# Sprint 6G-A.3 – Day content and document-access contract

This contract supersedes the document status/action wording in `docs/sprint6e4b-record-calendar-day-ui.md` for Dashboard V5.

## Document states

Technical and content decisions are independent:

- `original_status`: `available`, `missing`, `unsupported`, `blocked`, `too_large`
- `extraction_status`: `extracted`, `not_extracted`, `extraction_failed`, `unknown`
- `review_status`: existing human-review state; technical access never changes it
- `search_status`: `reviewed_searchable`, `extracted_not_reviewed`, `not_searchable`

The former `searchable` value is replaced by `reviewed_searchable` so browser and API consumers cannot mistake technical extraction for verified search eligibility.

An unreviewed document may expose a safe descriptor-backed original and a separately labelled, read-only extracted preview. Neither action changes review state or enters the content into verified FTS, doctor reports, or appointment packages.

## Reviewed-only boundaries

The following remain explicitly reviewed-only:

- verified document detail;
- verified FTS and match snippets;
- doctor-report document sections and overview document summaries;
- downstream report/package use.

## Nutrition mapping links

`mapping_queue_key` is emitted only for an exact `status='open'` row in the private review queue. Missing, closed, or nonmatching queue rows produce no browser action. The key is opaque and does not contain YAZIO or database identifiers.

## Private access boundary

When a health database is configured, both the V5 HTML bootstrap and `/api/v1/browser-session` require an API-token-backed authenticated principal. Interactive clients use HTTP Basic with the fixed non-sensitive username `health`; automation may use the existing Bearer token. The token is never embedded in HTML, JavaScript, URLs, logs, or evidence. Same-origin CSRF checks and the short-lived HttpOnly API session remain additional controls rather than substitutes for authentication.

## Routing

- Extracted preview routes include `preview=extracted` and preserve reload/back/forward behavior.
- Nutrition mapping routes accept exactly one 32-hex opaque mapping key. Unknown or malformed keys are removed fail-closed.
- Keyboard and pointer navigation use the same URL/history transitions.

No route or status in this contract constitutes medical review, diagnosis, therapy advice, or causal interpretation.