VSAC import: pin expansions to a release manifest + record version provenance

[Taleef7]

From the HL7 Connectathon research (defect D3, HL7 Connectathon/RESEARCH_FINDINGS_2026-07-15.md §2.5/§3):

pnpm resolve-valuesets currently $expands with no manifest/version pinning (latest-active semantics — a VSAC republish silently changes our expansions and therefore the CMS122/CMS125 literal results), writes version: null despite receiving ValueSet.version (column exists, is in the UNIQUE key), discards expansion.identifier/timestamp, and uses a 32-bit rolling expansion_hash.

Work items:

• --manifest <canonical> / --expansion <name> params on the CLI, appended to $expand (VSAC supports both today; default to the current eCQM AU manifest, e.g. Library/ecqm-update-2025-05-08 — verify exact id)
• Record ValueSet.version + expansion.identifier/timestamp (stop hardcoding null); include in the VALUE_SETS_RESOLVED audit payload
• SHA-256 the expansion hash (include version fields)
• Drift detection on re-import: distinct VALUE_SET_EXPANSION_CHANGED audit event when the hash changes
• Design call: reconcile runtime live-expansion vs imported rows (store-first preference for imported OIDs) — currently two potentially different 'official' expansions on a VSAC-keyed deployment

Refs: QM IG Measure Terminology Service (manifest/expansion profile), https://www.nlm.nih.gov/vsac/support/usingvsac/vsacfhirapi.html. Existing columns only — no DDL. ~half-day + the design call.