From 75303e8b849cc98517b8c3f3f5fd707659f31f8f Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 21 Jul 2026 20:21:47 +0800
Subject: [PATCH 1/3] fix(medication-safety): fail-safe physiological bounds
 for patient-profile inputs (FV-03)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Patient-considerations profile numeric fields (age/eGFR/CrCl/QTc/serum
creatinine) fed the medication-safety alert engine with no validation, so a
garbage-but-present value in a gate's non-firing direction (e.g. a negative
QTc) could silently flip a contraindication from the fail-safe "unassessed"
state to a false all-clear.

- sanitizeProfile now rejects physiologically impossible / out-of-range values
  to null (never clamps), routing them into the existing fail-closed unassessed
  path. Bounds are input-validity only and kept separate from the clinical
  firing thresholds. Serum creatinine is unit-aware (µmol/L canonical, mg/dL
  normalised x88.4).
- Close a latent false-all-clear hole in the bare-renal factor: the
  "eGFR or CrCl" unassessed signal now fires when EITHER renal input is missing
  and neither fired (was: both missing). No behaviour change on the current
  corpus (0 bare-renal contraindication rows) — pure hardening.
- Patient profile form gains min/max + aria-invalid + an inline out-of-range
  message; the invalid entry is never committed to the shared store.

Fix design adversarially verified before implementation: null-routing can never
convert a firing contraindication into a false all-clear (once the bare-renal
hole is closed), and the bounds never reject a legitimate clinical value.

Verified offline: typecheck, lint, format:check, full unit+jsdom suite
(349 files / 3120 passed / 0 failed), design-system-contract (baselines
unchanged), type-scale, icon-scale, check:production-readiness (READY).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../patient-profile-panel.tsx                 |  85 ++++++++++++-
 src/lib/medication-patient-alerts.ts          |   7 +-
 src/lib/patient-profile-storage.ts            |  52 ++++++--
 tests/medication-patient-alerts.test.ts       |  36 ++++++
 tests/patient-profile-panel.dom.test.tsx      |  89 +++++++++++++
 tests/patient-profile-storage.test.ts         | 120 ++++++++++++++++++
 6 files changed, 375 insertions(+), 14 deletions(-)
 create mode 100644 tests/patient-profile-panel.dom.test.tsx
 create mode 100644 tests/patient-profile-storage.test.ts

diff --git a/src/components/clinical-dashboard/patient-profile-panel.tsx b/src/components/clinical-dashboard/patient-profile-panel.tsx
index dcad3a6cd8..5029974bb0 100644
--- a/src/components/clinical-dashboard/patient-profile-panel.tsx
+++ b/src/components/clinical-dashboard/patient-profile-panel.tsx
@@ -5,7 +5,9 @@ import { useId, useState } from "react";
 
 import { usePatientProfile } from "@/components/clinical-dashboard/patient-profile-context";
 import { cn, fieldControlPlain, fieldLabel, ToggleSwitch } from "@/components/ui-primitives";
+import { SCR_UMOL_PER_MGDL } from "@/lib/medication-patient-alerts";
 import type { AllergyClass, HepaticSeverity, ScrUnit } from "@/lib/medication-patient-alerts";
+import { PATIENT_PROFILE_NUMERIC_BOUNDS, PATIENT_PROFILE_SCR_UMOL_BOUNDS } from "@/lib/patient-profile-storage";
 
 const HEPATIC_OPTIONS: { value: HepaticSeverity; label: string }[] = [
   { value: "none", label: "None" },
@@ -48,14 +50,34 @@ function NumberField({
   value,
   onChange,
   testId,
+  min,
+  max,
 }: {
   label: string;
   unit?: string;
   value: number | null | undefined;
   onChange: (value: number | null) => void;
   testId?: string;
+  min: number;
+  max: number;
 }) {
   const id = useId();
+  const errorId = `${id}-error`;
+  const [text, setText] = useState(value == null ? "" : String(value));
+  const [syncedValue, setSyncedValue] = useState<number | null>(value ?? null);
+
+  // React-sanctioned "adjust state during render" reconciliation: when the stored
+  // value changes from outside this field (e.g. a cross-page store update), re-sync
+  // the buffer — but keep an in-progress out-of-range entry so its validation
+  // message stays visible. A profile Clear remounts the field via `key` instead
+  // (the stored value is already null there, so no prop change would fire here).
+  const parsed = parseNumber(text);
+  const outOfRange = parsed !== null && (parsed < min || parsed > max);
+  if ((value ?? null) !== syncedValue) {
+    setSyncedValue(value ?? null);
+    if (!outOfRange) setText(value == null ? "" : String(value));
+  }
+
   return (
     <div>
       <label htmlFor={id} className={fieldLabel}>
@@ -66,11 +88,33 @@ function NumberField({
         id={id}
         type="number"
         inputMode="decimal"
-        value={value ?? ""}
-        onChange={(event) => onChange(parseNumber(event.target.value))}
-        className={cn(fieldControlPlain, "nums")}
+        min={min}
+        max={max}
+        value={text}
+        onChange={(event) => {
+          const raw = event.target.value;
+          setText(raw);
+          // Commit only in-range numbers; an empty or out-of-range entry commits
+          // null so the alert engine treats it as a missing input (surfaced as
+          // "unassessed") rather than acting on a physiologically impossible value.
+          const next = parseNumber(raw);
+          onChange(next !== null && next >= min && next <= max ? next : null);
+        }}
+        aria-invalid={outOfRange || undefined}
+        aria-describedby={outOfRange ? errorId : undefined}
+        className={cn(fieldControlPlain, "nums", outOfRange && "border-[color:var(--danger-border)]")}
         data-testid={testId}
       />
+      {outOfRange ? (
+        <span
+          id={errorId}
+          role="alert"
+          className="mt-1 block text-2xs font-medium leading-4 text-[color:var(--danger)]"
+        >
+          Enter {min}–{max}
+          {unit ? ` ${unit}` : ""}.
+        </span>
+      ) : null}
     </div>
   );
 }
@@ -87,8 +131,23 @@ export function PatientProfilePanel({
 }) {
   const { profile, updateField, toggleAllergy, clear, isEmpty } = usePatientProfile();
   const [open, setOpen] = useState(defaultOpen ?? variant === "full");
+  // Bumped on Clear to remount the numeric fields, so an out-of-range entry that
+  // is showing a validation message (stored value already null) is reset too.
+  const [resetNonce, setResetNonce] = useState(0);
   const allergies = new Set(profile.allergies ?? []);
 
