feat(health): P0 平台基座回顾 — 7项上线前必修

P0-1: 危急值告警消费者 — health_data.critical_alert 事件推送给责任医护
P0-2: 危急值阈值可配置化 — 硬编码改为数据库配置(critical_value_threshold表)，支持科室/年龄差异化
P0-3: daily_monitoring合并后告警验证 — update_vital_signs也触发危急值检测
P0-4: 随访逾期通知+幂等保护 — 只通知本次新标记的逾期任务，避免重复
P0-5: 知情同意记录(consent) — 新增实体/迁移/Service/Handler，PIPL合规
P0-6: 审计日志补全 — 患者更新记录前后值(过敏史/病史/状态变更)
P0-7: EventBus持久化增强 — 两阶段提交(pending→published)+启动时outbox relay恢复

crates/erp-server/migration/src/lib.rs

@@ -59,6 +59,8 @@ mod m20260426_000056_create_diagnosis;
 mod m20260426_000057_rename_points_transaction_type_column;
 mod m20260426_000058_merge_daily_monitoring_into_vital_signs;
 mod m20260426_000059_seed_menus;
+mod m20260426_000060_create_critical_value_thresholds;
+mod m20260426_000061_create_consent;
 
 pub struct Migrator;
 
@@ -125,6 +127,8 @@ impl MigratorTrait for Migrator {
             Box::new(m20260426_000057_rename_points_transaction_type_column::Migration),
             Box::new(m20260426_000058_merge_daily_monitoring_into_vital_signs::Migration),
             Box::new(m20260426_000059_seed_menus::Migration),
+            Box::new(m20260426_000060_create_critical_value_thresholds::Migration),
+            Box::new(m20260426_000061_create_consent::Migration),
         ]
     }
 }

crates/erp-server/migration/src/m20260426_000060_create_critical_value_thresholds.rs

@@ -0,0 +1,141 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(CriticalValueThreshold::Table)
+                    .col(
+                        ColumnDef::new(CriticalValueThreshold::Id)
+                            .uuid()
+                            .not_null()
+                            .primary_key(),
+                    )
+                    .col(
+                        ColumnDef::new(CriticalValueThreshold::TenantId)
+                            .uuid()
+                            .not_null(),
+                    )
+                    .col(
+                        ColumnDef::new(CriticalValueThreshold::Indicator)
+                            .string_len(50)
+                            .not_null(),
+                    )
+                    .col(
+                        ColumnDef::new(CriticalValueThreshold::Direction)
+                            .string_len(10)
+                            .not_null(),
+                    )
+                    .col(
+                        ColumnDef::new(CriticalValueThreshold::ThresholdValue)
+                            .double()
+                            .not_null(),
+                    )
+                    .col(
+                        ColumnDef::new(CriticalValueThreshold::Level)
+                            .string_len(20)
+                            .not_null()
+                            .default("critical"),
+                    )
+                    .col(
+                        ColumnDef::new(CriticalValueThreshold::Department)
+                            .string_len(100),
+                    )
+                    .col(ColumnDef::new(CriticalValueThreshold::AgeMin).integer())
+                    .col(ColumnDef::new(CriticalValueThreshold::AgeMax).integer())
+                    .col(
+                        ColumnDef::new(CriticalValueThreshold::IsActive)
+                            .boolean()
+                            .not_null()
+                            .default(true),
+                    )
+                    .col(
+                        ColumnDef::new(CriticalValueThreshold::CreatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(
+                        ColumnDef::new(CriticalValueThreshold::UpdatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(ColumnDef::new(CriticalValueThreshold::CreatedBy).uuid())
+                    .col(ColumnDef::new(CriticalValueThreshold::UpdatedBy).uuid())
+                    .col(ColumnDef::new(CriticalValueThreshold::DeletedAt).timestamp_with_time_zone())
+                    .col(
+                        ColumnDef::new(CriticalValueThreshold::Version)
+                            .integer()
+                            .not_null()
+                            .default(1),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx_cvt_tenant_indicator_direction")
+                    .table(CriticalValueThreshold::Table)
+                    .col(CriticalValueThreshold::TenantId)
+                    .col(CriticalValueThreshold::Indicator)
+                    .col(CriticalValueThreshold::Direction)
+                    .to_owned(),
+            )
+            .await?;
+
+        // 种子数据：默认危急值阈值
+        let sql = r#"
+            INSERT INTO critical_value_threshold (id, tenant_id, indicator, direction, threshold_value, level, created_at, updated_at) VALUES
+            (gen_random_uuid(), '00000000-0000-0000-0000-000000000001', 'systolic_bp',  'high', 180,  'critical', now(), now()),
+            (gen_random_uuid(), '00000000-0000-0000-0000-000000000001', 'systolic_bp',  'low',  80,   'critical', now(), now()),
+            (gen_random_uuid(), '00000000-0000-0000-0000-000000000001', 'diastolic_bp', 'high', 110,  'critical', now(), now()),
+            (gen_random_uuid(), '00000000-0000-0000-0000-000000000001', 'diastolic_bp', 'low',  50,   'critical', now(), now()),
+            (gen_random_uuid(), '00000000-0000-0000-0000-000000000001', 'heart_rate',   'high', 150,  'critical', now(), now()),
+            (gen_random_uuid(), '00000000-0000-0000-0000-000000000001', 'heart_rate',   'low',  40,   'critical', now(), now()),
+            (gen_random_uuid(), '00000000-0000-0000-0000-000000000001', 'blood_sugar',  'high', 25.0, 'critical', now(), now()),
+            (gen_random_uuid(), '00000000-0000-0000-0000-000000000001', 'blood_sugar',  'low',  2.5,  'critical', now(), now())
+        "#;
+        manager.get_connection().execute_unprepared(sql).await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(
+                Table::drop()
+                    .table(CriticalValueThreshold::Table)
+                    .to_owned(),
+            )
+            .await
+    }
+}
+
+#[derive(DeriveIden)]
+enum CriticalValueThreshold {
+    Table,
+    Id,
+    TenantId,
+    Indicator,
+    Direction,
+    ThresholdValue,
+    Level,
+    Department,
+    AgeMin,
+    AgeMax,
+    IsActive,
+    CreatedAt,
+    UpdatedAt,
+    CreatedBy,
+    UpdatedBy,
+    DeletedAt,
+    Version,
+}

