@choiceapps/communityservices-sdk 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.6.0 - 2026-11-10
+
+- Reject yes/no fields in `correctEntry.clear` before any correction write or new journal entry. Correct synthetic fixtures that incorrectly accepted blank yes/no values. Setting `No` remains supported.
+- Surface correction HTTP status and preserve allowlisted kind/status across retries without journaling response bodies. Retain write and read causes when reconciliation also fails.
+- Add explicit `resolveEntryCorrection` with independent confirmation and two unchanged-state checks. Preserve attempted history, refuse partial/verified commits, and require a new key for corrected intent after rejection. Never reset a sent request automatically from a 4xx response.
+- Clarify shared answers across assessment instruments, the public GWT enrollment catalog, and adoption for interims and scalar corrections. HUD label resolution and household-ID discovery still require authoritative metadata.
+- Correct password recovery documentation: WellSky permits immediately resetting back to the previous password.
+
 ## 0.5.0 - 2026-11-10
 
 - Use a configured GWT enrollment catalog for creation and member preflight. Prior household enrollments, including exited entries, no longer force the known-broken REST grouped list. Failed or incomplete reads never imply absence.

package/browser/enrollment-workflow.d.mts

@@ -79,6 +79,28 @@ export interface EntryCorrectionInput {
  subassessments?:EntryRowCorrection[];
 }
 export interface EntryCorrectionResult extends EnrollmentWorkflowResult {enrollmentKey:string;}
+export interface EntryCorrectionFailure {
+ status?:number;
+ kind?:'http'|'auth'|'timeout'|'network'|'aborted'|'protocol'|'validation'|'throttled'|'cooldown';
+}
+export interface EntryCorrectionResolution {
+ kind:'not-applied';evidenceReference:string;resolvedAt:string;
+}
+export interface EntryCorrectionResolutionEvidence {
+ key:string;enrollmentKey:string;clientId:number;enrollmentId:number;effectiveDate:string;matchesBefore:true;
+ steps:Array<{name:string;state:'attempted'|'verified';failure?:EntryCorrectionFailure}>;
+}
+export interface ResolveEntryCorrectionInput {
+ key:string;enrollmentKey:string;clientId:number;
+ /** Opaque reference to independent non-application evidence, not a response body. */
+ evidenceReference:string;
+ /** Read-only confirmation using independent server/administrative evidence.
+  * A 4xx response plus matchesBefore alone is not sufficient. */
+ confirmNotApplied:(evidence:EntryCorrectionResolutionEvidence)=>boolean|Promise<boolean>;
+}
+export interface ResolveEntryCorrectionResult {
+ key:string;enrollmentKey:string;clientId:number;outcome:'rejected'|'already-rejected';resolution:EntryCorrectionResolution;
+}
 export interface AdoptEnrollmentInput {key:string;clientId:number;enrollmentId:number;}
 export interface AdoptHouseholdEnrollmentInput {
  key:string;householdId:number;headClientId:number;
@@ -105,14 +127,15 @@ export interface ExitWorkflowDiscovery extends EnrollmentWorkflowDiscovery {exit
 export interface EnrollmentWorkflowStatus {
   key:string;
   kind:'entry'|'interim'|'exit'|'correction';
-  stage:'pending'|'verified';
+  stage:'pending'|'verified'|'rejected';
   assessmentCode:string;
   enrollmentId?:number;
   reviewId?:number;
   projectExitDate?:string;
   exitSubgroupId?:string|null;
   recordsetIds:Record<string,number>;
-  steps:{name:string;state:'attempted'|'verified'}[];
+  steps:{name:string;state:'attempted'|'verified';failure?:EntryCorrectionFailure}[];
+  resolution?:EntryCorrectionResolution;
 }
 export interface EnrollmentWorkflow {
   discover(input:EnrollmentDiscoveryInput):Promise<EnrollmentWorkflowDiscovery>;
@@ -123,6 +146,8 @@ export interface EnrollmentWorkflow {
   exitEnrollment(input:ExitEnrollmentInput):Promise<ExitEnrollmentResult>;
   /** Patch an open entry at its original timestamp, before any review or exit. */
   correctEntry(input:EntryCorrectionInput):Promise<EntryCorrectionResult>;
+  /** Verify unchanged state and independently confirmed rejection; keeps the attempt history. */
+  resolveEntryCorrection(input:ResolveEntryCorrectionInput):Promise<ResolveEntryCorrectionResult>;
   /** Verify an existing standalone entry and journal it without an HMIS write. */
   adoptEnrollment(input:AdoptEnrollmentInput):Promise<EnrollmentWorkflowResult>;
   /** Verify all existing linked entries, original head and dates; no HMIS writes. */
@@ -217,9 +242,12 @@ export interface EnrollmentWorkflowOptions {
 }
 export class EnrollmentWorkflowError extends Error {
   readonly reason:string;
+  readonly code?:string;
+  readonly fields?:string[];
+  readonly status?:number;
   /** Failed durable stage, when known. The original write error is available as cause in memory. */
   readonly step?:string;
-  constructor(reason:string,options?:ErrorOptions&{step?:string});
+  constructor(reason:string,options?:ErrorOptions&{step?:string;code?:string;fields?:string[];status?:number});
 }
 /** An unavailable list is never evidence that no enrollment exists. */
 export class EnrollmentReadError extends EnrollmentWorkflowError {

package/browser/enrollment-workflow.mjs

@@ -1,7 +1,7 @@
 import {apiScope} from './connection.mjs';
 import {validateBirthDate} from './date-of-birth.mjs';
 import {expectedExitDetails} from './exit-details.mjs';
-import {createEntryCorrector} from './entry-correction.mjs';
+import {createEntryCorrector,correctionFailureDetails} from './entry-correction.mjs';
 import {createHash} from 'node:crypto';
 import {readProgramCatalog,encodeAnswers,encodeNewSubassessmentRow,toItems,parseRestInstant} from '../dist/esm/index.js';
 
