Selected reviewer reconciliation questions

The minimal usable slice lets a freshly authorized reconciler ask selected eligible candidate reviewers a question about the current project, study and stage. A durable conversation retains participants, questions and replies; its committed posts capture recipient notifications in the same transaction. Saved inbox links reopen authorized context after refresh or sign-in.

Acceptance: authoritative candidate selection, current stage grants and account admission, participant-only reads/replies, blinding-safe labels, retry deduplication, atomic capture and no changes to canonical annotation/reconciliation answers. Routine study claims stay silent. The shortest critical path is domain context/participant admission, persistence and inbox shaping, question/reply controls and security/transaction/browser verification.

The default-off studyAttention flag admits new questions and replies, and requires notificationInbox. Existing conversation reads remain available through disable. Amended 28 October 2026 (L6): with the flag off every conversation route answers 404 and conversation notices read as unavailable; saved conversations come back when it is on. studyAttention is deployment-managed until private conversations land (L7), because every participant sees every post (gap C7); see the L6 section of the technical plan. Existing review and reconciliation paths remain intact. Accepted conversations retain history through later role/candidate changes, while every visible detail and reply action rechecks current authority. Email uses the existing category preferences and shared immediate/daily ledger; no separate transport.

Study issue reports and quarantined PDF correction are the remaining ordered slices. No merge or deployment is authorized.

The server binds candidates to saved non-reconciliation sessions in the same study and stage, including incomplete sessions as the existing candidate view does. It checks fresh active accounts, active project membership and current stage Review/Reconcile grants without application-admin shortcuts. Selected session IDs are admitted by the server; clients cannot supply participant identities. Each post and its other-participant notifications commit in one majority transaction. Stable request/post IDs deduplicate retries; changed payloads and stale revisions refuse writes.

History retains the admitted participants. Later candidate removal disables that reviewer's replies; current role withdrawal hides protected history and turns related inbox items generic. Inactive stages retain authorized history and disable replies. DTOs contain generic participant labels, never names, emails or investigator IDs. Free text is rendered as text. The exact study/stage link retains context.

Initial bounds are 20 selected sessions, 4,000 characters per post, 100 posts per conversation and 100 recent conversations per study/stage/participant query. A full conversation becomes read-only; new questions remain independent. Paging and closed-thread controls are ordered follow-ups.

Validation: 383 focused API checks, four physical Mongo replica-set transaction checks and 29 Angular tests pass. Changed-file lint, generated-code validation and Release builds pass. The full browser journey passes (four tests including authentication setup): two reviewers save conflicting answers, only the selected reviewer receives the question, a foreign participant is refused, replies reopen after reload and both parties follow their saved inbox links. Canonical ExtractionInfo is byte-for-byte unchanged by the conversation, and history remains readable through admission disable (superseded by L6: off is 404). The existing E2E_BROWSER_NETNS=1 harness isolates Chromium from sibling Docker interface changes on this shared host.