cms165 blood pressures are not profile-stamped at WebChart ingest — #533's other half, which closed with the issue

Start with backend-ts/src/wiring/qicore-preparation.ts and the cited ADR-037 and ADR-057 decisions, then trace WebChart ingest to the executor. Check the existing corpus-path test coverage and add coverage that exercises an unstamped live-data bundle. Done means blood-pressure Observations are handled deterministically at ingest and the unknown-status behavior is explicit and tested.

#533 was closed on 2026-09-08, but only half of it shipped. Four documents still cite #533 as the open tracker for the other half — docs/MEASURES.md:81,95, docs/DECISIONS.md:929, docs/DEPLOY.md:320 and docs/ROADMAP_2026-08-30.md:284. A closed issue cannot carry work, so this one does.

What is still outstanding

cms165 (Controlling High Blood Pressure) is routed on the sandbox (ADR-078) and runs correctly there, because the generated corpus stamps every QI-Core profile at build time. Live WebChart data is not stamped.

Two facts make that a silent failure rather than a loud one:

1. cms165 identifies a blood pressure by PROFILE ALONE. It is the only Observation retrieve in the routed set that does so (see the comment in backend-ts/src/wiring/qicore-preparation.ts).
2. cqf-fhir-cr retrieval is meta.profile-sensitive — an unstamped resource is silently never retrieved. Nothing errors. The measure simply reports the patient out of population or missing data.

So on real data, cms165 would report a clean-looking result computed over blood pressures the engine never saw. That is the worst shape a defect can have here: a number that looks right.

There is a second, related input: WebChart returns BP panels with status: "unknown" (recorded in docs/DEPLOY.md:320 and in the teatea trial findings), and ADR-057's rule is that deriving a status is an inference we do not make silently.

Scope

• Stamp QI-Core profiles on blood-pressure Observations at WebChart ingest, deterministically and per ADR-037 (normalization only, never fabrication).
• Decide what a status: "unknown" BP panel means for retrieval, explicitly — and refuse rather than promote it to final if that is the honest answer (ADR-057's direction).
• A test that fails when a bundle reaches the executor unstamped, rather than one that asserts the corpus path still works.

Scope note

This gates the PHI phase, not the sandbox. ADR-078 routed cms165 on the sandbox by owner decision with exactly this caveat attached, and LOCKED §4A.5's "no known-unverified measure" bar is read as applying to what the pilot runs over real data. Nothing here blocks the current sandbox.

Related: #532 (cms165's 11/68 cross-engine disagreements — CLOSED 2026-09-15), #572 (56 of 68 fall out of the Java engine's initial population), ADR-078, ADR-057, ADR-037.