@@ -11,7 +11,16 @@ const entryExitTypes=['HUD','Basic','Standard','RHY','VA','Basic Center Program
 const canonical=v=>JSON.stringify(v,(_,x)=>object(x)?Object.fromEntries(Object.keys(x).sort().map(k=>[k,x[k]])):x);
 const hash=v=>createHash('sha256').update(canonical(v)).digest('hex');
 const fail=message=>{throw new EnrollmentWorkflowError(message);};
-export class EnrollmentWorkflowError extends Error {constructor(reason,options){super(`Enrollment workflow: ${reason}`,options);this.name='EnrollmentWorkflowError';this.reason=reason;if(options?.step!==undefined)this.step=options.step;}}
+export class EnrollmentWorkflowError extends Error {
+ constructor(reason,options){
+  super(`Enrollment workflow: ${reason}`,options);this.name='EnrollmentWorkflowError';this.reason=reason;
+  if(options?.step!==undefined)this.step=options.step;
+  if(options?.code!==undefined)this.code=options.code;
+  if(options?.fields!==undefined)this.fields=[...options.fields];
+  const status=options?.status??options?.cause?.status;
+  if(Number.isInteger(status)&&status>=100&&status<=599)this.status=status;
+ }
+}
 export class EnrollmentReadError extends EnrollmentWorkflowError {
  constructor({clientId,source,writeAttempted,cause}){
   super(cause instanceof EnrollmentWorkflowError?cause.reason:'enrollment list unavailable',{step:'enrollment-read',cause});this.name='EnrollmentReadError';this.code='ENROLLMENT_READ_FAILED';this.clientId=clientId;this.source=source;this.phase=writeAttempted?'reconciliation':'preflight';this.committed=writeAttempted?'unknown':false;
@@ -129,7 +138,7 @@ export function createEnrollmentWorkflow({api,discovery,helpers,store,enrollment
  };
  const scope=clientId=>JSON.stringify([tenantScope,'enrollment-workflow',clientId]);
  const reservationScope=clientId=>JSON.stringify([tenantScope,'household-workflow-reservation',clientId]);
- const correctEntry=createEntryCorrector({api,store,enrollmentSession,writeLabel,discover,scope,reservationScope,makeError:(reason,options)=>new EnrollmentWorkflowError(reason,options)});
+ const {correctEntry,resolveEntryCorrection}=createEntryCorrector({api,store,enrollmentSession,writeLabel,discover,scope,reservationScope,makeError:(reason,options)=>new EnrollmentWorkflowError(reason,options)});
  const run=async(kind,raw,internal={})=>{
   const standaloneExit=kind==='exit'&&internal.standaloneExit===true;
   fields(raw,kind==='entry'?['key','clientId','providerId','type','entryDate','assessment']:['key','enrollmentKey','clientId',kind==='exit'?'exitDate':'reviewDate','assessment',...(standaloneExit?['destination','reasonForLeaving','destinationDetails','reasonForLeavingOther']:[])]);
@@ -145,7 +154,7 @@ export function createEnrollmentWorkflow({api,discovery,helpers,store,enrollment
    const reservations=await store.withLock(reservationScope(input.clientId),()=>store.read(reservationScope(input.clientId)));
    if(!Array.isArray(reservations)||reservations.some(r=>r.stage!=='verified'&&r.owner!==internal.owner))fail('unfinished household workflow must be reconciled first');
    const records=await store.read(scope(input.clientId));if(!Array.isArray(records)||records.some(r=>!object(r)||r.version!==1||!object(r.steps)))fail('invalid workflow journal');
-   if(records.some(r=>r.stage!=='verified'&&r.key!==input.key))fail('another unfinished workflow must be reconciled first');
+   if(records.some(r=>r.stage!=='verified'&&!(r.kind==='correction'&&r.stage==='rejected')&&r.key!==input.key))fail('another unfinished workflow must be reconciled first');
    const matches=records.filter(r=>r.key===input.key);if(matches.length>1)fail('duplicate journal keys');let record=matches[0];
    const intentHash=hash({kind,input,...(internal.owner?{household:internal.owner}:{})});if(record&&record.intentHash!==intentHash)fail('key conflicts with previous intent');
    // Changing the yes/no endpoint after an attempt would be an endpoint switch, not reconciliation.
@@ -387,7 +396,7 @@ export function createEnrollmentWorkflow({api,discovery,helpers,store,enrollment
      if(!Array.isArray(reservations)||reservations.some(r=>r.stage!=='verified'&&r.owner!==owner))fail('unfinished household workflow must be reconciled first');
      const records=await store.read(scope(target.clientId)),member=household?memberKey(input.key,target.clientId):input.key;
      if(!Array.isArray(records)||records.some(r=>r.version!==1||!object(r.steps)))fail('invalid workflow journal');
-     if(records.some(r=>r.stage!=='verified'&&r.key!==member))fail('another unfinished workflow must be reconciled first');
+     if(records.some(r=>r.stage!=='verified'&&!(r.kind==='correction'&&r.stage==='rejected')&&r.key!==member))fail('another unfinished workflow must be reconciled first');
      if(records.some(r=>r.kind==='entry'&&r.enrollmentId===target.enrollmentId&&r.key!==member))fail('enrollment already journaled; use its existing entry key');
      const matches=records.filter(r=>r.key===member);if(matches.length>1)fail('duplicate journal keys');
      if(matches[0]&&(!matches[0].adopted||matches[0].intentHash!==intentHash))fail('adoption key conflicts with previous intent');
@@ -690,6 +699,7 @@ export function createEnrollmentWorkflow({api,discovery,helpers,store,enrollment
  };
  return {
   correctEntry,
+  resolveEntryCorrection,
   adoptEnrollment:input=>adopt(false,input),adoptHouseholdEnrollment:input=>adopt(true,input),
   addHouseholdMembers:input=>householdRun('addition',input),
   createHouseholdEnrollment:input=>householdRun('entry',input),createHouseholdInterim:input=>householdRun('interim',input),exitHousehold:input=>householdRun('exit',input),
@@ -710,7 +720,7 @@ export function createEnrollmentWorkflow({api,discovery,helpers,store,enrollment
     const records=await store.read(scope(input.clientId));if(!Array.isArray(records))fail('invalid workflow journal');
     const matches=records.filter(r=>r.key===input.key);if(matches.length>1)fail('duplicate journal keys');const r=matches[0];if(!r)return null;
     if(r.version!==1||!object(r.steps))fail('invalid workflow journal');
-    return {key:r.key,kind:r.kind,stage:r.stage,assessmentCode:r.assessmentCode,...(r.enrollmentId?{enrollmentId:r.enrollmentId}:{}),...(r.reviewId?{reviewId:r.reviewId}:{}),...(r.projectExitDate?{projectExitDate:r.projectExitDate,exitSubgroupId:r.exitSubgroupId}:{}),recordsetIds:structuredClone(r.rows),steps:Object.entries(r.steps).map(([name,step])=>({name,state:step.state}))};
+    return {key:r.key,kind:r.kind,stage:r.stage,assessmentCode:r.assessmentCode,...(r.enrollmentId?{enrollmentId:r.enrollmentId}:{}),...(r.reviewId?{reviewId:r.reviewId}:{}),...(r.projectExitDate?{projectExitDate:r.projectExitDate,exitSubgroupId:r.exitSubgroupId}:{}),...(r.resolution?{resolution:structuredClone(r.resolution)}:{}),recordsetIds:structuredClone(r.rows),steps:Object.entries(r.steps).map(([name,step])=>({name,state:step.state,...(step.failure?{failure:correctionFailureDetails(step.failure)}:{})}))};
    });
   },
  };