+  // Serum-creatinine validity bounds are canonical in µmol/L; convert to the
+  // active display unit (rounding inward so the field and the storage-layer
+  // check agree on the edge). Same conversion factor the alert engine uses.
+  const scrUnit = profile.scrUnit ?? "umol/L";
+  const scrBounds =
+    scrUnit === "mg/dL"
+      ? {
+          min: Math.ceil((PATIENT_PROFILE_SCR_UMOL_BOUNDS.min / SCR_UMOL_PER_MGDL) * 100) / 100,
+          max: Math.floor((PATIENT_PROFILE_SCR_UMOL_BOUNDS.max / SCR_UMOL_PER_MGDL) * 100) / 100,
+        }
+      : PATIENT_PROFILE_SCR_UMOL_BOUNDS;
+
   return (
     <details
       open={open}
@@ -119,39 +178,54 @@ export function PatientProfilePanel({
       <div className="space-y-3 border-t border-[color:var(--border)] p-3">
         <div className="grid grid-cols-2 gap-2.5 sm:grid-cols-3">
           <NumberField
+            key={`age-${resetNonce}`}
             label="Age"
             unit="years"
             value={profile.ageYears}
             onChange={(value) => updateField("ageYears", value)}
             testId="patient-age"
+            min={PATIENT_PROFILE_NUMERIC_BOUNDS.ageYears.min}
+            max={PATIENT_PROFILE_NUMERIC_BOUNDS.ageYears.max}
           />
           <NumberField
+            key={`egfr-${resetNonce}`}
             label="eGFR"
             unit="mL/min"
             value={profile.egfr}
             onChange={(value) => updateField("egfr", value)}
             testId="patient-egfr"
+            min={PATIENT_PROFILE_NUMERIC_BOUNDS.egfr.min}
+            max={PATIENT_PROFILE_NUMERIC_BOUNDS.egfr.max}
           />
           <NumberField
+            key={`crcl-${resetNonce}`}
             label="CrCl"
             unit="mL/min"
             value={profile.crcl}
             onChange={(value) => updateField("crcl", value)}
             testId="patient-crcl"
+            min={PATIENT_PROFILE_NUMERIC_BOUNDS.crcl.min}
+            max={PATIENT_PROFILE_NUMERIC_BOUNDS.crcl.max}
           />
           <NumberField
+            key={`qtc-${resetNonce}`}
             label="QTc"
             unit="ms"
             value={profile.qtc}
             onChange={(value) => updateField("qtc", value)}
             testId="patient-qtc"
+            min={PATIENT_PROFILE_NUMERIC_BOUNDS.qtc.min}
+            max={PATIENT_PROFILE_NUMERIC_BOUNDS.qtc.max}
           />
           <div className="col-span-2 sm:col-span-1">
             <NumberField
+              key={`scr-${resetNonce}-${scrUnit}`}
               label="Serum creatinine"
               value={profile.scr}
               onChange={(value) => updateField("scr", value)}
               testId="patient-scr"
+              min={scrBounds.min}
+              max={scrBounds.max}
             />
           </div>
           <fieldset className="col-span-2 min-w-0 sm:col-span-1">
@@ -236,7 +310,10 @@ export function PatientProfilePanel({
           </span>
           <button
             type="button"
-            onClick={clear}
+            onClick={() => {
+              clear();
+              setResetNonce((nonce) => nonce + 1);
+            }}
             disabled={isEmpty}
             className="ml-auto inline-flex min-h-tap items-center gap-1.5 rounded-lg border border-[color:var(--border)] px-2.5 text-2xs font-semibold text-[color:var(--text-muted)] transition hover:border-[color:var(--border-strong)] hover:text-[color:var(--text-heading)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[color:var(--focus)] disabled:cursor-not-allowed disabled:opacity-50"
           >
diff --git a/src/lib/medication-patient-alerts.ts b/src/lib/medication-patient-alerts.ts
index 6d04960332..5a857c7606 100644
--- a/src/lib/medication-patient-alerts.ts
+++ b/src/lib/medication-patient-alerts.ts
@@ -283,7 +283,12 @@ function evaluateRow(patient: MedicationPatientMetadata, profile: PatientProfile
       const crcl = numberField(profile.crcl);
       if (egfr !== null && egfr < RENAL_IMPAIRMENT_EGFR) reasons.push(`Renal impairment (eGFR ${egfr})`);
       else if (crcl !== null && crcl < RENAL_IMPAIRMENT_EGFR) reasons.push(`Renal impairment (CrCl ${crcl})`);
-      else if (egfr === null && crcl === null) missingGates.push("eGFR or CrCl");
+      // Fail-safe: flag the gate unassessed when EITHER renal input is missing and
+      // neither fired. A renal contraindication clears only when both eGFR and CrCl
+      // are present and non-firing, so an input rejected as out-of-range (nulled by
+      // sanitizeProfile) can never be silently read as an all-clear when the other
+      // input happens to be present and normal.
+      else if (egfr === null || crcl === null) missingGates.push("eGFR or CrCl");
     } else if (factor === "hepatic" && !coversHepatic) {
       if (!profile.hepatic) missingGates.push("hepatic status");
       else if (profile.hepatic !== "none") reasons.push(`${capitalize(profile.hepatic)} hepatic impairment`);
diff --git a/src/lib/patient-profile-storage.ts b/src/lib/patient-profile-storage.ts
index bfb79a8486..c543cbc593 100644
--- a/src/lib/patient-profile-storage.ts
+++ b/src/lib/patient-profile-storage.ts
@@ -11,6 +11,7 @@
 // `use-sidebar-collapsed.ts` — which shares state across the prescribing
 // workspace and detail pages without a hydration mismatch or setState-in-effect.
 
