feat(sp14): 5-lane Inbox UI with Payer-Rejected acknowledge action

Closes the gap between the SP10 backend (5 lanes) and the SP6
frontend (4 lanes). The Payer-Rejected lane (277CA STC A4/A6/A7)
is now rendered alongside Rejected/Candidates/Unmatched/Done,
with an Acknowledge bulk action that drops claims from the
working surface without erasing the original 277CA rejection
event (audit log stays intact, SP11).

Backend:
* Migration 0010: add payer_rejected_acknowledged_at +
  payer_rejected_acknowledged_actor columns + partial index.
* db.py: surface the two new columns on the Claim model.
* inbox_lanes.py: filter acknowledged claims out of the
  payer_rejected lane; expose the new fields on the row payload
  for forward-compat (e.g. a future 'Recently acknowledged' view).
* api.py:
  - POST /api/inbox/payer-rejected/acknowledge
    Bulk-acknowledge. Idempotent. Returns transitioned /
    already_acked / not_found / not_rejected counts so the UI
    can show '3 of 5 were already acknowledged' on a noop bulk.
    Writes a 'claim.payer_rejected_acknowledged' event to the
    SP11 hash-chained audit log.
  - GET /api/inbox/export.csv: accept 'payer_rejected' lane.
* test_acks.py: bump user_version assertion to 10.
* test_lane_filter_acknowledged.py: 4 tests for the lane filter
  and forward-compat row payload.
* test_payer_rejected_acknowledge.py: 6 tests for the endpoint
  (happy path, idempotency, no-op on non-rejected, missing
  ids, 400 on empty, audit-log wiring + chain integrity).

Frontend:
* lib/inbox-api.ts: add payer_rejected to InboxLanes, add
  acknowledgePayerRejected(), update exportInboxCsvUrl union.
* hooks/useInboxLanes.ts: add payer_rejected to initial state.
* hooks/useInboxLanes.test.ts: add payer_rejected to mocks.
* components/inbox/BulkBar.tsx: add 'payer_rejected' lane with
  Acknowledge action (no Resubmit, no Dismiss — payer-rejected
  is not eligible for either).
* components/inbox/BulkBar.test.tsx: add payer_rejected test.
* pages/Inbox.tsx: render the 5th lane, hook up onAcknowledge,
  include payer_rejected in the needEyes count.
* pages/Inbox.test.tsx: 3 new tests (5-lane render, need-eyes
  count, acknowledge action hits the right endpoint).
* components/inbox/InboxHeader.tsx: doc comment now explains
  why payer_rejected rolls up into need-eyes.

Pre-existing typecheck warnings in BulkBar.test.tsx / InboxRow
.test.tsx / Lane.tsx / download.test.ts are unchanged from
main — not touched here.

Test counts: backend 724 -> 734 (+10). Frontend 350 -> 354 (+4).

backend/tests/test_acks.py

@@ -51,18 +51,18 @@ def test_migration_0002_creates_acks_table():
 
 def test_migration_latest_idempotent_on_fresh_db():
     """Re-running the migration on the same DB must be a no-op (PRAGMA
-    user_version already at the latest version — currently 9 after
+    user_version already at the latest version — currently 10 after
     0004-0006 line_reconciliation, 0005 ta1_acks, SP9's 0007
-    providers/payers/clearhouse, SP10's 0008 payer_rejected, and
-    SP11's 0009 audit_log)."""
+    providers/payers/clearhouse, SP10's 0008 payer_rejected,
+    SP11's 0009 audit_log, and SP14's 0010 payer_rejected_acknowledged)."""
     with db.engine().begin() as c:
         v1 = c.exec_driver_sql("PRAGMA user_version").scalar() or 0
-    assert v1 == 9
+    assert v1 == 10
     # A second run should not raise and should not bump the version.
     db_migrate.run(db.engine())
     with db.engine().begin() as c:
         v2 = c.exec_driver_sql("PRAGMA user_version").scalar() or 0
-    assert v2 == 9
+    assert v2 == 10
 
 
 def test_add_ack_persists_row():