package/browser/entry-correction.mjs

@@ -6,6 +6,12 @@ const canonical=v=>JSON.stringify(v,(_,x)=>object(x)?Object.fromEntries(Object.k
 const hash=v=>createHash('sha256').update(canonical(v)).digest('hex');
 const positive=v=>Number.isSafeInteger(v)&&v>0;
 const scalarTypes=new Set(['lookup','yes_no','date','int','money','textbox','textarea']);
+export function correctionFailureDetails(error){
+ const failure={};
+ if(Number.isInteger(error?.status)&&error.status>=100&&error.status<=599)failure.status=error.status;
+ if(['http','auth','timeout','network','aborted','protocol','validation','throttled','cooldown'].includes(error?.kind))failure.kind=error.kind;
+ return failure;
+}
 
 /** Internal correction writer. The workflow supplies its existing client locks and journal scopes. */
 export function createEntryCorrector({api,store,enrollmentSession,writeLabel,discover,scope,reservationScope,makeError}){
@@ -21,6 +27,8 @@ export function createEntryCorrector({api,store,enrollmentSession,writeLabel,dis
  const encode=(questions,answers,clear,endpoint)=>{
   if(!object(answers)||!Array.isArray(clear)||new Set(clear).size!==clear.length||clear.some(f=>typeof f!=='string'||Object.hasOwn(answers,f)))fail('invalid or conflicting correction answers and clears');
   const index=new Map(questions.map(q=>[q.fieldName,q]));
+  const unsupportedClears=clear.filter(field=>index.get(field)?.questionType==='yes_no');
+  if(unsupportedClears.length)throw makeError('yes/no answers cannot be cleared',{code:'UNSUPPORTED_YES_NO_CLEAR',fields:unsupportedClears});
   for(const field of [...Object.keys(answers),...clear]){
    const q=index.get(field);
    if(!q||!scalarTypes.has(q.questionType)||endpoint==='mobile'&&q.questionType==='yes_no')fail('unsupported correction field type');
@@ -42,9 +50,12 @@ export function createEntryCorrector({api,store,enrollmentSession,writeLabel,dis
   if(rows.some(q=>!object(q)||typeof q.virt_field_name!=='string')||new Set(rows.map(q=>q.virt_field_name)).size!==rows.length)fail('ambiguous correction assessment read');
   return rows;
  };
- return async raw=>{
-  fields(raw,['key','enrollmentKey','clientId','answers','clear','subassessments']);
-  const input=structuredClone(raw);key(input.key);key(input.enrollmentKey);
+ const run=async(mode,raw)=>{
+  const resolving=mode==='resolve';
+  fields(raw,resolving?['key','enrollmentKey','clientId','evidenceReference','confirmNotApplied']:['key','enrollmentKey','clientId','answers','clear','subassessments']);
+  const {confirmNotApplied,...serializable}=raw;
+  const input=structuredClone(serializable);key(input.key);key(input.enrollmentKey);
+  if(resolving){key(input.evidenceReference);if(typeof confirmNotApplied!=='function')fail('independent non-application confirmation required');}
   if(!positive(input.clientId)||!Array.isArray(input.subassessments??[]))fail('invalid correction client or rows');
   if(typeof api.assessments?.create!=='function'||typeof enrollmentSession?.readEnrollment!=='function')fail('standard assessment writes and authoritative enrollment reader required for corrections');
   return store.withLock(scope(input.clientId),async()=>{
@@ -52,11 +63,22 @@ export function createEntryCorrector({api,store,enrollmentSession,writeLabel,dis
    if(!Array.isArray(reservations)||reservations.some(r=>r.stage!=='verified'))fail('unfinished household workflow must be reconciled first');
    const records=await store.read(scope(input.clientId));
    if(!Array.isArray(records)||records.some(r=>!object(r)||r.version!==1||!object(r.steps)))fail('invalid workflow journal');
-   if(records.some(r=>r.stage!=='verified'&&r.key!==input.key))fail('another unfinished workflow must be reconciled first');
+   if(records.some(r=>r.stage!=='verified'&&!(r.kind==='correction'&&r.stage==='rejected')&&r.key!==input.key))fail('another unfinished workflow must be reconciled first');
    const entries=records.filter(r=>r.kind==='entry'&&r.key===input.enrollmentKey&&r.stage==='verified');
    if(entries.length!==1)fail('verified enrollment workflow required');const entry=entries[0];
    const matches=records.filter(r=>r.key===input.key);if(matches.length>1)fail('duplicate correction journal keys');let record=matches[0];
-   const intentHash=hash(input);if(record&&(record.kind!=='correction'||record.intentHash!==intentHash))fail('correction key conflicts with previous intent');
+   const intentHash=hash(input);
+   if(resolving){
+    if(!record||record.kind!=='correction'||record.enrollmentKey!==input.enrollmentKey)fail('matching correction journal required');
+    if(record.stage==='verified')fail('verified correction cannot be rejected');
+    if(record.stage==='rejected'){
+     if(record.resolution?.evidenceReference!==input.evidenceReference)fail('resolution evidence reference changed');