+import { SCR_UMOL_PER_MGDL } from "@/lib/medication-patient-alerts";
 import type { AllergyClass, HepaticSeverity, PatientProfile, ScrUnit } from "@/lib/medication-patient-alerts";
 
 export const PATIENT_PROFILE_STORAGE_KEY = "clinical-kb-patient-profile";
@@ -40,11 +41,44 @@ const ALLERGY_CLASSES: AllergyClass[] = [
   "fluoroquinolone",
 ];
 
-function numberOrNull(value: unknown): number | null {
-  return typeof value === "number" && Number.isFinite(value) ? value : null;
+// Physiological input-VALIDITY bounds (inclusive). These are deliberately NOT the
+// clinical firing thresholds (RENAL_IMPAIRMENT_EGFR / QTC_PROLONGED_MS / the age
+// cut-offs live in medication-patient-alerts.ts and must never be relaxed here):
+// they only reject values that are physically impossible or a clear data-entry
+// error. An out-of-range entry is rejected to `null` — never clamped — so the
+// alert engine treats it as a missing input and surfaces a contraindication row
+// as "unassessed" rather than reading garbage as a false all-clear. Ranges
+// verified 2026-07-21 against clinical extremes: neonate age 0, anuric eGFR/CrCl
+// 0, short-QT syndrome ~250 ms, augmented renal clearance CrCl ~350, severe-AKI
+// creatinine ~2200 µmol/L.
+export const PATIENT_PROFILE_NUMERIC_BOUNDS = {
+  ageYears: { min: 0, max: 130 },
+  egfr: { min: 0, max: 250 },
+  crcl: { min: 0, max: 400 },
+  qtc: { min: 240, max: 800 },
+} as const;
+
+// Serum creatinine bounds are canonical in µmol/L; a mg/dL entry is normalised by
+// ×SCR_UMOL_PER_MGDL before the range check (the same conversion the alert engine
+// applies), so a single bound covers both units with no unit/bound mismatch.
+export const PATIENT_PROFILE_SCR_UMOL_BOUNDS = { min: 15, max: 3000 } as const;
+
+function boundedNumberOrNull(value: unknown, bounds: { min: number; max: number }): number | null {
+  return typeof value === "number" && Number.isFinite(value) && value >= bounds.min && value <= bounds.max
+    ? value
+    : null;
+}
+
+// Returns the entered value (in its own unit) when its µmol/L-normalised
+// magnitude is physiologically valid, else null. The engine re-normalises the
+// raw value itself, so we only use the normalised figure for the range check.
+function scrOrNull(value: unknown, scrUnit: ScrUnit): number | null {
+  if (typeof value !== "number" || !Number.isFinite(value)) return null;
+  const umol = scrUnit === "mg/dL" ? value * SCR_UMOL_PER_MGDL : value;
+  return umol >= PATIENT_PROFILE_SCR_UMOL_BOUNDS.min && umol <= PATIENT_PROFILE_SCR_UMOL_BOUNDS.max ? value : null;
 }
 
-function sanitize(raw: unknown): PatientProfile {
+export function sanitizeProfile(raw: unknown): PatientProfile {
   if (!raw || typeof raw !== "object") return { ...EMPTY_PATIENT_PROFILE };
   const value = raw as Record<string, unknown>;
   const hepatic = HEPATIC_LEVELS.includes(value.hepatic as HepaticSeverity) ? (value.hepatic as HepaticSeverity) : null;
@@ -53,13 +87,13 @@ function sanitize(raw: unknown): PatientProfile {
     ? value.allergies.filter((item): item is AllergyClass => ALLERGY_CLASSES.includes(item as AllergyClass))
     : [];
   return {
-    ageYears: numberOrNull(value.ageYears),
-    egfr: numberOrNull(value.egfr),
-    crcl: numberOrNull(value.crcl),
-    scr: numberOrNull(value.scr),
+    ageYears: boundedNumberOrNull(value.ageYears, PATIENT_PROFILE_NUMERIC_BOUNDS.ageYears),
+    egfr: boundedNumberOrNull(value.egfr, PATIENT_PROFILE_NUMERIC_BOUNDS.egfr),
+    crcl: boundedNumberOrNull(value.crcl, PATIENT_PROFILE_NUMERIC_BOUNDS.crcl),
+    scr: scrOrNull(value.scr, scrUnit),
     scrUnit,
     hepatic,
-    qtc: numberOrNull(value.qtc),
+    qtc: boundedNumberOrNull(value.qtc, PATIENT_PROFILE_NUMERIC_BOUNDS.qtc),
     pregnant: value.pregnant === true,
     breastfeeding: value.breastfeeding === true,
     allergies,
@@ -82,7 +116,7 @@ export function getPatientProfileSnapshot(): PatientProfile {
   if (raw === cachedRaw) return cachedProfile;
   cachedRaw = raw;
   try {
-    cachedProfile = raw ? sanitize(JSON.parse(raw)) : { ...EMPTY_PATIENT_PROFILE };
+    cachedProfile = raw ? sanitizeProfile(JSON.parse(raw)) : { ...EMPTY_PATIENT_PROFILE };
   } catch {
     cachedProfile = { ...EMPTY_PATIENT_PROFILE };
   }
diff --git a/tests/medication-patient-alerts.test.ts b/tests/medication-patient-alerts.test.ts
index 8420752d73..62ec070bce 100644
--- a/tests/medication-patient-alerts.test.ts
+++ b/tests/medication-patient-alerts.test.ts
@@ -181,6 +181,42 @@ describe("evaluatePatientAlerts — partial / empty profile and unassessed", ()
   });
 });
 
