Pushing updates to a wallet

Once a patient's record is imported from their wallet as a permanent share, the clinic and the patient hold linked copies. When a clinician updates that record, they can push the update back to the patient's app — where it stays pending until the patient approves it on their phone. This is the clinic→patient direction of the patient-owned records flow.

Pushing an update

1. Edit the patient as usual, then open the patient sheet and click Push to wallet. The button appears only for wallet-linked patients (a permanent, approved share).
2. Tick the record sections that changed (and optionally add a short note) — this becomes the human-readable summary the patient sees. Click Send update.
3. The dialog shows the status: waiting → delivered → approved / declined. You can also review every push under Settings → Signing → Updates sent to wallets.

Sending straight from a dialog

You don't have to make a separate trip to the patient sheet. When you add or edit a record for a wallet-linked patient — an invoice, appointment, prescription, a demographics edit, or an AI note — the create/edit dialog shows a "Sync to wallet" stepper at the top:

1. Fill in the record and save as usual.
2. The stepper advances to a second step offering to send the change to the patient's wallet — confirm to push it (same seal-sign-approve flow as above), or skip.

Patients without a linked wallet never see the step — the dialog just closes on save.

What the patient sees

The update lands in the wallet app's pending-updates inbox (delivered live if the phone is online, or the next time the app connects). The patient reviews the clinic name, the change summary, and the clinic's key fingerprint, then approves or declines. Only on approval is the on-device record replaced.

On approval, the pushed snapshot carries the record itself plus the patient's appointments, invoices, prescriptions and the list of documents on file — each of these lives in its own table on the clinic side, so all of them ride along with the record.

How it's secured

• The full updated record is sealed (encrypted) to the wallet's key and signed with the clinic's Ed25519 signing key — the relay only ever forwards ciphertext.
• The wallet verifies the clinic signature before applying, and pins the clinic's key on first contact (trust-on-first-use): if a later update arrives signed with a different key, the app warns the patient rather than trusting it silently. The pin is held against the clinic's stable id, so renaming a clinic — or two clinics sharing a name — doesn't trigger a false warning.
• Approving replaces the patient's on-device copy with the pushed snapshot. In this first version that assumes a single linked clinic; the app states this in the approval screen.

See the signing API for the endpoints.