+     return {key:input.key,enrollmentKey:input.enrollmentKey,clientId:input.clientId,outcome:'already-rejected',resolution:structuredClone(record.resolution)};
+    }
+   }else{
+    if(record?.kind==='correction'&&record.stage==='rejected')throw makeError('correction was resolved as not applied; use a new key for a corrected intent',{code:'ENTRY_CORRECTION_REJECTED'});
+    if(record&&(record.kind!=='correction'||record.intentHash!==intentHash))fail('correction key conflicts with previous intent');
+   }
    if(!record&&records.some(r=>r.enrollmentId===entry.enrollmentId&&!['entry','correction'].includes(r.kind)))fail('entry correction must precede interim or exit workflows');
    const {providerId,type,entryDate}=entry.context,at=new Date(parseRestInstant(entryDate)).toISOString(),readAt=new Date(parseRestInstant(at)+1000).toISOString();
    const target={clientId:input.clientId,enrollmentId:entry.enrollmentId};
@@ -99,6 +121,17 @@ export function createEntryCorrector({api,store,enrollmentSession,writeLabel,dis
     return {raw,scalars,rows};
    };
    const observed=await snapshot();
+   if(resolving){
+    if(record.stage!=='pending'||!Object.values(record.steps).some(s=>s.state==='attempted'))fail('attempted correction required for resolution');
+    const unchanged=state=>canonical({scalars:state.scalars,rows:state.rows})===canonical(record.before);
+    if(!unchanged(observed))fail('correction state differs from its pre-write snapshot; non-application cannot be resolved');
+    const evidence={clientId:input.clientId,enrollmentId:entry.enrollmentId,enrollmentKey:input.enrollmentKey,key:input.key,effectiveDate:at,matchesBefore:true,steps:Object.entries(record.steps).map(([name,s])=>({name,state:s.state,...(s.failure?{failure:correctionFailureDetails(s.failure)}:{})}))};
+    if(await confirmNotApplied(evidence)!==true)fail('independent non-application confirmation required');
+    await verifyEnrollment();if(!unchanged(await snapshot()))fail('correction state changed during resolution');
+    record.resolution={kind:'not-applied',evidenceReference:input.evidenceReference,resolvedAt:new Date().toISOString()};record.stage='rejected';
+    await store.write(scope(input.clientId),structuredClone(records));
+    return {key:input.key,enrollmentKey:input.enrollmentKey,clientId:input.clientId,outcome:'rejected',resolution:structuredClone(record.resolution)};
+   }
    const readOverrides=state=>{
     for(const q of Object.values(entry.correctedScalars??{})){
      const actual=state.scalars[q.virt_field_name];if(!actual||actual.value!==value(q.question_type,q.answer_value)||actual.value!==null&&actual.date!==parseRestInstant(at))fail('verified entry correction changed');
@@ -145,12 +178,19 @@ export function createEntryCorrector({api,store,enrollmentSession,writeLabel,dis
     return scalarsMatch&&canonical(state.rows)===canonical(want.rows);
    };
    const step=async(name,submit)=>{
-    if(await inspect(name)){record.steps[name]={state:'verified'};await persist();return;}
-    if(record.steps[name])throw makeError('uncertain entry correction requires reconciliation',{step:name});
+    const uncertain=cause=>makeError('uncertain entry correction requires reconciliation',{step:name,code:'ENTRY_CORRECTION_UNCERTAIN',status:record.steps[name]?.failure?.status,...(cause===undefined?{}:{cause})});
+    let found;try{found=await inspect(name);}catch(readError){if(record.steps[name])throw uncertain(readError);throw readError;}
+    if(found){record.steps[name]={state:'verified'};await persist();return;}
+    if(record.steps[name])throw uncertain();
     if(!await inspect(null))fail('entry changed since correction preflight');
     await verifyEnrollment();record.steps[name]={state:'attempted'};await persist();let cause;
-    try{await submit();}catch(e){cause=e;}
-    if(!await inspect(name))throw makeError('uncertain entry correction requires reconciliation',{step:name,cause});
+    try{await submit();}catch(e){
+     cause=e;const failure=correctionFailureDetails(e);
+     if(Object.keys(failure).length){record.steps[name].failure=failure;await persist();}
+    }
+    let saved;
+    try{saved=await inspect(name);}catch(readError){throw uncertain(cause===undefined?readError:new AggregateError([cause,readError],'Correction write and reconciliation read failed'));}
+    if(!saved)throw uncertain(cause);
     record.steps[name]={state:'verified'};await persist();
    };
    if(record.scalarBody.length)await step('scalars',()=>api.assessments.create({path:{clientId:input.clientId,assessmentCode:code},query:{dateEffective:at},body:record.scalarBody}));
@@ -161,4 +201,5 @@ export function createEntryCorrector({api,store,enrollmentSession,writeLabel,dis
    record.stage='verified';await persist();return result('verified');
   });
  };
+ return {correctEntry:raw=>run('correct',raw),resolveEntryCorrection:raw=>run('resolve',raw)};
 }