+describe("evaluatePatientAlerts — bare-renal fail-safe (no false all-clear on partial input)", () => {
+  it("surfaces unassessed when one renal input is missing and the other is present-and-normal", () => {
+    const record = recordWith({ factors: ["renal"], action: "contraindication", match: {} });
+    // eGFR missing, CrCl present and non-firing (>=60): must NOT read as a silent
+    // all-clear — a renal contraindication clears only when BOTH inputs are present.
+    const egfrMissing = evaluatePatientAlerts(record, { crcl: 90 });
+    expect(egfrMissing.considerations).toHaveLength(0);
+    expect(egfrMissing.unassessed).toContain("eGFR or CrCl");
+    // Symmetric: CrCl missing, eGFR present-and-normal.
+    const crclMissing = evaluatePatientAlerts(record, { egfr: 90 });
+    expect(crclMissing.unassessed).toContain("eGFR or CrCl");
+  });
+
+  it("clears only when both renal inputs are present and non-firing", () => {
+    const record = recordWith({ factors: ["renal"], action: "contraindication", match: {} });
+    const result = evaluatePatientAlerts(record, { egfr: 90, crcl: 90 });
+    expect(result.considerations).toHaveLength(0);
+    expect(result.unassessed).toHaveLength(0);
+  });
+
+  it("still fires renal impairment on a low input", () => {
+    const record = recordWith({ factors: ["renal"], action: "contraindication", match: {} });
+    expect(reasons(evaluatePatientAlerts(record, { egfr: 20 }).considerations)).toContain("Renal impairment (eGFR 20)");
+  });
+
+  it("leaves non-contraindication bare-renal rows unchanged (unassessed is contraindication-only)", () => {
+    // This is why the ||-guard is a no-op on the current corpus: every existing
+    // bare-renal row is advisory (monitor/dose-adjust/caution/info), and missingGates
+    // is only promoted to unassessed for contraindication rows.
+    const record = recordWith({ factors: ["renal"], action: "monitor", match: {} });
+    const result = evaluatePatientAlerts(record, { crcl: 90 });
+    expect(result.considerations).toHaveLength(0);
+    expect(result.unassessed).toHaveLength(0);
+  });
+});
+
 describe("evaluatePatientAlerts — real records", () => {
   it("flags celecoxib for both NSAID and sulfa allergy", () => {
     const record = getMedicationRecord("celecoxib");
diff --git a/tests/patient-profile-panel.dom.test.tsx b/tests/patient-profile-panel.dom.test.tsx
new file mode 100644
index 0000000000..9f73b69e18
--- /dev/null
+++ b/tests/patient-profile-panel.dom.test.tsx
@@ -0,0 +1,89 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { PatientProfileProvider } from "@/components/clinical-dashboard/patient-profile-context";
+import { PatientProfilePanel } from "@/components/clinical-dashboard/patient-profile-panel";
+import { PATIENT_PROFILE_STORAGE_KEY } from "@/lib/patient-profile-storage";
+
+function renderPanel() {
+  return render(
+    <PatientProfileProvider>
+      <PatientProfilePanel />
+    </PatientProfileProvider>,
+  );
+}
+
+function storedProfile(): Record<string, unknown> {
+  return JSON.parse(window.sessionStorage.getItem(PATIENT_PROFILE_STORAGE_KEY) ?? "{}");
+}
+
+beforeEach(() => {
+  window.sessionStorage.clear();
+});
+
+afterEach(() => {
+  window.sessionStorage.clear();
+});
+
+describe("PatientProfilePanel — physiological input validation", () => {
+  it("flags an out-of-range eGFR with an accessible error and never stores it", () => {
+    renderPanel();
+    const egfr = screen.getByTestId("patient-egfr") as HTMLInputElement;
+
+    fireEvent.change(egfr, { target: { value: "-5" } });
+
+    expect(egfr).toHaveAttribute("aria-invalid", "true");
+    const error = screen.getByRole("alert");
+    expect(error).toHaveAttribute("id", egfr.getAttribute("aria-describedby"));
+    expect(error.textContent).toMatch(/0.*250/);
+    // The physiologically impossible value is committed as null, never as -5.
+    expect(storedProfile().egfr).toBeNull();
+    // The typed text stays visible so the clinician can correct it in place.
+    expect(egfr.value).toBe("-5");
+  });
+
+  it("accepts an in-range value with no error and stores it", () => {
+    renderPanel();
+    const egfr = screen.getByTestId("patient-egfr") as HTMLInputElement;
+
+    fireEvent.change(egfr, { target: { value: "45" } });
+
+    expect(egfr).not.toHaveAttribute("aria-invalid");
+    expect(screen.queryByRole("alert")).toBeNull();
+    expect(storedProfile().egfr).toBe(45);
+  });
+
+  it("clears an out-of-range field (and its error) when the profile is cleared", () => {
+    renderPanel();
+    // A valid field makes the profile non-empty so the Clear button is enabled.
+    fireEvent.change(screen.getByTestId("patient-age"), { target: { value: "50" } });
+    const egfr = screen.getByTestId("patient-egfr") as HTMLInputElement;
+    fireEvent.change(egfr, { target: { value: "-5" } });
+    expect(egfr).toHaveAttribute("aria-invalid", "true");
+
+    fireEvent.click(screen.getByRole("button", { name: "Clear" }));
+
+    // Clear resets the invalid field too, even though its stored value was already null.
+    expect((screen.getByTestId("patient-age") as HTMLInputElement).value).toBe("");
+    const egfrAfter = screen.getByTestId("patient-egfr") as HTMLInputElement;
+    expect(egfrAfter.value).toBe("");
+    expect(egfrAfter).not.toHaveAttribute("aria-invalid");
+    expect(screen.queryByRole("alert")).toBeNull();
+  });
+
+  it("applies unit-aware bounds to serum creatinine after switching to mg/dL", () => {
+    renderPanel();
+    fireEvent.click(screen.getByRole("button", { name: "mg/dL" }));
+    const scr = screen.getByTestId("patient-scr") as HTMLInputElement;
+
+    // 200 mg/dL ≈ 17680 µmol/L — valid as a µmol/L number but absurd as mg/dL.
+    fireEvent.change(scr, { target: { value: "200" } });
+    expect(scr).toHaveAttribute("aria-invalid", "true");
+    expect(storedProfile().scr).toBeNull();
+
+    // A realistic paediatric mg/dL value is accepted.
+    fireEvent.change(scr, { target: { value: "0.3" } });
+    expect(scr).not.toHaveAttribute("aria-invalid");