crates/erp-server/migration/src/m20260426_000061_create_consent.rs

@@ -0,0 +1,102 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(
+                Table::create()
+                    .table(Consent::Table)
+                    .col(
+                        ColumnDef::new(Consent::Id)
+                            .uuid()
+                            .not_null()
+                            .primary_key(),
+                    )
+                    .col(ColumnDef::new(Consent::TenantId).uuid().not_null())
+                    .col(ColumnDef::new(Consent::PatientId).uuid().not_null())
+                    .col(ColumnDef::new(Consent::ConsentType).string_len(50).not_null())
+                    .col(ColumnDef::new(Consent::ConsentScope).string_len(100).not_null())
+                    .col(
+                        ColumnDef::new(Consent::Status)
+                            .string_len(20)
+                            .not_null()
+                            .default("granted"),
+                    )
+                    .col(ColumnDef::new(Consent::GrantedAt).timestamp_with_time_zone())
+                    .col(ColumnDef::new(Consent::RevokedAt).timestamp_with_time_zone())
+                    .col(ColumnDef::new(Consent::ExpiryDate).date())
+                    .col(ColumnDef::new(Consent::ConsentMethod).string_len(30))
+                    .col(ColumnDef::new(Consent::WitnessName).string_len(100))
+                    .col(ColumnDef::new(Consent::Notes).text())
+                    .col(
+                        ColumnDef::new(Consent::CreatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(
+                        ColumnDef::new(Consent::UpdatedAt)
+                            .timestamp_with_time_zone()
+                            .not_null()
+                            .default(Expr::current_timestamp()),
+                    )
+                    .col(ColumnDef::new(Consent::CreatedBy).uuid())
+                    .col(ColumnDef::new(Consent::UpdatedBy).uuid())
+                    .col(ColumnDef::new(Consent::DeletedAt).timestamp_with_time_zone())
+                    .col(
+                        ColumnDef::new(Consent::Version)
+                            .integer()
+                            .not_null()
+                            .default(1),
+                    )
+                    .to_owned(),
+            )
+            .await?;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx_consent_tenant_patient")
+                    .table(Consent::Table)
+                    .col(Consent::TenantId)
+                    .col(Consent::PatientId)
+                    .to_owned(),
+            )
+            .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(Consent::Table).to_owned())
+            .await
+    }
+}
+
+#[derive(DeriveIden)]
+enum Consent {
+    Table,
+    Id,
+    TenantId,
+    PatientId,
+    ConsentType,
+    ConsentScope,
+    Status,
+    GrantedAt,
+    RevokedAt,
+    ExpiryDate,
+    ConsentMethod,
+    WitnessName,
+    Notes,
+    CreatedAt,
+    UpdatedAt,
+    CreatedBy,
+    UpdatedBy,
+    DeletedAt,
+    Version,
+}

