so a code cannot be admitted as a bare key.
+    for (const [code, provenance] of Object.entries(DEADLINE_BEARING_FORM_PROVENANCE)) {
+      expect(provenance.length, `Form ${code}'s provenance line is too short to be a real record`).toBeGreaterThan(20);
+    }
+
+    // `offendingFormsIn` actually applies the allowlist, in both directions — proven against a
+    // synthetic state rather than trusted. The 4A passes; the invented code does not.
+    const seeded = seedWardFlowState();
+    const withForms: WardFlowState = {
+      ...seeded,
+      movements: [
+        {
+          ...seeded.movements[0],
+          id: "PROBE-4A",
+          legalForm: { code: "4A", label: "Transport order", kind: "transport", dueAt: NOW_ANCHOR - 10 },
+        },
+        {
+          ...seeded.movements[0],
+          id: "PROBE-9Z",
+          legalForm: { code: "9Z", label: "Invented form", kind: "transport", dueAt: NOW_ANCHOR - 10 },
+        },
+      ],
+    };
+    const flagged = offendingFormsIn(withForms, "probe");
+    expect(flagged).toHaveLength(1);
+    expect(flagged[0]).toContain("PROBE-9Z");
+  });
+
+  it("records provenance for every exported declaration in ward-model.ts that writes a number down", () => {
+    const modelPath = `${WARD_DIR}/ward-model.ts`;
+    const allExported = exportedNamesInFile(modelPath);
+    const numericExported = exportedNamesInFile(modelPath, true);
+
+    // Non-vacuity 1: the AST really read the file, and really distinguishes declarations that
+    // write a number from those that do not. `MOVEMENT_STAGES` and `DECLINE_REASONS` are exported
+    // string arrays and must be excluded; the two numeric constants must be included. If the
+    // containment rule ever matched nothing, the offender list below would be empty for the wrong
+    // reason, and these assertions are what catch that.
+    expect(allExported, "exportedNamesInFile read nothing from ward-model.ts").toContain("MOVEMENT_STAGES");
+    expect(numericExported, "MOVEMENT_STAGES is an array of strings").not.toContain("MOVEMENT_STAGES");
+    expect(numericExported, "DECLINE_REASONS is an array of strings").not.toContain("DECLINE_REASONS");
+    expect(numericExported).toContain("ED_ACCESS_TARGET_MINUTES");
+    expect(numericExported).toContain("PARALLEL_REFERRAL_CAP");
+
+    /** Names the rule would demand provenance for, in a snippet of source. */
+    const flaggedIn = (source: string): string[] =>
+      exportedDeclarationNames(ts.createSourceFile("probe.ts", source, ts.ScriptTarget.Latest, true), true);
+
+    // Non-vacuity 2: every shape that has defeated a previous version of this rule is caught.
+    // The first five defeated the NAME-based rules; the last three defeated the "initializer IS a
+    // number" rule by merely CONTAINING one. All eight are real reviewer bypasses, not inventions.
+    for (const [label, snippet] of [
+      ["denylist bypass: expiry-minutes", "export const FORM_1A_REFERRAL_EXPIRY_MINUTES = 7 * 24 * 60;"],
+      ["denylist bypass: assessment window", "export const ASSESSMENT_WINDOW_MINUTES = 24 * 60;"],
+      ["denylist bypass: involuntary order", "export const INVOLUNTARY_ORDER_HOURS = 72;"],
+      ["denylist bypass: section review", "export const SECTION_REVIEW_DAYS = 7;"],
+      ["name-rule bypass: no unit token", "export const FORM_1A_REFERRAL_CLOCK = 7 * 24 * 60;"],
+      ["shape bypass: object", "export const REFERRAL_CLOCK_SPEC = { minutes: 7 * 24 * 60 };"],
+      ["shape bypass: arrow function", "export const referralClockMinutes = (): number => 7 * 24 * 60;"],
+      ["shape bypass: enum", "export enum ReferralClock { Window = 10080 }"],
+    ] as const) {
+      expect(flaggedIn(snippet), `${label} would not be flagged`).toHaveLength(1);
+    }
+
+    // Non-vacuity 3: the rule is not simply "flag every export". A declaration that writes no
+    // number down is not flagged, in each of the same shapes — otherwise the rule would be
+    // useless noise and would be disabled on its first false positive.