+    expect(storedProfile().scr).toBe(0.3);
+  });
+});
diff --git a/tests/patient-profile-storage.test.ts b/tests/patient-profile-storage.test.ts
new file mode 100644
index 0000000000..a816c20cd5
--- /dev/null
+++ b/tests/patient-profile-storage.test.ts
@@ -0,0 +1,120 @@
+import { describe, expect, it } from "vitest";
+
+import { evaluatePatientAlerts } from "@/lib/medication-patient-alerts";
+import type { MedicationPatientMetadata, MedicationRecord } from "@/lib/medications";
+import {
+  PATIENT_PROFILE_NUMERIC_BOUNDS,
+  PATIENT_PROFILE_SCR_UMOL_BOUNDS,
+  sanitizeProfile,
+} from "@/lib/patient-profile-storage";
+
+describe("sanitizeProfile — physiological input bounds", () => {
+  it("keeps in-range values, including the inclusive boundaries", () => {
+    expect(sanitizeProfile({ ageYears: 82, egfr: 15, crcl: 350, qtc: 500, scr: 200 })).toMatchObject({
+      ageYears: 82,
+      egfr: 15,
+      crcl: 350,
+      qtc: 500,
+      scr: 200,
+    });
+    // Documented clinical extremes must survive: neonate age 0, anuric eGFR/CrCl 0,
+    // short-QT floor, and the upper validity ceilings.
+    expect(sanitizeProfile({ ageYears: 0, egfr: 0, crcl: 0, qtc: 240 })).toMatchObject({
+      ageYears: 0,
+      egfr: 0,
+      crcl: 0,
+      qtc: 240,
+    });
+    expect(sanitizeProfile({ ageYears: 130, egfr: 250, crcl: 400, qtc: 800 })).toMatchObject({
+      ageYears: 130,
+      egfr: 250,
+      crcl: 400,
+      qtc: 800,
+    });
+  });
+
+  it("rejects negatives and physiologically impossible magnitudes to null", () => {
+    expect(sanitizeProfile({ ageYears: -1 }).ageYears).toBeNull();
+    expect(sanitizeProfile({ ageYears: 131 }).ageYears).toBeNull();
+    expect(sanitizeProfile({ egfr: -5 }).egfr).toBeNull();
+    expect(sanitizeProfile({ egfr: 251 }).egfr).toBeNull();
+    expect(sanitizeProfile({ crcl: -1 }).crcl).toBeNull();
+    expect(sanitizeProfile({ crcl: 401 }).crcl).toBeNull();
+    expect(sanitizeProfile({ qtc: 239 }).qtc).toBeNull(); // below the short-QT floor
+    expect(sanitizeProfile({ qtc: -5 }).qtc).toBeNull();
+    expect(sanitizeProfile({ qtc: 801 }).qtc).toBeNull();
+  });
+
+  it("applies serum-creatinine bounds by unit (µmol/L canonical, mg/dL normalised ×88.4)", () => {
+    // µmol/L: inclusive [15, 3000].
+    expect(sanitizeProfile({ scr: 15, scrUnit: "umol/L" }).scr).toBe(15);
+    expect(sanitizeProfile({ scr: 3000, scrUnit: "umol/L" }).scr).toBe(3000);
+    expect(sanitizeProfile({ scr: 14, scrUnit: "umol/L" }).scr).toBeNull();
+    expect(sanitizeProfile({ scr: 3001, scrUnit: "umol/L" }).scr).toBeNull();
+    expect(sanitizeProfile({ scr: -5, scrUnit: "umol/L" }).scr).toBeNull();
+    // mg/dL: 0.3 (26.5 µmol/L) valid paediatric floor; 0.1 (8.84) too low; 40 (3536) too high.
+    expect(sanitizeProfile({ scr: 0.3, scrUnit: "mg/dL" }).scr).toBe(0.3);
+    expect(sanitizeProfile({ scr: 0.1, scrUnit: "mg/dL" }).scr).toBeNull();
+    expect(sanitizeProfile({ scr: 40, scrUnit: "mg/dL" }).scr).toBeNull();
+  });
+
+  it("rejects non-finite and non-number inputs", () => {
+    expect(sanitizeProfile({ egfr: "45" }).egfr).toBeNull();
+    expect(sanitizeProfile({ egfr: Number.NaN }).egfr).toBeNull();
+    expect(sanitizeProfile({ qtc: Number.POSITIVE_INFINITY }).qtc).toBeNull();
+    expect(sanitizeProfile(null)).toMatchObject({ egfr: null, qtc: null });
+  });
+
+  it("exposes the verified bounds as named exports (validity, not clinical thresholds)", () => {
+    expect(PATIENT_PROFILE_NUMERIC_BOUNDS.ageYears).toEqual({ min: 0, max: 130 });
+    expect(PATIENT_PROFILE_NUMERIC_BOUNDS.egfr).toEqual({ min: 0, max: 250 });
+    expect(PATIENT_PROFILE_NUMERIC_BOUNDS.crcl).toEqual({ min: 0, max: 400 });
+    expect(PATIENT_PROFILE_NUMERIC_BOUNDS.qtc).toEqual({ min: 240, max: 800 });
+    expect(PATIENT_PROFILE_SCR_UMOL_BOUNDS).toEqual({ min: 15, max: 3000 });
+  });
+});
+
+function contraRecord(patient: MedicationPatientMetadata): MedicationRecord {
+  return {
+    slug: "test-med",
+    name: "Test Med",
+    class: "",
+    subclass: "",
+    category: "",
+    accent: "#0f766e",
+    tag: "",
+    schedule: "",
+    stats: [],
+    quick: [],
+    sections: [{ title: "Contraindications", type: "contra", rows: [{ key: "Absolute", val: "row text", patient }] }],
+  };
+}
+
+describe("sanitizeProfile + evaluatePatientAlerts — garbage input never becomes a false all-clear", () => {
+  it("routes a garbage QTc to unassessed on a QTc contraindication instead of a silent clear", () => {
+    const record = contraRecord({ factors: ["qtc"], action: "contraindication", match: { qtc: { gte: 450 } } });
+    // Unsanitised, a negative QTc reads `-5 >= 450` as false → assessed-and-cleared.
+    // Sanitised, it becomes null → surfaced as unassessed.
+    const result = evaluatePatientAlerts(record, sanitizeProfile({ qtc: -5 }));
+    expect(result.considerations).toHaveLength(0);
+    expect(result.unassessed).toContain("QTc");
+  });
+
+  it("closes the bare-renal hole: out-of-range eGFR + present-normal CrCl → unassessed, not all-clear", () => {
+    // The adversarially-found counterexample. Pre-fix, egfr -5 fired a nonsense
+    // "Renal impairment (eGFR -5)". Null-routing alone would have produced a FALSE
+    // ALL-CLEAR because CrCl 90 is present and non-firing; the engine's ||-guard
+    // surfaces it as unassessed instead.
+    const record = contraRecord({ factors: ["renal"], action: "contraindication", match: {} });
+    const result = evaluatePatientAlerts(record, sanitizeProfile({ egfr: -5, crcl: 90 }));
+    expect(result.considerations).toHaveLength(0);
+    expect(result.unassessed).toContain("eGFR or CrCl");
+  });
+
+  it("preserves a real low eGFR so the contraindication still fires", () => {
+    const record = contraRecord({ factors: ["renal"], action: "contraindication", match: { egfr: { lt: 30 } } });
+    const result = evaluatePatientAlerts(record, sanitizeProfile({ egfr: 15 }));
+    expect(result.considerations).toHaveLength(1);
+    expect(result.considerations[0].reasons).toContain("eGFR 15 < 30 mL/min");
+  });
+});

