chore(rules): correct three stale architecture invariants CodeRabbit reads on every PR

`.coderabbit.yaml`'s `**/*` block is applied to every file in every PR, and it
is live — PRs #197/#199/#200 all report `Configuration used: Path:
.coderabbit.yaml`. Three of its seven architecture invariants were wrong:

- "Schema lives in server/db.ts only" — db.ts has held no table since
  c1780d8 (2026-05-24). It is 23 lines: pool, drizzle instance, re-export.
  Tables live in server/schema/*.ts via the vtTable alias. The instruction was
  not merely stale, it pointed the reviewer at the wrong file for three months
  and survived an edit to this same file two months into that window.
- "Medication volume must stay strictly below 100 ml" — enforced nowhere.
- "Billing ledger inserts require deterministic idempotency keys" — the ledger
  was removed (shadow-inventory.service.ts:2).

The realtime invariant was correct but had no carve-out for the sanctioned
/collab-ws channel, so a correct change under server/lib/realtime-collab/ would
have read as a violation. Added.

.cursorrules said the right thing on lines 30 and 110 and the wrong thing on
line 15 and in the heading at 151. A reader going top-down met the wrong one
first. Aligned.

No drift gate added: the obvious one (assert named paths exist) would not have
caught this, since server/db.ts exists and merely stopped holding what was
claimed. Reasoning recorded in the audit log.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: exposwifty31

.coderabbit.yaml

@@ -48,12 +48,11 @@ reviews:
         - Caching emergency or realtime endpoints in the service worker
 
         Architecture invariants (see .cursorrules, CLAUDE.md, AGENTS.md):
-        - Schema lives in server/db.ts only; new workers register in server/app/start-schedulers.ts
+        - Drizzle table and enum definitions live in server/schema/*.ts, declared via the `vtTable` alias, and are re-exported from server/db.ts. server/db.ts itself holds only the pool, the drizzle instance and that re-export — it defines no tables. Never ask for a table definition to be moved or added there.
+        - New workers and recurring schedulers register in server/app/start-schedulers.ts
         - API client traffic goes through src/lib/api.ts; no raw fetch() in feature code
         - i18n user-facing copy only in locales/en.json and locales/he.json (paired keys)
-        - Medication volume must stay strictly below 100 ml for liquids
-        - Billing ledger inserts require deterministic idempotency keys
-        - Realtime uses SSE + vt_event_outbox; do not introduce parallel polling transports
+        - Realtime domain state uses SSE + vt_event_outbox; do not introduce parallel polling transports. The Socket.io channel on /collab-ws is a sanctioned exception carrying ephemeral collaboration state only (presence, cursors, typing, nudges) and must never carry domain or emergency state.
 
     - path: "src/**/*.tsx"
       instructions: |

.cursorrules

@@ -12,7 +12,7 @@ These rules govern all AI-assisted work on this repository. They extend the focu
 - Never satisfy tenancy by joining alone if the target row’s table is not also filtered by `clinicId`.
 - **Never** hardcode `dev-clinic-default` in production-only code paths; it is the dev-bypass default clinic on `AuthUser` in `server/middleware/auth.ts` (`DEV_USER`) and `ensureDevUserRecord`.
 - Cross-clinic access is a **defect**, not a style issue.
-- New `pgTable` definitions in `server/db.ts` must include tenant scope: `clinicId` is **not null** and references `clinics` where the rest of the schema does; place it **immediately after the primary key** for new tables unless an existing table family uses a different column order (match neighbors).
+- New table definitions in `server/schema/*.ts` (declared via the `vtTable` alias) must include tenant scope: `clinicId` is **not null** and references `clinics` where the rest of the schema does; place it **immediately after the primary key** for new tables unless an existing table family uses a different column order (match neighbors).
 
 ## Auth
 
@@ -148,7 +148,7 @@ These rules govern all AI-assisted work on this repository. They extend the focu
 
 - Exported functions must be called from at least one route, worker, scheduler, or other service. Subset-only imports: remove unused named exports.
 