+    expect(flaggedIn('export const DECLINE_REASONS = ["no_bed"] as const;')).toEqual([]);
+    expect(flaggedIn('export const SHAPE = { label: "text" };')).toEqual([]);
+    expect(flaggedIn("export const describeForm = (code: string): string => `Form ${code}`;")).toEqual([]);
+    expect(flaggedIn('export enum Kind { Examination = "examination" }')).toEqual([]);
+    // A non-exported declaration is out of scope, and the limits section says so.
+    expect(flaggedIn("const PRIVATE_CLOCK = 7 * 24 * 60;")).toEqual([]);
+
+    // Every allowlist entry carries a non-trivial provenance line, so an entry cannot be added as
+    // a bare name to silence the guard.
+    for (const [name, provenance] of Object.entries(MODEL_CONSTANT_PROVENANCE)) {
+      expect(provenance.length, `${name}'s provenance line is too short to be a real record`).toBeGreaterThan(20);
+    }
+
+    // The allowlist must not rot: an entry for a declaration that no longer exists is dead weight
+    // that would silently re-admit the name later.
+    for (const name of Object.keys(MODEL_CONSTANT_PROVENANCE)) {
+      expect(numericExported, `${name} is allowlisted but no longer writes a number down`).toContain(name);
+    }
+
+    const offenders = numericExported.filter((name) => !(name in MODEL_CONSTANT_PROVENANCE));
+    expect(offenders).toEqual([]);
+  });
+
+  // Fix wave 1, finding 5. Part 1 exercises the reducer's two legal-form authoring sites by
+  // dispatching RAISE_REFERRAL and RECORD_EXAMINATION. That is complete only while those remain
+  // the ONLY two sites — a third branch stamping a `dueAt` would be invisible to Part 1, which
+  // would then still pass while claiming to cover "every LegalForm the reducer produces". Pin the
+  // set, so growing a new authoring site fails here until Part 1 is taught to exercise it.
+  it("pins the reducer's legal-form authoring sites, so Part 1 cannot silently miss a new one", () => {
+    const reducerPath = `${WARD_DIR}/ward-flow-reducer.ts`;
+    const source = ts.createSourceFile(
+      reducerPath,
+      readFileSync(reducerPath, "utf8"),
+      ts.ScriptTarget.Latest,
+      true,
+      ts.ScriptKind.TS,
+    );
+
+    // An authored legal form is an object literal carrying a `code:` string. Read from the AST,
+    // so a `code` mentioned in a comment or a string cannot inflate or hide the count.
+    const authoredCodes: string[] = [];
+    const visit = (node: ts.Node): void => {
+      if (ts.isObjectLiteralExpression(node)) {
+        for (const property of node.properties) {
+          if (
+            ts.isPropertyAssignment(property) &&
+            ts.isIdentifier(property.name) &&
+            property.name.text === "code" &&
+            ts.isStringLiteral(property.initializer)
+          ) {
+            authoredCodes.push(property.initializer.text);
+          }
+        }
+      }
+      ts.forEachChild(node, visit);
+    };
+    visit(source);
+
+    // Non-vacuity: the walk really found the literals rather than returning an empty list.
+    expect(authoredCodes.length, "no legal-form literal was found in the reducer").toBeGreaterThan(0);
+
+    // Exactly these two, in source order. A third authoring site — of any code — fails, and so
+    // does deleting one, which would mean Part 1 is dispatching at a site that no longer exists.
+    expect(authoredCodes).toEqual(["1A", "3B"]);
+  });
+
+  /**
+   * Fix wave 1, findings 6 and 7 — the rendered legal wording.
+   *
+   * Both renderers are `"use client"` components whose helpers are not exported, so a unit test
+   * cannot call them; the only behavioural coverage is Playwright, which this task may not run.
