feat(anamnesis): soft-delete AUDIT-C in its route, admit both AUDIT-C verbs at manage level, and settle the guards

src/app/api/anamnesis/audit-c/[id]/route.ts

@@ -10,8 +10,9 @@ import { NextRequest } from "next/server";
 import { apiHandler, requireRecordAuth } from "@/lib/api-handler";
 import { apiError, apiSuccess, getClientIp } from "@/lib/api-response";
 import { auditLog } from "@/lib/auth/audit";
+import { prisma } from "@/lib/db";
 import { annotate } from "@/lib/logging/context";
-import { removeAuditC } from "@/lib/profile/life-circumstances";
+import { invalidateHealthProfileFactConsumers } from "@/lib/profile/health-facts";
 
 type RouteParams = { params: Promise<{ id: string }> };
 
@@ -20,12 +21,20 @@ export const DELETE = apiHandler(
     const { user } = await requireRecordAuth("manage", "profile");
     const { id } = await params;
 
-    const removed = await removeAuditC(user.id, id);
-    if (!removed) {
+    // Soft delete, scoped to a live AUDIT-C entry of the record: a foreign
+    // id, a screener's id or an entry already removed is the same 404.
+    const now = new Date();
+    const result = await prisma.mentalHealthAssessment.updateMany({
+      where: { id, userId: user.id, instrument: "AUDIT_C", deletedAt: null },
+      data: { deletedAt: now, syncVersion: { increment: 1 } },
+    });
+    if (result.count !== 1) {
       return apiError("AUDIT-C entry not found", 404, {
         errorCode: "anamnesis.auditC.notFound",
       });
     }
+    await invalidateHealthProfileFactConsumers(user.id, prisma);
+    const removed = { id, removedAt: now.toISOString() };
 
     await auditLog("anamnesis.audit_c.delete", {
       userId: user.id,

src/app/api/anamnesis/facts/__tests__/route.test.ts

@@ -106,6 +106,8 @@ describe("anamnesis facts API", () => {
       "user-1",
       "SMOKING_STATUS",
       "FORMER",
+      expect.any(Date),
+      undefined,
     );
     expect(mocks.audit).toHaveBeenCalledOnce();
   });
@@ -135,7 +137,13 @@ describe("anamnesis facts API", () => {
         where: expect.objectContaining({ id: "fact-1", userId: "user-1" }),
       }),
     );
-    expect(mocks.correct).toHaveBeenCalledWith("user-1", "fact-1", "NEVER");
+    expect(mocks.correct).toHaveBeenCalledWith(
+      "user-1",
+      "fact-1",
+      "NEVER",
+      expect.any(Date),
+      undefined,
+    );
     expect(mocks.audit).toHaveBeenCalledOnce();
   });