From 99c688cee35b1f8c72396b42b014e244b27dc502 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Tue, 21 Jul 2026 20:22:42 +0800
Subject: [PATCH 2/3] docs(ledger): record FV-03 clinical-safety verification
 (PR #1045)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 docs/branch-review-ledger.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md
index 3c1b13d59a..8ae636bfbc 100644
--- a/docs/branch-review-ledger.md
+++ b/docs/branch-review-ledger.md
@@ -678,3 +678,4 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD
 | 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (parity commit review) | 1aebf02 (fix landed a3b9a54) | rag-retrieval-reviewer on the monitoring evidence-gate parity commit: REQUEST-CHANGES (soft) — P2 reproduced: inflected monitoring kind tokens (monitor\w*/annual(?:ly)?/blood tests?/ecgs?/lfts?) steal sole-dose-value sentences from the dose arm; dose-intent answers then reject the monitoring-kind fact ("Quetiapine is monitored at a dose of 200 mg daily" flipped grounded true→false, source-gap — fails CLOSED, never a wrong dose). P3: monitoring figure escape lacked the dose escape's multi-drug bare-row guard. Clean: over-admission bounded (broad vocab lives in gate/filter only, promotion still corpus-guarded, claim-support unchanged); regex cost negligible; mismatched-unit test relaxation legitimate (synopsis is corpus-verbatim; weeks pin enforced by atom identity + adjacent_context exclusion from both gate and claim corpora). | BOTH FINDINGS FIXED in a3b9a54: kind arm classifies legacy tokens byte-identically and new-inflection-only sentences fall through to the dose arm when they carry a clinicalDoseValuePattern value (both repro sentences pinned as dose-intent tests); multi-drug bare-row guard extended to monitoring_schedule with a discriminating test — red-proven both directions. Reviewer checks: formatting 38/38, focused 644/644; targeting eval deferred to the wave's live canary pair. |
 | 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (parity commit review) | 1aebf02 (fix landed a3b9a54) | clinical-governance-reviewer on the same commit: APPROVE-WITH-NITS. P2 (independently converged with the retrieval reviewer's P3): monitoring figure-escape lacked the dose-path multi-drug cross-entity guard — a bare wrong-drug schedule/level row in a multi-drug chunk could be entity-prefixed for a named-drug monitoring query; downstream gates verify text-vs-source presence, never attribution (worked lithium/valproate LFT path traced through finalize). FIXED in a3b9a54 exactly as its smallest-fix prescribed (guard at the :872-881 site now fires for monitoring_schedule; negative multi-drug test added, red-proven). Clean: unsupported figures impossible (admission-only change; promotion corpus guard + numeric verification + claim support all byte-unchanged); conservative failure intact (figure-bearing-only escape, schedule-free refusal pinned); adjacent-context safety held (sourceEvidenceText excludes adjacent_context; weeks refusal confirmed by probe); no PHI/provider/ranking surface. P3s: RAG impact line (present in the PR body — behaviour-change form, correct since the PR also carries the Option A retrieval change); multi-drug negative test (landed in a3b9a54). | Offline guard-chain trace + targeted vitest probes (named-drug guard, bare-figure admission, conservative gap, adjacent refusal). Provider/release gates deferred per confirmation boundary. |
 | 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (Option A rescue review) | 0abf3c9 | clinical-governance-reviewer on the S3 escalation rescue: APPROVE-WITH-NITS, no P0/P1. P2 = the mandated live canary pair itself (process gate, declared in the PR body; offline-green + review-approved proven insufficient for this surface 2026-07-20). P3s: multi-drug escalation-query recall edge (titled drug + untitled drug — fast-path return can skip the vector leg; recall limitation, not misattribution, mirrors the pre-existing allowlisted-class tradeoff); reviewer probe files must stay uncommitted (relocated to scratchpad). All six clinical concerns verified safe: wrong-document impossible (alias phrases must appear in the query; per-document alias groups, no cross-drug conflation), conservative availability (S3 purely additive via keyed-union merge; sibling retention test-pinned), live expansion acceptable (title-named correct-entity SOP in every firing shape), fail-closed double layer (adversarial short-circuit precedes the predicate; injection-forge case intent=protocol cannot fire — executed), governance metadata unbypassed (same attachDocumentRankingMetadata + status=indexed + access-scope filters), no PHI/provider/schema surface. | Reviewer checks: escalation-rescue suite 8/8, injection-forge intent derivation executed, static trace of the full S3 chain. Live canary pair = the trust gate, dispatched post-merge. |
+| 2026-07-21 | claude/patient-profile-input-bounds-123366 (PR #1045: FV-03 fail-safe input bounds) | 75303e8b8 | Clinical-governance verification of FV-03 (patient-profile numeric fields → medication-safety alert engine). 4-agent adversarial workflow (consumer map + suppression audit + physiological bounds + synthesis). | ADJUST→implemented. Consumer map: evaluatePatientAlerts is the ONLY numeric consumer, no dose arithmetic, sanitize() is the sole guaranteed chokepoint. Suppression audit found naive null-routing UNSAFE via the bare-renal both-null hole (medication-patient-alerts.ts:286) — nulling one out-of-range renal input while the other is present-normal → false all-clear; fixed with &&→|| (0 bare-renal contraindication rows in corpus → no-op on current data). Bounds VALIDATED (age 0-130, egfr 0-250, crcl 0-400, qtc 240-800, scr µmol/L 15-3000 unit-aware): never reject a legitimate clinical extreme. Reject-to-null (never clamp). | typecheck, lint, format:check, full unit+jsdom 349 files/3120 passed/0 failed (incl. 38 new/updated FV-03 tests), design-system-contract (baselines unchanged), type-scale, icon-scale, check:production-readiness READY. verify:ui in CI. No provider calls. |