+   * This reads the STRING LITERALS from the AST instead — which is strictly better than a text
+   * search for this job, because comments are not string literals, so the paragraphs in those two
+   * files that *discuss* the rejected wording cannot satisfy or trip the check.
+   *
+   * WHAT THIS CANNOT SEE: it proves the literal exists in the module, not that any code path
+   * reaches it or that a user sees it. It would not catch the branch being made unreachable. That
+   * is a real limit and Playwright remains the only thing that closes it.
+   */
+  it("renders absence as 'no deadline recorded', never as a claim about the Act", () => {
+    const renderers = [`${WARD_DIR}/ward-management-console.tsx`, `${WARD_DIR}/coordinator/shortlist-panel.tsx`];
+
+    const literalsIn = (path: string): string[] => {
+      const source = ts.createSourceFile(
+        path,
+        readFileSync(path, "utf8"),
+        ts.ScriptTarget.Latest,
+        true,
+        ts.ScriptKind.TSX,
+      );
+      const literals: string[] = [];
+      const visit = (node: ts.Node): void => {
+        if (
+          ts.isStringLiteral(node) ||
+          ts.isNoSubstitutionTemplateLiteral(node) ||
+          ts.isTemplateHead(node) ||
+          ts.isTemplateMiddle(node) ||
+          ts.isTemplateTail(node)
+        ) {
+          literals.push(node.text);
+        }
+        ts.forEachChild(node, visit);
+      };
+      visit(source);
+      return literals;
+    };
+
+    for (const path of renderers) {
+      const literals = literalsIn(path);
+
+      // Non-vacuity: the parse really produced literals for this file.
+      expect(literals.length, `no string literal was read from ${path}`).toBeGreaterThan(0);
+
+      // The wording states what the record holds, not what the legislation requires. Asserting an
+      // absence in the Act is the same overreach as asserting the deleted seven-day figure.
+      expect(
+        literals.some((literal) => literal.includes("no deadline recorded")),
+        `${path} no longer renders "no deadline recorded"`,
+      ).toBe(true);
+      expect(
+        literals.filter((literal) => literal.includes("no statutory deadline")),
+        `${path} renders a claim about what the Mental Health Act requires`,
+      ).toEqual([]);
+    }
+
+    // Finding 7: the breach line must still exist in the shortlist renderer. Before this, the only
+    // test mentioning the string was a whole-page ABSENCE assertion, which deleting the string
+    // makes MORE likely to pass. (Its counterpart in ward-priority.ts is pinned behaviourally in
+    // tests/ward-priority.test.ts, which is the stronger proof of the two.)
+    expect(
+      literalsIn(`${WARD_DIR}/coordinator/shortlist-panel.tsx`).some((literal) =>
+        literal.includes("passed its deadline"),
+      ),
+      "the shortlist breach line was deleted or renamed",
+    ).toBe(true);
+  });
+
+  // PART 3 — the wider but INCOMPLETE token denylist. Green here proves nothing on its own; see
+  // the file header's bypass table. Part 2 above is the fail-closed check.
+  it("trips the wider token denylist on no identifier under the ward directory (incomplete net)", () => {
+    const files = scanWardFiles();
+
+    // Non-vacuity 1 — the walk is recursive and really reached the subdirectories. Naming the
+    // files rather than counting them is what stops a walk that silently stopped at the top
+    // level from passing: a guard that "walked only one directory" is a defect this repository
+    // has already shipped once.