backend/tests/test_lane_filter_acknowledged.py

@@ -0,0 +1,105 @@
+"""SP14 — Lane filter drops acknowledged payer-rejected claims.
+
+The Payer-Rejected Inbox lane must not include claims the operator
+has already acknowledged. This is the working-surface UX: acknowledged
+claims drop out so the operator only sees new rejections.
+"""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+import pytest
+
+from cyclone import db
+from cyclone.db import Batch, Claim, ClaimState
+from cyclone.inbox_lanes import compute_lanes
+
+
+@pytest.fixture(autouse=True)
+def _setup(tmp_path, monkeypatch):
+    monkeypatch.setenv("CYCLONE_DB_URL", f"sqlite:///{tmp_path}/test.db")
+    db._reset_for_tests()
+    db.init_db()
+
+
+def _seed(*, acked: bool = False) -> str:
+    now = datetime.now(timezone.utc)
+    cid = "C1"
+    with db.SessionLocal()() as session:
+        batch = Batch(
+            id="b-1", kind="837p",
+            input_filename="t.x12", parsed_at=now,
+        )
+        session.add(batch)
+        session.flush()
+        claim = Claim(
+            id=cid, batch_id=batch.id, patient_control_number=cid,
+            state=ClaimState.SUBMITTED, charge_amount=100,
+            payer_rejected_at=now,
+            payer_rejected_status_code="A7",
+            payer_rejected_reason="invalid dx",
+        )
+        if acked:
+            claim.payer_rejected_acknowledged_at = now
+            claim.payer_rejected_acknowledged_actor = "operator"
+        session.add(claim)
+        session.commit()
+    return cid
+
+
+def test_unacknowledged_claim_appears_in_lane():
+    _seed(acked=False)
+    with db.SessionLocal()() as session:
+        lanes = compute_lanes(session, dismissed_pairs=set())
+    assert len(lanes.payer_rejected) == 1
+    assert lanes.payer_rejected[0]["id"] == "C1"
+
+
+def test_acknowledged_claim_drops_out_of_lane():
+    _seed(acked=True)
+    with db.SessionLocal()() as session:
+        lanes = compute_lanes(session, dismissed_pairs=set())
+    assert lanes.payer_rejected == []
+
+
+def test_mix_of_acked_and_unacked():
+    """Only the unacknowledged one shows up."""
+    now = datetime.now(timezone.utc)
+    with db.SessionLocal()() as session:
+        batch = Batch(
+            id="b-1", kind="837p",
+            input_filename="t.x12", parsed_at=now,
+        )
+        session.add(batch)
+        session.flush()
+        for i, acked in enumerate([True, False, True, False]):
+            claim = Claim(
+                id=f"C{i}", batch_id=batch.id,
+                patient_control_number=f"PCN-{i}",
+                state=ClaimState.SUBMITTED, charge_amount=100,
+                payer_rejected_at=now,
+                payer_rejected_status_code="A7",
+            )
+            if acked:
+                claim.payer_rejected_acknowledged_at = now
+            session.add(claim)
+        session.commit()
+
+    with db.SessionLocal()() as session:
+        lanes = compute_lanes(session, dismissed_pairs=set())
+    ids = [r["id"] for r in lanes.payer_rejected]
+    assert sorted(ids) == ["C1", "C3"]
+
+
+def test_lane_row_carries_ack_fields_for_forward_compat():
+    """The row payload still carries the ack fields (all null on the lane)
+    so future views that want a 'Recently acknowledged' section don't need
+    a schema change."""
+    _seed(acked=False)
+    with db.SessionLocal()() as session:
+        lanes = compute_lanes(session, dismissed_pairs=set())
+    row = lanes.payer_rejected[0]
+    assert "payer_rejected_acknowledged_at" in row
+    assert row["payer_rejected_acknowledged_at"] is None
+    assert "payer_rejected_acknowledged_actor" in row
+    assert row["payer_rejected_acknowledged_actor"] is None