From 676e1d9362e9e46f3184a2d5dc498f3c4100df9e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 21 Jul 2026 20:42:44 +0000
Subject: [PATCH 3/3] fix(medication-safety): convert stored creatinine on unit
 toggle (FV-03 follow-up)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Toggling the serum-creatinine unit (µmol/L ↔ mg/dL) previously called
updateField("scrUnit", …) but left the stored `scr` number unchanged, so
the alert engine re-read the same value on the new scale — a silent
misread of the renal input (a narrow window can flip a firing renal
contraindication to a false all-clear; the sanitiser fail-safes the rest
to "unassessed").

Add `convertScrValue` (µmol/L canonical, same ×88.4 factor the engine
uses) and a `setScrUnit` context action that converts `scr` and changes
the unit in a single atomic write, so the sanitiser never reads the
mismatched intermediate. The panel's unit buttons now call `setScrUnit`.

Tests: storage-level conversion + round-trip/validity, and a DOM test
proving a switch converts the stored value (90 µmol/L ↔ 1.02 mg/dL) and
round-trips.

Addresses the CodeRabbit review finding on PR #1045.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LRZ1EyBZW1ADXrZvMxEEsC
---
 .../patient-profile-context.tsx               | 19 ++++++++++++---
 .../patient-profile-panel.tsx                 |  4 ++--
 src/lib/patient-profile-storage.ts            | 13 ++++++++++
 tests/patient-profile-panel.dom.test.tsx      | 24 +++++++++++++++++++
 tests/patient-profile-storage.test.ts         | 16 +++++++++++++
 5 files changed, 71 insertions(+), 5 deletions(-)

diff --git a/src/components/clinical-dashboard/patient-profile-context.tsx b/src/components/clinical-dashboard/patient-profile-context.tsx
index 63cecb90da..c1febbd25e 100644
--- a/src/components/clinical-dashboard/patient-profile-context.tsx
+++ b/src/components/clinical-dashboard/patient-profile-context.tsx
@@ -2,8 +2,9 @@
 
 import { createContext, useCallback, useContext, useMemo, useSyncExternalStore } from "react";
 
-import { isProfileEmpty, type AllergyClass, type PatientProfile } from "@/lib/medication-patient-alerts";
+import { isProfileEmpty, type AllergyClass, type PatientProfile, type ScrUnit } from "@/lib/medication-patient-alerts";
 import {
+  convertScrValue,
   EMPTY_PATIENT_PROFILE,
   getPatientProfileSnapshot,
   getServerPatientProfileSnapshot,
@@ -14,6 +15,7 @@ import {
 export type PatientProfileContextValue = {
   profile: PatientProfile;
   updateField: <K extends keyof PatientProfile>(key: K, value: PatientProfile[K]) => void;
+  setScrUnit: (unit: ScrUnit) => void;
   toggleAllergy: (allergy: AllergyClass) => void;
   clear: () => void;
   isEmpty: boolean;
@@ -34,6 +36,17 @@ export function PatientProfileProvider({ children }: { children: React.ReactNode
     writePatientProfile({ ...getPatientProfileSnapshot(), [key]: value });
   }, []);
 
+  // Switching the creatinine unit must convert the stored value, not just relabel
+  // it — otherwise the alert engine re-reads the same number on the new scale. The
+  // convert + unit change is a single write so the sanitiser never sees the
+  // mismatched intermediate (which a two-step update would drop to null).
+  const setScrUnit = useCallback((unit: ScrUnit) => {
+    const current = getPatientProfileSnapshot();
+    const from = current.scrUnit ?? "umol/L";
+    if (from === unit) return;
+    writePatientProfile({ ...current, scr: convertScrValue(current.scr, from, unit), scrUnit: unit });
+  }, []);
+
   const toggleAllergy = useCallback((allergy: AllergyClass) => {
     const current = getPatientProfileSnapshot();
     const allergies = current.allergies ?? [];
@@ -46,8 +59,8 @@ export function PatientProfileProvider({ children }: { children: React.ReactNode
   }, []);
 
   const value = useMemo<PatientProfileContextValue>(
-    () => ({ profile, updateField, toggleAllergy, clear, isEmpty: isProfileEmpty(profile) }),
-    [profile, updateField, toggleAllergy, clear],
+    () => ({ profile, updateField, setScrUnit, toggleAllergy, clear, isEmpty: isProfileEmpty(profile) }),
+    [profile, updateField, setScrUnit, toggleAllergy, clear],
   );
 
   return <PatientProfileContext.Provider value={value}>{children}</PatientProfileContext.Provider>;
diff --git a/src/components/clinical-dashboard/patient-profile-panel.tsx b/src/components/clinical-dashboard/patient-profile-panel.tsx
index 5029974bb0..3e38a8eae0 100644
--- a/src/components/clinical-dashboard/patient-profile-panel.tsx
+++ b/src/components/clinical-dashboard/patient-profile-panel.tsx
@@ -129,7 +129,7 @@ export function PatientProfilePanel({
   defaultOpen?: boolean;
   className?: string;
 }) {
-  const { profile, updateField, toggleAllergy, clear, isEmpty } = usePatientProfile();
+  const { profile, updateField, setScrUnit, toggleAllergy, clear, isEmpty } = usePatientProfile();
   const [open, setOpen] = useState(defaultOpen ?? variant === "full");
   // Bumped on Clear to remount the numeric fields, so an out-of-range entry that
   // is showing a validation message (stored value already null) is reset too.
@@ -238,7 +238,7 @@ export function PatientProfilePanel({
                     key={option.value}
                     type="button"
                     aria-pressed={active}
-                    onClick={() => updateField("scrUnit", option.value)}
+                    onClick={() => setScrUnit(option.value)}
                     className={cn(segmentBase, "flex-1", active ? segmentActive : segmentIdle)}
                   >
                     {option.label}
diff --git a/src/lib/patient-profile-storage.ts b/src/lib/patient-profile-storage.ts
index c543cbc593..ca52aa1faa 100644
--- a/src/lib/patient-profile-storage.ts
+++ b/src/lib/patient-profile-storage.ts
@@ -69,6 +69,19 @@ function boundedNumberOrNull(value: unknown, bounds: { min: number; max: number
     : null;
 }
 