crates/erp-server/src/outbox.rs

@@ -1,20 +1,32 @@
 use chrono::Utc;
-use sea_orm::{ActiveModelTrait, ColumnTrait, EntityTrait, QueryFilter, Set};
+use sea_orm::{ActiveModelTrait, ColumnTrait, EntityTrait, QueryFilter, QueryOrder, QuerySelect, Set};
 use std::time::Duration;
 
 use erp_core::entity::domain_event;
 use erp_core::events::{DomainEvent, EventBus};
 
+const MAX_RETRY: i32 = 5;
+
 /// 启动 outbox relay 后台任务。
 ///
-/// 定期扫描 domain_events 表中 status = 'pending' 的事件，
-/// 重新广播并标记为 published。
+/// 先执行一次性扫描（处理服务重启前遗留的 pending 事件），
+/// 然后每 5 秒定期扫描 domain_events 表中 status = 'pending' 的事件。
 pub fn start_outbox_relay(db: sea_orm::DatabaseConnection, event_bus: EventBus) {
+    let db_clone = db.clone();
+    let event_bus_clone = event_bus.clone();
     tokio::spawn(async move {
+        // 启动时立即处理一次（恢复重启前未广播的事件）
+        match process_pending_events(&db_clone, &event_bus_clone).await {
+            Ok(count) if count > 0 => tracing::info!(count = count, "启动时 outbox relay 恢复完成"),
+            Ok(_) => tracing::info!("启动时 outbox relay 无待处理事件"),
+            Err(e) => tracing::warn!(error = %e, "启动时 outbox relay 处理失败"),
+        }
+
+        // 定期轮询
         let mut interval = tokio::time::interval(Duration::from_secs(5));
         loop {
             interval.tick().await;
-            if let Err(e) = process_pending_events(&db, &event_bus).await {
+            if let Err(e) = process_pending_events(&db_clone, &event_bus_clone).await {
                 tracing::warn!(error = %e, "Outbox relay 处理失败");
             }
         }
@@ -24,35 +36,42 @@ pub fn start_outbox_relay(db: sea_orm::DatabaseConnection, event_bus: EventBus)
 async fn process_pending_events(
     db: &sea_orm::DatabaseConnection,
     event_bus: &EventBus,
-) -> Result<(), sea_orm::DbErr> {
+) -> Result<usize, sea_orm::DbErr> {
     let pending = domain_event::Entity::find()
         .filter(domain_event::Column::Status.eq("pending"))
-        .filter(domain_event::Column::Attempts.lt(3))
+        .filter(domain_event::Column::Attempts.lt(MAX_RETRY))
+        .order_by_asc(domain_event::Column::CreatedAt)
+        .limit(100)
         .all(db)
         .await?;
 
     if pending.is_empty() {
-        return Ok(());
+        return Ok(0);
     }
 
-    tracing::info!(count = pending.len(), "处理待发领域事件");
+    let count = pending.len();
+    tracing::info!(count = count, "处理待发领域事件");
 
     for event_model in pending {
-        // 重建 DomainEvent 并广播
-        let domain_event = DomainEvent::new(
-            &event_model.event_type,
-            event_model.tenant_id,
-            event_model.payload.clone().unwrap_or(serde_json::json!({})),
-        );
+        // 重建 DomainEvent 并广播（保留原始 ID 和时间戳）
+        let domain_event = DomainEvent {
+            id: event_model.id,
+            event_type: event_model.event_type.clone(),
+            tenant_id: event_model.tenant_id,
+            payload: event_model.payload.clone().unwrap_or(serde_json::json!({})),
+            timestamp: event_model.created_at,
+            correlation_id: event_model.correlation_id.unwrap_or(event_model.id),
+        };
 
         event_bus.broadcast(domain_event);
 
-        // 标记为 published
+        // 标记为 published，增加 attempts 计数
         let mut active: domain_event::ActiveModel = event_model.into();
         active.status = Set("published".to_string());
         active.published_at = Set(Some(Utc::now()));
+        active.attempts = Set(active.attempts.unwrap() + 1);
         active.update(db).await?;
     }
 
-    Ok(())
+    Ok(count)
 }