+    const scannedPaths = files.map((file) => file.path.replaceAll("\\", "/"));
+    for (const expected of [
+      `${WARD_DIR}/ward-model.ts`,
+      `${WARD_DIR}/ward-movements.ts`,
+      `${WARD_DIR}/ward-flow-reducer.ts`,
+      `${WARD_DIR}/coordinator/priority-queue.tsx`,
+      `${WARD_DIR}/coordinator/shortlist-panel.tsx`,
+      `${WARD_DIR}/ed/ed-screen.tsx`,
+      `${WARD_DIR}/officer/officer-screen.tsx`,
+      `${WARD_DIR}/tracker/live-tracker.tsx`,
+      `${WARD_DIR}/ward/ward-screen.tsx`,
+    ]) {
+      expect(scannedPaths, `${expected} was never scanned`).toContain(expected);
+    }
+
+    // Non-vacuity 2 — parsing actually produced identifiers. If `ts.createSourceFile` ever
+    // returned an empty tree (a changed API, a parse failure swallowed, a wrong ScriptKind),
+    // every rule below would pass on nothing. These two sentinels are real constants in this
+    // directory, so their absence means the scan itself is broken, not that the code is clean.
+    const allIdentifiers = new Set(files.flatMap((file) => file.identifiers));
+    expect(allIdentifiers, "the AST scan produced no identifiers").toContain("ED_ACCESS_TARGET_MINUTES");
+    expect(allIdentifiers, "the AST scan produced no identifiers").toContain("PARALLEL_REFERRAL_CAP");
+
+    // Non-vacuity 3 — the predicates themselves discriminate. A rule that can never match is
+    // the "check that cannot fail" shape; a rule that matches everything would be disabled on
+    // its first false positive. Both directions are pinned here against real names.
+    expect(namesALegalDuration("FORM_1A_REFERRAL_EXPIRY_MINUTES")).toBe(true);
+    expect(namesALegalDuration("FORM_1A_SOMETHING_MINUTES")).toBe(true);
+    expect(namesALegalDuration("STATUTORY_EXAMINATION_WINDOW_HOURS")).toBe(true);
+    expect(namesALegalDuration("ED_ACCESS_TARGET_MINUTES")).toBe(false);
+    expect(namesALegalDuration("PARALLEL_REFERRAL_CAP")).toBe(false);
+    expect(namesALegalDuration("MINUTES_PER_DAY")).toBe(false);
+    // Tokenisation is word-level, not substring: FORM inside FORMATTED must not match.
+    expect(namesALegalDuration("formattedMinutes")).toBe(false);
+    // The header calls this net INCOMPLETE. That is not a hedge, it is a measured fact, and this
+    // is the assertion that keeps it honest: `FORM_1A_REFERRAL_CLOCK` names a form and a clock,
+    // carried the deleted fabrication's exact value, and this predicate does not flag it. Part 2
+    // is what catches it — in `ward-model.ts`, which is where it was declared. If someone ever
+    // "fixes" this by adding CLOCK to the token list, this assertion fails and the header's claim
+    // must be re-measured rather than quietly outgrown.
+    expect(namesALegalDuration("FORM_1A_REFERRAL_CLOCK")).toBe(false);
+    // The constant-name filter is what excludes the honest camelCase readers of the 4A/4C
+    // deadlines; if it ever started matching them the guard would be disabled on its first
+    // false positive, and if it stopped matching real constants the guard would be inert.
+    expect(isConstantName("FORM_1A_REFERRAL_EXPIRY_MINUTES")).toBe(true);
+    expect(isConstantName("ED_ACCESS_TARGET_MINUTES")).toBe(true);
+    expect(isConstantName("legalDueAt")).toBe(false);
+    expect(isConstantName("minutesLegalClock")).toBe(false);
+    expect(namesABannedModelShape("SOME_EXPIRY_MINUTES")).toBe(true);
+    expect(namesABannedModelShape("A_DEADLINE_B")).toBe(true);
+    expect(namesABannedModelShape("ED_ACCESS_TARGET_MINUTES")).toBe(false);
+
+    const offenders = files.flatMap((file) =>
+      [...new Set(file.identifiers)]
+        .filter(isConstantName)
+        .filter(
+          (identifier) =>
+            namesALegalDuration(identifier) ||
+            (file.path.replaceAll("\\", "/") === `${WARD_DIR}/ward-model.ts` && namesABannedModelShape(identifier)),
+        )
+        .map((identifier) => `${file.path.replaceAll("\\", "/")}: ${identifier}`),
+    );
+    expect(offenders).toEqual([]);
+  });
+});
diff --git a/tests/ward-model-phase3.test.ts b/tests/ward-model-phase3.test.ts
index 669224b8f3..c224783cb5 100644
--- a/tests/ward-model-phase3.test.ts
+++ b/tests/ward-model-phase3.test.ts
@@ -92,13 +92,21 @@ describe("Phase 3 model additions", () => {
     }
   });
 
-  it("never gives a Form 3B a dueAt, and never omits one from a Form 1A", () => {
-    // Task 6A: the Mental Health Act imposes no post-examination deadline (clinician-confirmed —
-    // the post-examination clock is elapsed ED wait, counting up, never a legal countdown), so a
-    // 3B must carry no dueAt at all — not a wrong one, none. A 1A still carries a real statutory
-    // examination window and must always have one. Both sides are accumulated so this cannot
-    // pass vacuously if the fixture ever stopped carrying one kind or the other — a vacuous guard
-    // shape has already cost this phase two fix rounds (see the deleted test this replaces).