+// Convert a serum-creatinine value between display units, preserving the
+// underlying physiological quantity (µmol/L is canonical; the alert engine uses
+// the same ×SCR_UMOL_PER_MGDL factor). Used when the clinician toggles the
+// creatinine unit so the stored value follows the unit instead of being silently
+// reinterpreted on the new scale. Rounds to the display precision of the target
+// unit (integer µmol/L, 2 dp mg/dL). A null/non-finite value stays null.
+export function convertScrValue(value: number | null | undefined, from: ScrUnit, to: ScrUnit): number | null {
+  if (value == null || !Number.isFinite(value) || from === to) return value ?? null;
+  const umol = from === "mg/dL" ? value * SCR_UMOL_PER_MGDL : value;
+  const converted = to === "mg/dL" ? umol / SCR_UMOL_PER_MGDL : umol;
+  return to === "mg/dL" ? Math.round(converted * 100) / 100 : Math.round(converted);
+}
+
 // Returns the entered value (in its own unit) when its µmol/L-normalised
 // magnitude is physiologically valid, else null. The engine re-normalises the
 // raw value itself, so we only use the normalised figure for the range check.
diff --git a/tests/patient-profile-panel.dom.test.tsx b/tests/patient-profile-panel.dom.test.tsx
index 9f73b69e18..222e2a90cf 100644
--- a/tests/patient-profile-panel.dom.test.tsx
+++ b/tests/patient-profile-panel.dom.test.tsx
@@ -71,6 +71,30 @@ describe("PatientProfilePanel — physiological input validation", () => {
     expect(screen.queryByRole("alert")).toBeNull();
   });
 
+  it("converts the stored serum creatinine when the unit is switched, preserving the value", () => {
+    renderPanel();
+    const scr = screen.getByTestId("patient-scr") as HTMLInputElement;
+
+    // A normal µmol/L creatinine.
+    fireEvent.change(scr, { target: { value: "90" } });
+    expect(storedProfile().scr).toBe(90);
+    expect(storedProfile().scrUnit).toBe("umol/L");
+
+    // Switching to mg/dL must convert (90 / 88.4 ≈ 1.02), not leave 90 to be
+    // reinterpreted as 90 mg/dL by the alert engine.
+    fireEvent.click(screen.getByRole("button", { name: "mg/dL" }));
+    expect(storedProfile().scrUnit).toBe("mg/dL");
+    expect(storedProfile().scr as number).toBeCloseTo(1.02, 2);
+    const scrMgdl = screen.getByTestId("patient-scr") as HTMLInputElement;
+    expect(scrMgdl.value).toBe("1.02");
+    expect(scrMgdl).not.toHaveAttribute("aria-invalid");
+
+    // Switching back restores ~90 µmol/L (round-trip within display rounding).
+    fireEvent.click(screen.getByRole("button", { name: "µmol/L" }));
+    expect(storedProfile().scrUnit).toBe("umol/L");
+    expect(storedProfile().scr).toBe(90);
+  });
+
   it("applies unit-aware bounds to serum creatinine after switching to mg/dL", () => {
     renderPanel();
     fireEvent.click(screen.getByRole("button", { name: "mg/dL" }));
diff --git a/tests/patient-profile-storage.test.ts b/tests/patient-profile-storage.test.ts
index a816c20cd5..04e25411aa 100644
--- a/tests/patient-profile-storage.test.ts
+++ b/tests/patient-profile-storage.test.ts
@@ -3,6 +3,7 @@ import { describe, expect, it } from "vitest";
 import { evaluatePatientAlerts } from "@/lib/medication-patient-alerts";
 import type { MedicationPatientMetadata, MedicationRecord } from "@/lib/medications";
 import {
+  convertScrValue,
   PATIENT_PROFILE_NUMERIC_BOUNDS,
   PATIENT_PROFILE_SCR_UMOL_BOUNDS,
   sanitizeProfile,
@@ -65,6 +66,21 @@ describe("sanitizeProfile — physiological input bounds", () => {
     expect(sanitizeProfile(null)).toMatchObject({ egfr: null, qtc: null });
   });
 
+  it("converts a stored creatinine on a unit switch instead of reinterpreting it on the new scale", () => {
+    // No-ops: same unit, or a missing value.
+    expect(convertScrValue(90, "umol/L", "umol/L")).toBe(90);
+    expect(convertScrValue(null, "umol/L", "mg/dL")).toBeNull();
+    // µmol/L → mg/dL (÷88.4, 2 dp) and mg/dL → µmol/L (×88.4, integer).
+    expect(convertScrValue(90, "umol/L", "mg/dL")).toBeCloseTo(1.02, 2);
+    expect(convertScrValue(1.02, "mg/dL", "umol/L")).toBe(90);
+    expect(convertScrValue(442, "umol/L", "mg/dL")).toBeCloseTo(5, 2);
+    // Round-trips within display rounding, and a converted value stays a valid
+    // stored input — the switch must never spuriously reject the value.
+    expect(convertScrValue(convertScrValue(120, "umol/L", "mg/dL"), "mg/dL", "umol/L")).toBe(120);
+    const mgdl = convertScrValue(200, "umol/L", "mg/dL");
+    expect(sanitizeProfile({ scr: mgdl, scrUnit: "mg/dL" }).scr).toBe(mgdl);
+  });
+
   it("exposes the verified bounds as named exports (validity, not clinical thresholds)", () => {
     expect(PATIENT_PROFILE_NUMERIC_BOUNDS.ageYears).toEqual({ min: 0, max: 130 });
     expect(PATIENT_PROFILE_NUMERIC_BOUNDS.egfr).toEqual({ min: 0, max: 250 });