backend/tests/test_payer_rejected_acknowledge.py

@@ -0,0 +1,168 @@
+"""SP14 — Payer-Rejected acknowledge endpoint tests.
+
+The endpoint marks payer-rejected claims as acknowledged so the
+working-surface lane query filters them out. The original
+payer_rejected_* fields stay intact (SP11 audit).
+"""
+from __future__ import annotations
+
+import pytest
+
+from cyclone import db
+from cyclone.db import Claim, ClaimState
+from cyclone.audit_log import verify_chain
+
+
+@pytest.fixture(autouse=True)
+def _setup(tmp_path, monkeypatch):
+    monkeypatch.setenv("CYCLONE_DB_URL", f"sqlite:///{tmp_path}/test.db")
+    db._reset_for_tests()
+    db.init_db()
+
+
+def _make_claim(claim_id: str, *, payer_rejected: bool = True) -> None:
+    """Insert a minimal claim with optional payer_rejected markers."""
+    from datetime import datetime, timezone
+    from cyclone.db import Batch
+    with db.SessionLocal()() as session:
+        batch = Batch(
+            id=f"b-{claim_id}",
+            kind="837p",
+            input_filename="t.x12",
+            parsed_at=datetime.now(timezone.utc),
+        )
+        session.add(batch)
+        session.flush()
+        claim = Claim(
+            id=claim_id,
+            batch_id=batch.id,
+            patient_control_number=claim_id,
+            state=ClaimState.SUBMITTED,
+            charge_amount=100,
+        )
+        if payer_rejected:
+            now = datetime.now(timezone.utc)
+            claim.payer_rejected_at = now
+            claim.payer_rejected_reason = "invalid diagnosis code"
+            claim.payer_rejected_status_code = "A7"
+        session.add(claim)
+        session.commit()
+
+
+def test_acknowledge_marks_unacknowledged_claim():
+    _make_claim("C1", payer_rejected=True)
+    from fastapi.testclient import TestClient
+    from cyclone.api import app
+    with TestClient(app) as client:
+        r = client.post(
+            "/api/inbox/payer-rejected/acknowledge",
+            json={"claim_ids": ["C1"], "actor": "operator"},
+        )
+    assert r.status_code == 200, r.text
+    body = r.json()
+    assert body["ok"] is True
+    assert body["transitioned"] == 1
+    assert body["already_acked"] == 0
+    assert body["not_found"] == 0
+    assert body["not_rejected"] == 0
+
+    with db.SessionLocal()() as session:
+        c = session.get(Claim, "C1")
+        assert c.payer_rejected_acknowledged_at is not None
+        assert c.payer_rejected_acknowledged_actor == "operator"
+        # Original fields stay intact for audit.
+        assert c.payer_rejected_at is not None
+        assert c.payer_rejected_status_code == "A7"
+        assert c.payer_rejected_reason == "invalid diagnosis code"
+
+
+def test_acknowledge_is_idempotent():
+    _make_claim("C1", payer_rejected=True)
+    from fastapi.testclient import TestClient
+    from cyclone.api import app
+    with TestClient(app) as client:
+        r1 = client.post(
+            "/api/inbox/payer-rejected/acknowledge",
+            json={"claim_ids": ["C1"]},
+        )
+        assert r1.json()["transitioned"] == 1
+        r2 = client.post(
+            "/api/inbox/payer-rejected/acknowledge",
+            json={"claim_ids": ["C1"]},
+        )
+        assert r2.json()["transitioned"] == 0
+        assert r2.json()["already_acked"] == 1
+
+
+def test_acknowledge_skips_non_payer_rejected_claims():
+    _make_claim("C1", payer_rejected=False)
+    from fastapi.testclient import TestClient
+    from cyclone.api import app
+    with TestClient(app) as client:
+        r = client.post(
+            "/api/inbox/payer-rejected/acknowledge",
+            json={"claim_ids": ["C1"]},
+        )
+        assert r.status_code == 200
+        body = r.json()
+        assert body["transitioned"] == 0
+        assert body["not_rejected"] == 1
+
+
+def test_acknowledge_counts_missing_ids():
+    from fastapi.testclient import TestClient
+    from cyclone.api import app
+    with TestClient(app) as client:
+        r = client.post(
+            "/api/inbox/payer-rejected/acknowledge",
+            json={"claim_ids": ["nope"]},
+        )
+        assert r.status_code == 200
+        body = r.json()
+        assert body["transitioned"] == 0
+        assert body["not_found"] == 1
+
+
+def test_acknowledge_empty_claim_ids_400():
+    from fastapi.testclient import TestClient
+    from cyclone.api import app
+    with TestClient(app) as client:
+        r = client.post(
+            "/api/inbox/payer-rejected/acknowledge",
+            json={"claim_ids": []},
+        )
+        assert r.status_code == 400
+
+
+def test_acknowledge_writes_audit_event():
+    _make_claim("C1", payer_rejected=True)
+    from fastapi.testclient import TestClient
+    from cyclone.api import app
+    with TestClient(app) as client:
+        r = client.post(
+            "/api/inbox/payer-rejected/acknowledge",
+            json={"claim_ids": ["C1"], "actor": "alice"},
+        )
+        assert r.status_code == 200
+
+    # SP11: the chain is intact and includes the new event.
+    with db.SessionLocal()() as session:
+        result = verify_chain(session)
+        assert result.ok, f"chain broken: {result.reason} at {result.first_bad_id}"
+
+    # And the event itself is queryable.
+    import json as _json
+    from cyclone.db import AuditLog
+    with db.SessionLocal()() as session:
+        events = (
+            session.query(AuditLog)
+            .filter(AuditLog.event_type == "claim.payer_rejected_acknowledged")
+            .all()
+        )
+        assert len(events) == 1
+        e = events[0]
+        assert e.entity_type == "claim"
+        assert e.entity_id == "C1"
+        assert e.actor == "alice"
+        payload = _json.loads(e.payload_json) if e.payload_json else {}
+        assert payload["payer_rejected_status_code"] == "A7"