The instructions here are too fuzzy.

"The DTR process MAY request other scopes to retrieve FHIR resources to evaluate payer rules. The DTR process MAY also request the openid and fhirUser scopes to establish a user session. Greater detail on this can be found in Section 4.4.5.2 - Requesting User Identity."

Actually, there's no 'MAY' about it.  Additional scopes will absolutely be required at some point.  The question is "when should it happen?"  Should the app initially request all scopes, or does it start with the patient scope so it can get the launch context, then request additional scopes as needed to retrieve the relevant order, then retrieve the Questionnaire, then request the scopes needed to satisfy the Questionnaire queries - or should it always ask for everything.  We need explicit guidance here (and users to decide whether they want a self-limiting app that's more annoying with user prompts; or an app that expects access to everything, but only prompts the user once.

We say we want the patient back - if so, we should be mandating the launch/patient context.  (Then the patient should automatically come back and we don't have to mandate anything.)

Saying we 'MAY' request the openid fhirUser, then the referenced content saying we SHALL have the user isn't super helpful.  We need the user, so make that a SHALL here too.  Also, there reference link doesn't provide any detail other than why.  So how about we just clearly state here what the initial launch contexts SHALL be along with why and not bother with the reference.