package/docs/assessments.md

@@ -29,7 +29,7 @@ The default metadata cache TTL is 60 seconds with 100 entries per client. Config
 
 WellSky requires a client context and known assessment code for these reads. There is no documented global assessment-list or standalone picklist-list endpoint. Mobile option metadata has no effective-date filter, so definitions explicitly identify its options as current even when the generic assessment read is dated. Metadata also does not provide a complete questionnaire branching engine.
 
-Use the raw `assessments.get`, `assessmentsMobile.getAnswers`, and `enrollments.getAssessment` methods for recorded answers. Use `encodeAnswers` and `encodeNewSubassessmentRow` for endpoint-specific encoding. Mobile lookups use option IDs; standalone/enrollment lookups require an explicit `writeLabel` resolver with tenant-verified labels. Raw option names are not assumed to be valid write labels. Provider answers are refused for mobile writes because that endpoint can silently discard them. Answer-state code mappings and multi-value serialization are caller-supplied; a refusal is never converted to `No`.
+Use the raw `assessments.get`, `assessmentsMobile.getAnswers`, and `enrollments.getAssessment` methods for recorded answers. Use `encodeAnswers` and `encodeNewSubassessmentRow` for endpoint-specific encoding. Mobile lookups use option IDs; standalone/enrollment lookups require an explicit `writeLabel` resolver with tenant-verified labels. Raw option names are not assumed to be valid write labels. Some HUD-marked choices require `(HUD)` in the full write label even when metadata `name` omits it. Do not infer this from trailing whitespace or append the suffix to every option. Continue supplying tenant-verified labels until a label resolver has authoritative metadata; recorded `answer_value_text` is useful evidence for the corresponding option. Provider answers are refused for mobile writes because that endpoint can silently discard them. Answer-state code mappings and multi-value serialization are caller-supplied; a refusal is never converted to `No`.
 
 ## Yes/no answer acceptance
 
@@ -48,6 +48,12 @@ Reproduced on November 2, 2026 in a sandbox tenant with synthetic clients:
 
 The enrollment workflow writes yes/no answers through the mobile batch by default. That keeps their stage pending because the saved values never verify. Construct it with `yesNoWrites: 'standard'` and a `writeLabel` resolver to send them through `assessments.create` instead; see [the enrollment workflow](enrollments.md#yesno-answers). It never treats an empty yes/no answer as `No`, skips a requested field, or switches endpoints for a stage that was already attempted. For a minimal reproduction, [enable private error diagnostics](troubleshooting.md#inspect-an-upstream-error-privately) and retain the question's current metadata.
 
+## Shared questions across assessment instruments
+
+An entry assessment and a standalone form can reference the same stored question. Changing `assessmentCode` does not make a second answer at the same client/question/effective instant available for a mobile insert. The integrator reported this for `HPTARGETINGSCORETOTAL` on an entry and form 1002: when the stored value differed, the mobile batch was rejected. Compare question identifiers and effective dates, not only form names.
+
+Read the existing answer before planning a mobile scalar insert. If it already exists at that instant with another value, use a supported standard correction/update path after resolving the original operation; do not move its timestamp to evade the collision. Raw `assessmentsMobile.addAnswer` remains a raw write and performs no implicit read or cross-form collision check. Never switch endpoints to retry an uncertain batch.
+
 ## Race and ethnicity combinations
 
 `encodeAnswers` recognizes the standard `HUD_RACEETHNICITY` field. It resolves single-category and multiple-category answers to the tenant's `RACE_ETH_COMBO_*` option IDs. A single White answer uses `RACE_ETH_COMBO_WHI`, even when the caller supplies `RACE_ETH_WHI`. Atomic option IDs can read back with a label while appearing blank in the UI.

package/docs/browser-session.md

@@ -97,7 +97,7 @@ On the expired-login form, the helper appends the character to the original `HMI
 
 Use one shared, durable recovery store for every caller of the same UI account. Multi-host deployments must override the default with shared durable storage and locking. Keep using an existing custom recovery store if it has a pending recovery; changing stores does not reconcile it. The per-account lock covers the entire recovery. Its journal contains stages and the append character, never either password. The original must be 8–49 characters when a reset is needed so the temporary password fits the observed 50-character limit. A 50-character password can still log in normally. Keep the original credential and append character unchanged while a recovery is pending. The SDK sanitizes login errors; do not enable Playwright tracing, request-body capture, or debug logging containing credentials.
 