+  // Renamed and inverted 2026-08-23. Task 6A first established that a Form 3B carries no
+  // `dueAt`: put to the clinician directly, he settled that the post-examination clock "is just
+  // counting how long they have been in ED determining priority. So counting up," so no
+  // post-examination deadline is recorded for a 3B. That was established while
+  // this fixture still gave a Form 1A one. That 1A `dueAt` was never a real statutory figure —
+  // it was an unverified number an earlier agent wrote into ward-model.ts from its own
+  // recollection of the Act, not from the clinician or product owner. Put to the product owner
+  // directly on 2026-08-23, the instruction was narrower than a corrected figure: drop the
+  // legal countdown from this model entirely rather than get its number right ("please can you
+  // leave the legal part and just start a clock once the patient arrives to ED. Keep it simple
+  // for now"). So a 1A now carries no `dueAt` either — the same absence a 3B has always carried.
+  // Both codes are accumulated so this cannot pass vacuously if the fixture ever stopped
+  // carrying one kind or the other — a vacuous guard shape has already cost this phase two fix
+  // rounds (see the deleted test this replaces).
+  it("never gives any legal form — 1A or 3B — a dueAt", () => {
     const form3B: string[] = [];
     const form1A: string[] = [];
     for (const movement of wardMovements) {
@@ -108,11 +116,8 @@ describe("Phase 3 model additions", () => {
     expect(form3B.length).toBeGreaterThan(0);
     expect(form1A.length).toBeGreaterThan(0);
     for (const movement of wardMovements) {
-      if (movement.legalForm?.code === "3B") {
-        expect(movement.legalForm.dueAt).toBeUndefined();
-      }
-      if (movement.legalForm?.code === "1A") {
-        expect(movement.legalForm.dueAt).toBeDefined();
+      if (movement.legalForm?.code === "3B" || movement.legalForm?.code === "1A") {
+        expect(movement.legalForm.dueAt, `${movement.id} (${movement.legalForm.code}) carries a dueAt`).toBeUndefined();
       }
     }
   });
diff --git a/tests/ward-model.test.ts b/tests/ward-model.test.ts
index 46e96d849d..8ceb4101ca 100644
--- a/tests/ward-model.test.ts
+++ b/tests/ward-model.test.ts
@@ -38,9 +38,9 @@ describe("ward model constants", () => {
   });
 
   it("pins the ED access target as a departmental performance measure, not a legal clock", () => {
-    // Task 6A: the Mental Health Act imposes no post-examination deadline — the clinician
-    // confirmed the post-examination clock is elapsed ED wait, counting up, not a legal
-    // countdown. This constant is the real, separately named figure from spec §7 (originally the
+    // Task 6A: the clinician settled that the post-examination clock is elapsed ED wait,
+    // counting up, not a countdown, so no post-examination deadline is recorded against a legal
+    // form. This constant is the real, separately named figure from spec §7 (originally the
     // four-hour access target departments are judged on; the product owner superseded that
     // figure to 24 hours on 2026-08-22 — see the constant's own doc comment); Task 11's ED
     // screen renders it against `openedAt`. Pinned here so a later task cannot silently redefine
@@ -100,8 +100,6 @@ describe("ward sites", () => {
   });
 });
 
-const NOW_ANCHOR = 10 * 60 + 42;
-
 describe("ward movements", () => {
   it("runs at realistic pressure, not comfortable pressure", () => {
     expect(wardMovements.length).toBeGreaterThanOrEqual(40);
@@ -141,7 +139,11 @@ describe("ward movements", () => {
     }
   });
 
-  it("gives every non-voluntary movement a legal form with a deadline", () => {
+  // Renamed 2026-08-23: this used to assert "with a deadline" in its title, but neither a Form
+  // 1A nor a Form 3B carries a `dueAt` any longer (see `LegalForm`'s own doc comment in
+  // ward-model.ts) — the body below never checked `dueAt` at all, only that the form itself is
+  // present, so the assertion is unchanged and still real.