-## Schema (`server/db.ts`)
+## Schema (`server/schema/*.ts`, re-exported from `server/db.ts`)
 
 - New columns need at least one **query** in the same PR (select/insert/update/where). Before dropping a column, check **`migrations/`**, **`src/lib/offline-db.ts`**, and **`server/integrations/`**.
 

docs/audit/PROOF_ALIGNMENT_LOG.md

@@ -8600,3 +8600,58 @@ entry does not close and does not claim to.
 **Verdict:** VERIFIED — every item above was observed this session by direct `gh api` output, not
 restated from a commit message or a prior entry. The one non-observable item, the absence of a
 registered company, is recorded as an owner statement and labelled as such.
+
+---
+
+## 2026-08-20 — Architecture invariants in `.coderabbit.yaml` and `.cursorrules` corrected against live code (chore/rule-invariants-drift)
+
+**Claim:** The `**/*` path instruction CodeRabbit applies to every file in every vettrack PR carried
+seven architecture invariants. Three were wrong. All seven were checked against live code and the
+block was rewritten. Two contradicting lines in `.cursorrules` were aligned with the two in the same
+file that were already correct.
+
+**Evidence:**
+
+- **The config is live, not inert.** Review comments on PRs #197, #199 and #200 each report
+  `Configuration used: Path: .coderabbit.yaml`. (The RN repo's PR #81 reports `Organization UI` — a
+  different repo with a different source. The two must not be conflated.)
+- **`server/db.ts` holds no schema.** 23 lines: the pool, `drizzle(pool)`,
+  `export * from "./schema/index.js"`, and a legacy `initDb()` stub. `grep -c pgTable server/db.ts`
+  → `0`.
+- Tables are declared with `vtTable(...)` in `server/schema/*.ts`. `server/schema/helpers.ts:5` →
+  `export const vtTable = pgTable;`, whose own comment reads "identical table names as the original
+  db.ts monolith" — the helper documents the split that the instruction had not caught up with.
+- **The staleness is datable.** `git log --diff-filter=A -- server/schema/core.ts` → `c1780d8f7`,
+  2026-05-24, `refactor: modularize server/db.ts into domain schema files (#421)`.
+  `git log -1 -- .coderabbit.yaml` → `27975124a`, 2026-07-28. The file was edited **two months after**
+  the split and the wrong line survived that edit.
+- **Medication < 100 ml is enforced nowhere.** `grep -rnE '\b100\b' server src shared` filtered to
+  `ml|volume|liquid` → no matches.
+- **The billing ledger is gone.** `find server src shared -iname '*billing*'` → no results.
+  `server/services/shadow-inventory.service.ts:2` → "Shadow inventory — billing ledger removed;
+  orphan-stock scan is a no-op." A residual guard survives at
+  `server/workers/integration.worker.ts:85` and was left alone; this entry does **not** claim the
+  removal is complete.
+- **The realtime invariant was correct but incomplete.** It read "do not introduce parallel polling
+  transports" with no carve-out, while CLAUDE.md's frozen-surfaces section documents the `/collab-ws`
+  Socket.io channel as the one sanctioned additive exception. As written, a correct change under
+  `server/lib/realtime-collab/` would have read to the reviewer as a violation.
+- **`.cursorrules` contradicted itself.** Lines 30 and 110 name `server/schema/*.ts` correctly. Line
+  15 said "New `pgTable` definitions in `server/db.ts`", and the section heading at line 151 read
+  `## Schema (server/db.ts)`. A reader going top-down met the wrong statement first, and nothing in
+  the file established precedence. Both corrected.
+- **The edited YAML was re-parsed, not assumed.** `ruby -ryaml` → 5 `path_instructions` blocks, and
+  the rendered invariants text was read back to confirm what the reviewer actually receives.
+
+**Not done, deliberately — no drift gate was added.** The obvious gate ("every path named in a rule
+file must exist") would **not** have caught this bug: `server/db.ts` exists, it simply no longer holds
+what the rule claimed. A gate that passes green on the exact defect it was written for is the failure
+mode this week's audit found nine separate times, and shipping one here would have added the
+appearance of coverage and none of it. A narrow assertion covering only this instance was judged not
+to earn its maintenance.
+
+**Also observed, not fixed:** `CLAUDE.md:123` still lists `server/lib/` as holding "Business logic
+(billing, …)" though no billing file exists. Out of scope for this change; recorded so it is not lost.
+
+**Verdict:** VERIFIED — every claim above comes from direct command output run this session, not from
+a commit message or a prior entry.