# OZI-RIS UX and Workflow Consistency Review

Reviewed: 17 July 2026  
Scope: 80 Blade files, shared authenticated/public/error layouts, navigation,
clinical study flow, administration and the new P1/P2 security/DICOM functions.

## Implemented in this review

- Added DICOM & PACS to permission-aware Administration navigation.
- Rebuilt DICOM administration as a responsive command centre with operational
  metrics, clear safety boundary, node cards, connection testing, safe removal,
  reconciliation actions and integration-event visibility.
- Added global validation summaries plus success, error, warning and information
  feedback to the shared authenticated layout.
- Added a keyboard-accessible skip link and live status feedback for PACS query.
- Changed Study Detail so PACS/viewer actions appear only when their matching
  active node exists. PACS query now returns inline found/not-found/error feedback
  instead of navigating clinicians to raw JSON.
- Removed authenticated prototype/demo routes that duplicated real workflow pages.
- Fixed profile-photo delivery so stored avatars use an origin-safe relative URL
  instead of the static `APP_URL`; added cache-busting and safe replacement cleanup.
- Corrected Profile form grid nesting and aligned the browser password minimum with
  the enforced 12-character server policy.
- Preserved the fixed OZI-RIS brand, configurable system name, shared footer,
  theme behavior and role/permission filtering across the primary layout.

## Consistency findings

- The shared AdminLTE layout is the effective authenticated layout; legacy
  partial layout files are not used by production pages and should not be extended.
- Clinical lifecycle controls remain server-authoritative. This review did not
  weaken status-transition, report-finalization, reconciliation or RBAC rules.
- DICOMweb PACS query is operational locally. Viewer launch remains intentionally
  unavailable until an HTTPS viewer node is configured.
- Node connection checks prove DICOMweb HTTP or TCP reachability. They do not
  replace C-ECHO, association negotiation or vendor acceptance testing.

## Required next additions

1. Add edit/rotation workflow for DICOM node credentials without replacing an
   existing encrypted token unless a new token is explicitly supplied.
2. Add scheduled node-health monitoring and alerts; manual connection tests are
   insufficient for production availability monitoring.
3. Configure an HTTPS reverse proxy and authenticated viewer before enabling the
   Study Detail viewer action.
4. Validate responsive behavior using a browser matrix (desktop, tablet and
   supported clinical workstation resolutions) and assistive-technology checks.
5. Complete English/Bahasa Melayu translation coverage for recently added P1/P2
   administration and interoperability screens.
6. Remove unused prototype views/partials only after confirming no downstream
   deployment or training material references them.

## Verification

- Laravel: 73 tests, 218 assertions passed.
- Blade templates compile successfully.
- Vite production build completed successfully.
- Known non-blocking issue: Sass reports upstream Bootstrap/AdminLTE `@import`
  and legacy function deprecations; this remains a technical-maintenance item.