-A saved temporary-password attempt can resume with one authentication check of that temporary password. A saved restoration attempt can resume with one authentication check of the original. Neither uncertain password write is repeated. An interrupted or failed authentication check leaves a blocking journal stage and raises `RECOVERY_UNCERTAIN`; reconcile the account and journal before proceeding. A process crash may also leave the file store's exclusive lock. Do not delete journals or automatically expire locks to force retries. If server policy rejects restoring the original, the helper stops and the temporary password may remain active.
+A saved temporary-password attempt can resume with one authentication check of that temporary password. A saved restoration attempt can resume with one authentication check of the original. Neither uncertain password write is repeated. An interrupted or failed authentication check leaves a blocking journal stage and raises `RECOVERY_UNCERTAIN`; reconcile the account and journal before proceeding. A process crash may also leave the file store's exclusive lock. Do not delete journals or automatically expire locks to force retries. WellSky permits immediately resetting back to the previous password. Password history does not prevent the restore-original step.
 
 Both UI actions use GWT-RPC: the shipped expired-login handler calls `AuthenticationService.changePasswordHeartbeat`, while the user-settings restoration was observed calling `UserService.updateUserPassword` with HTTP 200 / GWT OK. The former uses the limited session established by the expired login. The helper currently drives the live forms to generate fresh requests. A standalone RPC-only password adapter has not been implemented or tested; captured password payloads must not be stored or replayed. See [sandbox findings](capabilities.md).
 

package/docs/capabilities.md

@@ -39,7 +39,7 @@ The generated client covers the pinned V2/V3 Swagger operations. The following f
 | Client Notes, goals, action steps | `createCasePlans` plus raw REST methods | Journaled create/update and supported-field verification; helper supplies clientId on goal updates; unreadable follow-up fields excluded |
 | Goal case notes | `session.workflows.createCaseNote` | Optional source key rejects changed intent and verifies saved note ID; legacy unkeyed matching remains; single client only. REST goal response does not expose these notes |
 | Multi-client/multi-case notes | No packaged bulk helper | Do not infer note participants from unrelated `households` nested in a goal response |
-| Expired UI password | Headless login, enabled by default | Temporary suffix then restore original, durable recovery stages, fresh-login verification; policy rejection may leave temporary password active |
+| Expired UI password | Headless login, enabled by default | Temporary suffix then restore original, durable recovery stages, fresh-login verification; WellSky permits immediate restoration of the previous password |
 | Session expiration | Managed session plus durable workflow journals | Reauthenticate and report interruption; caller retries original intent for reconciliation, not automatic callback replay |
 
 ## Known server gaps
@@ -69,7 +69,7 @@ These observations explain the current contracts. They are dated acceptance resu
 | Household exits and head coverage, October 23, 2026 | An invalid early head exit was blocked before writes. Valid staggered exits and an all-member exit preserved dates, original heads, and selected subgroups; retries made no extra record writes. | Earlier server-accepted orphaned groups were invalid under the current SDK contract. See [head validation feedback](vendor-issues/household-head-validation.md) and [enrollments](enrollments.md). |
 | Attachment identity and content, October 24, 2026 | Profile, Case Plans, and goal files retained their IDs across fresh helpers, and downloaded bytes matched the originals. | Does not establish anonymous access or sharing permissions. REST authentication remained a separate failure. See [files and notes](files-and-notes.md). |
 | SSVF conditional forms, October 23, 2026 | Form inspection checked conditional branches and required-date validation without saving; four REST-supported dependencies were then saved and read back, with zero duplicate writes on same-key retries. | This is a dated rules snapshot, not exhaustive financial assistance or funding-allocation acceptance. See [SSVF rules](../SSVF.md) and [services](services.md). |
-| Expired-password recovery, October 23, 2026 | An expired account completed temporary-password recovery, restored its original password, and authenticated in a fresh context. | Account policy can reject a recovery stage; retain the durable recovery journal. See [browser sessions](browser-session.md). |
+| Expired-password recovery, October 23, 2026 | An expired account completed temporary-password recovery, restored its original password, and authenticated in a fresh context. | WellSky permits immediate restoration of the previous password; retain the durable recovery journal for interrupted operations. See [browser sessions](browser-session.md). |
 
 Independent needs and AIRS/service-type discovery use UI/GWT helpers. See [independent needs](independent-needs.md) for the creation, counted catalog, and retry contracts. The pinned Swagger exposes need reads but no independent-need creation.
 