+  it("gives every non-voluntary movement a legal form", () => {
     for (const movement of wardMovements) {
       if (!requiresAuthorisedDestination(movement.legalStatus)) continue;
       expect(movement.legalForm, `${movement.id} has no legal form`).toBeDefined();
@@ -153,7 +155,10 @@ describe("ward movements", () => {
     expect(wardMovements.some((movement) => movement.declines.length >= 3)).toBe(true);
     expect(wardMovements.some((movement) => movement.statusChanges.length > 0)).toBe(true);
     expect(wardMovements.some((movement) => movement.closure?.outcome === "did_not_proceed")).toBe(true);
-    expect(wardMovements.some((movement) => (movement.legalForm?.dueAt ?? Infinity) < NOW_ANCHOR)).toBe(true);
+    // A fifth expectation here used to require a legal form with a `dueAt` in the past — removed
+    // 2026-08-23, along with `NOW_ANCHOR`'s only use in this file, because no `LegalForm` in this
+    // model carries a `dueAt` any longer (see `LegalForm`'s own doc comment in ward-model.ts):
+    // that state is no longer one this fixture is meant to express.
   });
 
   it("never records a decline against a unit that is also a live referral", () => {
diff --git a/tests/ward-pressure.test.ts b/tests/ward-pressure.test.ts
index e5bc79ff1d..ac152eed9e 100644
--- a/tests/ward-pressure.test.ts
+++ b/tests/ward-pressure.test.ts
@@ -44,6 +44,12 @@ describe("emergency department pressure", () => {
     }
   });
 
+  // Fix wave 1, finding 2. This test derives its expectation from the real fixture, where the
+  // count is now zero for every row — so on its own it can no longer fail: hard-wiring
+  // `breaching: 0` in ward-pressure.ts passes it, and passes the two zero-expecting breach tests
+  // below as well. It is kept because "the row agrees with the fixture" is still worth pinning,
+  // but the positive proof it used to carry has been restored as its own test underneath, using
+  // an injected movement rather than fixture data.
   it("counts a breach only where a legal deadline has actually passed", () => {
     for (const row of edPressure(NOW_ANCHOR)) {
       const breaching = wardMovements.filter(
@@ -57,6 +63,38 @@ describe("emergency department pressure", () => {
     }
   });
 
+  /**
+   * Fix wave 1, finding 2 — the restored positive proof that `breaching` can ever be non-zero.
+   *
+   * `edPressure(now, movements)` takes an explicit array, so this injects its own movement rather
+   * than depending on the fixture: after the 2026-08-23 correction no fixture movement carries a
+   * past-due deadline, and a suite in which every breach expectation is zero cannot distinguish a
+   * working counter from `breaching: 0`.
+   *
+   * The carrier is a Form **4A** ("Transport order"), which is about moving a person and is
+   * unrelated to the examination timeline this project's fabrications were about. `- 45` is
+   * arbitrary test scaffolding chosen to sit in the past; it is NOT a Mental Health Act figure
+   * and nothing derives it from one.