package/docs/enrollments.md

@@ -148,14 +148,36 @@ const corrected = await workflow.correctEntry({
 });
 ```
 
-`answers` uses the ordinary answer and option selectors. `clear` explicitly removes a recorded value; an omitted field stays unchanged. Clearing a yes/no answer is distinct from answering `No`. Do not use `notApplicable` to clear an old answer. Every row key must identify an existing row returned by the original entry operation. The correction never creates a second row, deletes a row, or changes the enrollment date.
+`answers` uses the ordinary answer and option selectors. `clear` explicitly removes a recorded value; an omitted field stays unchanged. Yes/no fields cannot appear in `clear`: the SDK throws `UNSUPPORTED_YES_NO_CLEAR`, with the affected `fields`, before any correction write or new journal record. Use `{value: false}` to answer `No`; it does not mean blank. No alternative yes/no blanking route has been verified. Do not use `notApplicable` to clear an old answer. Every row key must identify an existing row returned by the original entry operation. The correction never creates a second row, deletes a row, or changes the enrollment date.
 
-Scalars use the standard assessment endpoint, which supports same-date updates. The batch includes every mandatory scalar, preserving its current value unless the patch explicitly answers or clears it. Missing mandatory values require an explicit answer or clear; lookup values require verified write labels. Readback checks one second after the original instant so stored yes/no values are visible.
+Scalars use the standard assessment endpoint, which supports same-date updates. The batch includes every mandatory scalar, preserving its current value unless the patch explicitly answers or clears it. Missing mandatory values require an explicit answer, or an explicit clear for a supported non-yes/no type; lookup values require verified write labels. Readback checks one second after the original instant so stored yes/no values are visible.
 
 Row edits send only the changed cells to the existing recordset through the mobile endpoint. Lookup, text, numeric and date cells are supported; provider and yes/no row cells are refused before any write. Untouched cells, all other rows and row IDs must remain unchanged. DOB and household-head changes require their dedicated workflows and cannot be supplied as corrections here. An unmodified mandatory DOB is also refused because the standard batch cannot safely resend it through the DOB helper.
 
 All changes are validated before the first write. Scalar and row batches have separate journal stages, so a partial correction is not rolled back. Retry the same intent and key to reconcile; an uncertain batch is never resent automatically. `getStatus({clientId, key})` reports correction progress. Verified corrections update the original entry's verification expectations, so retrying `createEnrollment` under its old key does not restore the old path. A later correction uses a new correction key. See the [typed example](../examples/entry-correction-workflow.mts).
 
+## Resolve a rejected correction
+
+An attempted correction stays pending until its outcome is established. A 4xx response or an unchanged read alone does not prove non-application, so the SDK does not automatically reset or resend it. New failures expose `code: 'ENTRY_CORRECTION_UNCERTAIN'`, `step`, and an available HTTP `status`. The first failure retains its original `cause`; a failed reconciliation read retains both errors in an `AggregateError`. Only allowlisted failure kind/status are persisted and returned by `getStatus`. Response bodies, messages, credentials and stacks are not written to the journal. Older journals cannot recover diagnostics they never saved.
+
+If independent server or administrative evidence establishes that an attempted correction was not applied, call:
+
+```ts
+await workflow.resolveEntryCorrection({
+  key: failedCorrectionKey,
+  enrollmentKey,
+  clientId,
+  evidenceReference: independentReviewReference,
+  confirmNotApplied: async evidence => rejectionReview.confirmNotApplied(evidence),
+});
+```
+
+`rejectionReview` is application-owned. Its callback must be read-only and confirm non-application from independent evidence; do not implement it as `() => true` or infer its answer only from HTTP status and `matchesBefore`. The callback receives identities, effective date and sanitized step diagnostics. Do not call the same client's workflow methods from the callback: the client journal lock remains held.
+
+The SDK verifies the complete saved pre-write state before and after confirmation and rechecks enrollment context. A partial application, changed state or unavailable read prevents resolution. Successful resolution marks the correction `rejected` while retaining its original intent, attempted steps, diagnostics and evidence reference. It makes no SDK record writes to WellSky. Repeating the same resolution returns `already-rejected`; submitting that correction key again throws `ENTRY_CORRECTION_REJECTED`. Use a new correction key for the corrected intent only after resolution. A verified successful correction cannot be rejected.
+
+This also supports pending 0.5.0 journals, including those without failure metadata, when the required independent evidence exists. A new validation failure that occurs before journaling needs no resolution.
+
 ## Household enrollment and interim assessments
 
 Enrollment creation and member preflight use the complete GWT list when the configured `enrollmentSession` supplies `listEnrollments`. The built-in sessions supply it. This avoids the REST `42703` failure for clients with existing household enrollments, including exited enrollments and enrollments in other programs. Reads verify the client, tenant, row identities and count; a failed GWT read never falls back to REST or means an empty list. The current GWT reader refuses lists above 1,000 records. Legacy custom readers without this method retain the counted REST path.
@@ -196,6 +218,22 @@ Client locks coordinate overlapping household and single-client operations. Dura
 
 See the typed [household example](../examples/household-enrollment-workflow.mts) and [live household verification](capabilities.md). The integration uses the configured tenant and uses an isolated authenticated page.
 
+## Public enrollment reads
+
+The managed session exposes a GWT-backed catalog independently of the workflow:
+
+```ts
+const {values: enrollments} =
+  await session.enrollmentSession.listEnrollments({clientId});
+
+const detail = await session.enrollmentSession.readEnrollment({
+  clientId: headClientId, enrollmentId: headEnrollmentId,
+});
+// detail.members contains the complete linked clientId/enrollmentId pairs.
+```
+