+   */
+  it("counts a movement whose deadline has passed — the counter is not hard-wired to zero", () => {
+    const breachedMovement = movementFrom({
+      id: "TEST-past-due-transport",
+      originEdId: "sjgm-ed",
+      legalForm: { code: "4A", label: "Transport order", kind: "transport", dueAt: NOW_ANCHOR - 45 },
+    });
+    const rows = edPressure(NOW_ANCHOR, [breachedMovement]);
+
+    const row = rows.find((candidate) => candidate.ed.id === "sjgm-ed");
+    expect(row, "sjgm-ed must be reported").toBeDefined();
+    expect(row?.breaching).toBe(1);
+
+    // Every other department must read zero from the same call, so a counter that returned a
+    // constant 1, or counted movements regardless of department, fails here too.
+    const others = rows.filter((candidate) => candidate.ed.id !== "sjgm-ed");
+    expect(others.length, "the fixture must contain more than one department").toBeGreaterThan(0);
+    expect(others.map((candidate) => candidate.breaching)).toEqual(others.map(() => 0));
+  });
+
   it("sorts worst first — breaching, then longest wait, then volume", () => {
     // RULING 1: the brief's original assertion compared two arrays with `>=`, which coerces
     // both sides to strings and compares character-by-character. That reads "2,767,7" against
@@ -145,7 +183,7 @@ describe("emergency department pressure", () => {
       movementFrom({
         id: "TEST-due-now",
         originEdId: "sjgm-ed",
-        legalForm: { code: "1A", label: "Referral for examination", kind: "examination", dueAt: NOW_ANCHOR },
+        legalForm: { code: "4A", label: "Transport order", kind: "transport", dueAt: NOW_ANCHOR },
       }),
     ];
     const rows = edPressure(NOW_ANCHOR, movements);
@@ -153,9 +191,10 @@ describe("emergency department pressure", () => {
     expect(row?.breaching).toBe(0);
   });
 
-  // Task 6A: a Form 3B honestly carries no dueAt at all (the Mental Health Act imposes no
-  // post-examination deadline) — a form in that state must never reach `clockState`'s
-  // arithmetic and must never be counted as breaching, however long the patient has waited.
+  // Task 6A: a Form 3B carries no dueAt at all — the clinician settled that the
+  // post-examination clock counts up, so none is recorded. A form in that state must never reach
+  // `clockState`'s arithmetic and must never be counted as breaching, however long the patient
+  // has waited.
   it("never counts a legal form with no dueAt as breaching, however old the movement", () => {
     const movements: Movement[] = [
       movementFrom({
diff --git a/tests/ward-priority.test.ts b/tests/ward-priority.test.ts
index c148f0559d..ecd30f7481 100644
--- a/tests/ward-priority.test.ts
+++ b/tests/ward-priority.test.ts
@@ -27,17 +27,66 @@ describe("operational score", () => {
     expect(operationalScore(waitedLonger, NOW_ANCHOR).score).toBeGreaterThan(operationalScore(base, NOW_ANCHOR).score);
   });
 
+  // Relabelled from Form 1A to Form 4A on 2026-08-23 (fix wave 1, finding 8). These two
+  // movements are test scaffolding, not fixture data: they exist to prove the breach-scoring
+  // path works at all, and since the product-owner correction no Form 1A or 3B carries a `dueAt`,
+  // labelling them 1A contradicted the model's own doc comment and invited a future author to
+  // copy the shape. A Form 4A ("Transport order") is the honest carrier — it is about moving a
+  // person, not about the examination timeline, and it legitimately carries a `dueAt` in this
+  // model. The -30 and +400 offsets below are arbitrary test scaffolding chosen to sit either
+  // side of `NOW_ANCHOR`; they are NOT Mental Health Act figures and nothing derives them from
+  // one. After this correction these two movements are the only positive proof left that the
+  // breach-scoring path scores at all, which is why they are relabelled rather than deleted.
   it("scores a breached legal deadline above a clear one", () => {
     const base = movementById("WF-001");
     const breached: Movement = {
       ...base,
-      legalForm: { code: "1A", label: "Referral for examination", kind: "examination", dueAt: NOW_ANCHOR - 30 },
+      legalForm: { code: "4A", label: "Transport order", kind: "transport", dueAt: NOW_ANCHOR - 30 },
     };
     const clear: Movement = {
       ...base,
-      legalForm: { code: "1A", label: "Referral for examination", kind: "examination", dueAt: NOW_ANCHOR + 400 },
+      legalForm: { code: "4A", label: "Transport order", kind: "transport", dueAt: NOW_ANCHOR + 400 },
     };
     expect(operationalScore(breached, NOW_ANCHOR).score).toBeGreaterThan(operationalScore(clear, NOW_ANCHOR).score);
+
+    // Fix wave 1, finding 7: before this, `"passed its deadline"` (ward-priority.ts) was pinned
+    // by no unit test at all — deleting or renaming it would have gone undetected, because the
+    // only test that mentioned the string was the new whole-page ABSENCE assertion in Playwright,
+    // which a deletion makes *more* likely to pass. Assert the rendered factor positively here.
+    const breachFactor = operationalScore(breached, NOW_ANCHOR).factors.find(
+      (factor) => factor.label === "Statutory timing",
+    );
+    expect(breachFactor, "a past-due form must produce a Statutory timing factor").toBeDefined();
+    expect(breachFactor?.detail).toBe("Form 4A passed its deadline 30 min ago");
+    // Fix wave 2, finding 6. Closing the gap disclosed in fix wave 1: the comparison above is an
+    // ORDERING claim against a form scoring zero, so any positive value satisfied it and dropping
+    // the breached tier from 30 to 10 survived as a mutation. `Bed need confirmed` already pins
+    // its 25; this pins the statutory tiers. No clinical or statutory figure is involved — these
+    // are the model's own operational priority weights.
+    expect(breachFactor?.points).toBe(30);
+
+    // A +400 deadline is "clear" under `clockState` (>= 180 min remaining), which scores zero
+    // points and so pushes no factor at all. Pinning that explicitly is the honest assertion —
+    // and it is what makes the comparison above meaningful rather than a comparison of two
+    // scored states.
+    const clearFactor = operationalScore(clear, NOW_ANCHOR).factors.find(
+      (factor) => factor.label === "Statutory timing",
+    );
+    expect(clearFactor, "a deadline still 400 min away must score no Statutory timing points").toBeUndefined();
+
+    // The forward-counting branch of the same line. 90 min remaining is "due" under `clockState`
+    // (remaining < 180 is "due"; < 60 is "critical"; < 0 is "breached"), which scores 10 points
+    // and therefore renders. 90 is arbitrary test scaffolding on a transport order, not a legal
+    // figure.
+    const approaching: Movement = {
+      ...base,
+      legalForm: { code: "4A", label: "Transport order", kind: "transport", dueAt: NOW_ANCHOR + 90 },
+    };
+    const approachingFactor = operationalScore(approaching, NOW_ANCHOR).factors.find(
+      (factor) => factor.label === "Statutory timing",
+    );
+    expect(approachingFactor?.detail).toBe("Form 4A due in 90 min");
+    expect(approachingFactor?.points).toBe(10);
   });
 
   it("awards Bed need confirmed points when an examination outcome is recorded as inpatient_order", () => {
@@ -76,8 +125,8 @@ describe("operational score", () => {
   });
 
   it("awards no Statutory timing points to a legal form with no dueAt", () => {
-    // Task 6A: a Form 3B honestly carries no dueAt (the Mental Health Act imposes no
-    // post-examination deadline). This must never score as breached, critical or due — the
+    // Task 6A: a Form 3B carries no dueAt — the clinician settled that the post-examination
+    // clock counts up, so none is recorded. This must never score as breached, critical or due — the
     // patient's priority rides on "Time waiting" alone, which is precisely the clinician's rule,
     // and this must never gain a compensating bonus for being detained instead.
     const base = movementById("WF-003");