+Use the session returned by `openEnrollmentSession`. Lists include open and exited entries, validate complete counts, and refuse more than 1,000 records. The detail read currently exposes `householdClientIds`, not `householdId`; these client IDs and the enrollment's group are not interchangeable with a household ID. Household adoption still requires an explicitly verified household ID.
+
 ## Individual enrollment exits
 
 Use `exitEnrollment` to end a standalone person's program enrollment. It requires a verified `createEnrollment` entry in the same durable store. Supply `enrollmentSession: session.enrollmentSession` and `exitUi: createHouseholdExitUi({page: session.page})` when constructing the workflow. The same exit UI port serves individual and household forms.
@@ -226,7 +264,7 @@ Use `adoptEnrollment({key, clientId, enrollmentId})` for a standalone enrollment
 
 Adoption writes only to the local durable journal. It does not create, attach, exit or modify an HMIS record. Later entrants retain their own original entry dates. An enrollment already tracked under another entry key is rejected; use its existing key. Retry an interrupted adoption with the same inputs and store.
 
-After adoption, pass its key as `enrollmentKey` to `exitEnrollment` or `exitHousehold`. Exit assessment plans and normal household head rules still apply. Adoption records existing enrollment identities, not historical subassessment row-key mappings, so its returned `recordsetIds` is empty. It cannot identify rows for `correctEntry` by a new invented key. See [manual-entry exit examples](../examples/existing-enrollment-exits.mts).
+After standalone adoption, its key can be used as `enrollmentKey` for `createInterim`, scalar-only `correctEntry`, or `exitEnrollment`. After household adoption, the group key works with `createHouseholdInterim` and `exitHousehold`; use the returned member's `key` for that person's scalar-only `correctEntry`. Correction still requires an open entry without reviews or exits. Do not use an all-not-applicable `createEnrollment` call merely to link an existing entry: it can create an enrollment when no match exists. Exit assessment plans and normal household head rules still apply. Adoption records existing enrollment identities, not historical subassessment row-key mappings, so its returned `recordsetIds` is empty. It cannot identify rows for `correctEntry` by a new invented key. See [manual-entry exit examples](../examples/existing-enrollment-exits.mts).
 
 ## Household exits
 

package/docs/reference.md

@@ -36,7 +36,7 @@ Runtime exports: `AttachmentConflictError`, `CoordinatedEntryEventConflictError`
 | Profile fields and Sex | [Client profile](../browser/client-profile.d.mts) | `read`, `update` |
 | Calendar DOB | [Birth dates](../browser/date-of-birth.d.mts) | `read`, `validate`, `verify`, `update` |
 | Provider assessment defaults | [Discovery](../browser/program-discovery.d.mts) | `listAssessments`, `getProviderAssessments` |
-| Enrollment and household lifecycle | [Workflow](../browser/enrollment-workflow.d.mts) | Discovery, entry, `correctEntry`, `adoptEnrollment`, `adoptHouseholdEnrollment`, member additions, interim, `exitEnrollment`, `exitHousehold`, journal status; `EntryExitType` and per-type `assessmentLocations` in [enrollments](enrollments.md) |
+| Enrollment and household lifecycle | [Workflow](../browser/enrollment-workflow.d.mts) | Discovery, entry, `correctEntry`, `resolveEntryCorrection`, `adoptEnrollment`, `adoptHouseholdEnrollment`, member additions, interim, `exitEnrollment`, `exitHousehold`, journal status; `EntryExitType` and per-type `assessmentLocations` in [enrollments](enrollments.md) |
 | Entry-date and exit UI ports | [Member entry](../browser/member-entry-date.d.mts), [exit](../browser/household-exit.d.mts) | Fresh reads and targeted completion |
 | Services and recovery diagnostics | [Service recording](../browser/service-recording.d.mts) | `record`, `recordBulk`, Funding Sources, `RecoveryDiagnostic` |
 | SSVF conditional rules | [SSVF types](../browser/ssvf-rules.d.mts) | [Field rules](../SSVF.md) and dated option snapshots |

package/docs/troubleshooting.md

@@ -28,6 +28,9 @@ Successful adoption of an existing record also needs its journal. Retain it even
 | `DefinitionDriftError`, `UnknownPicklistValueError` | Metadata or lookup assumption changed | Refresh/review definitions and application mapping. Do not guess a numeric option |
 | `AmbiguousCommitError` | Mutation outcome not established | Keep journal pending; re-read through the workflow's authoritative path |
 | `GwtEnrollmentConflictError` | Duplicate/partial/conflicting enrollment or review | Inspect membership and review instant. Do not replay the captured request |
+| `UNSUPPORTED_YES_NO_CLEAR` | A correction attempted to blank a yes/no field | Fix the plan before any write; `No` and blank are different states |
+| `ENTRY_CORRECTION_UNCERTAIN` | An attempted correction is not verified | Inspect `status`, `cause`, and journal step diagnostics; use [explicit resolution](enrollments.md#resolve-a-rejected-correction) only with independent non-application evidence |
+| `ENTRY_CORRECTION_REJECTED` | The old correction key was resolved as not applied | Keep its audit record and use a new key for corrected intent |
 | `EnrollmentWorkflowError` | Invalid plan, missing head, schema drift, conflict, or unresolved stage | Inspect the specific reason and local status; fix application inputs only before reservation, otherwise reconcile original intent |
 | `SessionInterruptedError`, `SESSION_INTERRUPTED` | Managed page operation ended around session expiry | Check `reauthenticated`; retry the original workflow call, never its prepared RPC |
 | `LoginError`, `PASSWORD_EXPIRED` | Expiration detected with recovery disabled | Use the documented recovery option or resolve the password outside the helper |

package/examples/entry-correction-workflow.mts

@@ -2,6 +2,7 @@ import {
  createEnrollmentWorkflow,
  type EnrollmentWorkflowOptions,
  type EntryCorrectionInput,
+  type ResolveEntryCorrectionInput,
 } from '@choiceapps/communityservices-sdk/browser';
 
 /** The application supplies explicit answers, clears and original row keys.
@@ -12,3 +13,10 @@ export async function correctOriginalEntry(dependencies:EnrollmentWorkflowOption
  const workflow=createEnrollmentWorkflow(dependencies);
  return workflow.correctEntry(input);
 }
+
+/** The confirmation callback must use independent server or administrative evidence.
+ * The SDK also checks the complete pre-write state before and after that callback.
+ * Retain the rejected key; submit a corrected request under a new key afterward. */
+export async function resolveRejectedCorrection(dependencies:EnrollmentWorkflowOptions,input:ResolveEntryCorrectionInput){
+ return createEnrollmentWorkflow(dependencies).resolveEntryCorrection(input);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@choiceapps/communityservices-sdk",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "SDK for WellSky Community Services (HMIS), formerly ServicePoint, Client API V2 and V3",
   "type": "module",
   "main": "./dist/cjs/index.js",